The Network Layer

 Computers are able to communicate through massive distances at instant speeds. They help billions of people help the internet every single day. These lessons will focus on technologies across many networks. This module will describe the IP addressing scheme and how subnetting works, and how encapsulation works, and how protocols allow the different links of the networks to communicate. 

 Nodes can communicate with each other through their physical networks through a Local Area Network or LAN. Switches can learn the MAC addresses connected through the ports to have transmissions appropriately. Every single network interface has a unique MAC address and they aren't ordered in any systematic way. It's not ideal for communicating across distances. The network layer is the internet protocol or IP and the IP addresses that come over it. I'll be able to describe an IP address, IP datagrams inside the payload of the ethernet frame, and correctly describe many fields of the IP datagram header. IP address all has to be represented by 8 bits which means that every number is less than 128. 12.34.56.78 is valid but 123.456.789.100 isn't. This format is known as dotted decimal notation.  IP addresses are more hierarchical and easier than physical addresses. Your laptop will have the same MAC address no matter how you use it. The LAN at the house will be responsible for handling the IP address to the laptop. A new device connected will get an IP address automatically through a technology called the Dynamic Host Configuration Protocol. 

In most cases, static IP addresses are reserved for servers and network devices, while dynamic IP addresses are reserved for clients. Under the IP protocol, a packet is referred to as an IP datagram. An IP datagram is a series of fields that are strictly defined, as the header and the payload, and the IP datagram header has a lot more data than the ethernet header. The most common version is IPv4 and IPv6 is more widespread. After the version, we have the header length field, 20 bytes when dealing with IPv4, which is the minimum for an IP header. Then the Service Type field specifies details about QoS, or Quality of Service, Technologies. Then there is a field called the total length field, indicating the total length of the IP datagram it's attached to. An identification field is a 16-bit number that is used to group messages together. The Maximum size of a single datagram is 65,535. If the total amount of data needs to be sent is larger than what can fit in a single datagram, the IP layer needs to split this into individual packets. 

The flag is used to indicate if a datagram is allowed to be fragmented or to indicate that the datagram has already been fragmented. Fragmentation is the process of taking a single IP datagram and splitting it into several smaller datagrams. If a datagram has to cross from a larger datagram size or a smaller datagram size, it will have to be fragmented into smaller offset fields. The fragmentation offset field takes all the parts of a fragment and puts them back together in the proper order. TTL is the time to live, is an 8-bit field that indicates how many routers hops a datagram can traverse before it's thrown away. An endless loop is where router A thinks router B is the next hop, and router B thinks router A is the next hop. After the TTL field is the protocol field is an 8-bit field that contains data about what transport layer protocol is being used. 

The most common transport layer protocols is TCP and UDP, and we'll cover both of those in detail. Then, there's a header checksum which is a checksum of the contents of the entire IP datagram header. Since TTL has to be recomputed at every router, the checksum field changes things too.  Then there are the source and destination IP address fields. Then we have the IP options field, which is an optional field used to set special characteristics for datagrams used for testing purposes. The options field is followed by a padding field. Padding is a series of zeroes used to ensure that the header is the correct total size. The entire contents of an IP datagram are encapsulating as the payload of an ethernet frame. Each layer in a network is needed for the one above it.  IP addresses can be split into 2 sections: The network ID and the host ID. IBM owns all IP addresses that have a 9 in the first octet in the IP address. The network id is the first octet and the host id is the second, third, and fourth octet. The address class system is a way of defining how the global IP address space is split up. 

There are class A, class B, and Class C addresses. Class A addresses is an address where the first octet is used for the network ID and the last 3 is used for the host id. Class B is where the first 2 octets are used for the network id and the second two are used for the host id. Class C is where 3 octets are used for the network id and the final octet is used for the host id. 

Class A has 24 bits of host id space with 2^24 address spaces, where class C only has 2^8, or 256 addresses. Class B has 2^16 addresses. You might remember each octet is 8 bits, which means each octet has a value between 0 and 255. Any IP addresses from 0-126 are class A, class B begins with the first octet of 128-191, and class C begins with the first octet of 192-224. This doesn't cover every IP address. Class D addresses begin with bits 1110 and used for multicasting. Class E makes up the remaining numbers but are unassigned and only used for testing purposes. This class system has mostly been ways in a system. The address class systems are important to understand for everyone looking for a well-routed application. 

