billion.
These 4.3 billion addresses in the IPv4 address space are divided into Internet address classes.
Although this terminology is considered to be old, you can still run into people who use it. Figure 5-7
shows the address ranges for each class of addresses. There are three classes of addresses that can be
assigned to organizations: Class A, Class B, and Class C. Addresses are assigned into a particular class by
the value of the first byte (the original standard used the term “octet” to mean a “byte,” so you may see
documents using the term “octet”). For example, Class A addresses can have any number between 1 and
126 in the first byte.
The first byte can be any number from 0 to 255 (for an explanation, refer to Hands-On Activity 5C). Figure
5-9 shows that there are some numbers in the first byte range that are not assigned to any address range.
An address starting with 0 is not allowed. The 127 address range is reserved for a computer to
communicate with itself and is called the loopback. Loopback is used mostly by developers and system
administrators when testing software. Addresses starting from 224 are reserved addresses that should
not be used on IP networks. Addresses from 224 to 239 belong to Class D and are reserved for
multicasting, which is sending messages to a group of computers rather than to one computer (which is
normal) or every computer on a network (called broad-cast). Addresses from 240 to 254 belong to Class E
and are reserved for experimental use. Some companies use the Class E addresses for multicasting
internal content in addition to the Class D addresses. Addresses starting with 255 are reserved for
broadcast messages (which are explained in more detail in the final section of this chapter).


broadcast messages (which are explained in more detail in the final section of this chapter).
FIGURE 5-9 IPv4 public address space
Within each class, there is a set of addresses that are labeled as private IPv4 address space (see Figure
5-10). This address space can be used internally by organizations, but routers on the Internet do not route
packets that use private addresses (they simply discard them). For this reason, private addresses are often
used to increase security. An organization will assign private addresses to its computers so that hackers
can’t send messages to them. However, these computers need to be able to send messages to other
computers on the Internet. The organization has special devices (called NAT firewalls) that translate the
private addresses on messages that these computers send into valid public addresses for use on the
Internet. We talk more about NAT firewalls and the use of private addresses in Chapter 11. The computer
you’re using right now probably has a private IP address (see Hands-On Activity 5A).
Figure 5-8 also shows how the newer terminology classless addressing is used. Classless addressing
uses a slash to indicate the address range (it’s also called slash notation). For example, 128.192.1.0 is a
Class B address, so the first 2 bytes (16 bits) are to be used for the network address and the next 2 bytes
(third and fourth bytes) are allocated for host addresses. Using the slash notation, one would identify this
network as 128.192.1.0/16. However, a network administrator may decide that rather than allocating 16
bits for the network, it would be more beneficial to allocate 24 bits, and the remaining 8 bits would be


used for clients. Therefore, the network would be identified as 128.192.1.0/24. We discuss more about bit
allocation for a network and hosts when we discuss subnetting.
One of the problems with the current address system is that the Internet is quickly running out of
addresses. Although the 4-byte address of IPv4 provides more than 4 billion possible addresses, the fact
that they are assigned in sets significantly limits the number of usable addresses. For example, the address
range owned by Indiana University includes about 65,000 addresses, but the university will probably not
use all of them.


FIGURE 5-10 IPv4 private address space
The IP address shortage was one of the reasons behind the development of IPv6, discussed previously.
Once IPv6 is in wide use, the current Internet address system will be replaced by a totally new system
based on 16-byte addresses. Most experts expect that all the current 4-byte addresses will simply be
assigned an arbitrary 12-byte prefix (e.g., all zeros) so that the holders of the current addresses can
continue to use them.
Subnets
Each organization must assign the IP addresses it has received to specific computers on its networks. To
make the IP address assignment more functional, we use an addressing hierarchy. The first part of the
address defines the network, and the second part of the address defines a particular computer or host on
the network. However, it is not efficient to assign every computer to the same network. Rather,
subnetworks or subnets are designed on the network that subdivide the network into logical pieces. For
example, suppose that a university has just received a set of addresses starting with 128.192.x.x. It is
customary to assign all the computers in the same LAN numbers that start with the same first three digits,
so the business school LAN might be assigned 128.192.56.x, which means that all the computers in that
LAN would have IP numbers starting with those numbers (e.g., 128.192.56.4, 128.192.56.5, and so on)
(Figure 5-11). The subnet ID for this LAN then is 128.192.56. Two addresses on this subnet cannot be
assigned as IP address to any computer. The first address is 128.192.56.0, and this is the network address.


The second address is 128.192.56.255, which is the broadcast address. The computer science LAN might
be assigned 128.192.55.x, and similarly, all the other LANs at the university and the BN that connects
them would have a different set of numbers. Similar to the business school LAN, the computer science
LAN would have a subnet ID 128.192.55. Thus, 128.192.55.0 and 128.192.55.255 cannot be assigned to any
computer on this network because they are reserved for the network address and broadcast address.


FIGURE 5-11 Address subnets
Routers connect two or more subnets so they have a separate address on each subnet. Without routers,
the two subnets would not be able to communicate. The routers in Figure 5-11, for example, have two
addresses each because they connect two subnets and must have one address in each subnet.


Although it is customary to use the first 3 bytes of the IP address to indicate different subnets, it is not
required. Any portion of the IP address can be designated as a subnet by using a subnet mask. Every
computer in a TCP/IP network is given a subnet mask to enable it to determine which computers are on
the same subnet (i.e., LAN) that it is on and which computers are outside of its subnet. Knowing whether
a computer is on your subnet is very important for message routing, as we shall see later in this chapter.
For example, a network could be configured so that the first 2 bytes indicated a subnet (e.g., 128.184.x.x),
so all computers would be given a subnet mask giving the first 2 bytes as the subnet indicator. This would
mean that a computer with an IP address of 128.184.22.33 would be on the same subnet as 128.184.78.90.
IP addresses are binary numbers, so partial bytes can also be used as subnets. For example, we could
create a subnet that has IP addresses between 128.184.55.1 and 128.184.55.127 and another subnet with
addresses between 128.184.55.128 and 128.184.55.254.
Dynamic Addressing
To this point, we have said that every computer knows its network layer address from a configuration file
that is installed when the computer is first attached to the network. However, this leads to a major
network management problem. Any time a computer is moved or its network is assigned a new address,
the software on each individual computer must be updated. This is not difficult, but it is very time-
consuming because someone must go from office to office, editing files on each individual computer.


consuming because someone must go from office to office, editing files on each individual computer.
The easiest way around this is dynamic addressing. With this approach, a server is designated to
supply a network layer address to a computer each time the computer connects to the network. This is
commonly done for client computers but usually not for servers.
TECHNICAL FOCUS 5-1
Subnet Masks
Subnet masks tell computers what part of an Internet Protocol (IP) address is to be used to
determine whether a destination is on the same subnet or on a different subnet. A subnet mask is a
4-byte binary number that has the same format as an IP address and is not routable on the network.
A 1 in the subnet mask indicates that that position is used to indicate the subnet. A zero indicates
that it is not. Therefore, a mask can only contain a continuous stream of ones.
A subnet mask of 255.255.255.0 means that the first 3 bytes indicate the subnet; all computers with
the same first 3 bytes in their IP addresses are on the same subnet. This is because 255 expressed in
binary is 11111111.
In contrast, a subnet mask of 255.255.0.0 indicates that the first 2 bytes refer to the same subnet.
Things get more complicated when we use partial-byte subnet masks. For example, suppose that the
subnet mask was 255.255.255.128. In binary numbers, this is expressed as
11111111.11111111.11111111.10000000
This means that the first 3 bytes plus the first bit in the fourth byte indicate the subnet address.
Similarly, a subnet mask of 255.255.254.0 would indicate the first 2 bytes plus the first 7 bits of the


third byte indicate the subnet address because, in binary numbers, this is
11111111.11111111.11111110.00000000
The bits that are ones are called network bits because they indicate which part of an address is the
network or subnet part, whereas the bits that are zeros are called host bits because they indicate
which part is unique to a specific computer or host.
The most common standard for dynamic addressing is the Dynamic Host Configuration Protocol
(DHCP). DHCP does not provide a network layer address in a configuration file. Instead, there is a
special software package installed on the client that instructs it to contact a DHCP server to obtain an


address. In this case, when the computer is turned on and connects to the network, it first issues a
broadcast DHCP message that is directed to any DHCP server that can “hear” the message. This message
asks the server to assign the requesting computer a unique network layer address. The server runs a
corresponding DHCP software package that responds to these requests and sends a message back to the
client, giving it its network layer address (and its subnet mask).
The DHCP server can be configured to assign the same network layer address to the computer (based on
its data link layer address) each time it requests an address, or it can lease the address to the computer by
picking the “next available” network layer address from a list of authorized addresses. Addresses can be
leased for as long as the computer is connected to the network or for a specified time limit (e.g., 2 hours).
When the lease expires, the client computer must contact the DHCP server to get a new address. Address
leasing is commonly used by Internet Service Providers (ISPs) for dial-up users. ISPs have many more
authorized users than they have authorized network layer addresses because not all users can log in at the
same time. When a user logs in, his or her computer is assigned a temporary TCP/IP address that is
reassigned to the next user when the first user hangs up.
Dynamic addressing greatly simplifies network management in non-dial-up networks as well. With
dynamic addressing, address changes need to be made only to the DHCP server, not to each individual
computer. The next time each computer connects to the network or whenever the address lease expires,
the computer automatically gets the new address.
5.4.2 Address Resolution
To send a message, the sender must be able to translate the application layer address (or server name) of


