A. Compare/Contrast purpose and functionality of MTU and MSS

In computer networking, the maximum transmission unit (MTU) of a communications protocol of a layer is the size (in bytes) of the largest protocol data unit that the layer can pass onwards. MTU parameters usually appear in association with a communications interface (NIC, serial port, etc.). Standards (Ethernet, for example) can fix the size of an MTU; or systems (such as point-to-point serial links) may decide MTU at connect time.

A larger MTU brings greater efficiency because each packet carries more user data while protocol overheads, such as headers or underlying per-packet delays, remain fixed; the resulting higher efficiency means a slight improvement in bulk protocol throughput. A larger MTU also means processing of fewer packets for the same amount of data. In some systems, per-packet-processing can be a critical performance limitation.

However, this gain is not without some downside. Large packets can occupy a slow link for some time, causing greater delays to following packets and increasing lag and minimum latency. For example, a 1500-byte packet, the largest allowed by Ethernet at the network layer (and hence over most of the Internet), ties up a 14.4k modem for about one second.

Large packets are also problematic in the presence of communications errors. Corruption of a single bit in a packet requires that the entire packet be retransmitted. At a given bit error rate, larger packets are more likely to be corrupted. Retransmissions of larger packets takes longer. Despite the negative effects on retransmission duration, large packets can still have a net positive effect on end-to-end TCP performance.

The maximum segment size (MSS) is a parameter of the TCP protocol that specifies the largest amount of data, specified in octets, that a computer or communications device can receive in a single TCP segment, and therefore in a single IP datagram. It does not count the TCP header or the IP header.^[1] The IP datagram containing a TCP segment may be self-contained within a single packet, or it may be reconstructed from several fragmented pieces; either way, the MSS limit applies to the total amount of data contained in the final, reconstructed TCP segment.

Therefore: Headers + MSS ≤ MTU

The Maximum segment size to avoid fragmentation = Largest datagram size that any host is required to be able to reassemble – IP header size – TCP header size
So most IPv4 hosts are required to be able to handle an MSS of 536 octets (= 576 – 20 – 20)
and most IPv6 hosts are required to be able to handle an MSS of 1220 octets (= 1280 – 40 – 20).^[2]
A lower MSS will ensure that fragmentation will never be done along the path but, in counterpart, the data/header ratio will be lower.

For most computer users, the MSS option is established by the operating system on the SYN packet during the TCP handshake. Each direction of data flow can use a different MSS.

http://en.wikipedia.org/wiki/Maximum_segment_size
http://en.wikipedia.org/wiki/Maximum_segment_size
http://www.tcpipguide.com/free/t_TCPMaximumSegmentSizeMSSandRelationshiptoIPDatagra.htm

B. Explain the purpose and functionality of TCP

The Transmission Control Protocol (TCP) is one of the core protocols of the Internet protocol suite (IP), and is so common that the entire suite is often calledTCP/IP. TCP provides reliable, ordered, error-checked delivery of a stream of octets between programs running on computers connected to a local area network,intranet or the public Internet. It resides at the transport layer.

C. Explain the purpose and functionality of UDP

The User Datagram Protocol (UDP) is one of the core members of the Internet protocol suite (the set of network protocols used for the Internet). With UDP, computer applications can send messages, in this case referred to as datagrams, to other hosts on an Internet Protocol (IP) network without prior communications to set up special transmission channels or data paths. The protocol was designed by David P. Reed in 1980 and formally defined in RFC 768.

UDP uses a simple transmission model with a minimum of protocol mechanism.^[1] It has no handshaking dialogues, and thus exposes any unreliability of the underlying network protocol to the user’s program. As this is normally IP over unreliable media, there is no guarantee of delivery, ordering or duplicate protection. UDP provides checksums for data integrity, and port numbers for addressing different functions at the source and destination of the datagram.

UDP is suitable for purposes where error checking and correction is either not necessary or performed in the application, avoiding the overhead of such processing at the network interface level. Time-sensitive applications often use UDP because dropping packets is preferable to waiting for delayed packets, which may not be an option in a real-time system.^[2] If error correction facilities are needed at the network interface level, an application may use theTransmission Control Protocol (TCP) or Stream Control Transmission Protocol (SCTP) which are designed for this purpose.

A number of UDP’s attributes make it especially suited for certain applications.

• It is transaction-oriented, suitable for simple query-response protocols such as the Domain Name System or the Network Time Protocol.
• It provides datagrams, suitable for modeling other protocols such as in IP tunneling or Remote Procedure Call and the Network File System.
• It is simple, suitable for bootstrapping or other purposes without a full protocol stack, such as the DHCP and Trivial File Transfer Protocol.
• It is stateless, suitable for very large numbers of clients, such as in streaming media applications for example IPTV
• The lack of retransmission delays makes it suitable for real-time applications such as Voice over IP, online games, and many protocols built on top of theReal Time Streaming Protocol.
• Works well in unidirectional communication, suitable for broadcast information such as in many kinds of service discovery and shared information such as broadcast time or Routing Information Protocol

Packet structure[edit]

UDP is a minimal message-oriented Transport Layer protocol that is documented in IETF RFC 768.

UDP provides no guarantees to the upper layer protocol for message delivery and the UDP protocol layer retains no state of UDP messages once sent. For this reason, UDP is sometimes referred to asUnreliable Datagram Protocol.^[4]

UDP provides application multiplexing (via port numbers) and integrity verification (via checksum) of the header and payload.^[5] If transmission reliability is desired, it must be implemented in the user’s application.

