Networking Essentials

Introduction#

Have you ever wondered how your computer automatically configures its network settings when you turn it on or connect to a new network? Curious how many devices and countries your packets pass through before reaching their destination? Or how all your home devices share a single public IP address from your ISP?

This room will answer these questions and more.

Room Series#

This is the second room in a four-part networking series:

1. Networking Concepts
2. Networking Essentials (this room)
3. Networking Core Protocols
4. Networking Secure Protocols

Learning Prerequisites#

To get the most from this room, you should already know:

• ISO OSI model and its layers
• TCP/IP model and its layers
• Basics of Ethernet, IP, and TCP

Starting this room after Networking Concepts is recommended.

Learning Objectives#

By the end of this room, you will understand several fundamental protocols and technologies that hold networks together:

• Dynamic Host Configuration Protocol (DHCP): How devices automatically receive network configuration.
• Address Resolution Protocol (ARP): Mapping IP addresses to MAC addresses within a local network.
• Network Address Translation (NAT): Sharing one public IP across many private devices.
• Internet Control Message Protocol (ICMP): Supporting network diagnostics and error reporting.
• Ping: Testing connectivity and latency to another device.
• Traceroute: Tracking the path packets take across networks to reach a destination.

DHCP: Give Me My Network Settings#

Imagine you're at a coffee shop: you join the WiFi, and your laptop is instantly ready to go. You didn’t manually type in an IP address, gateway, or DNS server. This automatic setup is possible thanks to the Dynamic Host Configuration Protocol (DHCP).

When you connect to a network, at minimum, you need:

• An IP address and subnet mask
• A router (gateway)
• A DNS server

Manually configuring these settings is fine for servers, which rarely move between networks. But for laptops, phones, and other mobile devices, automation is essential. It avoids time-consuming manual setup and prevents address conflicts (two devices accidentally sharing the same IP).

DHCP is an application-layer protocol that runs over UDP. Typically:

• DHCP servers listen on UDP port 67
• DHCP clients send from UDP port 68

Most devices (like smartphones and laptops) are set to use DHCP by default.

The DORA Process#

DHCP uses a four-step process remembered by the acronym DORA:

1. Discover – The client broadcasts a DHCPDISCOVER message looking for a DHCP server.
2. Offer – The server responds with a DHCPOFFER including an available IP address.
3. Request – The client replies with a DHCPREQUEST to accept the offer.
4. Acknowledge – The server confirms with a DHCPACK that the address is assigned.

For example:

• Your laptop sends a DHCP Discover.
• The server replies with a DHCP Offer.
• Your laptop responds with a DHCP Request.
• The server sends back a DHCP Acknowledge.

Example Packet Capture#

Here’s a simplified capture of the four steps:

1 0.0.0.0 → 255.255.255.255 DHCP Discover
2 192.168.66.1 → 192.168.66.133 DHCP Offer
3 0.0.0.0 → 255.255.255.255 DHCP Request
4 192.168.66.1 → 192.168.66.133 DHCP ACK

Key details:

• Initially, the client has no IP address (0.0.0.0) and broadcasts to 255.255.255.255.
• The server offers an IP address and configuration, targeting the client’s MAC address.

Result of DHCP#

At the end of this process, the client has everything it needs:

• A leased IP address on the local network
• The gateway to route traffic outside the local network
• A DNS server for resolving domain names

DHCP is what makes getting online in a new location seamless and automatic.

ARP: Bridging Layer 3 Addressing to Layer 2 Addressing#

When two hosts communicate on a network, an IP packet is encapsulated within a data link frame. This is how Ethernet (IEEE 802.3) or WiFi (IEEE 802.11) actually transmits the data.

But there’s a problem: Even if one host knows the IP address of its target, it needs the target's MAC address to build the Ethernet header.

A MAC address is a 48-bit value, typically displayed in hexadecimal like 7C:DF:A1:D3:8C:5C. Devices don’t always know each other's MAC addresses automatically; they only need them when communicating.

Why ARP Is Needed#

Imagine you connect to a network. If there’s a DHCP server, your device learns:

• Its own IP address
• The gateway (router) IP
• The DNS server IP

These are all IP addresses. At this stage, no MAC addresses have been exchanged. But when your device wants to send an Ethernet frame to the gateway or another host on the same network, it needs that device’s MAC address.

Ethernet Frame Example#

An Ethernet frame header includes:

• Destination MAC address
• Source MAC address
• Type (for example, IPv4)

Inside that frame, the IP packet is carried as payload.

The ARP Process#

Address Resolution Protocol (ARP) lets a device learn the MAC address for a known IP address. Here’s how it works:

1. ARP Request: The device broadcasts an ARP Request on the local network asking, “Who has IP 192.168.66.1? Tell 192.168.66.89.”
2. ARP Reply: The target device responds with its MAC address.

Example packet capture:

1 cc:5e:f8:02:21:a7 → ff:ff:ff:ff:ff:ff ARP Request: Who has 192.168.66.1?
2 44:df:65:d8:fe:6c → cc:5e:f8:02:21:a7 ARP Reply: 192.168.66.1 is at 44:df:65:d8:fe:6c

• The Request is sent to the broadcast MAC address ff:ff:ff:ff:ff:ff.
• The Reply is unicast back to the requester.

Encapsulation Note#

ARP messages aren’t inside IP packets or UDP segments. They’re encapsulated directly in Ethernet frames. Example Wireshark capture:

• ARP Reply directly inside an Ethernet frame with no IP or UDP header.