Now, we want to discuss how these data types relate to each other. ARP is a protocol used to discover the hardware address of a node with a certain IP address. Once an IP datagram is fully formed, it needs to be encapsulated in an ethernet frame, meaning that the translating device needs a destination MAC address to complete the ethernet frame header. Almost all devices will contain a local ARP table, a list of IP addresses, and the MAC addresses associated with them. Let's say we want to send some data to the IP address 10.20.30.40. This might not have an entry in the ARP table, but when this happens, the node that wants to send data sends an ARP message to the  MAC broadcast address, which is all F's. These kinds of ARP messages are delivered to all computers in the network. The network computers will then send an ARP response which contains the MAC addresses for the network interface in question.

Now the transmitting computer knows what MAC address to put in the destination hardware address field; as a result, the ethernet frame is ready for delivery. It'll also likely store this IP address in a local ARP table so that it won't have to send an ARP address the next time it needs to communicate with this IP. ARP table entries generally expire after a short amount of time to ensure changes in the network are accounted for.

Now we want to move on and talk about subnetting. This is the process of taking a large network and splitting it up into many individual and smaller subnetworks or subnets. Subnet masks extend what's possible with networks and host ids. CIDR allows for even more flexibility than playing something. Incorrect subnetting setups are a common problem, so it's important to have a strong understanding of how this works. Address classes give us a way to break the total global IP space into discrete networks. Core routers know this IP belongs to the class A network. Then they route the message to the gateway network by looking at the network id. You can contract this with a core internet router. Once got to the Gateway router, that router is now responsible for getting that data to the proper system by looking at the host ID. A single class A network has 16 million individual IPs. That's way too many addresses, so this is where subnetting comes in. Subnets help to split a large network into many smaller ones, and these will all have their own routers, serving as the ingress and egress point for each subnet.

The next thing that I want to discuss is the subnet mask. Network ids are used to identify networks and host ids are used to identify individuals. To push things even further, we'll want to introduce another concept, called the subnet id. A certain number of bits is used for the network id and a certain number of bits are used for the host id. Some bits that comprise the host id would be the subnet id. All 3 of these ids are representable and a single 32-bit number. We want to use this to send the datagram to the gateway router across the network. The host id is used by the last number to deliver the datagram to the intended recipient machine. Subnet ids are calculated via a subnet mask. Subnet masks are 32-bit numbers normally written as four octets in decimal. 

Each octet is 8 bits so

9.100.100.100 is 

00001001 01100100  01100100  01100100 

A subnet mask has 2 sections, a beginning part and a part with all zeros, which says what to keep. The purpose of the 1's is to tell the router what part of an address is the subnet id.  The size of the subnet is entirely defined by a subnet mask. A single 8-bit number can represent 256 different numbers, or more specifically, the numbers 0-255. In general, a subnet has only 2 less than the total number of host IDs available. 255 is reserved as a broadcast address for the subnet, meaning that only the numbers 1 to 254 are available for assignment to the host. You refer to the number of hosts available in the subnet as the entire number, since these other IPs are still IP addresses. Subnet mask 255. 255. 255. 224 is 

111111111111111111111111100000 

This means that we have five bits of host ID space or a total of 32 addresses. So there is a shorthand way of writing subnets. Let's say we nave 9.100.100.100 with a subnet mask of 255.255.255.224 but we should just do 27. We can do 9.100.100.100/27.

There are numbers only in terms of 0 and 1. This is also known as binary or base two. This trick doesn't work for binary, it works for any number system. We can also refer to binary as base 2 and decimal as base 10. The addition  is known as an operator and there are many operators that computers use to make calculations, and 2 of the most important are OR and AND. In computer logic, a 1 represents a true and a 0 represents a false. 

A subnet mask is a way for a computer to use AND operators to determine if an IP address exists on the same network. 

Address classes were the first attempt at splitting up the global internet IP space. Subnetting was introduced when it was determined that address classes themselves weren't a sufficient way of keeping everything organized.  