UDP Header

Offsets	Octet	0								1								2								3
Octet	Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
0	0	Source port																Destination port
4	32	Length																Checksum

The UDP header consists of 4 fields, each of which is 2 bytes (16 bits).^[2] The use of the fields “Checksum” and “Source port” is optional in IPv4 (pink background in table). In IPv6 only the source port is optional (see below).

Source port number

This field identifies the sender’s port when meaningful and should be assumed to be the port to reply to if needed. If not used, then it should be zero. If the source host is the client, the port number is likely to be an ephemeral port number. If the source host is the server, the port number is likely to be a well-known port number.^[3]

Destination port number

This field identifies the receiver’s port and is required. Similar to source port number, if the client is the destination host then the port number will likely be an ephemeral port number and if the destination host is the server then the port number will likely be a well-known port number.^[3]

Length

A field that specifies the length in bytes of the UDP header and UDP data. The minimum length is 8 bytes since that’s the length of the header. The field size sets a theoretical limit of 65,535 bytes (8 byte header + 65,527 bytes of data) for a UDP datagram. The practical limit for the data length which is imposed by the underlying IPv4 protocol is 65,507 bytes (65,535 − 8 byte UDP header − 20 byte IP header).^[3]

In IPv6 Jumbograms it is possible to have UDP packets of size greater than 65,535 bytes.^[6] RFC 2675 specifies that the length field is set to zero if the length of the UDP header plus UDP data is greater than 65,535.

Checksum

The checksum field is used for error-checking of the header and data. If no checksum is generated by the transmitter, the field uses the value all-zeros.^[7] This field is not optional for IPv6.^[8]

Comparison of UDP and TCP

Transmission Control Protocol is a connection-oriented protocol, which means that it requires handshaking to set up end-to-end communications. Once a connection is set up user data may be sent bi-directionally over the connection.

• Reliable – TCP manages message acknowledgment, retransmission and timeout. Multiple attempts to deliver the message are made. If it gets lost along the way, the server will re-request the lost part. In TCP, there’s either no missing data, or, in case of multiple timeouts, the connection is dropped.
• Ordered – if two messages are sent over a connection in sequence, the first message will reach the receiving application first. When data segments arrive in the wrong order, TCP buffers delay the out-of-order data until all data can be properly re-ordered and delivered to the application.
• Heavyweight – TCP requires three packets to set up a socket connection, before any user data can be sent. TCP handles reliability and congestion control.
• Streaming – Data is read as a byte stream, no distinguishing indications are transmitted to signal message (segment) boundaries.

UDP is a simpler message-based connectionless protocol. Connectionless protocols do not set up a dedicated end-to-end connection. Communication is achieved by transmitting information in one direction from source to destination without verifying the readiness or state of the receiver. However, one primary benefit of UDP over TCP is the application to voice over internet protocol (VoIP) where latency and jitter are the primary concerns. It is assumed in VoIP UDP that the end users provide any necessary real time confirmation that the message has been received.

• Unreliable – When a message is sent, it cannot be known if it will reach its destination; it could get lost along the way. There is no concept of acknowledgment, retransmission, or timeout.
• Not ordered – If two messages are sent to the same recipient, the order in which they arrive cannot be predicted.
• Lightweight – There is no ordering of messages, no tracking connections, etc. It is a small transport layer designed on top of IP.
• Datagrams – Packets are sent individually and are checked for integrity only if they arrive. Packets have definite boundaries which are honored upon receipt, meaning a read operation at the receiver socket will yield an entire message as it was originally sent.
• No congestion control – UDP itself does not avoid congestion, and it’s possible for high bandwidth applications to trigger congestion collapse, unless they implement congestion control measures at the application level.

[1-8] (https://en.wikipedia.org/wiki/User_Datagram_Protocol)

D. Explain the purpose and functionality of ports in general

In computer networking, a port is an application-specific or process-specific software construct serving as a communications endpoint in a computer’s host operating system. A port is associated with an IP address of the host, as well as the type of protocol used for communication. The purpose of ports is to uniquely identify different applications or processes running on a single computer and thereby enable them to share a single physical connection to a packet-switched network like the Internet.

The protocols that primarily use ports are the Transport Layer protocols, such as the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP) of the Internet Protocol Suite. A port is identified for each address and protocol by a 16-bit number, commonly known as the port number. The port number, added to a computer’s IP address, completes the destination address for a communications session. That is, data packets are routed across the network to a specific destination IP address, and then, upon reaching the destination computer, are further routed to the specific process bound to the destination port number.

Note that it is the combination of IP address and port number together that must be globally unique. Thus, different IP addresses or protocols may use the same port number for communication; e.g., on a given host or interface UDP and TCP may use the same port number, or on a host with two interfaces, both addresses may be associated with a port having the same number.

Of the thousands of enumerated ports, about 250 well-known ports are reserved by convention to identify specific service types on a host. In the client-server model of application architecture, ports are used to provide a multiplexing service on each server-side port number that network clients connect to for service initiation, after which communication can be reestablished on other connection-specific port numbers.

Common port numbers[edit]

Main article: List of TCP and UDP port numbers

The Internet Assigned Numbers Authority (IANA) is responsible for the global coordination of the DNS Root, IP addressing, and other Internet protocol resources. This includes the registration of commonly used port numbers for well-known Internet services.

