Essential Networking Protocols and Addressing Fundamentals
Networking Fundamentals: Protocols, Routing, and Security
Routing Protocols: Link State vs. Distance Vector
Link State Algorithm (OSPF, IS-IS)
The Link State Algorithm requires each router to build a full topological map of the network. It uses Dijkstra’s algorithm to compute the shortest path.
Link State Steps
- Neighbor Discovery: Routers use Hello packets to find direct neighbors.
- Link Cost Calculation: Measures the cost to each neighbor (e.g., bandwidth, delay).
- LSA Generation: Link-State Advertisements describe the router’s links and costs.
- Flooding LSAs: LSAs are sent to all routers in the area.
- SPF Calculation: Each router runs Dijkstra’s algorithm on the link-state database to compute the Shortest Path Tree (SPT).
- Forwarding Table: Extracted from the SPT with next-hop information.
Distance Vector Routing Algorithm (RIP)
Distance Vector protocols determine the best path based on distance (metric, typically hop count) and direction (next hop). Routers periodically share their routing tables with directly connected neighbors and use the Bellman-Ford algorithm to recalculate routes.
RIP (Routing Information Protocol) Details
- Type: Distance-vector protocol.
- Metric: Hop count (maximum 15 hops; 16 = unreachable).
- Routing Updates: Every 30 seconds to neighbors.
- Convergence: Slow compared to link-state protocols.
RIP Timers
- Update Timer: 30 seconds (frequency of updates).
- Invalid Timer: 180 seconds (time before a route is marked invalid).
- Hold-Down Timer: 180 seconds (prevents immediate route changes).
- Flush Timer: 240 seconds (time before an invalid route is removed).
Distance Vector Loop Prevention
- Split Horizon: Prevents routing information from being sent back to the source interface.
- Route Poisoning: Sets unreachable routes to an infinite metric (16).
- Hold-down Timers: Temporarily prevents changes to routes to stabilize the network.
OSPF Message Types
OSPF (Open Shortest Path First) uses 5 types of packets, all carried within IP protocol 89:
- Hello Packet: Establishes and maintains neighbor relationships.
- Database Description (DBD): Summarizes LSAs during adjacency setup.
- Link-State Request (LSR): Requests specific LSAs that are outdated or missing.
- Link-State Update (LSU): Contains one or more LSAs; used to flood new or updated LSAs.
- Link-State Acknowledgment (LSAck): Acknowledges the receipt of LSAs to ensure reliability.
IP Addressing and Subnetting
IPv4 Subnetting Example: 160.20.0.0/17
Given: IP = 160.20.0.0/17 (Class B network, default mask /16).
- New Subnet Mask: /17 → 255.255.128.0
- No. of Subnets: 2¹ = 2 subnets (1 bit borrowed).
- No. of IP Addresses per Subnet: 2¹⁵ = 32,768 IPs.
- No. of Hosts per Subnet: 2¹⁵ – 2 = 32,766 usable hosts.
Subnet Details
Subnet 1:
- Network ID: 160.20.0.0
- Broadcast ID: 160.20.127.255
- Host Range: 160.20.0.1 to 160.20.127.254
Subnet 2:
- Network ID: 160.20.128.0
- Broadcast ID: 160.20.255.255
- Host Range: 160.20.128.1 to 160.20.255.254
IPv4 Subnetting Example: 210.0.0.0/25
Given: IP = 210.0.0.0/25 (Class C network, 1 extra bit borrowed).
- Subnet Mask: /25 = 255.255.255.128
- No. of Subnets: 2¹ = 2 subnets.
- No. of IP Addresses per Subnet: 2⁷ = 128 IP addresses.
- No. of Hosts per Subnet: 128 – 2 = 126 usable hosts.
