Have you ever wondered why you need an IP address to access the Internet?

Is it true
that an IP address can uniquely identify the user? Are you curious to learn what the life
of a packet looks like? If the answer is yes, let’s dive in!

This room is the first room in a series of four rooms dedicated to introducing the user to
vital networking concepts and the most common networking protocols:

●​ Networking Concepts (this room)

●​ Networking Essentials
●​ Networking Core Protocols
●​ Networking Secure Protocols

Room Prerequisites
This room expects that you know terms such as IP address and TCP port number;
however, we don’t expect that the reader is able to explain such terms in proper
technical depth. If you are unfamiliar with these terms, please consider joining the Pre
Security path.

Learning Objectives
By the time you finish this room, you will have learned about the following:

●​ ISO OSI network model

●​ IP addresses, subnets, and routing
●​ TCP, UDP, and port numbers
●​ How to connect to an open TCP port from the command line

OSI Model
Before we start, we should note that the OSI model might initially seem complicated.
Don’t worry if you encounter cryptic acronyms, as we provide examples of the OSI
model layers. We assure you that by the time you finish this module, this task will feel
like a piece of cake.

The OSI (Open Systems Interconnection) model is a conceptual model developed by

the International Organization for Standardization (ISO) that describes how
communications should occur in a computer network. In other words, the OSI model
defines a framework for computer network communications. Although this model is
theoretical, it is vital to learn and understand as it helps grasp networking concepts on a
deeper level. The OSI model is composed of seven layers:
 1.​ Physical Layer
2.​ Data Link Layer
3.​ Network Layer
4.​ Transport Layer
5.​ Session Layer
6.​ Presentation Layer
7.​ Application Layer

The numbering starts with the physical layer being layer 1, while the top layer, the
application layer, is layer 7. To help you remember the layers from bottom to top, you
can use a mnemonic such as “Please Do Not Throw Spinach Pizza Away.” You can
check the Internet for other easy-to-remember acronyms if this helps you memorise
them. Remembering the OSI model layers with their layer numbers is important;
otherwise, you will struggle to understand terms such as “layer 3 switch” or “layer 7
firewall.”

Layer 1: Physical Layer

The physical layer, also referred to as layer 1, deals with the physical connection
between devices; this includes the medium, such as a wire, and the definition of the
binary digits 0 and 1. Data transmission can be via an electrical, optical, or wireless
signal. Consequently, we need data cables or antennas, depending on our physical
medium.

In addition to Ethernet cable, shown in the illustration below, and optical fibre cable,
examples of the physical layer medium include the WiFi radio bands, the 2.4 GHz band,
the 5 GHz band, and the 6 GHz band.

Layer 2: Data Link Layer

The physical layer defines a medium to transmit our signal. The data link layer, i.e.,
layer 2, represents the protocol that enables data transfer between nodes on the same
network segment. Let’s put it in simpler terms. The data link layer describes an
agreement between the different systems on the same network segment on how to
communicate. A network segment refers to a group of networked devices using a
shared medium or channel for information transfer. For example, consider a company
office with ten computers connected to a network switch; that’s a network segment.
Examples of layer 2 include Ethernet, i.e., 802.3, and WiFi, i.e., 802.11. Ethernet and
WiFi addresses are six bytes. Their address is called a MAC address, where MAC
stands for Media Access Control. They are usually expressed in hexadecimal format
with a colon separating each two hexadecimal digits (one byte). The three leftmost
bytes identify the vendor.

We expect to see two MAC addresses in each frame in real network communication
over Ethernet or WiFi. The packet in the screenshot below shows:

●​ The destination data-link address (MAC address) highlighted in yellow

●​ The source data link address (MAC address) is highlighted in blue
●​ The remaining bits show the data being sent

Layer 3: Network Layer

The data link layer focuses on sending data between two nodes on the same network
segment. The network layer, i.e., layer 3, is concerned with sending data between
different networks. In more technical terms, the network layer handles logical
addressing and routing, i.e., finding a path to transfer the network packets between the
diverse networks.

