B

Networking 101

The Internet has become a big place, with many different kinds of individual computers as well as LANs connected to it. Sometimes a group of LANs have special interconnections, making a Wide Area Network (WAN). Though these networks used to operate using a variety of network protocols, these have all more or less died out in favor of one, the Internet Protocol, or IP. Protocols that did not make it to the Internet include IPX, DecNet, NetBEUI, LAT, and X.25. This book focuses only on the IP protocol. Many of these obsolete protocols can be encapsulated in IP packets if they really need to travel over the Internet. Sometimes the entire Internet Protocol is called TCP/IP, although technically speaking this is a very bad name.

The OSI Model and the IP Model

The Internet Protocol defies the old OSI network model from the ISO committee. For those of you who still try to believe in this model, think about it for a bit. You might be able to match some things, such as 802.3 to layer 2, IP to layer 3, TCP to layer 4, TLS to layer 5, HTTP to layer 6, and HTML to layer 7. But ICMP is also layer 3, IPsec ESP is layer 2, 3, and 4, since ESP can live on top of layer 3 (therefore it must be 4 also), and it can have layer 4 in it (so it must be layer 3), and it can have a layer 3 in it (so it must be layer 2). We will try and prevent using anything from this old model, and we encourage you to rip your OSI model poster off the wall and focus on the properties of IP. Welcome to the real world...

No Layers, Just Packets

The IP protocol has no concept of layers. It consists simply of packets. When people talk about layers (often layer 2 or layer 3) they are actually talking about how to stuff IP packets into some transport medium such as coax cables, fiber, WiFi, or Ethernet. We will hardly have to worry about those layers, since IPsec deals with IP packets, and not the physical medium of sending those packets.

If you connect from one machine to the other, you are sending and receiving packets. A connection is nothing more than two machines remembering the state of the packets sent and received. An IP packet consists of an IP header, and the IP body. The header contains information that ensures the packets are passed along until they reach their destination. The header also describes what kind of data is inside the packet. The body is the actual data, or the payload.

Networking 101

Each IP packet's header contains the source address, the IP address of the machine that created the packet (and later on perhaps expects an answer). It contains the destination IP address, the place where this packet is intended to go, and a protocol number. Most protocols also require a port number. The IP header has further space for a bunch of other options or flags that can be set.

The Protocol

Without going into too much detail about all the different kinds of protocols and options, Internet communication today mostly consists of two protocols, TCP and UDP. Note that technically we should be talking about sub-protocols of the IP protocol, but the fact that to do so would actually make things more confusing is only proof that the OSI model is dead.

These two IP protocols, TCP and UDP, have ports, which are simply a way of sub-addressing an IP address. Ports go from 1 to 65535. TCP and UDP connections are therefore characterized by four properties: source address, source port, destination address, and destination port. You can either listen or send on a certain address and port, but you can not use them for both sending and receiving at the same time.

These ports are separate 'entries' into the host. For instance, email is sent using the SMTP protocol, which consists of a TCP connection to the IP address of a mail server on port 25. A DNS server listens on UDP port 53 for questions about translating a hostname to an IP address.

Another well known IP protocol is ICMP. This protocol is used to send error or informational messages. The ping command uses an ICMP packet. The ICMP protocol has no ports. Actually, this protocol is a bit special, as it is a control function of the IP protocol, and not a sub-protocol of the IP protocol.

IP Network Overview

Most people are familiar with IP address notation and netmasks, but in our support work and on the mailing lists we often see people using impossible configurations. Usually, this is because they have not fully understood the meaning of netmasks, the CIDR notation, or the concept of the gateway. We will give a quick explanation of these concepts for IPv4. If you are familiar with these, you can skip this part, but be aware that if you do not fully understand netmasks and gateways, you will run into problems later.

If you connect a computer to the Internet, you have to ensure that its address is unique, or else you cannot distinguish it. This is done by assigning the computer (which becomes a host on the network) an Internet Protocol address, or IP address.

An IPv4 address is a unique 32 bit number. Because humans are not fluent in binary notation, we write them in a special way, four bytes separated by dots. For example, 193.110.157.77 is the IP address of the mailing list server of the Openswan project.

IP Address Management

These addresses are handed out in chunks by a few central organizations. This registration started with Jon Postel, who started the IANA, the Internet Assigned Number Authority. After the Internet hype and commercial and government interests in the Internet increased, this technical

312

Appendix B

process became a political process. Currently, the authority for these numbers formerly resides at ICANN, though in practice the three Regional Internet Registrars (RIRs) control and hand out the address space. ARIN hands out IP addresses in North and South America, RIPE hands them out in Europe and bits of Africa and the Middle East, and APNIC gives out addresses to the Asian and Pacific regions.