The port numbers are divided into three ranges: the well-known ports, the registered ports, and the dynamic or private ports. The well-known ports are those from 0 through 1023. Examples include:

• 20 & 21: File Transfer Protocol (FTP)
• 22: Secure Shell (SSH)
• 23: Telnet remote login service
• 25: Simple Mail Transfer Protocol (SMTP)
• 53: Domain Name System (DNS) service
• 80: Hypertext Transfer Protocol (HTTP) used in the World Wide Web
• 110: Post Office Protocol (POP3)
• 119: Network News Transfer Protocol (NNTP)
• 143: Internet Message Access Protocol (IMAP)
• 161: Simple Network Management Protocol (SNMP)
• 443: HTTP Secure (HTTPS)

The registered ports are those from 1024 through 49151. IANA maintains the official list.^[2] The dynamic or private ports are those from 49152 through 65535. One common use is for ephemeral ports.

(http://en.wikipedia.org/wiki/Port_(computer_networking))

E. Explain how retransmissions occur

Retransmission, essentially identical with Automatic repeat request (ARQ), is the resending of packets which have been either damaged or lost. It is a term that refers to one of the basic mechanisms used by protocols operating over a packet switched computer network to provide reliable communication (such as that provided by a reliable byte stream, for example TCP).

Such networks are usually ‘unreliable’, meaning they offer no guarantees that they will not delay, damage, or lose packets, or deliver them out of order. Protocols which provide reliable communication over such networks use a combination of acknowledgments (i.e. an explicit receipt from the destination of the data), retransmission of missing and/or damaged packets (usually initiated by a time-out), andchecksums to provide that reliability.

Acknowledgment

There are several forms of acknowledgement which can be used alone or together in networking protocols:

• Positive Acknowledgement: the receiver explicitly notifies the sender which packets, messages, or segments were received correctly. Positive Acknowledgement therefore also implicitly informs the sender which packets were not received and provides detail on packets which need to be retransmitted. Positive Acknowledgment with Re-Transmission (PAR), is a method used by TCP (RFC 793) to verify receipt of transmitted data. PAR operates by re-transmitting data at an established period of time until the receiving host acknowledges reception of the data.
• Negative Acknowledgment (NACK): the receiver explicitly notifies the sender which packets, messages, or segments were received incorrectly and thus may need to be retransmitted (RFC 4077).
• Selective Acknowledgment (SACK): the receiver explicitly lists which packets, messages, or segments in a stream are acknowledged (either negatively or positively). Positive selective acknowledgment is an option in TCP (RFC 2018) that is useful in Satellite Internet access (RFC 2488).
• Cumulative Acknowledgment: the receiver acknowledges that it correctly received a packet, message, or segment in a stream which implicitly informs the sender that the previous packets were received correctly. TCP uses cumulative acknowledgment with its TCP sliding window.

Retransmission

Retransmission is a very simple concept. Whenever one party sends something to the other party, it retains a copy of the data it sent until the recipient has acknowledged that it received it. In a variety of circumstances the sender automatically retransmits the data using the retained copy. Reasons for resending include:

• if no such acknowledgment is forthcoming within a reasonable time, the time-out
• the sender discovers, often through some out of band means, that the transmission was unsuccessful
• if the receiver knows that expected data has not arrived, and so notifies the sender
• if the receiver knows that the data has arrived, but in a damaged condition, and indicates that to the sender

F. Explain the purpose and process of a reset

TCP resets

The stream of packets in a TCP connection each contains a TCP header. Each of these headers contains a bit known as the “reset” (RST) flag. In most packets this bit is set to 0 and has no effect, however if this bit is set to 1 it indicates to the receiving computer that the computer should immediately stop using the TCP connection – It should not send any more packets using the connection’s identifying numbers (called ports), and discard any further packets it receives with headers indicating they belong to that connection. A TCP reset basically kills a TCP connection instantly.

When used as designed this can be a useful tool. One common application is the scenario where a computer (computer A) crashes while a TCP connection is in progress. The computer on the other end (computer B) will continue to send TCP packets since it does not know computer A has crashed. When computer A reboots, it will then receive packets from the old pre-crash connection. Computer A has no context for these packets and no way of knowing what to do with them, so it might send a TCP reset to computer B. This reset lets computer B know that the connection is no longer working. The user on computer B can now try another connection or take other action.

G. Describe various TCP options

TCP Header

Offsets	Octet	0								1								2								3
Octet	Bit	0	1	2	3	4	5	6	7	8	9	10	11	12	13	14	15	16	17	18	19	20	21	22	23	24	25	26	27	28	29	30	31
0	0	Source port																Destination port
4	32	Sequence number
8	64	Acknowledgment number (if ACK set)
12	96	Data offset				Reserved 0 0 0			N S	C W R	E C E	U R G	A C K	P S H	R S T	S Y N	F I N	Window Size
16	128	Checksum																Urgent pointer (if URG set)
20 …	160 ...	Options (if data offset > 5. Padded at the end with “0” bytes if necessary.)