the destination into a network layer address and in turn translate that into a data link layer address. This
process is called address resolution. There are many different approaches to address resolution that
ranges from completely decentralized (each computer is responsible for knowing all addresses) to
completely centralized (there is one computer that knows all addresses). TCP/IP uses two different
approaches, one for resolving application layer addresses into IP addresses and a different one for
resolving IP addresses into data link layer addresses.
Server Name Resolution
Server name resolution is the translation of application layer addresses into network layer addresses (e.g.,
translating an Internet address such as www.yahoo.com into an IP address such as 204.71.200.74). This is
done using the Domain Name Service (DNS). Throughout the Internet, a series of computers called
name servers provide DNS services. These name servers have address databases that store thousands of
Internet addresses and their corresponding IP addresses. These name servers are, in effect, the “directory
assistance” computers for the Internet. Anytime a computer does not know the IP number for a computer,
it sends a message to the name server requesting the IP number.
Whenever you register an Internet application layer address, you must inform the registrar of the IP
address of the name server that will provide DNS information for all addresses in that name range. For
example, because Indiana University owns the indiana.edu name, it can create any name it wants that
ends in that suffix (e.g., www.indiana.edu, www.kelley.indiana.edu, abc.indiana.edu). When it registers its
name, it must also provide the IP address of the DNS server that it will use to provide the IP addresses for
all the computers within this domain name range (i.e., everything ending in indiana.edu). Every
organization that has many servers also has its own DNS server, but smaller organizations that have only


organization that has many servers also has its own DNS server, but smaller organizations that have only
one or two servers often use a DNS server provided by their ISP. DNS servers are maintained by network
managers, who update their address information as the network changes. DNS servers can also exchange
information about new and changed addresses among themselves, a process called replication.
When a computer needs to translate an application layer address into an IP address, it sends a special
DNS request packet to its DNS server. This packet asks the DNS server to send to the requesting computer
the IP address that matches the Internet application layer address provided. If the DNS server has a
matching name in its database, it sends back a special DNS response packet with the correct IP address. If
that DNS server does not have that Internet address in its database, it will issue the same request to
another DNS server elsewhere on the Internet.
For example, if someone at the University of Toronto were to ask for a Web page on the server


(www.kelley.indiana.edu) at Indiana University, the software on the Toronto client computer would issue
a DNS request to the University of Toronto DNS server, called the resolving name server (Figure 5-12).
This DNS server probably would not know the IP address of our server, so it would send a DNS request to
one of the DNS root servers that it knows. The root server would respond to the resolving name server
with a DNS response that said “I don’t know the IP address you need, but ask this DNS server,” and it
would include the IP address of the top-level domain (TLD) server for the requested website (in this
case, the .edu TLD server, because the destination website is in the .edu domain). The resolving name
server would then send a DNS request to the .edu TLD server. The .edu TLD domain server would
respond with a DNS response that tells the resolving name server to ask the authoritative name
server for indiana.edu and provides its IP address. The resolving name server would send a DNS request
to the authoritative name server for indiana.edu. The authoritative name server would then respond to the
resolving name server with the needed IP address, and the resolving name server would send a DNS
response to the client computer with the IP address.
FIGURE 5-12 How the DNS system works?
This is why it sometimes takes longer to access certain sites. Most DNS servers know only the names and
IP addresses for the computers in their part of the network. Some store frequently used addresses (e.g.,
www.yahoo.com). If you try to access a computer that is far away, it may take a while before your
computer receives a response from the resolving name server.


Once your application layer software receives an IP address, it is stored on your computer in a DNS cache.
This way, if you ever need to access the same computer again, your computer does not need to contact its
resolving name server. The DNS cache is routinely deleted whenever you turn off your computer.
Data Link Layer Address Resolution
To actually send a message on a multipoint circuit, the network layer software must know the data link
layer address of the receiving computer. The final destination may be far away (e.g., sending from Toronto
to Indiana). In this case, the network layer would route the message by selecting a path through the
network that would ultimately lead to the destination. (Routing is discussed in the next section.) The first
step on this route would be to send the message to its router.
To send a message to another computer in its subnet, a computer must know the correct data link layer
address. In this case, the TCP/IP software sends a broadcast message to all computers in its subnet. A
broadcast message, as the name suggests, is received and processed by all computers in the same LAN
(which is usually designed to match the IP subnet). The message is a specially formatted request using
Address Resolution Protocol (ARP) that says, “Whoever is IP address xxx.xxx.xxx.xxx, please send
me your data link layer address.” The software in the computer with that IP address then sends an ARP
response with its data link layer address. The sender transmits its message using that data link layer
address. The sending computer also stores the data link layer address in its address table for future use.
5.5 ROUTING
Routing is the process of determining the route or path through the network that a message will travel
from the sending computer to the receiving computer. In some networks (e.g., the Internet), there are


many possible routes from one computer to another. In other networks (e.g., internal company networks),
there may only be one logical route from one computer to another. In either case, some device has to route
messages through the network.
Routing is done by special devices called routers. Routers are usually found at the edge of subnets
because they are the devices that connect subnets together and enable messages to flow from one subnet
to another as the messages move through the network from sender to receiver. Figure 5-13 shows a small
network with two routers, R1 and R2. This network has five subnets, plus a connection to the Internet.
Each subnet has its own range of addresses (e.g., 10.10.51.x), and each router has its IP address (e.g.,
10.10.1.1). The first router (R1) has four connections, one to the Internet, one to router R2, and one to
each of two subnets. Each connection, called an interface, is numbered from 0 to 3. The second router
(R2) also has four interfaces, one that connects to R1 and three that connect to other subnets.
Every router has a routing table that specifies how messages will travel through the network. In its
simplest form, the routing table is a two-column table. The first column lists every network or computer
that the router knows about, and the second column lists the interface that connects to it. Figure 5-14
shows the routing tables that might be used by routers in Figure 5-13. The first entry in R1’s routing table
says that any message with an IP address in the range from 10.10.51.0 to 10.10.51.255 should be sent out
on interface 1.


on interface 1.
A router uses its routing table to decide where to send the messages it receives. Suppose that a computer
in the 10.10.43.x subnet sends an HTTP request for a Web page that is located on the company’s Web
server, which is in the 10.10.20.x subnet (let’s say the Web server has an IP address of 10.10.20.10). The
computer would send the message to its router, R2. R2 would look at the IP address on the IP packet and
search its routing table for a matching address. It would search through the table, from top to bottom,
until it reached the third entry, which is a range of addresses that contains the Web server’s address
(10.10.20.10). The matching interface is number 2, so R2 would transmit the message on this interface.


FIGURE 5-13 A small corporate network
FIGURE 5-14 Sample routing tables
The process would be similar if the same computer were to request a page somewhere on the Internet
(e.g., www.yahoo.com). The computer would send the message to its router, R2. R2 would look at the IP
address on the IP packet (www.yahoo.com has an IP address of 69.147.125.65) and search its routing table
for a matching entry. It would look at the first four entries and not find a match. It would reach the final
entry that says to send a message with any other address on interface 0, so R2 would transmit this
message on interface 0 to router R1.


The same process would be performed by R1. It would search through its routing table for an address that
matched 69.147.125.65 and not find it. When it reaches the final entry, R1 knows to send this message on
interface 0 into the Internet.
5.5.1 Types of Routing
There are three fundamental approaches to routing: centralized routing, static routing, and dynamic
routing. As you will see in the TCP/IP Example section later in this chapter, the Internet uses all three
approaches.
Centralized Routing
With centralized routing, all routing decisions are made by one central computer or router. Centralized
routing is commonly used in host-based networks (see Chapter 2), and in this case, routing decisions are
rather simple. All computers are connected to the central computer, so any message that needs to be
routed is simply sent to the central computer, which in turn retransmits the message on the appropriate
circuit to the destination.
Static Routing
Static routing is decentralized, which means that all computers or routers in the network make their
own routing decisions following a formal routing protocol. In WANs, the routing table for each computer
is developed by its individual network manager (although network managers often share information). In
LANs or BNs, the routing tables used by all computers on the network are usually developed by one
individual or a committee. Most decentralized routing protocols are self-adjusting, meaning that they can
automatically adapt to changes in the network configuration (e.g., adding and deleting computers and
circuits).
With static routing, routing decisions are made in a fixed manner by individual computers or routers. The
routing table is developed by the network manager, and it changes only when computers are added to or
removed from the network. For example, if the computer recognizes that a circuit is broken or unusable


(e.g., after the data link layer retry limit has been exceeded without receiving an acknowledgment), the
computer will update the routing table to indicate the failed circuit. If an alternate route is available, it will
be used for all subsequent messages. Otherwise, messages will be stored until the circuit is repaired. Static
routing is commonly used in networks that have few routing options that seldom change.
Dynamic Routing
With dynamic routing (or adaptive routing), routing decisions are made in a decentralized manner by
individual computers. This approach is used when there are multiple routes through a network, and it is
important to select the best route. Dynamic routing attempts to improve network performance by routing
messages over the fastest possible route, away from busy circuits and busy computers. An initial routing
table is developed by the network manager but is continuously updated by the computers themselves to
reflect changing network conditions.
With distance vector dynamic routing, routers count the number of hops along a route. A hop is one
circuit, so that router R1 in Figure 5-13 would know it could reach a computer in the 10.10.52.X subnet in
one hop, and a computer in the 10.10.43.X subnet in two hops, by going through R2. With this approach,
computers periodically (usually every 1–2 minutes) exchange information on the hop count and
sometimes on the relative speed of the circuits in route and how busy they are with their neighbors.
With link state dynamic routing, computers or routers track the number of hops in the route, the
speed of the circuits in each route, and how busy each route is. In other words, rather than knowing just a
route’s distance, link state routing tries to determine how fast each possible route is. Each computer or
router periodically (usually every 30 seconds or when a major change occurs) exchanges this information


router periodically (usually every 30 seconds or when a major change occurs) exchanges this information
with other computers or routers in the network (not just their neighbors) so that each computer or router
has the most accurate information possible. Link state protocols are preferred to distance vector protocols
in large networks because they spread more reliable routing information throughout the entire network
when major changes occur in the network. They are said to converge more quickly.
There are two drawbacks to dynamic routing. First, it requires more processing by each computer or


router in the network than does centralized routing or static routing. Computing resources are devoted to
adjusting routing tables rather than to sending messages, which can slow down the network. Second, the
transmission of routing information “wastes” network capacity. Some dynamic routing protocols transmit
status information very frequently, which can significantly reduce performance.
5.5.2 Routing Protocols
A routing protocol is a protocol that is used to exchange information among computers to enable them to
build and maintain their routing tables. You can think of a routing protocol as the language that is used to
build the routing tables in Figure 5-14. When new paths are added or paths are broken and cannot be
used, messages are sent among computers using the routing protocol.
It can be useful to know all the possible routes to a given destination. However, as a network gets quite
large, knowing all possible routes becomes impractical; there are simply too many possible routes. Even at
some modest number of computers, dynamic routing protocols become impractical because of the amount
of network traffic they generate. For this reason, networks are often subdivided into autonomous systems
of networks.
An autonomous system is simply a network operated by one organization, such as IBM or Indiana
University, or an organization that runs one part of the Internet. Remember that we said that the Internet
was simply a network of networks. Each part of the Internet is run by a separate organization such as
AT&T, MCI, and so on. Each part of the Internet or each large organizational network connected to the
Internet can be a separate autonomous system.
The computers within each autonomous system know about the other computers in that system and
usually exchange routing information because the number of computers is kept manageable. If an
autonomous system grows too large, it can be split into smaller parts. The routing protocols used inside an
autonomous system are called interior routing protocols.