The network ID is 8 bit for class A networks, 16 bits for class B networks, and 24 bits for class C networks. There are around 2 million class C networks, which is a lot of entries for a routing table. Many companies have multiple class C networks that have their needs. CIDR, or Classless InterDomain Routing, is an even more flexible approach in terms of describing blocks of IP addresses. It uses subnet masks to demarcate networks. When discussing computer networking, you'll often hear the term "demarcation point" to describe where one network or system ends and another one begins.

With CIDR, the network ID and subnet ID are combined into one. CIDR is where we get the shorthand slash notation that we discussed earlier. This slash notation is also known as CIDR notation, abandoning the concept of address classes entirely, allowing an address to be defined by only 2 individual ids. 

Take 9.100.100.100 with a  netmask of 255.255.255.0 which can be written as 9.100.100.100/24. We no longer care about the address class, all we need is the network mask to determine what we need. CIDR allows for networks themselves to be of different sizes.  Before, network sizes were static, and only subnets can be different sizes. Before this, a company needs an entire separate Class C. We then will make the netmask of 9.100.100.100/23 or 255.255.254.0, meaning routers need to only have one entry of the routing table to deliver traffic to these addresses instead of 2. We also get additional available host IDs out of this practice. You always lose 2 host IDs per network. What does this mean? Now we have 256 - 2 or 254 available IPs of this size. If you need 2 networks, this means you have 254 + 254 = 508 hosts, and a /23 network is 2^9 bits 512, and 512 - 2 is 510 hosts. CIDR allows you to combine address spaces into one contiguous chunk.

Now we only need one entry in the routing table to deliver traffic to these addresses instead of 2. Routing is a technique we use to ping data from one side to the other side of the planet. Underneath the hood, routing is a very complex and technologically advanced topic. Most intensively routing issues are exclusively handled by ISPs. Routing is an important topic to understand no matter what. A router is a network device that forwards traffic depending on the destination address of that traffic. It has at least 2 network interfaces since it needs to connect to at least 2 networks to do its job. Basic routing has 2 steps to it. A router receives a packet of data in one of its interfaces and examines the destination IP in one of its packets. We then look at the destination IP in its routing table and forward the traffic to the destination. These steps are repeated as often as needed until the traffic reaches its destination.

Imagine a router connected to 2 networks, a network A and a network B. Let's have network A have number 192.168.1.0/24, and network B equal to 10.0.0.0/24. Remeber, IP addresses belong to networks, not individual addresses on a network. So it sends this packet to MAC addresses and the router interface receives a packet because it sees that the destination MAC address belongs to it. It then strips away the data link layer, leaving the network content, the IP datagram. 

Now the router can inspect the IP datagram into the destination IP field. Next, the router needs to form a new packet in order to forward along to network B. It takes all of the data from the first IP datagram and duplicates it, decrementing the TTL field and calculating a new checksum. This time it sets his own MAC address on the interface on the source MAC address. Lastly, the packet sends out on network B, and the data gets delivered to the node at 10.0.0.10. Let's introduce a third network, and as a result, everything else is still the same with networks. The router that bridges these 2 networks still have the IPs of 192.168.1.1 on the IP and 10.0.0.0/24 on B, but let's introduce network C, 172.16.1.100/23 and there's a second router connected network B and network C and B interface has IP of 10.0.0.1 and network has IP of 172.16.1.1. We go through 2 routers to do this.

The computer at 192.168.1.100 knows that 172.16.1.100 is not on its local network. So it sends the packet to the gateway, the routers between network A and network B. You can access data from almost anywhere else in fractions of a second. A router tries to forward traffic depending on the destination address of that traffic.

After decrementing the TTL field, the router encapsulates this new IP datagram inside this new ethernet frame. Core internet routers are typically connected in a mesh to prevent breakage errors. 

 Routers are made out of routing table. The most basic routing table has 4 columns. 

1. The destination network. This router will contain a row for each network that the router knows about.

2. The remote network contains a network id and a netmask. These can be stored in one column in CIDR notation, or thee network ID and the netmask might be in a second column. A routing table will generally have a catch all entry for any network address that it doesn't have an explicit listing for. 