Options (Variable 0–320 bits, divisible by 32)

The length of this field is determined by the data offset field. Options have up to three fields: Option-Kind (1 byte), Option-Length (1 byte), Option-Data (variable). The Option-Kind field indicates the type of option, and is the only field that is not optional. Depending on what kind of option we are dealing with, the next two fields may be set: the Option-Length field indicates the total length of the option, and the Option-Data field contains the value of the option, if applicable. For example, an Option-Kind byte of 0x01 indicates that this is a No-Op option used only for padding, and does not have an Option-Length or Option-Data byte following it. An Option-Kind byte of 0 is the End Of Options option, and is also only one byte. An Option-Kind byte of 0x02 indicates that this is the Maximum Segment Size option, and will be followed by a byte specifying the length of the MSS field (should be 0x04). Note that this length is the total length of the given options field, including Option-Kind and Option-Length bytes. So while the MSS value is typically expressed in two bytes, the length of the field will be 4 bytes (+2 bytes of kind and length). In short, an MSS option field with a value of 0x05B4 will show up as (0x02 0x04 0x05B4) in the TCP options section.

Some options may only be sent when SYN is set; they are indicated below as ^[SYN]. Option-Kind and standard lengths given as (Option-Kind,Option-Length).

• 0 (8 bits) – End of options list
• 1 (8 bits) – No operation (NOP, Padding) This may be used to align option fields on 32-bit boundaries for better performance.
• 2,4,SS (32 bits) – Maximum segment size (see maximum segment size) ^[SYN]
• 3,3,S (24 bits) – Window scale (see window scaling for details) ^[SYN][6]
• 4,2 (16 bits) – Selective Acknowledgement permitted. ^[SYN] (See selective acknowledgments for details)^[7]
• 5,N,BBBB,EEEE,… (variable bits, N is either 10, 18, 26, or 34)- Selective ACKnowledgement (SACK)^[8] These first two bytes are followed by a list of 1–4 blocks being selectively acknowledged, specified as 32-bit begin/end pointers.
• 8,10,TTTT,EEEE (80 bits)- Timestamp and echo of previous timestamp (see TCP timestamps for details)^[9]
• 14,3,S (24 bits) – TCP Alternate Checksum Request. ^[SYN][10]
• 15,N,… (variable bits) – TCP Alternate Checksum Data.

(The remaining options are obsolete, experimental, not yet standardized, or unassigned)

H. Describe a TCP checksum error

If the data gets where it needs to go but is corrupted and we do not detect the corruption, this is in some ways worse than it never showing up at all. To provide basic protection against errors in transmission, TCP includes a 16-bit Checksum field in its header. The idea behind a checksum is very straight-forward: take a string of data bytes and add them all together. Then send this sum with the data stream and have the receiver check the sum. In TCP, a special algorithm is used to calculate this checksum by the device sending the segment; the same algorithm is then employed by the recipient to check the data it received and ensure that there were no errors.

I. Describe how TCP addresses error correction

To calculate the TCP segment header’s Checksum field, the TCP pseudo header is first constructed and placed, logically, before the TCP segment. The checksum is then calculated over both the pseudo header and the TCP segment. The pseudo header is then discarded.

When the TCP segment arrives at its destination, the receiving TCP software performs the same calculation. It forms the pseudo header, prepends it to the actual TCP segment, and then performs the checksum (setting the Checksum field to zero for the calculation as before). If there is a mismatch between its calculation and the value the source device put in the Checksum field, this indicates that an error of some sort occurred and the segment is normally discarded.

http://www.tcpipguide.com/free/t_TCPChecksumCalculationandtheTCPPseudoHeader-2.htm

J. Describe how the flow control process occurs

A. Explain the purpose and functionality of IP addressing and subnetting.

IP (Internet Protocol) addresses are used to identify hosts on the campus Internet, a Cornell network that ties into the Internet, a global network. If the computer is attached to Cornell’s network, it needs an IP address to be recognized as part of the campus Internet.

IP addresses are constructed according to a set of specific rules so that hosts on any part of the Internet can communicate with each other. This document describes IP addresses only as they apply to Cornell’s campus network. (If you want to know more about Internet addressing, refer to Internetworking with TCP/IP: Principles, Protocols, and Architecture by Douglas Comer, Prentice Hall).

An IP address consists of a 32-bit binary number, which is typically presented as four decimal numbers (one for each 8-bit byte) separated by decimal points. For example, 128.253.21.58.

A subnet mask defines how many bits are used for the network address and how many for the host address.

The subnet mask address is 255.255.255.0, and it currently is the same for all LANs. If you convert the subnet mask address to its binary form, it looks like this:

Subnet mask: 11111111 11111111 11111111 00000000

If you convert our example host address (128.253.21.58) to its binary form, it looks like this:

Host address: 10000000 11111101 00010101 00111010

Together they look like this:

Subnet mask: 11111111 11111111 11111111 00000000

Host address: 10000000 11111101 00010101 00111010

The subnet mask when shown this way, as an overlay on the host address, essentially tells the computer which part of the IP address is a network address and which part is a host address. Everything in the host address that corresponds to a 1 in the subnet mask is a network address and everything in the host address that corresponds to a 0 in the subnet mask is a host address.

http://media.packetlife.net/media/library/15/IPv4_Subnetting.pdf

B. Given an IP address and netmask, determine the Network IP and the Broadcast IP.

http://ccna-cisco.webs.com/subnetting.htm

C. Given a routing table and a destination IP address, identify which routing table entry the destination IP address will match.