Subnet Details
First Subnet:
- Network ID: 210.0.0.0
- Broadcast ID: 210.0.0.127
- Host Range: 210.0.0.1 to 210.0.0.126
Second Subnet:
- Network ID: 210.0.0.128
- Broadcast ID: 210.0.0.255
- Host Range: 210.0.0.129 to 210.0.0.254
IPv6 Concepts and Transition
Types of Addresses in IPv6
IPv6 uses three main address types:
- Unicast Address: Identifies a single unique interface. Data is delivered only to that specific interface.
- Global Unicast: Publicly routable on the internet.
- Link-Local: Used within a single link (e.g.,
fe80::/10). - Unique Local: Private addresses used within an organization (e.g.,
fc00::/7).
- Multicast Address: Identifies a group of interfaces. Data is delivered to all group members (e.g.,
ff02::1for all nodes). - Anycast Address: Assigned to multiple interfaces (typically on different devices). Data is delivered to the nearest (topologically closest) interface. Used for load balancing (e.g., DNS services).
IPv4 to IPv6 Transition Strategies
Since IPv4 and IPv6 are incompatible, transition mechanisms are essential for interoperability:
- Dual Stack: Devices run both IPv4 and IPv6 stacks simultaneously. Easy to implement but requires support on all devices and networks.
- Tunneling: Encapsulates IPv6 packets inside IPv4 to travel through IPv4 networks.
- 6to4: Automatic tunneling using special IPv6 address format.
- Teredo: Tunnels IPv6 over UDP through NATs.
- ISATAP: Works within private networks.
- Translation: Converts between IPv4 and IPv6 packet headers.
- NAT64: Allows IPv6 clients to access IPv4 servers.
- DNS64: Synthesizes AAAA records from A records.
IPv6 Extension Headers
IPv6 uses extension headers to carry optional information separately from the main header, promoting modularity and reducing complexity in the base header. They are processed in a specific order:
- Hop-by-Hop Options Header: Must be processed by every node along the path (e.g., jumbo payloads).
- Routing Header: Allows source routing—specifying intermediate nodes.
- Fragment Header: Handles fragmentation by the source (intermediate routers do not fragment).
- Destination Options Header: For options that only the destination node needs to process.
- Authentication Header (AH): Provides integrity and authentication (part of IPsec).
- Encapsulating Security Payload (ESP): Provides encryption and authentication (part of IPsec).
IPv6 Address Compression Examples
IPv6 allows zero compression (::) and omitting leading zeros.
Example 1: Abbreviation
Given: 64 bits of 1 followed by 32 10 patterns, followed by 32 bits of 0.
- Unabbreviated:
FFFF:FFFF:FFFF:FFFF:AAAA:AAAA:0000:0000 - Abbreviated:
FFFF:FFFF:FFFF:FFFF:AAAA:AAAA::
Example 2: Zero Compression
- Full Address:
2001:0db8:0000:0000:0000:ff00:0042:8329 - Zero Compressed:
2001:db8::ff00:42:8329
IPv6 Address Generation (EUI-64 Format)
Goal: Generate an IPv6 address using the EUI-64 format from a MAC address.
- Network Prefix:
2000:1110:1287::/48 - MAC Address:
F5-A9-23-14-7A-D2 - Subnet ID (3rd subnet):
0002
- Insert FFFE:
F5A9:23FF:FE14:7AD2 - Flip the 7th bit (U/L bit) of the first byte (F5 → F7):
F7A9:23FF:FE14:7AD2 - Combine Prefix, Subnet ID, and Interface ID:
2000:1110:1287:0002:F7A9:23FF:FE14:7AD2
Core Network Protocols and Services
TCP/IP Model in Detail
TCP/IP (Transmission Control Protocol/Internet Protocol) is the foundational suite of protocols defining how data is packetized, addressed, transmitted, and received across networks.
- Application Layer: Provides end-user services (HTTP, FTP, SMTP, DNS).
- Transport Layer: Ensures reliable (TCP) or fast (UDP) delivery between devices.
