Internet Protocol for Beginners

Computers seem to be virtually limitless in their abilities – they can send and receive digital information, serve content via many defined protocols, compute algorithms much faster than a human can, and even provide countless hours of fun and entertainment. One very common use of computers is indeed serving content to consumers, a technological concept known as client / server model. A simple metaphor: a consumer (or a client) goes (makes a connection request) to a place of business (or a server) and peruses the content therein. The bottom line is that a server hosts and provides resources and content to clients requesting said resources.

The way the clients and servers communicate is in terms of protocols, or a predefined method of communication between multiple networked hosts. A prominent protocol used nowadays is the HTTP protocol in our ever-beloved usage of the Internet. Other protocols that make our lives much simpler, without diving too far into their technical details, include: TCP, or really the TCP/IP suite, that essentially allows communication between computer systems (identified by IP addresses) in a reliable manner (TCP); DHCP, which saves many network administrators the headache of manually assigning IP address to their userbase; DNS, which negates the need of humans to remember yet another numerical identifier (or multiple IP addresses of their favorite websites); NTP, that allows for proper time alignment; and ARP, which works with MAC and IP address matching on a local network. If you’re interested in other common networking protocols and a description of the above protocols and more, refer to this article.

This article is written based on the client / server architecture model and discusses perspectives based on the model, though other architectures work in similar ways. That is, any network communication you have between multiple networked hosts will more or less follow the same basis as the client / server architecture.

How Servers Serve Services

Let’s assume that a business wanted to serve certain content to their userbase. They can create a website describing the business that is accessible using the HTTP protocol. In addition, they can offer file downloads (if applicable) that are accessible via the FTP protocol, or any of the other abundant protocols available. It is also entirely possible to serve content multiple ways from the same machine to meet the needs of varying clients – some may not want to use web access and prefer downloading content via FTP, for instance.

The way a server knows which service to serve is by the requested port number indicated by an incoming connection request. A sample connection may include: source IP address, destination IP address, source port, destination port, as well as protocol being used. When the server receives the connection request over a port, that server system (physical hardware itself) should have server software with an available socket that is bound on that port. For instance: port 80 is the common port for HTTP, 443 is for HTTPS, and 21 is for FTP. Once a connection is established, that is, the kernel sends the request to the appropriate software listening on that port, the server may offload that request internally to allow for further incoming connection requests on that same port. This StackOverflow post is rather technical but provides great insight on how this is done.

Depending on what server software is configured, a web server or FTP server, then that software determines how communications will be further handled. Each protocol is designated and specified by their appropriate RFC number. Request for Comments (RFC) are standards that detail out how each protocol will allow communication between connecting clients. There are numerous special keywords used to identify what the behavior of the software should be. For instance: HTTP has a GET keyword that queries a resource on a specific host.

Fun fact, there are 65,535 TCP ports and 65,535 UDP ports on a computer! In other words, a server can serve a lot of different services over TCP or UDP. Granted each service would share the pool of available resources (RAM, CPU, storage utilizations) on the system itself, so it may not be wise to have everything hosted on a single computer system. Another consideration in this would be how many clients are accessing the server content simultaneously. If you wanted to personally have a test server setup, I wouldn’t suspect this being an issue at all. In fact, I have a single system acting as a web server and FTP server at home, among other services.

How Do Clients and Servers Communicate

Let’s expand a bit more from the above-mentioned incoming request – which takes five bits of information (source IP, destination IP, source port, destination port, protocol).

When a client makes a request to a server for HTTPS communications, the client would use a system-generated source port number to send the request out through the local router to the server on a desired port, in this case port 443 for HTTPS communications. The client’s host itself has a random source port, the router generates yet another random source port that it keeps track of, and the request continues to the respective server. That server would return the traffic request to the originating IP address and respective source port number, in which the source IP is the public IP address where the client made the request from and the router identifies which internal client made that request based on the source port. This way if multiple clients from within the same network location made multiple connections to the same remote server, the source ports determine which client the router should send the return traffic to.

