- Home
- NELUG Starting Page
- Activities
- Information on meetings, mailing list etc.
- Resources
- Tutorials and other resources produced by the group
- Links
- Other linux-related sites
- Forums
- Nelug discussion forums (NEW)
Meetings this year:
Year 2008
15th January
19th February
18th March
15th April
20th May
17th June
15th July
19th August
16th September
21st October
18th November
16th December
|
|
An Introduction to the Internet Protocols
NELUG meeting 16/2/2000
Richard Mortimer
Overview
- Internet connects millions of machines around the world.
- Allows machines to find/talk to each other.
- No one machine knows the whole of the network (knowledge
is distributed).
- Supports the "languages" (protocols) that various
applications use to talk to each other - done in layers.
- Example:
| applications |
| protocol layer - http, ftp, nfs |
| tcp | udp |
| ip | icmp |
| Hardware layer (ethernet, token ring, ppp) |
- applications
- These are the user and system programs which talk to each other
using IP.
- protocol layer
- These are application/domain specific languages which the various
applications understand. These hide the gory details of ip, tcp and
udp from the user.
- tcp/udp
- These are basic protocols that the higher level protocols use.
- ip
- The basic unit of information transmission. The higher layers
use one or more ip packets to transfer data.
- icmp
- internet control message protocol - a close friend of ip which is
used to pass various control messages between different machines. This
is normally only used by the operating system.
- hardware layer
- This is the actual hardware which is used to transmit
network packets.
IP addresses
- Each machine on the internet has a (unique) IP address.
- Written as four digits with values between 0 & 255
e.g. 129.234.200.99.
- To talk to a machine you address packets of data with your
address (source) and the targets address (destination).
Subnets (and netmasks)
- Subnets are used to group a number of machines which are
directly connected together.
- A netmask defines the subnet by separating the network and
subnet parts of the address parts form the host part.
- For example a netmask of 255.255.255.0 specifies a subnet
which has up to 254 (0 and 255 are special addresses) hosts
connected to it.
- Historically networks were classed as either class A
(netmask 255.0.0.0), B (255.255.0.0) and C
(255.255.255.0). These represent the way in which addresses were
allocated to individual institutions. i.e a university may have
a class B network allocated and it is responsible for allocating
all of the addresses within that range.
- In most cases you should probably assume that you are
connected to a class C network and set the netmask appropriately.
DNS - Domain Name Service
- IP addresses are not easy to remember (names are easier).
- The Domain Name Service provides a mapping from names to IP
addresses.
- Makes the net more user friendly.
- Allows particular name to move between machines - e.g. to a new
service provider.
- Multiple names may map to the same address (often used for
web sites).
Routing
- Machines are not directly connected to all other machines.
- To talk to non local machines you go via a gateway (often an
ISP).
- That gateway machine is connected to other gateways.
- Any machine can act as a gateway if it has two or more
network interfaces.So to talk to machine z you may have to go
via
me -> a -> b -> c -> z
or maybe
me -> w -> x-> z
- Routing protocols allow machines to work out the best way to
get to another machine.
- This allows problems to be worked around (i.e. broken
gateway machine).
- In most cases we only need to know one gateway machine (our
ISP) - this is known as the default route.
Protocols
- IP (internet protocol) is the core internet message format.
- This consists of the header and a message body.
- The message body carries sub protocols.
- The most widely used are:
- tcp - transmission control protocol - a reliable bidirectional
stream of data.
- udp - user datagram protocol - an unreliable packet
based protocol.
tcp (also known as tcp/ip)
- tcp uses IP packets to construct a reliable bidirectional
data stream.
- It handles lost, corrupted and reordered IP packets presenting
a stream of data to the application.
- This is a connection oriented protocol, i.e. the user makes
a connection and may then use that connection until it breaks it
(or someone else does).
- http (hypertext transmission protocol), ftp (file transfer
protocol), telnet all use this protocol.
udp (also known as udp/ip)
- udp does not provide a connection oriented protocol.
- Instead each packet of data has to be individually addressed and
- The user is responsible for handling lost packets (corrupted
packets are detected by the IP layer and discarded).
- This is useful where a machine must talk to multiple
machines and where it does not want the overhead of a connection
oriented protocol.
- Examples: nfs (network file system), tftp (trivial file
transfer protocol).
ports
- An ip address allows a packet to be delivered to a specific
machine.
- But the machine must work out which application should
receive that packet.
- Ports are used to do this (both tcp and udp use these).
- A port is effectively an address within a machine. They are
usually specified as an ip addr/port/protocol combination
i.e. 129.234.200.7:23 (tcp)
- Programs bind to a port to say that they wish to receive
packets which are addressed to that port or that they wish to transmit
packets from that port.
- A port is identified by a 16 bit integer e.g. 0 to 65535.
- There are a number of well known ports:
- 7/tcp
- echo - echos back everything that is sent to it
- 7/udp
- echo - echos back everything that is sent to it
- 23/tcp
- telnet - remote terminal protocol
- 25/tcp
- smtp - simple mail transfer protocol
Note that tcp and udp have separate port numberings.
- Most systems define well known ports in the file /etc/services.
arp - address resolution protocol
- Machines on the local area network must be able to address each
other directly (in terms of hardware addresses).
- arp allows machines to find others and to dynamically
account for new machines which are added/removed.
- Put simply it maps ip addresses to mac (ethernet) addresses.
- Only those machines which you are currently (or have
recently been) talking to are kept in the arp cache.
Diagnostic/fault finding tools
ping
- Ping uses low level packets to talk to a machine to check if
it is responding (these are not actually IP packets (they are
icmp packets) but are very closely related).
- This is useful to check if things are setup correctly.
- It also helps to diagnose slow/busy links.
- Example use of ping (localhost is loopback interface which
talks to your own machine)
richm@patricia richm]$ ping localhost
PING localhost (127.0.0.1) from 127.0.0.1 : 56(84) bytes of data.
64 bytes from 127.0.0.1: icmp_seq=0 ttl=255 time=0.2 ms
64 bytes from 127.0.0.1: icmp_seq=1 ttl=255 time=0.2 ms
64 bytes from 127.0.0.1: icmp_seq=2 ttl=255 time=0.1 ms
...
64 bytes from 127.0.0.1: icmp_seq=8 ttl=255 time=0.1 ms
--- localhost ping statistics ---
9 packets transmitted, 9 packets received, 0% packet loss
round-trip min/avg/max = 0.1/0.1/0.2 ms
- Note that when using ping on a dialup connection expect to
see times or 100 or 200ms.
- If a machine is very busy or there is congestion somewhere
in the network some packets may get lost. This is normal but if
a large percentage of packets are being lost then connection to
that machine may be very difficult.
ifconfig
netstat
netstat -r
traceroute
tcpdump (snoop is similar on Solaris)
- tcpdump analyses network packets on your local network and prints
summaries of their contents.
- It is useful when looking for a subtle network problem.
- *** Care *** this program has access to all of the traffic
on your network. If used inappropriately it can decode all
manner of information. Unauthorised use can get you in serious
trouble.
arp
nslookup
Richard Mortimer
Last modified: Mon Mar 6 22:22:07 GMT 2000
|
|
![[The North-East Linux User Group]](/pix/logo.jpg){kind=logo}