- Internet Layer: Responsible for logical addressing and routing (IP, ICMP, ARP).
- Network Access Layer (Link Layer): Handles physical connection and hardware addressing (Ethernet, Wi-Fi, MAC addresses).
Transmission Control Protocol (TCP)
TCP Connection Establishment (Three-Way Handshake)
- SYN: Client sends SYN=1 (request to establish connection).
- SYN-ACK: Server responds with SYN=1, ACK=1 (acknowledging request and sending its own SYN).
- ACK: Client sends final ACK (connection established).
TCP Connection Termination (Four-Step Process)
- FIN from Client: Client sends FIN=1 (requesting close).
- ACK from Server: Server replies with ACK=1 (acknowledging FIN).
- FIN from Server: Server sends its own FIN=1 when ready to close.
- Final ACK from Client: Client responds with ACK=1 (connection fully closed).
User Datagram Protocol (UDP)
UDP is a connectionless protocol known for low latency and minimal overhead.
UDP Services and Characteristics
- Connectionless Communication (no handshake).
- Low Latency (faster than TCP).
- Broadcast and Multicast Support.
- Minimal Overhead.
- Used in DNS, VoIP, TFTP, streaming, etc.
UDP Datagram Packet Format (8 bytes total)
The UDP header is simple and fixed at 8 bytes:
- Source Port (2 bytes): Identifies the sending application.
- Destination Port (2 bytes): Identifies the receiving application.
- Length (2 bytes): Total length of the UDP datagram (header + data).
- Checksum (2 bytes): Ensures integrity (mandatory in IPv6, optional in IPv4).
UDP Header Analysis Example
Header: A084000C001C001D
- Source Port Number:
A084(Hex) = 41092 - Destination Port Number:
000C(Hex) = 12 - Total Length:
001C(Hex) = 28 bytes - Data Length: Total Length (28) – Header (8) = 20 bytes
Address Resolution Protocol (ARP)
ARP maps IPv4 addresses to MAC (Media Access Control) addresses within a local network.
How ARP Works
- ARP Request: Sender broadcasts a request asking for the MAC address corresponding to a known IP address.
- ARP Reply: The device owning the IP address responds directly with its MAC address.
- Caching: The mapping is stored in the ARP cache for future use.
Note: In IPv6, ARP is replaced by the Neighbor Discovery Protocol (NDP).
Dynamic Host Configuration Protocol (DHCP)
DHCP assigns IP addresses and network configuration dynamically to clients (Application layer, UDP ports 67 & 68).
Key Functions
Assigns IP address, Subnet mask, Default gateway, DNS servers, and Lease time.
DHCP Process (DORA)
- Discover: Client broadcasts a discovery message.
- Offer: DHCP server responds with an available IP and configuration.
- Request: Client selects and requests the offered IP.
- Acknowledgment: Server confirms assignment.
ICMPv6 Messages and Neighbor Discovery
ICMPv6 (Internet Control Message Protocol for IPv6) is used for error reporting, diagnostics, and Neighbor Discovery in IPv6 networks.
ICMPv6 Error Messages (Type 0–127)
- Destination Unreachable
- Packet Too Big
- Time Exceeded (Hop Limit expired)
- Parameter Problem
ICMPv6 Informational Messages (Type 128–255)
- Echo Request/Reply (used in Ping)
Neighbor Discovery Protocol (NDP) Messages
NDP is crucial for local link communication in IPv6:
- Router Solicitation (RS): Host requests configuration info from a router.
- Router Advertisement (RA): Router provides configuration and prefix info.
- Neighbor Solicitation (NS): Queries for a neighbor’s link-layer address.
- Neighbor Advertisement (NA): Response with the MAC address.
- Redirect Message: Suggests a better first-hop router.
Network Security and Infrastructure
Main Goals of Network Security (CIA Triad)
Network security aims to protect data and resources based on five core principles:
- Confidentiality: Prevent unauthorized access (e.g., using Encryption, VPNs, SSL/TLS).