autonomous system are called interior routing protocols.
Protocols used between autonomous systems are called exterior routing protocols. Although interior
routing protocols are usually designed to provide detailed routing information about all or most
computers inside the autonomous systems, exterior protocols are designed to be more careful in the
information they provide. Usually, exterior protocols provide information about only the preferred or the
best routes rather than all possible routes.
TECHNICAL FOCUS 5-2
Routing on the Internet
The Internet is a network of autonomous system networks. Each autonomous system operates its
own interior routing protocol while using Border Gateway Protocol (BGP) as the exterior routing
protocol to exchange information with the other autonomous systems on the Internet. Although
there are several interior routing protocols, Open Shortest Path First (OSPF) is the preferred
protocol and most organizations that run the autonomous systems forming large parts of the
Internet use OSPF.
Figure 5-15 shows how a small part of the Internet might operate. In this example, there are six
autonomous systems (e.g., Sprint, AT&T), three of which we have shown in more detail. Each
autonomous system has a border router that connects it to the adjacent autonomous systems and
exchanges route information via BGP. In this example, autonomous system A is connected to
autonomous system B, which in turn is connected to the autonomous system C. A is also connected
to C via a route through systems D and E. If someone in A wants to send a message to someone in C,
the message should be routed through B because it is the fastest route. The autonomous systems
must share route information via BGP so that the border routers in each system know what routes
are preferred. In this case, B would inform A that there is a route through it to C (and a route to E),


and D would inform A that it has a route to E, but D would not inform A that there is a route through
it to C. The border router in A would then have to decide which route to use to reach E.
Each autonomous system can use a different interior routing protocol. In this example, B is a rather


simple network with only a few devices and routes, and it uses RIP, a simpler protocol in which all
routers broadcast route information to their neighbors every minute or so. A and C are more
complex networks and use OSPF. Most organizations that use OSPF create a special router called a
designated router to manage the routing information. Every 15 minutes or so, each router sends
its routing information to the designated router, which then broadcasts the revised routing table
information to all other routers. If no designated router is used, then every router would have to
broadcast its routing information to all other routers, which would result in a very large number of
messages. In the case of autonomous system C, which has seven routers, this would require 42
separate messages (seven routers each sending to six others). By using a designated router, we now
have only 12 separate messages (the six other routers sending to the designated router, and the
designated router sending the complete set of revised information back to the other six).


FIGURE 5-15 Routing on the Internet with Border Gateway Protocol (BGP), Open Shortest Path First
(OSPF), and Routing Information Protocol (RIP)
There are many different protocols that are used to exchange routing information. Five are commonly
used on the Internet: Border Gateway Protocol (BGP), Internet Control Message Protocol (ICMP),


Routing Information Protocol (RIP), Intermediate System to Intermediate System (IS-IS), Open Shortest
Path First (OSPF), and Enhanced Interior Gateway Routing Protocol (EIGRP).
Border Gateway Protocol (BGP) is a dynamic distance vector exterior routing protocol used on the
Internet to exchange routing information between autonomous systems—that is, large sections of the
Internet. Although BGP is the preferred routing protocol between Internet sections, it is seldom used
inside companies because it is large, complex, and often hard to administer.
Internet Control Message Protocol (ICMP) is the simplest interior routing protocol on the Internet.
ICMP is simply an error-reporting protocol that enables computers to report routing errors to message
senders. ICMP also has a very limited ability to update routing tables.
Routing Information Protocol (RIP) is a dynamic distance vector interior routing protocol that is
commonly used in smaller networks, such as those operated by one organization. The network manager
uses RIP to develop the routing table. When new computers are added, RIP simply counts the number of
computers in the possible routes to the destination and selects the route with the least number.
Computers using RIP send broadcast messages every minute or so (the timing is set by the network
manager) announcing their routing status to all other computers. RIP is used by both TCP/IP and
IPX/SPX.
Intermediate System to Intermediate System (IS-IS) is a link state interior routing protocol that is
commonly used in large networks. IS-IS is an ISO protocol that has been added to many TCP/IP
networks.
Open Shortest Path First (OSPF) is a dynamic hybrid interior routing protocol that is commonly used
on the Internet. It uses the number of computers in a route as well as network traffic and error rates to
select the best route. OSPF is more efficient than RIP because it normally doesn’t use broadcast messages.


Instead, it selectively sends status update messages directly to selected computers or routers. OSPF is the
preferred interior routing protocol used by TCP/IP.
Enhanced Interior Gateway Routing Protocol (EIGRP) is a dynamic hybrid interior routing
protocol developed by Cisco and is commonly used inside organizations. Hybrid means that it has some
features that act like distance vector protocols and some other features that act like link state protocols. As
you might expect, EIGRP is an improved version of the Interior Gateway Routing Protocol (IGRP).
EIGRP records information about a route’s transmission capacity, delay, reliability, and load. EIGRP is
unique in that computers or routers store their own routing tables as well as the routing tables for all of
their neighbors so they have a more accurate understanding of the network.
5.5.3 Multicasting
The most common type of message in a network is the transmission between two computers. One
computer sends a message to another computer (e.g., a client requesting a Web page). This is called a
unicast message. Earlier in the chapter, we introduced the concept of a broadcast message that is sent
to all computers on a specific LAN or subnet. The third type of message called a multicast message is
used to send the same message to a group of computers.
MANAGEMENT FOCUS 5-2
Captain D’s Gets Cooking with Multicast
Captain D’s has more than 500 company owned and franchised fast-food restaurants across North
America. Each restaurant has a small low-speed satellite link that can send and receive data.
Captain D’s used to send its monthly software updates to each of its restaurants one at a time, which
meant transferring each file 500 times, once to each restaurant. You don’t have to be a network
wizard to realize that this is slow and redundant.


wizard to realize that this is slow and redundant.
Captain D’s now uses multicasting to send monthly software updates to all its restaurants at once.
What once took hours is now accomplished in minutes.


Multicasting also enables Captain D’s to send large human resource file updates each week to all
restaurants and to transmit computer-based training videos to all restaurants each quarter. The
training videos range in size from 500 to 1,000 megabytes, so without multicasting, it would be
impossible to use the satellite network to transmit the videos.
Source: Adapted from “Captain D’s Gets Cooking with Multicast from XcelleNet,”
www.xcellenet.com.
Consider a videoconferencing situation in which four people want to participate in the same conference.
Each computer could send the same voice and video data from its camera to the computers of each of the
other three participants using unicasts. In this case, each computer would send three identical messages,
each addressed to the three different computers. This would work but would require a lot of network
capacity. Alternatively, each computer could send one broadcast message. This would reduce network
traffic (because each computer would send only one message), but every computer on the network would
process it, distracting them from other tasks. Broadcast messages usually are transmitted only within the
same LAN or subnet, so this would not work if one of the computers were outside the subnet.
The solution is multicast messaging. Computers wishing to participate in a multicast send a message to
the sending computer or some other computer performing routing along the way using a special type of
packet called Internet Group Management Protocol (IGMP). Each multicast group is assigned a
special IP address to identify the group. Any computer performing routing knows to route all multicast
messages with this IP address onto the subnet that contains the requesting computer. The routing
computer sets the data link layer address on multicast messages to a matching multicast data link layer
address. Each requesting computer must inform its data link layer software to process incoming messages


address. Each requesting computer must inform its data link layer software to process incoming messages
with this multicast data link layer address. When the multicast session ends (e.g., the videoconference is
over), the client computer sends another IGMP message to the organizing computer or the computer
performing routing to remove it from the multicast group.
5.5.4 The Anatomy of a Router
There is a huge array of software and hardware that makes the Internet work, but the one indispensable
device is the router. The router has three main functions: (1) it determines a path for a packet to travel
over, (2) it transmits the packet across the path, and (3) it supports communication between a wide
variety of devices and protocols. Now we will look inside a router to see how these three functions are
supported by hardware and software.
Routers are essentially special-purpose computers that consist of a CPU (central processing unit),
memory (both volatile and nonvolatile), and ports or interfaces that connect to them to the network
and/or other devices so that a network administrator can communicate with them. What differentiates
routers from computers that we use in our everyday lives is that they are diskless and they don’t come
with a monitor, keyboard, and mouse. They don’t have these because they were designed to move data
rather than display it.
There are three ways that a network manager can connect to a router and configure and maintain it: (1)
console port, (2) network interface port, and (3) auxiliary port (see Figure 5-16). When the router is
turned on for the very first time, it does not have an IP address assigned, so it cannot communicate on the
network. Because of this, the console port, also called the management port, is used to configure it. A


network manager would use a blue rollover cable (not the Ethernet cable) to connect the router’s console
port to a computer that has terminal emulation software on it. The network manager would use this
software to communicate with the router and perform the basic setup (e.g., IP address assignment,
routing protocol selection). Once the basic setup is done, the network manager can log in to the router
from any computer using the network interface using TCP/IP and Telnet with Secure Shell (SSH).
Although routers come with an auxiliary port that allows an administrator to log via a direct,
nonnetwork connection (e.g., using modems), this connection is rarely used today.
A router, just like a computer, must have an operating system so that it can be configured. The operating
system that is used in about 90% of routers is the Cisco Internetwork Operating Systems (IOS),
although other operating systems exist as well. IOS uses a command line interface rather than a graphical
user interface. The network manager uses IOS commands to create a configuration file (also called a


config file) that defines how the router will operate. The config file can contain the type of routing protocol
to be used, the interfaces that are active/enabled and those that are down, and what type of encryption is
used. The config file is central to a router’s operation, and the IOS refers to it hundreds of times per
second to tell the router how to do its job.
FIGURE 5-16 Anatomy of a router
The other important file is the Access Control List (ACL), which plays an important role in network
security. The ACL defines what types of packets should be routed and what types of packets should be
discarded. The ACL is discussed in more detail in Chapter 10 on security.
5.6 TCP/IP EXAMPLE