Bear in mind that traffic going out onto the Internet requires a unique IP address to be able to be identified for communication requests; that is, they’re publicly routable addresses. Internal client IP addresses are distinguished and reserved based on RFC 1918. This is where NATing comes into play, where internal clients making public server requests have their IP address rewritten by their network’s router / gateway device before sending the request out onto the Internet. The way gateway devices keep track of multiple clients is via connection tables and tracking internal client IP addresses and their corresponding source ports. Return traffic is addressed to the public IP of the network along with the source port, the one generated by the gateway device. From there, the gateway device looks up which client is associated with the gateway’s generated source port maintained within its connection table, then the traffic gets sent back to the original client.

Conclusion

The above may seem complicated, and the technical details surely are, but the concept of what it does is simple. Any computer system can be a server if appropriate software is installed on that system. This server software interacts with the hardware itself by means of system calls. In simple terms, system calls are basically API (application programming interface) calls or libraries that operating systems offer to software installed on it. The software uses the libraries, or API, that the OS offers to reach the kernel and have access to the hardware stack. Check the references for more insight on this.

One more example of Internet-bound connection requests. Suppose a local network is assigned 10.0.1.0/24. Any client (let’s say 10.0.1.50) on that network that makes a request has a random port (example, 55,087) assigned to the request and is sent alongside its IP address in the form of a packet. The gateway device accepts the request, granted it matches any preset rules for Internet traffic, rewrites the packet with its own source port (55,087 is changed to 53,798) as well as the public IP address assigned to the physical site by the ISP; for example, let’s assume it was WatchGuard.com’s IP address of 54.212.248.139. Since the public IP address is routable, the return traffic knows where to go and gets analyzed by the gateway device once again.

I added some references that greatly expand on all of this and recommend reading it, if you’re interested in the technical details at least. The complexity of computers and how they truly work on the inside, compared to the ease of use offered to consumers is just fascinating to me. My hopes are to break down complex details into easy-to-digest chunks of information.

References

Chase, J. Sockets and Client/Server Communication. Retrieved from https://users.cs.duke.edu/~chase/cps196/slides/sockets.pdf

Examcollection.com contributors. How do Common Networking Protocols Function. Retrieved from https://www.examcollection.com/certification-training/network-plus-how-do-common-networking-protocols-function.html

Mozilla.org contributors. What is a web server? Retrieved from https://developer.mozilla.org/en-US/docs/Learn/Common_questions/What_is_a_web_server

Computers are a great tool and provide many perks to their users; they can perform tasks in a rather impressively fast manner, potentially offer paperless offices, and you’re even able to play computer games…of course not during working time! Aside from these great benefits, however, how useful would they be if we typed something up, had to print it (thus negating the “paperless” aforementioned attribute) and fax / mail / hand-deliver it to the respective recipient?

This is where the ever-loved “network” aspect comes in. There is history to how this concept began, was revised, and came to be what it is today; read this if you’re interested in its history. Regardless of its ancestry, I am confident that most anyone is thankful to the many contributors to this awesome ability. How else could we send emails virtually versus the above-mentioned manual methods? What about the massive online gaming platforms that allow virtual users to face each other in combat, or team up and conquer dungeons and whatnot? Or in the case of our team’s admiration for “Neopets,” how would we be able to access their awesome website to do whatever we wanted to do?

The goal of this post is to clarify what a network is, some different types of networks used in today’s world, different devices used in networking, as well as how data is carried between the devices in terms of network media. Perhaps in the future I will build on this and dive into the Open Systems Interconnection (OSI) model where I will break down each of the seven layers. Stay tuned for that, but for the time being let’s dive into the basics of networking.

What Is Networking?

To be clear, networking refers to the ability for multiple network nodes to communicate with each other and share resources. Network nodes refer to any network-connected electronic device; network-capable gaming devices, cellular devices, laptops, computers, etc. Any sort of interaction from one network node reaching out to another network node is considered a network, regardless if there is Internet access available or not.

Two common implementations include peer-to-peer (P2P) and client/server set-ups. As the names may imply, a P2P connection is one where network nodes are able to connect to each other and share resources. Workloads are shared between nodes and no one has more privileges than the other. Think of this as a way for any number of nodes to share files with one another, but not designated to do so. In contrast to this is client / service architecture, which dictates one server to be the storehouse of whatever content. With this set-up, you have one computer that may have more resources and is a bit faster at processing requests.