- Integrity: Ensure data is not altered or tampered with (e.g., using Hashing algorithms, digital signatures).
- Availability: Ensure reliable access to resources when needed (e.g., using Redundancy, DoS/DDoS mitigation).
- Authentication: Verify the identity of users or systems (e.g., using Multi-factor authentication, PKI).
- Non-repudiation: Prevent a party from denying their actions (e.g., using Digital signatures, audit logs).
Types of Firewalls
A firewall monitors and controls network traffic based on predetermined security rules, acting as a barrier between trusted and untrusted networks.
- Packet Filtering Firewall: Examines packets based on IP/port/protocol headers. Fast but cannot inspect content or state.
- Stateful Inspection Firewall: Tracks the state of active connections, offering better security than simple packet filtering.
- Proxy Firewall: Acts as an intermediary (proxy) at the application layer, inspecting content deeply but potentially introducing latency.
- Next-Generation Firewall (NGFW): Combines traditional features with intrusion prevention systems (IPS) and application awareness.
Encryption and API Definition
Encryption
The process of converting data into a coded format to prevent unauthorized access.
Example: AES (Advanced Encryption Standard).
API (Application Programming Interface)
A set of rules and tools that allows different software components to communicate.
Example: A weather application using an API to fetch data from a weather server.
Internetworking and Tunneling
Internetworking refers to the process of connecting multiple different computer networks (LANs, WANs, different protocols) to create a unified communication system.
Tunneling Explained
Tunneling encapsulates one network protocol (e.g., IPv6) inside another (e.g., IPv4). This allows data to travel securely or traverse incompatible networks.
- How it works: The original packet is hidden inside a new packet header.
- Uses: IPv6 transition (6to4, Teredo) and Virtual Private Networks (VPNs).
Email Protocols and Domain Systems
Email Retrieval Protocols: POP3 vs. IMAP4
Both protocols retrieve emails from a server, but differ in storage and synchronization:
| Feature | POP3 (Post Office Protocol 3) | IMAP4 (Internet Message Access Protocol 4) |
|---|---|---|
| Storage Location | Downloads emails to the local device and typically deletes them from the server. | Keeps emails on the server; users view them remotely. |
| Synchronization | No synchronization across multiple devices. | Full synchronization across all devices (read status, folders, etc.). |
| Use Case | Ideal for single-device access or limited storage needs. | Preferred for multi-device access and centralized organization. |
Simple Mail Transfer Protocol (SMTP)
SMTP is the standard protocol used to send emails from a client to a server, or between servers. It operates at the Application layer, typically using TCP port 25 (or 587/465 for secure connections).
SMTP Communication Phases
- Connection Establishment: Client initiates TCP connection and uses
HELO/EHLO. - Mail Transfer: Client sends sender (
MAIL FROM:), recipient (RCPT TO:), and message content (DATA). - Connection Termination: Session ends with the
QUITcommand.
Types of Domains in DNS
The Domain Name System (DNS) organizes names hierarchically:
- Top-Level Domains (TLDs): Highest level (e.g.,
.com,.org,.net).- Country Code TLDs (ccTLDs): Represent countries (e.g.,
.uk,.jp). - Sponsored TLDs (sTLDs): Restricted use (e.g.,
.edu,.gov).
- Country Code TLDs (ccTLDs): Represent countries (e.g.,
- Second-Level Domains (SLDs): Chosen by the user, appearing before the TLD (e.g., “google” in
google.com). - Subdomains (Third-Level Domains): Used to organize sections (e.g., “mail” in
mail.google.com). - Root Domain: Represented by a dot (
.) at the end of the hierarchy.
Full Forms of Key Protocols
- OSPF: Open Shortest Path First
- UDP: User Datagram Protocol
- ARP: Address Resolution Protocol
- IP: Internet Protocol