(from http://en.wikipedia.org/wiki/Routing_table)

In computer networking a routing table, or routing information base (RIB), is a data table stored in a router or a networked computer that lists the routes to particular network destinations, and in some cases, metrics (distances) associated with those routes. The routing table contains information about the topology of the network immediately around it. The construction of routing tables is the primary goal of routing protocols. Static routes are entries made in a routing table by non-automatic means and which are fixed rather than being the result of some network topology “discovery” procedure.

Basics

A routing table uses the same idea that one does when using a map in package delivery. Whenever a node needs to send data to another node on a network, it must first know where to send it. If the node cannot directly connect to the destination node, it has to send it via other nodes along a proper route to the destination node. Most nodes do not try to figure out which route(s) might work; instead, a node will send an IP packet to a gateway in the LAN, which then decides how to route the “package” of data to the correct destination. Each gateway will need to keep track of which way to deliver various packages of data, and for this it uses a Routing Table. A routing table is a database which keeps track of paths, like a map, and allows the gateway to provide this information to the node requesting the information.

With hop-by-hop routing, each routing table lists, for all reachable destinations, the address of the next device along the path to that destination: the next hop. Assuming that the routing tables are consistent, the simple algorithm of relaying packets to their destination’s next hop thus suffices to deliver data anywhere in a network. Hop-by-hop is the fundamental characteristic of the IP Internetwork Layer^[1] and the OSI Network Layer.

The primary function of a router is to forward a packet toward its destination network, which is the destination IP address of the packet. To do this, a router needs to search the routing information stored in its routing table.

A routing table is a data file in RAM that is used to store route information about directly connected and remote networks. The routing table contains network/next hop associations. These associations tell a router that a particular destination can be optimally reached by sending the packet to a specific router that represents the “next hop” on the way to the final destination. The next hop association can also be the outgoing or exit interface to the final destination.

The network/exit-interface association can also represent the destination network address of the IP packet. This association occurs on the router’s directly connected networks.

A directly connected network is a network that is directly attached to one of the router interfaces. When a router interface is configured with an IP address and subnet mask, the interface becomes a host on that attached network. The network address and subnet mask of the interface, along with the interface type and number, are entered into the routing table as a directly connected network. When a router forwards a packet to a host, such as a web server, that host is on the same network as a router’s directly connected network.

A remote network is a network that is not directly connected to the router. In other words, a remote network is a network that can only be reached by sending the packet to another router. Remote networks are added to the routing table using either a dynamic routing protocol or by configuring static routes. Dynamic routes are routes to remote networks that were learned automatically by the router, using a dynamic routing protocol. Static routes are routes to networks that a network administrator manually configured.

Difficulties with routing tables. 

The need to record routes to large numbers of devices using limited storage space represents a major challenge in routing table construction. In the Internet, the currently dominant address aggregation technology is a bitwise prefix matching scheme called Classless Inter-Domain Routing (CIDR).

Since in a network each node presumably possesses a valid routing table, routing tables must be consistent among the various nodes or routing loops can develop. This is particularly problematic in the hop-by-hop routing model in which the net effect of inconsistent tables in several different routers could be to forward packets in an endless loop. Routing loops have historically plagued routing, and their avoidance is a major design goal of routing protocols.

Contents of routing tables

The routing table consists of at least three information fields:

1. the network id: i.e. the destination subnet
2. cost/metric: i.e. the cost or metric of the path through which the packet is to be sent
3. next hop: The next hop, or gateway, is the address of the next station to which the packet is to be sent on the way to its final destination

Depending on the application and implementation, it can also contain additional values that refine path selection:

1. quality of service associated with the route. For example, the U flag indicates that an IP route is up.
2. links to filtering criteria/access lists associated with the route
3. interface: such as eth0 for the first Ethernet card, eth1 for the second Ethernet card, etc.

Routing tables are also a key aspect of certain security operations, such as unicast reverse path forwarding (uRPF).^[2] In this technique, which has several variants, the router also looks up, in the routing table, the source address of the packet. If there exists no route back to the source address, the packet is assumed to be malformed or involved in a network attack, and is dropped.

Network id	Cost	Next hop
……..	……..	……..
……..	……..	……..

Shown below is an example of what the table above could look like on an average computer connected to the internet via a home router:

Network Destination	Netmask	Gateway	Interface	Metric
0.0.0.0	0.0.0.0	192.168.0.1	192.168.0.100	10
127.0.0.0	255.0.0.0	127.0.0.1	127.0.0.1	1
192.168.0.0	255.255.255.0	192.168.0.100	192.168.0.100	10
192.168.0.100	255.255.255.255	127.0.0.1	127.0.0.1	10
192.168.0.255	255.255.255.255	192.168.0.100	192.168.0.100	10

• The columns Network Destination and Netmask together describe the Network id as mentioned earlier. For example, destination 192.168.0.0 and netmask 255.255.255.0 can be written as network id192.168.0.0/24.
• The Gateway column contains the same information as the Next hop, i. e. it points to the gateway through which the network can be reached.
• The Interface indicates what locally available interface is responsible for reaching the gateway. In this example, gateway 192.168.0.1 (the internet router) can be reached through the local network card with address 192.168.0.100.
• Finally, the Metric indicates the associated cost of using the indicated route. This is useful for determining the efficiency of a certain route from two points in a network. In this example, it is more efficient to communicate with the computer itself through the use of address 127.0.0.1 (called “localhost”) than it would be through 192.168.0.100 (the IP address of the local network card).

