Data Communications Lab #3 Notes

Lab 4 introduces basic Internet management commands that are common to all TCP/IP networks. 
This is the reason for trying the commands in both Windows and Linux.  Any system connected to
the Internet will have available to the user (to a greater or lesser degree) similar commands
including your mobile device, iPad, Android, etc.  The commands allow us to monitor what is going
on at different levels of the Networking “stack” from the physical to application layers.  Here is a
rundown on what you are seeing when executing these commands.

ping – checks that an IP host is responding – it uses ICMP messages (echo request, echo reply)

traceroute, tracert – shows the path that a packet takes through the Internet to its destination.

route – displays the “routing table” – it shows the host on the local network to send packets.  Rather
than list every possible host in the Internet as possible destinations, a default is used as the
“gateway” to the networks beyond the local one.  If the routing table does not have a match with
the destination the default is used, if there is no default then what do you think happens???

Note that for the Ethernet routing table all destination switches are listed.

nslookup – similar to a telephone directory, given a name, it returns the IP address using the Domain
Name System (DNS).  This is operating at the Internet (or Network) layer.

arp – Again, similar to a telephone directory, it is used to determine the hardware address (MAC)
from an IP address.

A typical scenario:

I want to do a Google search.

1. I could check that the Google website is up and running with ping, and see the path through
the Internet to Google with traceroute.
2. If in either of the above commands I want to use the name (www.google.com) rather than
the IP address, the commands have to get the IP address to create the IP packets and place
the destination IP address in the packet.  

To do this, the DNS system will go out to the Internet and look up the name and return the
IP address.  nslookup is a command way to do the same thing.  The display shows the DNS
server address and the address (or addresses) that are associated with the name.

3. We know that the IP packet includes only the destination and so must know where to send it
first.  This is determined with the routing table, which can be displayed with the route
command.  Since there are millions of possible destinations (Google being only one of them),
and since there really only has to be one host (computer) that connects to the next network
in the Internet, that one is designated the “default”.  All packets for which the destination is
not in the routing table go to the “gateway” designated default (sometimes 0.0.0.0).
3. But this isn’t enough (and where it gets a bit abstract).  We know that the IP packet travels
over a data link layer (e.g. Ethernet).  So to send the packet it out (now called a “frame”), I
need to know the hardware address of the host (e.g. the default gateway), on my local
network to send the packet to.

This is done by the sender broadcasting a message  to all the hosts on the local network
asking for the hardware address of the specific IP address that was retrieved from the
routing table.  All hosts on the network read the packet, but only the one with the IP address
 that matches sends back its hardware address.  If you think about it there is no way for a
sender to know the hardware address of the router if it only knows the IP address unless it
asks for it in this way.

The Address Resolution Protocol does this (and the table that can be displayed is the ARP
table with the arp command).  The ARP table holds recently retrieved hardware addresses so
that the process doesn’t have to take place every time the same IP address is referenced.

This is a hard concept to get!

5. Ok, so now, I put www.google.com  in my browser, DNS looks up the IP address, the routing
table is used to determine the first host to send it to and ARP finds the hardware address to
set up the Ethernet frame.
5. So how does it find the Google Search Webpage on the Google server? 
a. It uses a well-known port number (80) at the TCP layer to establish a connection at
Google and gives Google a local ephemeral port number so that Google knows how
to set up its packets (segments).

We will be revisiting some of these topics more formally later in the semester (Chapter 8 and 9) –
For some more background on some of the network management displays – you can look ahead to
these chapters.