The key difference between the two architectures is that in P2P set-ups, all nodes are equal in privileges in accordance what the other nodes allow access to. Client / server architectures allow for more granular, centralized control. The two can seem ambiguous depending on your perception, but there is definitely a difference between them.

Types of Networks

On a smaller scale, local area networks (LAN) entail networked electronic devices that are within the same vicinity, generally. An example of this would be a home or smaller office. You can obviously get way broader than this, an example would be a wide area network (WAN), which is essentially what the Internet is. Regardless what set-up you have, chances are you have an Internet service provider (ISP) running some sort of cable (copper wired Ethernet or glass-based fiber optics) from their datacenter to your home or office. From there, you’d connect a modem to modulate outgoing network signals, and demodulate incoming network signals. The modem then connects to your router that may connect to a switch, which allows multiple devices to connect – thus creating a LAN. I’ll cover network devices a tad more in another section.

For corporations or businesses with multiple offices in remote areas, the HQ office can connect to these offices via a virtual private network (VPN). A VPN is essentially an encrypted tunnel that is created over the unencrypted Internet pipeline. Bottom line is, if you want to be secure between HQ and remote sites or home-based employees, use a VPN. Another important set-up to touch on is virtual LAN, or VLAN. In short, VLAN refers to creating segmented networks, thus allowing a segregation between user sets. Essentially you can have a VLAN domain for servers, one for the HR department, another for your IT team, and a general user VLAN. There are many other types of networks, but these are the main varieties.

Networking Devices

Starting from the gateway, that is the device that allows access to and from the Internet. There are devices that combine both modem and router capabilities into a single device. As stated previously, a modem’s job is to modulate outgoing network traffic, and demodulate incoming traffic – hence modem. On the other hand, a router is what routes traffic from one network node to another – whether on the local network or somewhere out on the Internet. It is important to note that routers specifically route between different network segmentations. As an example, if node A has an IP address of 192.168.1.5 and wants to connect to node B’s IP address of 10.0.1.5, then a router would assist in this.

Some routers possess the ability to broadcast wireless frequencies, thus allowing mobile devices, laptops, and other electronic devices to connect via wireless means. Some devices don’t even have network interface cards (NICs), so wireless connectivity is crucial in order to get online. If your router doesn’t have this ability, then a separate access point (AP) would allow for this functionality. In this case then the AP itself would be hardwired to the router. Wireless frequencies have gotten better and stronger over the years, but they still do face obstruction the further away your wireless device is compared to the AP; walls, plumbing, or whatever may be between the line of sight are other examples of this.

Let’s back up a bit to routers and connecting devices to them, such as the AP above. Routers have few Ethernet ports, thus limiting the number of hardwired devices. If you don’t have many devices, no worries, but if you do, then you may want to consider a switch. Modern technologies have paved the way for switches, which are generally faster than the predecessors they’ve replaced – hubs. Seeing that hubs are pretty much a thing of the past, I’ll explain switches but leave it up to you to research hubs more if you’re into the history of older devices. Switches essentially extend the router’s NICs to more than what is integrated on the router itself. Further, they also remember networked devices based on media access control (MAC) addresses to negate the need to send data frames to all devices, are able to send and receive transmissions simultaneously (known as full-duplex), and have the ability to send more data per second than hubs.

Networking Media

I touched on this throughout the article a bit but wanted to have a section for this as well. Network nodes communicate in terms of network media. Physical media refers to the more common Ethernet cables, optical fiber, and coaxial cables. Wireless technologies include infrared and radio waves, which introduces Bluetooth options, as well as satellite connections and the wireless capabilities of cellular devices.

Conclusion

This article covers only the basics of what networking is, different network implementations, as well as network devices and media. If you’re a more technical person, what this post covers can translate into a few layers of the OSI model – mainly layers one (Bluetooth & NICs) and two (switches & APs), but a tad into three when covering routing between networks (routers). By no means is this a super technical break down of the layers, though potentially one day in a future post I will go there.

by Rik Farrow and Scott Pinzon, with updates by Corey Nachreiner

[Editor's note: This article continues our attempt to explain the complex subject of subnetting in terms you can understand even if you're not a rocket scientist. If these concepts are new to you, you'll increase your comprehension by reading Corey Nachreiner's prequel, "Understanding IP Addresses and Binary," and then Rik Farrow's "Understanding IPv4 Subnetting (Part 1)."]