Forwarding table

Routing tables are generally not used directly for packet forwarding in modern router architectures; instead, they are used to generate the information for a smaller forwarding table. A forwarding table contains only the routes which are chosen by the routing algorithm as preferred routes for packet forwarding. It is often in a compressed or pre-compiled format that is optimized for hardware storage and lookup.

This router architecture separates the Control Plane function of the routing table from the Forwarding Plane function of the forwarding table. ^[3] This separation of control and forwarding provides uninterrupted performance.

References

1. ^ Requirements for IPv4 Routers, F. Baker, RFC 1812, June 1995
2. ^ Ingress Filtering for Multihomed Networks,RFC 3704, F. Baker & P. Savola,March 2004
3. ^ Forwarding and Control Element Separation (ForCES) Framework, L. Yang et al., RFC3746,April 2004.
4. http://technet.microsoft.com/en-us/library/cc779122(WS.10).aspx

D. Explain the purpose and functionality of routing protocols

(http://en.wikibooks.org/wiki/CCNA_Certification/Routing_Protocols)

Routing protocols are used in the implementation of routing algorithms to facilitate the exchange of routing information between networks, allowing routers to build routing tables dynamically. Routers talk to one another about the state of the network and of nearby devices. The protocols they use for to talk to each other, routing protocols, should not be confused with ROUTED protocols like IP and IPX that carry data on the network.

Common routing protocols include RIP, RIPv2, IGRP, EIGRP, IS-IS and BGP. For the CCNA exam you will need to be well versed in RIP, RIPv2, IGRP and EIGRP. You should be aware of IS-IS and BGP, and be able to configure basic OSPF.

Two main types of routing protocols exist – distance vector and link state. A third type known as balanced hybrid (Known now as “Advanced Distance Vector“) combines features of both link state and distance vector protocols.

E. Explain the purpose of fragmentation.

(http://en.wikipedia.org/wiki/IP_fragmentation)

The Internet Protocol (IP) implements datagram fragmentation, breaking it into smaller pieces, so that packets may be formed that can pass through a link with a smaller maximum transmission unit (MTU) than the original datagram size.When an Internet router has multiple parallel paths, technologies like LAG and CEF split traffic across the links according to a hash algorithm. One goal of the algorithm is to ensure all packets of the same flow are sent out the same path to minimize unnecessary packet reordering. Fragmentation reduces efficiency and increases the chances of part of a TCP segment being lost, resulting in the entire segment needing to be retransmitted.

F. Given a fragment, identify what information is needed for reassembly

(http://en.wikipedia.org/wiki/IPv4#Fragmentation_and_reassembly)

Fragmentation and reassembly

The Internet Protocol enables networks to communicate with one another. The design accommodates networks of diverse physical nature; it is independent of the underlying transmission technology used in the Link Layer. Networks with different hardware usually vary not only in transmission speed, but also in the maximum transmission unit (MTU). When one network wants to transmit datagrams to a network with a smaller MTU, it may fragment its datagrams. In IPv4, this function was placed at the Internet Layer, and is performed in IPv4 routers, which thus only require this layer as the highest one implemented in their design.

In contrast, IPv6, the next generation of the Internet Protocol, does not allow routers to perform fragmentation; hosts must determine the path MTU before sending datagrams.

Fragmentation

When a router receives a packet, it examines the destination address and determines the outgoing interface to use and that interface’s MTU. If the packet size is bigger than the MTU, and the Do not Fragment (DF) bit in the packet’s header set to 0; the router may fragment the packet.

The router divides the packet into segments. The max size of each segment is the MTU minus the IP header size (20 bytes minimum; 60 bytes maximum). The router puts each segment into its own packet, each fragment packet having following changes:

• The total length field is the segment size.
• The more fragments (MF) flag is set for all segments except the last one, which is set to 0.
• The fragment offset field is set, based on the offset of the segment in the original data payload. This is measured in units of eight-byte blocks.
• The header checksum field is recomputed.

For example, for an MTU of 1,500 bytes and a header size of 20 bytes, the fragment offsets would be multiples of (1500–20)/8 = 185. These multiples are 0, 185, 370, 555, 740, …

It is possible for a packet to be fragmented at one router, and for the fragments to be fragmented at another router. For example, consider a packet with a data size of 4,500 bytes, no options, and a header size of 20 bytes. So the packet size is 4,520 bytes. Assume that the packet travels over a link with an MTU of 2,500 bytes. Then it will become two fragments:

Note how we get the offsets from the data sizes:Note that the fragments preserve the data size: 2480 + 2020 = 4500.

• 0.
• 0 + 2480/8 = 310.

Assume that these fragments reach a link with an MTU of 1,500 bytes. Each fragment will become two fragments:

Fragment	Total bytes	Header bytes	Data bytes	“More fragments” flag	Fragment offset (8-byte blocks)
1	1500	20	1480	1	0
2	1020	20	1000	1	185
3	1500	20	1480	1	310
4	560	20	540	0	495

Note that the fragments preserve the data size: 1480 + 1000 = 2480, and 1480 + 540 = 2020.

Note how we get the offsets from the data sizes:

• 0.
• 0 + 1480/8 = 185
• 185 + 1000/8 = 310
• 310 + 1480/8 = 495

We can use the last offset and last data size to calculate the total data size: 495*8 + 540 = 3960 + 540 = 4500.