This chapter has discussed the functions of the transport and network layers: linking to the application
layer, segmenting, session management, addressing, and routing. In this section, we tie all of these
concepts together to take a closer look at how these functions actually work using TCP/IP.
When a computer is installed on a TCP/IP network (or dials into a TCP/IP network), it must be given four
pieces of the network layer addressing and routing information before it can operate. This information
can be provided by a configuration file or via a DHCP server. The information is
1. Its IP address
2. A subnet mask, so it can determine what addresses are part of its subnet
FIGURE 5-17 Example Transmission Control Protocol/Internet Protocol (TCP/IP) network
3. The IP address of a DNS server, so it can translate application layer addresses into IP addresses
4. The IP address of an IP gateway (commonly called a router) leading outside of its subnet, so it can
route messages addressed to computers outside of its subnet (this presumes the computer is using
static routing and there is only one connection from it to the outside world through which all
messages must flow; if it used dynamic routing, some routing software would be needed instead)
These four pieces of information are the minimum required. A server would also need to know its
application layer address.
In this section, we use the simple network shown in Figure 5-17 to illustrate how TCP/IP works. This
figure shows an organization that has three LANs connected by a BN. The BN also has a connection to the
Internet. Each building is configured as a separate subnet. For example, Building A has the 128.192.98.x
subnet, whereas Building B has the 128.192.95.x subnet. The data center has the 128.192.50.x subnet. The


BN is its own subnet: 128.192.254.x. Each building is connected to the BN via a router that has two IP
addresses and two data link layer addresses, one for the connection into the building and one for the
connection onto the BN. The organization has a couple Web servers, one DNS server, and one Mail server
located in the data center. All networks use Ethernet as the data link layer and only focus on Web requests
at the application layer.
In the next sections, we describe how messages are sent through the network. For the sake of simplicity,
we initially ignore the need to establish and close TCP connections. Once you understand the basic
concepts, we will then add these in to complete the example.


TECHNICAL FOCUS 5-3
Finding Your Computer’s TCP/IP Settings
If your computer can access the Internet, it must use TCP/IP. In Windows, you can find out your
TCP/IP settings by looking at their properties. Click on the Start button and then select Control
Panel and then select Network Connections. Double click on your Local Area Connection and then
click the Support tab.
This will show you your computer’s IP address, subnet mask, and gateway, and whether the IP
address is assigned by a DHCP server. Figure 5-18 shows this information for one of our computers.
If you would like more information, you can click on the Details button. This second window shows
the same information, plus the computer’s Ethernet address (called the physical address), as well as
information about the DHCP lease and the DNS servers available.
Try this on your computer. If you have your own home network with your own router, there is a
chance that your computer has an IP address very similar to ours or someone else’s in your class—or
the same address, in fact. How can two computers have the same IP address? Well, they can’t. This is
a security technique called network address translation in which one set of “private” IP addresses is
used inside a network and a different set of “public” IP addresses is used by the router when it sends
the messages onto the Internet. Network address translation is described in detail in Chapter 11.
5.6.1 Known Addresses
Suppose that a client computer in Building A (e.g., 128.192.98.130) wanted to get a Web page from a Web
server A located in the data center (www2.anyorg.com). We will assume that this computer knows the
network layer and data link layer addresses of the Web server 1 (www1.anyorg.com) in the data center


(e.g., it has previously requested pages from this server, so the addresses are stored in appropriate tables
in the memory of the computer). Because the computer knows the IP address of the server, it uses its IP
address, not its application layer address.
FIGURE 5-18 TCP/IP configuration information


FIGURE 5-19 Packet nesting. HTTP = Hypertext Transfer Protocol; IP = Internet Protocol; TCP =
Transmission Control Protocol
In this case, the application layer software would pass an HTTP packet to the transport layer software
(TCP) with the Internet address of the destination www1.anyorg.com: 128.192.50.2. The transport layer
software (TCP) would make sure that the request fits in one segment and hands it to the network layer.
The network layer software (IP) would then check the subnet mask and would recognize that the Web
server is located outside of its subnet. Any messages going outside the subnet must be sent to the router
(128.192.98.1), whose job it is to process the message and send the message on its way into the outside
network. The network layer software would check its address table and find the Ethernet address for the
router. It would, therefore, set the data link layer address to the router’s Ethernet address on this subnet
(00-0C-00-33-3A-0B) and pass the IP packet to the data link layer for transmission. The data link layer
would surround the frame with an Ethernet frame and transmit it over the physical layer to the Web
server (Figure 5-19).
The router would receive the message and its data link layer would perform error checking before passing
the packet to the network layer software (IP). The network layer software would read the IP address to
determine the final destination. The router would recognize that this address (128.192.50.2) needed to be
sent to the 128.192.50.x subnet. It knows that the router for this subnet is 128.192.254.98. It would pass


the packet back to its data link layer, giving the Ethernet address of the router (00-0C-00-33-3A-DA).
This router in the data center would receive the message (do error checking, etc.) and read the IP address
to determine the final destination. The router would recognize that this address (128.192.50.2) was inside
its 128.192.50.x subnet and would search its data link layer address table for this computer. It would then
pass the packet to the data link layer along with the Ethernet address (00-0C-00-33-3A-1C) for
transmission.
The www1.anyorg.com Web server would receive the message and process it. This would result in a series
of TCP/IP packets addressed to the requesting client (128.192.98.130). These would make their way
through the network in reverse order. The Web server would recognize that this IP address is outside its
subnet and would send the message to the 128.192.50.1 router using its Ethernet address (00-0C-00-33-
3A-DC). This router would then send the message to the router for the 128.192.98.x subnet
(128.192.254.98) using its Ethernet address (00-0C-00-33-3A-BB). This router would, in turn, send the
message back to the client (128.192.98.130) using its Ethernet address (00-0C-00-33-3A-A3).
This process would work in the same way for Web servers located outside the organization on the
Internet. In this case, the message would go from the client to the 128.192.98.1 router, which would send


it to the Internet router (128.192.254.99), which would send it to its Internet connection. The message
would be routed through the Internet, from router to router, until it reached its destination. Then the
process would work in reverse to return the requested page.
5.6.2 Unknown Addresses
Suppose that the client computer in Building A (128.192.98.130) wants to retrieve a Web page from the
www1.anyorg.com Web server but does not know the IP address of the Web server. For simplicity, we will
start by assuming that the client knows the data link layer address of its subnet router, but after you read
through this example, you will realize that obtaining a data link layer address is straightforward.
The Web browser realizes that it does not know the IP address after searching its IP address table and not
finding a matching entry. Therefore, it issues a DNS request to the name server (128.192.50.4). The DNS


request is passed to the transport layer (TCP), which attaches a UDP datagram and hands the message to
the network layer.
Using its subnet mask, the network layer (IP) will recognize that the DNS server is outside of its subnet. It
will attach an IP packet and set the data link layer address to its router’s address.
The router will process the message and recognize that to reach the 128.192.50.4 IP address, it must send
the packet to the data center router, 128.192.254.96 and does this by using this router’s MAC address (00-
0-00-33-3A-DA). When the data center router receives this packet, it will realize that it has a direct
connection to the network the DNS server is on and will transmit the packet using the DNS server’s
Ethernet address (00-0C-00-CC-3A-B1).
The name server will process the DNS request and send the matching IP address back to the client via the
128.198.98.x subnet router. The IP address for the desired computer makes its way back to the application
layer software, which stores it in its IP table.
The application layer then issues the HTTP request using the IP address for the Web server (128.192.50.2)
and passes it to the transport layer, which in turn passes it to the network layer. The network layer uses its
subnet mask and recognizes that this computer is not on its subnet. Therefore, it will route the packet to
its default gateway, 128.192.98.1, which will then send the HTTP request to the data center’s router,
128.192.254.96, which will deliver the HTTP request to the Web server 1.
This process works the same for a Web server outside the subnet, whether in the same organization or


This process works the same for a Web server outside the subnet, whether in the same organization or
anywhere on the Internet. If the Web server is far away (e.g., Australia), the process will likely involve
searching more than one name server, but it is still the same process.
What would happen if the client in building A (128.192.98.130) did not know its router’s Ethernet
address, which it needs to send the message to the router? It would broadcast an ARP request to all
computers on its subnet, requesting that the computer whose IP address is 128.192.98.1 respond with its
Ethernet address.
This request is processed by all computers on the subnet, but only the router responds with an ARP packet
giving its Ethernet address. The network layer software on the client stores this address in its data link
layer address table (called ARP cache). Then the client computer could send the message.
This same ARP request/response process can occur at any point as a message moves through the network.
For example, suppose that the router in the data center (128.192.254.96) did not know the Ethernet
address of the DNS server (128.192.50.4). The DNS request would flow through the network in exactly the
same way as described earlier (because no computer knows whether the router knows or doesn’t know the
Ethernet address) until the DNS request arrived at the data center router. This router would try to address
the message to the DNS server and would realize that it did not have the server’s Ethernet address, so it
would issue an ARP request. The DNS server would respond with an ARP response containing its
Ethernet address, and the router would put that address on the message and send it to the server.
5.6.3 TCP Connections


