Preface
Trying to find the perfect networking resource or textbook can be a real challenge. Sometimes they are extremely focused on one technology, and thus miss the mark. Or they are extremely broad, covering every networking idea known to man. This book is about something that all networks have in commonthe core protocols. Networks have a couple of basic building blocks: routers, switches, access points, and hosts. These building blocks use a particular set of rules when forwarding bits of information from one side of the network to another.
These bits are wrapped up in a neat little package called a packet. Packets have many qualities, but one thing they never do is lie. If a packet is present, it is there because some device or network host put it there. By looking at the packets running on a network and understanding the forces (sometimes good, sometimes evil) that put them there, we can gain a deep understanding of how networks operate and what is happening at a given moment.
This book provides the structure (a.k.a. model) used to formulate network transmissions and then dives into the major protocols populating almost every single network today: Ethernet, Internet Protocol (IP), Address Resolution Protocol (ARP), and the Internet Control Message Protocol (ICMP). But this is not simply a description of the foundation protocols. In each chapter, the protocol is analyzed by examining topologies and the packets generated on actual networks. Wireshark is the tool of choice. It is not only powerful but the folks out at wireshark.org continue to provide it free of charge.
Almost all network devices and hosts use tables to make decisions. The packets are on the network because a table was consulted and the result indicated that a transmission be sent. So the packets are the end result. Inside these pages you will find discussion and examples of the ARP tables, routing tables, and source address tables. Tying it all together will be step-by-step descriptions of the processes used so that the reader will be able to completely trace and understand the content of the packets and the events within the communications architecture.
Other key components of this book include addressing and equipment operation. Since lists of addresses are not much use to someone wishing to understand actual behavior, each chapter describes variation and application of these addresses. A chapter on masks has also been included because it is such an integrated part of every single network. Just for fun, there is a section on cabling to provide an explanation of why we connect things the way we do.
The sources used in this book are the actual standards as described by the IEEE and ITU-T. Wherever possible, RFCs are directly referenced. So, if you see it here, it came from either the original source or an operational network.
In a nutshell, this book will describe the core protocols, tables, and equipment used on contemporary networks. Each chapter will take topologies and packets from actual networks and explain why the packets were generated and the purpose of the content found in each. The goal is to provide an in-depth understanding of these components, security concerns, and operation.
Audience
For those not familiar with OReilly books, they commonly do two things: provide lots of solid information and help with the real world. Ive tried to do the same thing here. So this book is terrific for anyone trying to understand networks for the first time and anyone who works with them on a regular basis.
If you have never run packet capture or analysis software, the first time is always an eye opener. All those packets whizzing around the network and each one chock full of arcane information. With this book as a guide you will be able to interpret what is seen and understand why it is there.
For the professional out there, well, we forget things and sometimes get lost in the weeds. When that happens or if you need a refresher, this book is a great reference, not only for the chapter content but for the decomposition of the standards as well. The expert in the field will also find many details not explained elsewhere.
Contents of This Book
Many networking texts start with models, but this is models with a twist. This book focuses on the TCP/IP model, and this chapter gives them a place in the universe and describes where the focus should be. Backed up with captures and standards, the models are populated with protocols, equipment, and addresses.
Ethernet provides the basis for a very large percentage of the networks deployed today. This chapter discusses the choices of the network administrator while providing significant details about operation and configuration. Topologies and cabling are two other focal points providing further details into actual networking practice.
Leaving Layer 2, we arrive at Layer 3 and the domain of IP. This chapter takes us through the structure and operation of IP, backed up by packet captures of course. Every field is given an example. Particular attention is paid to the addressing and how it is deployed, including the entries standard to the host routing table.
ARP is arguably the simplest protocol on a network, but it is also a very neat troubleshooting tool and a point of attack for the bad guys. This chapter discusses the operation and particular addressing associated with ARP. It also covers storage of learned information and network behavior.
It is easy to outline network device responsibilities and assign them to the various layers of the networking model. This chapter goes a step further to include tables used in making forwarding decisions and guides the reader through a series of step-by-step examples.
This protocol defines a large collection of error and informational message types. However, contemporary networks utilize a subset of this collection. For every one of these practical messages types, a topology is provided and sample packet captures analyzed to give the reader a complete understanding of the situations resulting in their transmission.
A network cannot be built without using network masks. This chapter describes the subnetting and supernetting procedures and provides two methods for arriving at the correct answer when dividing up address space. Several examples are provided and explained completely.
Limitations in IPv4 address space, IPv6 Day and the U.S. government are working together to bring about change at layer 3. IPv6 is the replacement for IPv4 and this chapter discusses the protocol, IPv6 addressing and operation. ICMPv6 is added for good measure.
Conventions Used in This Book
The following typographical conventions are used in this book:
Plain text
Indicates menu titles, menu options, menu buttons, and keyboard accelerators (such as Alt and Ctrl).
ItalicIndicates new terms, URLs, email addresses, filenames, file extensions, pathnames, directories, and Unix utilities.
Constant width
Indicates commands, options, switches, variables, attributes, keys, functions, types, classes, namespaces, methods, modules, properties, parameters, values, objects, events, event handlers, XML tags, HTML tags, macros, the contents of files, or the output from commands.