Reassembly

A receiver knows that a packet is a fragment if at least one of the following conditions is true:

• The “more fragments” flag is set. (This is true for all fragments except the last.)
• The “fragment offset” field is nonzero. (This is true for all fragments except the first.)

The receiver identifies matching fragments using the identification field. The receiver will reassemble the data from fragments with the same identification field using both the fragment offset and the more fragments flag. When the receiver receives the last fragment (which has the “more fragments” flag set to 0), it can calculate the length of the original data payload, by multiplying the last fragment’s offset by eight, and adding the last fragment’s data size. In the example above, this calculation was 495*8 + 540 = 4500 bytes.

When the receiver has all the fragments, it can put them in the correct order, by using their offsets. It can then pass their data up the stack for further processing.

G. Explain the purpose of TTL functionality

An eight-bit time to live field helps prevent datagrams from persisting (e.g. going in circles) on an internet. This field limits a datagram’s lifetime. It is specified in seconds, but time intervals less than 1 second are rounded up to 1. In practice, the field has become a hop count—when the datagram arrives at a router, the router decrements the TTL field by one. When the TTL field hits zero, the router discards the packet and typically sends an ICMP Time Exceeded message to the sender. The program traceroute uses these ICMP Time Exceeded messages to print the routers used by packets to go from the source to the destination.

H. Given a packet traversing a topology, document the source/destination IP address/MAC address changes at each hop.

The Source and Destination IP address is not going to change. Host 1 IP address will stay as being the source IP and the Host 2 IP address will stay the destination IP address. Those two are not going to change.

For the MAC address it is going to change each time it goes from one hope to another. (Except switches… they don’t change anything)

Frame leaving HOST 1 is going to have a source MAC of Host 1 and a destination MAC of Router 1.

Router 1 is going to strip that info off and then will make the source MAC address of Router1’s exiting interface, and making Router2’s interface as the destination MAC address.

Then the same will happen… Router2 is going to change the source/destination info to the source MAC being the Router2 interface that it is going out, and the destination will be Host2’s MAC address.

In a nutshell that is about what happens.

(https://learningnetwork.cisco.com/thread/11724)

• The process begins by examining the source address of an incoming packet. If the source address is not in the forwarding database, an entry for the address is made in the database. The port it came in on is also recorded. 
• The destination address is then examined. 

1. If the destination address is in the database, the packet is forwarded to the appropriate port if the port is different than the one on which it was received. 
2. If the destination address is not in the database, the packet is sent out all ports except for the one on which it was received. This is known as flooding. 
3. A broadcast packet is forwarded (flooded) to all ports except the one on which it was received.

• The frame contains data from the layers above the Data Link layer. 
• The frame’s integrity has been verified through a valid Cyclic Redundancy Check (CRC). 
• The frame is not addressed to the bridge. 

1. Store and forward: The switch buffers and verifies each frame before forwarding it.
2. Cut through: The switch reads only up to the frame’s hardware address before starting to forward it. Cut-through switches have to fall back to store and forward if the outgoing port is busy at the time the packet arrives. There is no error checking with this method.
3. Fragment free: A method that attempts to retain the benefits of both store and forward and cut through. Fragment free checks the first 64 bytes of the frame, where addressing information is stored. According to Ethernet specifications, collisions should be detected during the first 64 bytes of the frame, so frames that are in error because of a collision will not be forwarded. This way the frame will always reach its intended destination. Error checking of the actual data in the packet is left for the end device.
4. Adaptive switching: A method of automatically selecting between the other three modes.

For example, the computers Matterhorn and Washington are in an office, connected to each other on the office local area network by Ethernet cables and network switches, with no intervening gateways or routers. Matterhorn wants to send a packet to Washington. Through other means, it determines that Washington’s IP address is 192.168.0.55. In order to send the message, it also needs to know Washington’s MAC address. First, Matterhorn uses a cached ARP table to look up 192.168.0.55 for any existing records of Washington’s MAC address (00:eb:24:b2:05:ac). If the MAC address is found, it sends the IP packet on the link layer to address 00:eb:24:b2:05:ac via the local network cabling. If the cache did not produce a result for 192.168.0.55, Matterhorn has to send a broadcast ARP message (destination FF:FF:FF:FF:FF:FF Mac address which is accepted by all computers) requesting an answer for 192.168.0.55. Washington responds with its MAC address (and its IP). Washington may insert an entry for Matterhorn into its own ARP table for future use. The response information is cached in Matterhorn’s ARP table and the message can now be sent.^[1]

C. Explain the purpose and functionality of MAC addresses

A media access control address (MAC address) is a unique identifier assigned to network interfaces for communications on the physical network segment. MAC addresses are used as a network address for most IEEE 802 network technologies, including Ethernet. Logically, MAC addresses are used in the media access control protocol sublayer of the OSI reference model. The standard (IEEE 802) format for printing MAC-48 addresses in human-friendly form is six groups of two hexadecimal digits, separated by hyphens (-) or colons (:), in transmission order (e.g. 01-23-45-67-89-ab   or   01:23:45:67:89:ab ). This form is also commonly used for EUI-64. Another convention used by networking equipment uses three groups of four hexadecimal digits separated by dots (.) (e.g. 0123.4567.89ab ), again in transmission order.

D. Explain the purpose and functionality of a broadcast domain.

A broadcast domain is a logical division of a computer network, in which all nodes can reach each other by broadcast at the data link layer. A broadcast domain can be within the same LAN segment or it can be bridged to other LAN segments.