5.6.3 TCP Connections
Whenever a computer transmits data to another computer, it must choose whether to use a connection-
oriented service via TCP or a connectionless service via UDP. Most application layer software such as Web
browsers (HTTP), email (SMTP), FTP, and Telnet use connection-oriented services. This means that
before the first packet is sent, the transport layer first sends a SYN segment to establish a session (also
known as the three-way handshake). Once the session is established, then the data packets begin to flow.
Once the data are finished, the session is closed with a FIN segment (also known as the four-way
handshake).
In the preceding examples, this means that the first packet sent is really an SYN segment, followed by a
response from the receiver accepting the connection, and then the packets as described earlier. There is
nothing magical about the SYN and FIN segments; they are addressed and routed in the same manner as
any other packets. But they do add to the complexity and length of the example.
A special word is needed about HTTP packets. When HTTP was first developed, Web browsers opened a
separate TCP session for each HTTP request. That is, when they requested a page, they would open a
session, send the single packet requesting the Web page, and close the session at their end. The Web


server would open a session, send as many packets as needed to transmit the requested page, and then
close the session. If the page included graphic images, the Web browser would open and close a separate
session for each request. This requirement to open and close sessions for each request was time-
consuming and not really necessary. With the newest version of HTTP, Web browsers open one session
when they first issue an HTTP request and leave that session open for all subsequent HTTP requests to
the same server.
5.6.4 TCP/IP and Network Layers
In closing this chapter, we want to return to the layers in the network model and take another look at how
messages flow through the layers. Figure 5-20 shows how a Web request message from a client computer
in Building A would flow through the network layers in the different computers and devices on its way to
the Web server (www1.anyorg.com, 128.192.50.2) in the Data Center.
FIGURE 5-20 How messages move through the network layers.
Note: The addresses in this example are destination addresses
The message starts at the application layer of the sending computer (the client in Building A,
128.192.98.130), shown in the upper left corner of the figure, which generates an HTTP packet. This
packet is passed to the transport layer, which surrounds the HTTP packet with a TCP segment. This is
then passed to the network layer, which surrounds it with an IP frame that includes the IP address of the
final destination (128.192.50.2). This, in turn, is passed to the data link layer, which surrounds it within
an Ethernet frame that also includes the Ethernet address of the next computer to which the message will


an Ethernet frame that also includes the Ethernet address of the next computer to which the message will
be sent (00-0C-00-33-3A-0B). Finally, this is passed to the physical layer, which converts it into electrical
impulses for transmission through the cable to its next stop—the router that serves as the gateway in
Building A.
When the message arrives at the router in Building A, its physical layer translates it from electrical
impulses into digital data and passes the Ethernet frame to the data link layer. The data link layer checks
to make sure that the Ethernet frame is addressed to the router, performs error detection, strips off the


Ethernet frame, and passes its contents (the IP packet) to the network layer. The routing software running
at the network layer looks at the destination IP address, determines the next computer to which the
packet should be sent, and passes the outgoing packet down to the data link layer for transmission. The
data link layer surrounds the IP packet with a completely new Ethernet frame that contains the
destination address of the next computer to which the packet will be sent (00-0C-00-33-3A-DA). In
Figure 5-20, this new frame is shown in a different color. This is then passed to the physical layer, which
transmits it through the network cable to its next stop—the router that serves as the gateway in the Data
Center.
When the message arrives at the router in the Data Center, it goes through the same process. The physical
layer passes the incoming packet to the data link layer, which checks the destination Ethernet address,
performs error detection, strips off the Ethernet frame, and passes the IP packet to the network layer
software. The software determines the next destination and passes the IP packet back to the data link
layer, which adds a completely new Ethernet frame with the destination address of its next stop (00-0C-
00-33-3A-DC)—its final destination.
The physical layer at the server receives the incoming packet and passes it to the data link layer, which
checks the Ethernet address, performs error detection, removes the Ethernet frame, and passes the IP
packet to the network layer. The network layer examines the final destination IP address on the incoming
packet and recognizes that the server is the final destination. It strips off the IP packet and passes the TCP
segment to the transport layer, which in turn strips off the TCP segment and passes the HTTP packet to
the application layer (the Web server software).


the application layer (the Web server software).
There are two important things to remember from this example. First, at all gateways (i.e., routers) along
the way, the packet moves through the physical layer and data link layer up to the network layer, but no
higher. The routing software operates at the network layer, where it selects the next computer to which
the packet should be sent, and passes the packet back down through the data link and physical layers.
These three layers are involved at all computers and devices along the way, but the transport and
application layers are only involved at the sending computer (to create the application layer packet and
the TCP segment) and at the receiving computer (to understand the TCP segment and process the
application layer packet). Inside the TCP/IP network itself, messages only reach layer 3—no higher.
Second, at each stop along the way, the Ethernet frame is removed and a new one is created. The Ethernet
frame lives only long enough to move the message from one computer to the next and then is destroyed.
In contrast, the IP packet and the packets above it (TCP and application layer) never change while the
message is in transit. They are created and removed only by the original message sender and the final
destination.
5.7 IMPLICATIONS FOR CYBER SECURITY
The original design of the Internet and TCP/IP was done with only two user groups in mind (researchers
at universities and military personnel) so security was not a major design focus. Time has changed since
then, and today, more than 3.5 billion users are on the Internet (you can check out the live stats of
Internet users here: http://www.internetlivestats.com/internet-users/). This “design flaw” has some
unintended consequences when it comes to cyber security.


unintended consequences when it comes to cyber security.
One of the most exploited security flaws is the vulnerability created by the TCP three-way handshake that
initiates a connection between a client and a server (see Section 5.6.3). A hacker can use an army of
computers (zombies) to start requesting TCP sessions from a server but never follow through with an
actual Web page request. The server will keep a part of its memory reserved for these false connections
and, as a consequence, may not be able to respond to legitimate requests and, eventually, may crash
because it does not have enough memory. The largest attack of this kind was recorded in 2016 when it
brought down much of the Internet’s domain name system (DNS) infrastructure.
There is another issue that you should keep in mind. The most basic way somebody can identify you on
the Internet is by your IP address. From your IP address, one can roughly determine your geographical
location (city or area). In addition, most websites can track your operating system, browser version, time
zone, and may other information in addition to your IP address. You may ask why would they do this?
Well, there is big money in it. They can track you for advertising purposes or they would sell your


information to third entities.
SUMMARY
Transport and Network Layer Protocols TCP/IP are the standard transport and network
protocols used today. They perform addressing (finding destination addresses), routing (finding the
“best” route through the network), and segmenting (breaking large messages into smaller packets for
transmission and reassembling them at the destination).
Transport Layer The transport layer (TCP) uses the source and destination port addresses to link
the application layer software to the network. TCP is also responsible for segmenting—breaking large
messages into smaller segments for transmission and reassembling them at the receiver’s end. When
connection-oriented routing is needed, TCP establishes a connection or session from the sender to
the receiver. When connectionless routing is needed, TCP is replaced with UDP. Quality of service
provides the ability to prioritize packets so that real-time voice packets are transmitted more quickly
than simple email messages.
Addressing Computers can have three different addresses: application layer address, network layer
address, and data link layer address. Data link layer addresses are usually part of the hardware,
whereas network layer and application layer addresses are set by software. Network layer and
application layer addresses for the Internet are assigned by Internet registrars. Addresses within one
organization are usually assigned so that computers in the same LAN or subnet have similar
addresses, usually with the same first 3 bytes. Subnet masks are used to indicate whether the first 2 or
3 bytes (or partial bytes) indicate the same subnet. Some networks assign network layer addresses in
a configuration file on the client computer, whereas others use dynamic addressing, in which a DHCP
server assigns addresses when a computer first joins the network.
Address Resolution Address resolution is the process of translating an application layer address
into a network layer address or translating a network layer address into a data link layer address. On


into a network layer address or translating a network layer address into a data link layer address. On
the Internet, network layer resolution is done by sending a special message to a DNS server (also
called a name server) that asks for the IP address (e.g., 128.192.98.5) for a given Internet address
(e.g., www.kelley.indiana.edu). If a DNS server does not have an entry for the requested Internet
address, it will forward the request to another DNS server that it thinks is likely to have the address.
That server will either respond or forward the request to another DNS server, and so on until the
address is found or it becomes clear that the address is unknown. Resolving data link layer addresses
is done by sending an ARP request in a broadcast message to all computers on the same subnet that
asks the computer with the requested IP address to respond with its data link layer address.
Routing Routing is the process of selecting the route or path through the network that a message
will travel from the sending computer to the receiving computer. With centralized routing, one
computer performs all the routing decisions. With static routing, the routing table is developed by the
network manager and remains unchanged until the network manager updates it. With dynamic
routing, the goal is to improve network performance by routing messages over the fastest possible
route; an initial routing table is developed by the network manager but is continuously updated to
reflect changing network conditions, such as message traffic. BGP, RIP, ICMP, EIGRP, and OSPF are
examples of dynamic routing protocols.
TCP/IP Example In TCP/IP, it is important to remember that the TCP segments and IP packets are
created by the sending computer and never change until the message reaches its final destination.
The IP packet contains the original source and ultimate destination address for the packet. The


The IP packet contains the original source and ultimate destination address for the packet. The
sending computer also creates a data link layer frame (e.g., Ethernet) for each message. This frame
contains the data link layer address of the current computer sending the packet and the data link
layer address of the next computer in the route through the network. The data link layer frame is
removed and replaced with a new frame at each computer at which the message stops as it works its
way through the network. Thus, the source and destination data link layer addresses change at each
step along the route, whereas the IP source and destination addresses never change.
KEY TERMS