Is ARP Layer 2 or Layer 3?#

• ARP is often described as Layer 2 because it deals with MAC addresses.
• Others consider it supporting Layer 3 operations because it enables IP communication.

The key point is: ARP translates Layer 3 addressing (IP) to Layer 2 addressing (MAC).

ICMP: Troubleshooting Networks#

Internet Control Message Protocol (ICMP) is essential for diagnosing and managing network issues. It provides error messages and operational information. Two key tools rely on ICMP:

• ping: Tests connectivity to a target and measures round-trip time.
• traceroute: Maps the path packets take to a destination.

Ping#

The ping command sends an ICMP Echo Request (Type 8) to a target. If the target is reachable and allows ICMP, it replies with an ICMP Echo Reply (Type 0). This verifies connectivity and measures latency.

Example output:

anas@anas$ ping 192.168.11.1 -c 4
64 bytes from 192.168.11.1: icmp_seq=1 ttl=63 time=11.2 ms
...

• icmp_seq: Sequence number of the packet.
• ttl: Time To Live, decremented by each router.
• time: Round-trip time in milliseconds.

If no replies are received, the host might be offline, or a firewall might block ICMP.

Traceroute#

traceroute (or tracert on Windows) identifies the path packets take to a destination. It manipulates the Time-to-Live (TTL) field in IP headers:

• Each router decrements TTL by one.
• When TTL reaches zero, the router discards the packet and sends an ICMP Time Exceeded message (Type 11).

By incrementing TTL gradually, traceroute reveals each router (or hop) along the path.

Example output:

anas@anas$ traceroute example.com
1 _gateway (192.168.66.1) ...
2 192.168.11.1 ...
3 100.104.0.1 ...
...

• * * * indicates routers that didn’t respond.
• Some hops show private IPs (inside ISPs), while others show public IPs and domain names.

The path can change over time due to dynamic routing.

Key Points:

• ICMP is Layer 3: Operates directly over IP.
• ping verifies basic connectivity.
• traceroute maps the network route, useful for diagnosing latency or routing problems.

Routing#

When devices on different networks need to communicate, routers ensure that packets find their way across the network to their destination. But how does a router know where to send a packet next?

Imagine even a small setup with three local networks connected via their own routers. Even in this simple scenario, routers need to know how to deliver packets between these networks.

Now scale that up to the Internet: millions of routers and billions of devices, with many possible paths between any two endpoints. Each router along the way needs to decide which link to use to forward the packet toward its destination.

Routing Algorithms#

Routers use routing algorithms and routing protocols to exchange information about the network's structure and to determine the best path for traffic. These algorithms consider factors like distance, speed, congestion, and policy.

While the details of routing algorithms are beyond the scope of this introduction, it's important to know the names and purposes of some common routing protocols:

• OSPF (Open Shortest Path First):

  • A link-state routing protocol.
  • Routers exchange information about the entire network topology.
  • Each router builds a complete map of the network and calculates the most efficient paths.

• EIGRP (Enhanced Interior Gateway Routing Protocol):

  • A Cisco proprietary protocol.
  • Uses a combination of distance-vector and link-state features.
  • Routers share information about reachable networks and their costs (like bandwidth or delay) to choose the best path.

• BGP (Border Gateway Protocol):

  • The main protocol used between large networks on the Internet (like ISPs).
  • Allows networks (called autonomous systems) to exchange routing information.
  • Critical for establishing paths across multiple networks globally.

• RIP (Routing Information Protocol):

  • A simpler distance-vector protocol.
  • Suitable for small networks.
  • Chooses routes based on hop count (number of routers a packet must pass through).

Summary#

Routing is fundamental for inter-network communication. Routers rely on routing protocols to:

• Discover and maintain knowledge about the network's topology.
• Choose the best paths for packet delivery.
• Adapt to network changes, ensuring reliable communication even in complex, changing environments.

Understanding the basics of routing and these common protocols is essential for anyone working with or studying networking.

NAT (Network Address Translation)#

IPv4 was designed with around 4 billion possible addresses. That seemed like a lot in the early days of networking, but with the explosion of devices (computers, smartphones, IoT devices), it quickly became clear this space would be exhausted.

Network Address Translation (NAT) was introduced to extend the usability of the limited IPv4 address space.

How NAT Works#

The core idea of NAT is simple: use one (or a few) public IP addresses to give Internet access to many private IP addresses on a local network.

For example, instead of needing 20 public IP addresses for 20 devices in a company network, NAT lets them share a single public IP address to access the Internet.

Why is this important?

• It dramatically reduces the demand for public IPv4 addresses.
• Private IP ranges (like 192.168.x.x) can be reused in every internal network.

NAT in Action#

NAT works by translating private internal addresses to public addresses and ports. It keeps a translation table that maps:

• Internal IP + port ➜ External IP + port
• External IP + port ➜ Internal IP + port (for responses)

Example Flow:

• Your laptop (192.168.0.129:15401) wants to talk to a web server on the Internet.
• The NAT router rewrites the source address and port to its public IP (212.3.4.5:19273).
• The server sees the request as coming from 212.3.4.5:19273.
• When the server responds, the NAT router uses its table to send the response back to your laptop at 192.168.0.129:15401.

This translation is seamless. Devices inside the network are unaware their addresses are being translated.

Summary#

NAT is a critical technology that:

• Extends the life of IPv4.
• Allows multiple private devices to share a single public IP.
• Supports scalability and easier management of internal networks.

It's one of the key reasons IPv4 is still in wide use despite its limited address space.