The next hop is the address that is intended heavily for the destination network in question. It can also say that the network is connected so that there aren't any hops needed. There are lots of different paths to get from point A to point B when it comes to specific networks. Routers try to pick the shortest possible path at all times to ensure data. Sometimes the shortest path is changed, such as with traffic congestion, turning off/ breaking routers/ etc. The router will have to keep track of how far away a destination currently is with each hop.

The router need to know which of the interfaces it should forward traffic matching the destination network out of. Routing tables are really simple, but many of these core internet routers have millions of cases on the table. Early routers were just regular computers at the area, with 2 network interfaces and had a routing table that was manually.

Routing tables have information on the quickest paths to many different networks. The protocols will help you identify routing problems on any network, and in order to do this, routers will use routing protocols. These are specials protocols routers use to speak to each other in order to share the information that they might have. Routing protocols fall into 2 main categories: interior gating protocols and exterior gateway protocols. Interior gateway protocols are split into link state routing protocols and distance vector protocols.  Interior gateway protocols are used by routers to share information within a single autonomous system. An autonomous system is a collection of networks that all fall under the control of a single network operator. The best example is a big corporation wanting to route addresses in their own Local Area Network.

Another example is the many routers employed by the internet service provider whose reaches are usually national in scale. The two main types of interior gateway protocols are link state routing protocols and distance vector protocols. A router using a distance vector protocol uses its routing table and  sends this list to every neighboring router, or a vector. This is why a protocol that sends distance is called distance vector protocol. Routers don't know too much of the total state of an autonomous system with a distance vector protocol. Let's look at how 2 routers influence each other's tables.

Router A has a routing table for a bunch of entries and out of the entries is 10.1.1.0/24 or network X. Router A believes that the quickest path through router C will take 4 hops to get to the destination. Router B meanwhile is only 2 hops away from network X. Through the distance hop protocol, router B sends the basic contents of its routing table to router A. Router B using a distance vector protocol uses the distance vector protocol to send contents to router A. Router A sees that network X is only 2 hops away from router B, and as a result, network X is only 3 hops away from Router B, thus the result of this is that we go to router B. They don't let a router change the state out of their own direct neighbors. Because of this, a router might be slow to react to a change in the network far away from it.

Routers using a link state protocol are more sophisticated in determining the best path to a network. The information on each router is propagated to every other router in the autonomous system, and each router runs complicated algorithms to determine what the best path would to any destination network might be. Link state protocols require both more memory and more processing power. Link state protocols have mostly made distance vector protocols outdated. 

Routers use exterior gateway protocols when they need to share data across different organizations. Exterior gateway protocols are key to the internet operating how it does today. The internet is an enormous mesh of autonomous systems, and at the highest levels core internet routers need to know about autonomous systems in order to forward traffic to the routers. Getting data to an autonomous system is the number one goal for core internet routers. The Internet Assigned Numbers Authority (IANA) is a nonprofit organization that manages things like IP address allocation. The IANA is also responsible for ASN, or the autonomous system number allocation which are numbers assigned to individual autonomous systems. Unlike IP addresses they are referred to as a single decimal number instead of being referred to as readable bits. There are 2 reasons for this. IP addresses need to be able to represent a network id portion and a host id portion for each number. ASNs never need to change in order to represent more networks and hosts. 

Since it is useful to look at the IP 9.100.100.100, and know that 9.0.0.0/8 is owned by IBM, ASNs represent entire autonomous systems. 

When IP was first defined, it defined an IP address as a single 32-bit number. The IPv4, unfortunately, doesn't have enough IP addresses for every person on the planet. It also didn't account for data center containing thousands and thousands of data centers. RSC stands for Request for Comments, and outlines networks defined as non-routable address space, ranges of IPs set aside for use by anyone that cannot be routed to. Non-routable address space allows for nodes but no gateway router. In a future module, we'll cover NAT (network address translation), allowing for computer in non-routable address space to communicate with other devices on the internet. RSC 1918 define 3 ranges of IP addresses that belong to no one and anyone can use them, and there's no limiting as to how many people can use these networks, which are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, which are free to use for anyone within their internal networks.

Exterior gateway protocols are not appropriate for use within an autonomous system.