Access Control List (ACL)
acknowledgment (ACK)
address resolution
Address Resolution Protocol (ARP)
application layer address
authoritative name server
ARP cache
Automatic Repeat reQuest (ARQ)
autonomous systems
auxiliary port
Border Gateway Protocol (BGP)
border router
broadcast message
centralized routing
Cisco Internetwork Operating Systems (IOS)
classless addressing
Connectionless messaging
connection-oriented messaging
console port
continuous ARQ
data link layer address
designated router
destination port address
distance vector dynamic routing
Domain Name Service (DNS)
dynamic addressing
Dynamic Host Configuration Protocol (DHCP)
dynamic routing
Enhanced Interior Gateway Routing Protocol (EIGRP)
exterior routing protocol
flow control
gateway
Go-Back-N ARQ
hop
hops
interface
Interior Gateway Routing Protocol (IGRP)
interior routing protocol
Intermediate System to Intermediate System (IS-IS)


Internet address classes
Internet Control Message Protocol (ICMP)
Internet Corporation for Assigned Names and Numbers (ICANN)
Internet Group Management Protocol (IGMP)
Link Access Protocol for Modems [LAP-M]
link state dynamic routing
loopback
multicasting
multicast message
name server
negative acknowledgment (NAK)
network interface port
network layer address
Open Shortest Path First (OSPF)
port address
private IPv4 address space
Quality of Service (QoS)
Real-Time Streaming Protocol (RTSP)
Real-Time Transport Protocol (RTP)
reserved addresses
resolving name server
Resource Reservation Protocol (RSVP)
root server
router
routing
Routing Information Protocol (RIP)
segment
segmenting
Selective-Repeat ARQ
session
sliding window
source port address
static routing
stop-and-wait ARQ
subnet
subnet mask
top-level domain (TLD)
Transmission Control Protocol/Internet Protocol (TCP/IP)
unicast message


User Datagram Protocol (UDP)
QUESTIONS
1. What does the transport layer do?
2. What does the network layer do?
3. What are the parts of TCP/IP and what do they do? Who is the primary user of TCP/IP?
4. Compare and contrast the three types of addresses used in a network.
5. How is TCP different from UDP?
6. How does TCP establish a session?
7. What is a subnet and why do networks need them?
8. What is a subnet mask?
9. How does dynamic addressing work?
10. What benefits and problems does dynamic addressing provide?
11. What is address resolution?
12. How does TCP/IP perform address resolution from URLs into network layer addresses?
13. How does TCP/IP perform address resolution from IP addresses into data link layer addresses?
14. What is routing?
15. How does decentralized routing differ from centralized routing?
16. What are the differences between connectionless and connection-oriented messaging?
17. What is a session?
18. What is QoS routing and why is it useful?
19. Compare and contrast unicast, broadcast, and multicast messages.
20. Explain how multicasting works.
21. Explain how the client computer in Figure 5-16 (128.192.98.xx) would obtain the data link layer
address of its subnet router.
22. Why does HTTP use TCP and DNS use UDP?
23. How does static routing differ from dynamic routing? When would you use static routing? When
would you use dynamic routing?
24. What type of routing does a TCP/IP client use? What type of routing does a TCP/IP gateway use?
Explain.
25. What is the transmission efficiency of a 10-byte Web request sent using HTTP, TCP/IP, and


Ethernet? Assume that the HTTP packet has 100 bytes in addition to the 10-byte URL. Hint:
Remember from Chapter 4 that efficiency = user data/total transmission size.
26. What is the transmission efficiency of a 1,000-byte file sent in response to a Web request HTTP,
TCP/IP, and Ethernet? Assume that the HTTP packet has 100 bytes in addition to the 1,000-byte file.
Hint: Remember from Chapter 4 that efficiency = user data/total transmission size.
27. What is the transmission efficiency of a 5,000-byte file sent in response to a Web request HTTP,
TCP/IP, and Ethernet? Assume that the HTTP packet has 100 bytes in addition to the 5,000-byte file.
Assume that the maximum packet size is 1,200 bytes. Hint: Remember from Chapter 4 that efficiency
= user data/total transmission size.
28. Describe the anatomy of a router. How does a router differ from a computer?


EXERCISES
A. Would you recommend dynamic addressing for your organization? Why?
B. Look at your network layer software (either on a LAN or dial-in) and see what options are set—but
don’t change them! You can do this by using the RUN command to run winipcfg. How do these match
the fundamental addressing and routing concepts discussed in this chapter?
C. Suppose that a client computer (128.192.98.130) in Building B in Figure 5-17 requests a large Web
page from the Web server 2 in the Data Center (www2.anyorg.com). Assume that the client computer
has just been turned on and does not know any addresses other than those in its configuration tables.
Assume that all gateways and Web servers know all network layer and data link layer addresses.
a. Explain what messages would be sent and how they would flow through the network to deliver
the Web page request to the server.
b. Explain what messages would be sent and how they would flow through the network as the Web
server sent the requested page to the client.
c. Describe, but do not explain in detail, what would happen if the Web page contained several
graphic images (e.g., GIF [Graphics Interchange Format] or JPEG [Joint Photographic Experts
Group] files).
D. Network Solutions provides a service to find who owns domain names and IP addresses. Go to
www.networksolutions.com/whois. Find the owner of
a. books.com
b. TV.com
c. 74.128.18.22
d. 129.79.78.188
E. What is the subnet portion of the IP address and what is the subnet mask for the following:
a. 12.1.0.0/16
b. 12.1.0.0/24


b. 12.1.0.0/24
c. 12.1.0.0/20
d. 12.1.0.0/28
F. You might be wondering how the first bytes for each address range were picked. Why do you think
Class A’s first byte is 1–126, Class B’s byte is 128–191, and Class C’s byte is 192–223?
MINICASES
I. Central University Suppose that you are the network manager for Central University, a medium-
sized university with 13,000 students. The university has 10 separate colleges (e.g., business, arts,
journalism), 3 of which are relatively large (300 faculty and staff members, 2,000 students, and 3
buildings) and 7 of which are relatively small (200 faculty and staff, 1,000 students, and 1 building).
In addition, there are another 2,000 staff members who work in various administration departments
(e.g., library, maintenance, finance) spread over another 10 buildings. There are 4 residence halls that
house a total of 2,000 students. Suppose that the university has the 128.100.xxx.xxx address range on
the Internet. How would you assign the IP addresses to the various subnets? How would you control
the process by which IP addresses are assigned to individual computers? You will have to make some
assumptions to answer both questions, so be sure to state your assumptions.
II. Connectus Connectus is a medium-sized Internet Service Provider (ISP) that provides Internet
access and data communication services to several dozen companies across the United States and
Canada. Connectus provides fixed data connections for clients’ offices in about 50 cities and an
internal network that connects them. For reliability purposes, all centers are connected with at least


internal network that connects them. For reliability purposes, all centers are connected with at least
two other centers so that if one connection goes down, the center can still communicate with the


network. Predicting access volume is difficult because it depends on how many sales representatives
are in which city. Connectus currently uses RIP as its routing protocol but is considering moving to
OSPF. Should it stay with RIP or move to OSPF? Why?
III. Old Army Old Army is a large retail store chain operating about 1,000 stores across the United
States and Canada. Each store is connected to the Old Army data network, which is used primarily for
batch data transmissions. At the end of each day, each store transmits sales, inventory, and payroll
information to the corporate head office in Atlanta. The network also supports email traffic, but its
use is restricted to department managers and above. Because most traffic is sent to and from the
Atlanta headquarters, the network is organized in a hub and spoke design. The Atlanta office is
connected to 20 regional data centers, and each regional center is in turn connected to the 30–70
stores in its region. Network volumes have been growing, but at a fairly predictable rate, as the
number of stores and overall sales volume increase. The old Army currently uses RIP as its routing
protocol but is considering moving to OSPF. Should it stay with RIP or move to OSPF? Why?
IV. General Stores General Stores is a large retail store chain operating about 1,300 stores across the
United States and Canada. Each store is connected to the corporate data network. At the end of each
day, each store transmits sales and payroll information to the corporate head office in Seattle.
Inventory data are transmitted in real time as products are sold to one of a dozen regional
distribution centers across North America. The network is also used for credit card validations as
customers check out and pay for their purchases. The network supports email traffic, but its use is
restricted to department managers and above. The network is designed much like the Internet: One


restricted to department managers and above. The network is designed much like the Internet: One
connection from each store goes into a regional network that typically has a series of network
connections to other parts of the network. Network volumes have been growing, but at a fairly
predictable rate, as the number of stores and overall sales volume increase. General Stores is
considering implementing a digital telephone service that will allow it to transmit internal telephone
calls to other General Stores offices or stores through the data network. Telephone services outside of
General Stores will continue to be done normally. General Stores currently uses RIP as its routing
protocol but is considering moving to OSPF. Should it stay with RIP or move to OSPF? Why?
TECH UPDATES
In every chapter, we will offer a couple of ideas to investigate.
Topic A: The DNS Servers Hierarchy
The system of DNS Servers is essential for the Internet to work. Who came up with the idea of having this
type of directory? How did this hierarchy of servers evolved? What does it look like today? Provide a
timeline of the evolution of the DNS Servers hierarchy and its current state.
Topic B: SQL Injection
SQL Injection (SQLi) refers to an injection attack where an attacker can execute malicious SQL statements
(also commonly referred to as a malicious payload) that control a web application’s database server (also
commonly referred to as a Relational Database Management System—RDBMS). Using the http://hack.me
website (a great environment to try out safely some hacking techniques) explore the SQL Injection and
provide a report about what you learned. Show how to perform and block an SQLi.
Deliverables
Your job will be to prepare a presentation/video (7–10 minutes long) that addresses the topic and
provides information on the following items:
1. Title Slide
2. Short description of the topic


1. Title Slide
2. Short description of the topic
3. Main players—these could be people, processes, software, hardware, etc.
4. How it works—use a lot of pictures and be as technical as possible; create this part as a tutorial so that
your audience can follow along


5. How does it relate to material covered in class so far (and in the future)
6. Additional material/books/links where to learn more about this topic
7. Credits
8. List of References
9. Memo addressed to your professor describing all of the above information
HANDS-ON ACTIVITY 5A
Using TCP/IP
In this chapter, we’ve discussed the basic components of TCP/IP such as IP addresses, subnet masks, DNS
requests, and ARP requests. In this activity, we’ll show you how to explore these items on your computer.
Although this activity is designed for Windows computers, most of these commands will also work on
Apple computers.
This activity will use the command prompt, so start by clicking START, then RUN, and then type CMD
and press enter. You should see the command window, which in Windows is a small window with a black
background. Like all other windows, you can change its shape by grabbing the corner and stretching it.
IPCONFIG: Reading Your Computer’s Settings
In a focus box earlier in the chapter, we showed you how to find your computer’s TRCP/IP settings using
Windows. You can also do it by using the IPCONFIG command. In the command window, type
IPCONFIG/ALL and press enter.
You should see a screen like that shown in Figure 5-19. The middle of the screen will show the TCP/IP
information about your computer. You can see the IP address (192.168.1.102 in Figure 5-19); the subnet
mask (255.255.255.0); the default gateway, which is the IP address of the router leading out of your
subnet (192.168.1.1); the DHCP server (192.168.1.1); and the available DNS servers (e.g., 63.240.76.4).