In terms of current popular technologies: Any computer connected to the same Ethernet repeater or switch is a member of the same broadcast domain. Further, any computer connected to the same set of inter-connected switches/repeaters is a member of the same broadcast domain. Routers and other higher-layer devices form boundaries between broadcast domains.

This is as compared to a collision domain, which would be all nodes on the same set of inter-connected repeaters, divided by switches and learning bridges. Collision domains are generally smaller than, and contained within, broadcast domains.

While some layer two network devices are able to divide the collision domains, broadcast domains are only divided by layer 3 network devices such as routers or layer 3 switches. Separating VLANs divides broadcast domains as well, but provides no means to network these without layer 3 functionality.

The distinction between broadcast and collision domains comes about because simple Ethernet and similar systems use a shared transmission system. In simple Ethernet (without switches or bridges), data frames are transmitted to all other nodes on a network. Each receiving node checks the destination address of each frame, and simply ignores any frame not addressed to its own MAC. 

Switches act as buffers, receiving and analyzing the frames from each connected network segment. Frames destined for nodes connected to the originating segment are not forwarded by the switch. Frames destined for a specific node on a different segment are sent only to that segment. Only broadcast frames are forwarded to all other segments. This reduces unnecessary traffic and collisions. 

In such a switched network, transmitted frames may not be received by all other reachable nodes. Nominally, only broadcast frames will be received by all other nodes. Collisions are localized to the network segment they occur on. Thus, the broadcast domain is the entire inter-connected layer two network, and the segments connected to each switch/bridge port are each a collision domain.

E. Explain the purpose and functionality of VLANS

In computer networking, a single layer-2 network may be partitioned to create multiple distinct broadcast domains, which are mutually isolated so that packets can only pass between them via one or more routers; such a domain is referred to as a Virtual Local Area Network, Virtual LAN or VLAN.

Network architects set up VLANs to provide the segmentation services traditionally provided only by routers in LAN configurations. VLANs address issues such as scalability, security, and network management. Routers in VLAN topologies provide broadcast filtering, security, address summarization, and traffic-flow management. By definition, switches may not bridge IP traffic between VLANs as doing so would violate the integrity of the VLAN broadcast domain.

VLANs can also help create multiple layer 3 networks on the same layer 2 switch. For example, if a DHCP server is plugged into a switch it will serve any host on that switch that is configured to get its IP from a DHCP server. By using VLANs you can easily split the network up so some hosts won’t use that DHCP server and will obtain link-local addresses, or obtain an address from a different DHCP server. Hosts may also use a DNS server if a DHCP is not available.

VLANs are layer 2 constructs, compared with IP subnets, which are layer 3 constructs. In an environment employing VLANs, a one-to-one relationship often exists between VLANs and IP subnets, although it is possible to have multiple subnets on one VLAN. VLANs and IP subnets provide independent layer 2 and layer 3 constructs that map to one another and this correspondence is useful during the network design process.

By using VLANs, one can control traffic patterns and react quickly to relocations. VLANs provide the flexibility to adapt to changes in network requirements and allow for simplified administration.

Partitioning a local network into several distinctive segments for e.g.

• production
• Voice over IP
• network management
• storage area network (SAN)
• guest network
• demilitarized zone (DMZ)

in a common infrastructure shared across VLAN trunks can provide a very high level of security with great flexibility to a comparatively low cost. Quality of Service schemes can optimize traffic on trunk links for real time (VoIP) or low-latency requirements (SAN).

VLANs could also be used in a school or work environment to provide easier access to local networks, to allow for easy administration, and to prevent disruption on the network.

In cloud computing VLANs, IP addresses, and MAC addresses on them are resources which end users can manage. Placing cloud-based virtual machines on VLANs may be preferable to directly on the Internet to avoid security issues.

F. Explain the purpose and functionality of link aggregation

Link aggregation is a computer networking term to describe various methods of combining (aggregating) multiple network connections in parallel to increase throughput beyond what a single connection could sustain, and to provide redundancy in case one of the links fails.

In addition to the IEEE link aggregation substandards, there are a number of proprietary aggregation schemes including Cisco’s EtherChannel and Port Aggregation Protocol, AVAYA’s Multi-Link Trunking, Split Multi-Link Trunking, Routed Split Multi-Link Trunking and Distributed Split Multi-Link Trunking, ZTE’s “Smartgroup”, or Huawei’s “EtherTrunk”. Most high-end network devices support some kind of link aggregation, and software-based implementations – such as the *BSD lagg package, Linux’ bonding driver, Solaris’ dladm etc. – also exist for many operating systems.

===

[1] Chappell, Laura A. and Tittel, Ed. Guide to TCP/IP, Third Edition. Thomson Course Technology, 2007, pp. 115-116.

See more at:

http://braingineer.files.wordpress.com/2010/01/ccna-notes.pdf

http://en.wikipedia.org/wiki/Address_Resolution_Protocol

http://www.louiewong.com/archives/196

http://en.wikipedia.org/wiki/MAC_address

http://www.gtcc-it.net/billings/netbasics1.htm

http://en.wikipedia.org/wiki/Broadcast_domain

http://en.wikipedia.org/wiki/Virtual_LAN

http://alliedtelesis.com/manuals/AWPLUSV224CLIa1/port_based_VLANs_overview.html

http://en.wikipedia.org/wiki/Link_aggregation