In Part 1, I explained how an IP address is really two addresses in one: part of it is a network address, and part of it is a host address. This split between the network and host portions of the address formerly occurred predictably, on full-byte boundaries. But newer addressing techniques, aimed at stretching the finite number of addresses available to the ever-growing Internet, now allow an IP address to be split anywhere within its 32 bits.

Because of the history of TCP/IP, your operating system (which provides you with TCP/IP) still expects you to use the old Class system. If you use an address in the Class C range, say 192.168.1.0, your operating system will automatically think of it as a /24 address: the first three bytes indicate a network address. But suppose you don't want 192.168.1.0 to be a /24 network. Suppose you want it to be a /26. How do you, the administrator, impose your iron will upon IP addressing? By specifying a subnet mask. Your network has always had one. But in this case, you are seizing control by specifying one that differs from the Class C default.

To understand how a subnet mask works, we have to go back to binary, because that's what your computers understand. So, in binary, 192.168.1.0 is:

11000000.10101000.00000001.00000000

(If you don't understand where we got that value, see Corey's article.)

The subnet mask is simply a binary value that uses ones to represent how many bits (out of the 32-bit IP address) represent the network portion of the address. Zeros indicate the host portion of the address. So if you want a /26 address, you want 26 bits of the IP address to indicate the network and 6 bits for indicating host addresses, written like this:

11111111.11111111.11111111.11000000

To change a Class C address (or any class of address) into a classless CIDR address, you supply a subnet mask which differs from the "classful" default subnet mask. Your computer uses this subnet mask to "mask off" the network portion of the address, reminiscent of the way an usher in a theater might put velvet ropes around rows of seats reserved for a large group. The easy way to understand masking is to count the number of one bits in the subnet mask, because that is how many bits of the IP address will become the network portion. The hard way is to imagine how your operating system does this: by using a CPU operation known as a Logical or Binary AND. Without plunging deep into math theory -- in other words, defer knowing "why" -- let's stipulate that in this operation, 1 + 1 = 1, and 1 + [anything else] = 0. If that's hard to wrap your head around, think of 1 as "true" and zero as "false." The truth plus more truth equals truth. The truth plus anything false is no longer the truth. Using this Boolean logic, combining our sample IP address (192.168.1.0) with our sample subnet mask (/26) produces this result:

11000000.10101000.00000001.00000000 + 11111111.11111111.11111111.11000000 11000000.10101000.00000001.00000000

Convert the answer back to decimal, and you still have 192.168.1.0 -- but because you've specified a non-standard subnet mask, your OS now understands that this is 192.168.1.0/26, and that this network's range is 64 addresses rather than 256.

Bits of Pain

You don't have to go through the painful labor of calculating binary every time you want to specify a subnet. Though your OS uses binary bits internally, your OS permits you to specify the subnet mask in decimal or in slash notation. If you'll recall Corey's article, a full byte with all eight bits turned on (11111111) adds up to a value of 255 (128 + 64 + 32 + 16 + 8 + 4 + 2 + 1), so when subnet masks are expressed in decimal, you'll often see some 255s. For example, the decimal representation for /16 becomes 255.255.0.0.

So, just to create another example, what is the subnet mask for a /22 address? Well, first there will be 22 ones, and the rest zeroes, or 11111111.11111111.11111100.00000000, or 255.255.252.0. Converting the binary into decimal can get tricky, so it's nice to have a calculator or computer program that does the math for you, or a table. You can find such "cheats" all over the Web, including these:

• Online Subnet Calculator
• Free Subnet Calculator for Windows
• Free Subnet Calculator for Mac
• Subnetting Cheat Sheet

This is also why slash notation is so nice (no binary-to-decimal conversions).

Why Subnet?

If you've followed the logic thus far, you might wonder, "Was this trip really necessary?" The answer: yes, because subnetting lets you split a single network address into many subnets.