Your computer will have similar, but different, information. As discussed in Technical Focus 5.3, your
computer might be using “private” IP addresses the same as my computer shown in Figure 5-21, so your
addresses may be identical to mine. We’ll explain how network address translation (NAT) is done in
Chapter 11.
C:\Documents and Settings\Administrator>ipconfig/all
Windows IP Configuration
  Host Name . . . . . . . . . . . . . : ALAN
  Primary Dns Suffix . . . . . . . . .:
  Node Type . . . . . . . . . . . . . : Unknown
  IP Routing Enabled . . . . . . . . .: No
  WINS Proxy Enabled . . . . . . . . .: No
  DNS Suffix Search List . . . . . . .: insightbb.com
Ethernet adapter Local Area Connection:
  Connection-specific DNS Suffix . . .: insightbb.com
  Description . . . . . . . . . . . . : Intel(R) PRO/1000 MT Network Connection
  Physical Address . . . . . . . . . .: 00-0D-56-D8-8D-96
  Dhcp Enabled . . . . . . . . . . . .: Yes
  Autoconfiguration Enabled . . . . . : Yes
  IP Address . . . . . . . . . . . . .: 192.168.1.102
  Subnet Mask . . . . . . . . . . . . : 255.255.255.0
  Default Gateway . . . . . . . . . . : 192.168.1.1


DHCP Server . . . . . . . . . . . . : 192.168.1.1
  DNS Servers . . . . . . . . . . . . : 63.240.76.4

204.127.198.4

63.240.76.135
  Lease Obtained . . . . . . . . . . .: Wednesday, February 20, 2008 8:09:37 AM
  Lease Expires . . . . . . . . . . .: Tuesday, February 26, 2008 8:09:37 AM


C:\Documents and Settings\Administrator>
FIGURE 5-21 IPCONFIG command
Deliverables
1. Use the ipconfig/all command on your computer. What is the IP address, subnet mask, IP address of
default gateway, and MAC of your computer?
2. Why does every computer on the Internet need to have these four numbers?
PING: Finding Other Computers
The PING sends a small packet to any computer on the Internet to show you how long it takes the packet
to travel from your computer to the target computer and back again. You can ping a computer using its IP
address or Web URL. Not all computers respond to ping commands, so not every computer you ping will
answer.
Start by pinging your default gateway: just type PING followed by the IP address of your gateway. Figure
5-22 shows that the PING command sends four packets to the target computer and then displays the
maximum, minimum, and average transit times. In Figure 5-22, you can see that pinging my gateway is
fast: less than 1 millisecond for the packet to travel from my computer to my router and back again.
Next, ping a well-known website in the United States to see the average times taken. Remember that not
all websites will respond to the ping command. In Figure 5-22, you can see that it took an average of 52
milliseconds for a packet to go from my computer to Google and back again. Also, note that
www.google.com has an IP address of 216.239.37.99.
Now, ping a website outside the United States. In Figure 5-20, you can see that it took an average of 239
milliseconds for a packet to go from my computer to the City University of Hong Kong and back again. If
you think about it, the Internet is amazingly fast.
Deliverables


you think about it, the Internet is amazingly fast.
Deliverables
1. Ping your own default gateway. How many packets were returned? How long did it take for your
default gateway to respond?
2. Ping google.com. How many packets were returned? How long did it take for you default gateway to
respond?
3. Ping National Australian University www.anu.edu.au. How many packets were returned? How long
did it take for your default gateway to respond?
ARP: DISPLAYING PHYSICAL ADDRESSES
Remember that to send a message to other computers on the Internet, you must know the physical
address (aka data link layer address) of the next computer to send the message to. Most computers on the
Internet will be outside your subnet, so almost all messages your computer sends will be sent to your
gateway (i.e., the router leaving your subnet). Remember that computers use ARP requests to find
physical addresses and store them in their ARP tables. To find out what data link layer addresses your
computer knows, you can use the ARP command.
At the command prompt, type ARP-A and press enter. This will display the contents of your ARP table. In
Figure 5-23, you can see that the ARP table in my computer has only one entry, which means that all the
messages from my computer since I turned it on have only gone to this one computer—my router. You can
also see the physical address of my router: 00-04-5a-0b-d1-40.
If you have another computer on your subnet, ping it and then take a look at your ARP table again. In
Figure 5-23, you can see the ping of another computer on my subnet (192.168.1.152) and then see the ARP


table with this new entry. When I pinged 192.168.1.152, my computer had to find its physical address, so it
issued an ARP request, and 192.168.1.152 responded with an ARP response, which my computer added


into the ARP table before sending the ping.
Deliverables
1. Type ARP-A at the command prompt. What are the entries in your ARP table?
2. Suppose that there are no entries in your ARP table. Is this a problem? Why or why not?
NSLOOKUP: Finding IP Addresses
Remember that to send a message to other computers on the Internet, you must know their IP addresses.
Computers use DNS servers to find IP addresses. You can issue a DNS request by using the NSLOOKUP
command.
Type NSLOOKUP and the URL of a computer on the Internet and press enter. In Figure 5-24, you’ll see
that www.cnn.com has several IP addresses and is also known as cnn.com
Deliverable
Find the IP address of google.com and another website of your choice.
DNS Cache
The IPCONFIG/DISPLAYDNS command can be used to show the contents of the DNS cache. You can
experiment with this by displaying the cache, visiting a new website with your browser, and then
displaying the cache again. Figure 5-25 shows part of the cache on my computer after visiting several sites.
The DNS cache contains information about all the websites I’ve visited, either directly or indirectly (by
having a Web page on one server pull a graphics file off of a different server).
C:\Documents and Settings\Administrator>ping 192.168.1.1
Pinging 192.168.1.1 with 32 bytes of data:
Reply from 192.168.1.1: bytes = 32 time < 1ms TTL = 64
Reply from 192.168.1.1: bytes = 32 time < 1ms TTL = 64
Reply from 192.168.1.1: bytes = 32 time < 1ms TTL = 64


Reply from 192.168.1.1: bytes = 32 time < 1ms TTL = 64
Ping statistics for 192.168.1.1:
 Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
 Minimum = 0ms, Maximum = 0ms, Average = 0ms
_______________________________________________________________
C:\Documents and Settings\Administrator>ping www.google.com
Pinging www.1.google.com [216.239.37.99] with 32 bytes of data:
Reply from 216.239.37.99: bytes = 32 time = 53ms TTL = 235
Reply from 216.239.37.99: bytes = 32 time = 52ms TTL = 236
Reply from 216.239.37.99: bytes = 32 time = 52ms TTL = 236
Reply from 216.239.37.99: bytes = 32 time = 53ms TTL = 235
Ping statistics for 216.239.37.99:
 Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
 Minimum = 52ms, Maximum = 53ms, Average = 52ms
_______________________________________________________________
C:\Documents and Settings\Administrator>ping www.cityu.edu.hk
Pinging amber.cityu.edu.hk [144.214.5.218] with 32 bytes of data:
Reply from 144.214.5.218: bytes = 32 time = 240ms TTL = 236
Reply from 144.214.5.218: bytes = 32 time = 239ms TTL = 236


Reply from 144.214.5.218: bytes = 32 time = 239ms TTL = 236


Reply from 144.214.5.218: bytes = 32 time = 240ms TTL = 236
Ping statistics for 144.214.5.218:
 Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
 Minimum = 239ms, Maximum = 240ms, Average = 239ms
FIGURE 5-22 PING command
For example, the second entry in this figure is ns1 .cisco.com, which has an IP address of 128.107.241.185
(a 4-byte long address). The record type is one, which means this is a “host”—that is, a computer on the
Internet using IPv4. Because the DNS information might change, all entries have a maximum time to live
set by the DNS that provides the information (usually 24 hours); the time to live value is the time in
seconds that this entry will remain in the cache until it is removed.
C:\Documents and Settings\Administrator>arp.-a.
Interface: 192.168.1.102 --- 0x10003
  Internet Address  Physical Address   Type
  192.168.1.1     00-04-5a-0b-d1-40  dynamic
__________________________________________________________
C:\Documents and Settings\Administrator>ping 192.168.1.152
Pinging 192.168.1.152 with 32 bytes of data:
Reply from 192.168.1.152: bytes = 32 time < 1ms TTL = 64
Reply from 192.168.1.152: bytes = 32 time < 1ms TTL = 64


Reply from 192.168.1.152: bytes = 32 time < 1ms TTL = 64
Reply from 192.168.1.152: bytes = 32 time < 1ms TTL = 64
Ping statistics for 192.168.1.152:
  Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
  Minimum = 0ms, Maximum = 0ms, Average = 0ms
__________________________________________________________
C:\Documents and Settings\Administrator>arp -a
Interface: 192.168.1.102 --- 0x10003
 Internet Address   Physical Address   Type
 192.168.1.1
00-04-5a-0b-dl-40   dynamic
 192.168.1.152     00-08-e1-00-21-f6   dynamic
FIGURE 5-23 ARP command
C:\Documents and Settings\Administrator>nslookup www.cnn.com
Server: ns1.insightbb.com
Address: 63.240.76.135
Non-authoritative answer:
Name: cnn.com
Addresses: 64.236.16.116, 64.236.24.12, 64.236.24.20, 64.236.24.28

64.236.29.120, 64.236.16.20, 64.236.16.52, 64.236.16.84
Aliases: www.cnn.com
FIGURE 5-24 NSLOOKUP command
The very last entry in this figure is for ns1.v6.telekom.at. The record type of 28 means that this is a host


that uses IPv6, which you can see from the 16-byte long address in the record (2001:890:600:d1: :100).
Deliverables
1. Display your DNS cache using the command ipconfig/displaydns.