The Old IP Classes

In the early days, these chunks of addresses were split up in classes. The smallest class was the Class C, which would have 256 IP addresses. For example, 193.111.228.*, where * can be any number between 0 and 255. Bigger organizations such as universities would receive a Class B, for example 131.174.*.*. They could then split that class B into smaller class C networks for internal use. Some organizations were lucky enough to receive a huge pool, a class A. Stanford University used to have 36.*.*.*.

We will not go into the political discussion of the IP space shortage, but when it was deemed that this was a problem, people wanted to replace this system of network classes with something else. The problem of these classes was that a lot of IP addresses were wasted. If you needed 300 addresses, you could not use a class C, so you would get a class B, which contained 256*256= 65536 addresses, of which 65000 would be wasted. The difference between a class B and a class A is even worse.

Classless IP Networks

The concept of classes was replaced as ISPs needed to hand out smaller chunks of IP addresses to their customers. Instead of giving every customer 256 IP addresses, they would receive much smaller chunks. This could be any power of two between 4 and 256.

The Definition of a Subnet

Every Internet-connected network has two sides, the inside and the outside. Hosts on the inside can be reached directly, without the help of another host. The inside network is often called the LAN, which stands for Local Area Network. Sometimes people distinguish the LAN from a remote network according to who administers the hosts. An organization can have several local networks that fall into the larger corporate network. If you look at the corporate network as a whole versus the Internet, then you can call that corporate network the LAN too. We will be focusing on the technical aspects of networks. When we say local network, we mean this from the technical point of view. Two machines are in the same local network if they can communicate to each other without the help of a third host, even if they are five buildings and six kilometers apart, or end up belonging to a different company department and system administrator. The entire local network of all machines that can talk to each other without a third host is also called a subnet. The term subnet originates from the old days when we still spoke about classes. If you had a class B network, you could subnet this class into C classes and give separate buildings or departments their own subnet. These days we still speak of subnets, but more in a sense that every network on the Internet is a subnet of that Internet.

313

Networking 101

Calculating with Subnets: The Subnet Mask

Because subnets can have different sizes, we need to have a method for hosts to know what they should consider as their subnet. You do not want the host to try and find the host in the local subnet when the host it is trying to talk to is on the other side of the planet. Remember that an IP address is just a 32-bit number. The IP address 193.110.157.77 can be written in bits as 11000001 01101110 10011101 01001101. What do we know about these bits for the subnet that contains all the addresses in 193.110.157.*? Well, we notice that some of the bits, in our case the first 24, are always the same. The last 8 bits change, depending on the number we want that "*" to be, as anything from 0 to 255. This is exactly what the subnet mask (also called the netmask) tells us. It is also a series of 32 bits, but now the bits do not represent a number, but the property of a bit in the IP address.

For each bit in an IP address range that will never change, the corresponding bit in the netmask will be 1. If changing a bit in an IP address would indicate a different host in the same network, the netmask bit corresponding to the address bit would be 0.

Let us visualize this in a table, because it sounds a lot more complex than it really is. Let us write down our IP address, but also the first and last address possible in our subnet. The parts in bold in the table below never change, and are part of the subnet, and thus receive a 1 in the netmask.

IP address	Binary notation
193.110.157.0	11000001	01101110	10011101	00000000
193.110.157.77	11000001	01101110	10011101	01001101
193.110.157.255	11000001	01101110	10011101	11111111
Netmask	11111111	11111111	11111111	00000000

As expected, the only difference between IP addresses in the 193.110.157.* range are the last 8 bits: the first 24 bits (3 bytes) are always the same. We can also see another property of the netmask. It will always start with 1s and at one (and only one) point, it will switch to zeros. This is because our subnets will always be a continuous set of increasing numbers, e.g. from 0 to 255.

So if we want to describe our IP address and its subnet, we could use the decimal syntax 193.110.157.77/255.255.255.0. This gives us all the information we need. Our host's IP address is 193.110.157.77, and all the IP addresses that fall within 193.110.157.* can be reached directly.

But since sysadmins are inherently lazy, they do not want to write all these netmask numbers every time they need an address. Instead, a shorthand notation is used. For instance, for '255.255.255.0' we count the number of 1s in the netmask, and write that. So, the most common notation for our

machine here would be 193.110.157.77/24. If we want to describe the entire subnet instead of a single host in a subnet, we would use the lowest address in that subnet. Our subnet would be written as

193.110.157.0/24. This is called the CIDR notation, the Classless Internet Domain Routing notation.

314