Remember, every time an individual host on your network receives another packet of data, the one thing that host wants to know is, What do I do with this? For example, take a typical networked host, called Gandalf. Gandalf assesses every outgoing packet's Destination field in its IP header to decide whether the packet's destination is "local" or "not local." If the destination is local, Gandalf consults an ARP table for the MAC address of the destination machine, then sends the packet to it. If the destination is not local, Gandalf forwards the packet to his all-knowing buddy that handles everything else, a device we refer to as the default gateway. (This is some kind of device that routes, whether an actual router or something that can perform routing, such as your Firebox.) How does Gandalf define "local"? Simple: local is any device having the same subnet address as Gandalf.

Subnets are used throughout the Internet. But you can decide to use subnetting yourself on your own network, if you want. You can subnet for any reason, including security reasons -- for example, to split a single network into two or more parts, using one or more routers to connect each subnet together. Using routers means that broadcasts will (generally) be limited to each subnet. You could also use the Optional and Trusted interfaces of a Firebox to isolate two subnets, even if they were both internal networks. You can subnet to ease troubleshooting. Tracing a problem on a network segment is easier if the network has been cut into halves through subnetting; you're dealing with fewer hosts at a time.

Though at one time subnetting implied breaking your network down into shorter physical segments, today subnetting is not necessarily tied to the physical world. You can subnet simply because you want each department (or remote office, or floor in your highrise, or building on your campus, or ...) to have its own subnet address. You can decide, for example, that anything beginning with 192.168.100 indicates mobile users, and, say, 192.168.200 indicates executive users. You can make wireless addresses instantly recognizable to you, so you can keep an eye on them in your logs easily. Or whatever -- use your imagination!

But don't start yet...

Before you begin slicing and dicing your own subnets, we have to take another side adventure into the history of TCP/IP. Note that even though there are 256 possible addresses when we use one byte (0 through 255), you will only be able to use 254. This is because an address of all ones, or 255 in this case, is reserved for the broadcast address and an address of all zeroes is reserved for the network address. The broadcast address means "Send to all hosts on this network segment," so it obviously cannot be used as an individual host address. The network address is reserved for more traditional reasons.

As an example, suppose someone wanted to split their Class C network up into four smaller CIDR networks. Dividing the 256 possible addresses in a Class C network by 4 tells us each subnet can have 64 addresses. (However, for the reasons I just cited, only 62 of those addresses can be used for hosts.) Instead of using a Class C subnet mask of 255.255.255.0, or /24, you would use 255.255.255.192, or /26. This works because it leaves six bits (out of the 32 bits in an IP address) for addressing hosts. Six bits (32 + 16 + 8 + 4 + 2 + 1) is enough to make 64 addresses (the bits total 63, but 0 also counts as one of the addresses).

In Part 1, I pointed out that an IP address is two addresses in one: a network address, and a host address. When you specify a subnet mask, you could say that the portion that defines the subnet has been "borrowed" out of the host address portion and added to the network portion. Thus, the router that connects your subnets can determine which addresses belong to which subnet by considering the first two bits of (what was) the host address as being part of the (newly changed) network address.

How does IP addressing look when you slice up a network this way? Let's use 192.168.1.0/26 as the Class C network address to split up.

The routing for this will work whether all four subnets are on the same physical wire or not, as long as you have at least one strategically placed router that knows what's going on.

The binary arithmetic involved in using CIDR block addressing is painful. It is much easier to start with another private network address space, say 172.16.0.0, and use the third byte to represent internal subnets: 172.16.1.0, 172.16.2.0, 172.16.3.0, and so on. Now you use the default ( or "classful") subnet mask of 255.255.255.0 (or /24) and each subnet includes 254 host addresses. See how much easier it is to start with a Class B (/16) network, and split it into 254 Class Cs (/24)? Perhaps the designers of TCP/IP weren't so dumb after all when they chose to use byte boundaries in the initial network addressing scheme.

Subnets aren't black magic — just a place where administrators come face to face with binary arithmetic, often for the first time. We've barely scratched the surface of this topic. But at least now when networking experts are having one of those subnetting conversations where the technical concepts seem to rush past you at superhighway speeds, you have an onramp. You've got enough basics to join in the fun. Use your new powers wisely!