2. How many entries are there in your cache?
3. Open your browser and visit www.ietf.com. Once the page loads, display your DNS cache again. Copy
the DNS entry for this website.
TRACERT: Finding Routes through the Internet
The TRACERT command will show you the IP addresses of computers in the route from your computer to
another computer on the Internet. Many networks have disabled TRACERT for security reasons, so it
doesn’t always work. Type TRACERT and the URL of a computer on the Internet and press enter. In
Figure 5-26, you’ll see the route from my computer, through the Insight network, through the AT&T
network, through the Level 3 network, and then through the Google network until it reaches the server.
TRACERT usually sends three packets, so beside each hop is the total time to reach that hop for each of
the three packets. You’ll see that it took just over 50 milliseconds for a packet to go from my computer to
Google. You’ll also see that the times aren’t always “right,” in that the first packet took 50 milliseconds to
reach the bbrl Washington Level 3 router (step 9) but only 40 milliseconds to reach the next hop to the
car2 Washington Level 3 router (step 10). The time to each hop is measured separately, each with a
different packet, so sometimes a packet is delayed longer on one hop or another.


FIGURE 5-25 DNS cache
C:\Documents and Settings\Administrator>tracert www.google.com
Tracing route to www.1.google.com [216.239.37.104]
over a maximum of 30 hops:
  1 1 ms   1 ms   1 ms  192.168.1.1
  2 7 ms  10 ms   8 ms  12-220-5-129.client.insightBB.com [12.220.5.129]
  3 11 ms  12 ms  11 ms  12-220-1-78.client.insightBB.com [12.220.1.78]
  4 17 ms  16 ms  16 ms  12-220-0-26.client.insightBB.com [12.220.0.26]
  5 19 ms  18 ms  18 ms  tbr1-p011 901.cgcil.ip.att.net [12.123.4.226]
  6 18 ms  16 ms  16 ms  ggr2-p310.cgcil.ip.att.net [12.123.6.65]
  7 19 ms  18 ms  18 ms  so-9-1.car4.Chicagol.Level3.net [4.68.127.165]
  8 19 ms  18 ms  19 ms  ae-2-52.bbr2.Chicago1.Level3.net [4.68.101.33]
  9 50 ms  39 ms  39 ms  ae-2-0.bbr1.Washington1.Level3.net [4.68.128.201]


10 40 ms  40 ms  39 ms  ae-12-53.car2.Washington1.Level3.net [4.68.121.83]
 11 53 ms  78 ms  56 ms  unknown.Level3.net [166.90.148.174]
 12 54 ms  52 ms  51 ms  72.14.232.106
 13 55 ms  54 ms  53 ms  216.239.48.96
 14 55 ms  55 ms  54 ms  216.239.48.110
 15 52 ms  51 ms  52 ms  216.239.37.104
Trace complete.
FIGURE 5-26 TRACERT command
Deliverables
1. Type tracert google.com in your command window.
2. How many computers/hops did it take the packet to reach Google?
3. What was the shortest hop (in terms of time)? Why do you think this is the shortest hop?
HANDS-ON ACTIVITY 5B
Exploring DNS Request and DNS Response
In this chapter, we talked about address resolution. This activity will help you see how your computer
sends a DNS request for a website you never visited, before it can create a HTTP request packet to display
the website on your browser. We will use Wireshark for this activity. Use of Wireshark was explained in
Chapter 2.
1. Use ipconfig/all command to find the IP address of your computer and your DNS server.
2. So that we can explore the DNS request and response properly, the first step is to empty your DNS
cache. Use ipconfig/flushdns command in the command prompt window to empty the DNS of your
computer.


computer.
3. Open Wireshark and enter “ip.addr==your IP address” into the filter to only capture packets that
either originate or are destined for your computer.
4. Start packet capture in Wireshark.
5. With your browser, visit www.ietf.org.
6. Stop packet capture after the Web page is loaded.


FIGURE 5-27 DNS capture
Deliverables
1. Locate the DNS query and response message for www.ietf.org. In Figure 5-27, they are packets 27 and
28. Are these packets sent over UDP or TCP?
2. What is the destination port for the DNS query message? What is the source port of the DNE
response message?
3. To what IP address is the DNS query message sent? Compare this IP address to your local DNS server
IP address. Are these two IP addresses the same?
4. The www.ietf.org contains several images. Before retrieving each image, does your host issue a new
DNS query? Why or why not?
5. Now locate the HTTP Get message. What is the source and destination IP address? Compare the
source to your IP address. Are these the same?
6. Approximately how many HTTP GET request messages did your browser send? Why was there a
need to send additional HTTP GET messages?
HANDS-ON ACTIVITY 5C


Converting Decimal Values into Binary, and Vice Versa.
PART A
Being able to convert decimal values to binary (and vice versa) is very important in networking because
this is the basis for how subnetting is done. You may have done some of these exercises in high school and
probably didn’t know why it was important to be able to convert decimal values into binary, and vice
versa. This hands-on activity will help you recall how this is done or will teach how to do it in case you
never seen this before.
As you know, an IPv4 address consists of 32 bits that have been separated into 4 bytes (sometimes called
octets), for example, 129.79.126.1. This is called the dotted decimal address. Each byte has 8 bits, and each
of these bits can assume a value of 0 or 1. The following table shows how we convert each binary position
to a decimal value:s
Binary position 27
26 25 24 23 22 21 20
Decimal value
128 64 32 16 8 4 2 1
To practice the conversion from binary to decimal, let’s do a couple problems together:
1. You have the following binary number: 10101010. Convert it into decimal.
2. You have the following binary number: 01110111. Convert it into decimal.
It is important to notice what the range of possible decimal values for each byte is. The lower bound is
given when each bit is 0 and the upper bound is when each bit is 1. So 00000000 will give us 0 and
11111111 will give us 255. This is the reason why IPv4 addresses cannot go above the value of 255.
Deliverable


Deliverable
Calculate the decimal values of the following binary numbers: 11011011, 01111111, 10000000, 11000000,
11001101.
Part B
Now let’s practice the conversion of decimal value to binary. This is a bit trickier. Start by finding the
highest binary position that is equal to or smaller than the decimal number we are converting. All the
other placeholders to the left of this number will be 0. Then subtract the placeholder value from the
number. Then find the highest binary position that is equal to or smaller than the remainder. Keep
repeating these steps until the remainder is 0. Now, let’s practice.
3. Convert 60 into a binary number.
a. The placeholder that is equal to or lower than 60 is 32. Therefore, the first two bits for 60 are 0
and the third one is 1 − 001_ _ _ _ _ . The next step is to subtract 32 from 60, which equals 60 −
32 = 28.
b. The placeholder that is equal to or lower than 32 is 16, which is the fourth bit from the left.
Therefore, our binary number will look like this: 0011_ _ _ _. The next step is to subtract 16
from 28, which equals 28 − 16 = 12.
c. The placeholder that is equal to or lower than 12 is 8, and this is the fifth bit from the left.
Therefore, our binary number will look like this: 00111_ _ _. The next step is to subtract 8 from
12, which equals 12 − 8 = 4.
d. The placeholder that is equal to or lower than 4 is 4, and this is the sixth bit from the left.


Therefore, our binary number will look like this: 001111_ _. The next step is to subtract 4 from 4,
which equals 4 − 4 = 0.
e. Given that our remainder is 0, the additional bits are 0, and we find that our answer: 60 in
binary is 00111100.


4. Convert 182 into a binary number.
82= 10110110
(Because 182 − 128 = 54,54 − 32 = 22,22 − 16 = 6, and 6 − 4 = 2)
Deliverable
Calculate the binary value for each of the following binary numbers: 126, 128, 191, 192, 223.
HANDS-ON ACTIVITY 5D
Introduction to Subnetting
If you are not familiar with binary numbers, you may want to do Hands-On Activity 5C before you do this
activity.
A subnet mask is a 32-bit binary number that tells us to which subnet a device belongs. A 1 indicates that
that bit is part of the subnet network address, and a 0 indicates that that bit is part of the unique host
address for the individual computer. The subnet mask is a continuous stream of ones followed by all
zeros, so the subnet mask can assume only certain values. For example, a subnet mask could never have a
value of 11111111.11111111.00000000.10000000.
The following table shows the subnet mask values in both binary and decimal notation for classes A, B,
and C.
For example, a subnet mask of 255.255.255.0 for a computer with an address of 192.168.1.101 tells us that
the computer is in subnet 192.168.1.0 and has a unique address of 101 within that subnet.
Class First
Byte
Range
Byte Allocation
Subnet Mask in Binary Notation
Subnet Mask
in Decimal
Notation
A
1–126 Network.Host.Host.Host
11111111.00000000.00000000.00000000 255.0.0.0
B
128–
191


B
128–
191
Network.Network.Host.Host
11111111.11111111.00000000.00000000
255.255.0.0
C
192–
223
Network.Network.Network.Host 11111111.11111111.11111111.00000000
2555.255.255.0
Deliverable
Fill in the following table and find the admissible values for a subnet mask.
Binary Representation of a Byte Decimal Value
10000000
11000000
11100000
11110000
11111000
11111100
11111110
11111111
Suppose that you were assigned the network 209.98.208.0, which is a Class C address. The usual subnet
mask for a Class C address is 255.255.255.0, which provides one subnet with 253 host computers (there
are 255 possible addresses, but the .255 address is reserved and cannot be assigned to a computer because
this is the broadcast address for this subnet, and the .0 address is reserved for the subnet itself). Suppose
that you need to create 10 subnets within this address space. This means that part of the address usually