In the data link layer, we gave an example of one company office with ten computers,
where the data link layer is responsible for providing a connection between them. Let’s
say that this company has multiple offices distributed across various cities, countries, or
even continents. The network layer is responsible for connecting the different offices
together.
The network below shows that computers A and B are connected, although on different
networks. You can also notice two paths connecting the two computers; the network
layer will route the network packets through the path it deems better.

Examples of the network layer include Internet Protocol (IP), Internet Control Message
Protocol (ICMP), and Virtual Private Network (VPN) protocols such as IPSec and
SSL/TLS VPN.

Layer 4: Transport Layer

Layer 4, the transport layer, enables end-to-end communication between running
applications on different hosts. Your web browser is connected to the TryHackMe web
server over the transport layer, which can support various functions like flow control,
segmentation, and error correction.

Examples of layer 4 are Transmission Control Protocol (TCP) and User Datagram
Protocol (UDP).

Layer 5: Session Layer

The session layer is responsible for establishing, maintaining, and synchronising
communication between applications running on different hosts. Establishing a session
means initiating communication between applications and negotiating the necessary
parameters for the session. Data synchronisation ensures that data is transmitted in the
correct order and provides mechanisms for recovery in case of transmission failures.

Examples of the session layer are Network File System (NFS) and Remote Procedure
Call (RPC).

Layer 6: Presentation Layer

The presentation layer ensures the data is delivered in a form the application layer can
understand. Layer 6 handles data encoding, compression, and encryption. An example
of encoding is character encoding, such as ASCII or Unicode.

Various standards are used at the presentation layer. Consider the scenario where we
want to send an image via email. First, we use JPEG, GIF, and PNG to save our
images; furthermore, although hidden from the user by the email client, we use MIME
(Multipurpose Internet Mail Extensions) to attach the file to our email. MIME encodes a
binary file using 7-bit ASCII characters.
Layer 7: Application Layer
The application layer provides network services directly to end-user applications. Your
web browser would use the HTTP protocol to request a file, submit a form, or upload a
file.

The application layer is the top layer, and you might have encountered many of its
protocols as you use different applications. Examples of Layer 7 protocols are HTTP,
FTP, DNS, POP3, SMTP, and IMAP. Don’t worry if you are not familiar with all of them.

Summary
Reading about the ISO OSI model for the first time can be intimidating; however, it
becomes easier as you progress in your study of networking protocols. To help with
your studies, we have summarised the ISO OSI layers in the table below.

Layer Example Protocols and

Layer Name Main Function
Number Standards

Providing
Application services and HTTP, FTP, DNS, POP3, SMTP,
Layer 7
layer interfaces to IMAP
applications

Data encoding,
Presentation Unicode, MIME, JPEG, PNG,
Layer 6 encryption, and
layer MPEG
compression
 Establishing,
maintaining, and
Layer 5 Session layer NFS, RPC
synchronising
sessions

End-to-end
communication
Layer 4 Transport layer UDP, TCP
and data
segmentation

Logical
addressing and
Layer 3 Network layer IP, ICMP, IPSec
routing between
networks

Reliable data
Layer 2 Data link layer transfer between Ethernet (802.3), WiFi (802.11)
adjacent nodes

Physical data
Electrical, optical, and wireless
Layer 1 Physical layer transmission
signals
media
TCP/IP Model
Now that we have covered the conceptual ISO OSI model, it is time to study an
implemented model, the TCP/IP model. TCP/IP stands for Transmission Control
Protocol/Internet Protocol and was developed in the 1970s by the Department of
Defense (DoD). I hear you ask why DoD would create such a model. One of the
strengths of this model is that it allows a network to continue to function as parts of it are
out of service, for instance, due to a military attack. This capability is possible in part
due to the design of the routing protocols to adapt as the network topology changes.

In our presentation of the ISO OSI model, we went from bottom to top, from layer 1 to
layer 7. In this task, let’s look at things from a different perspective, from top to bottom.
From top to bottom, we have:

●​ Application Layer: The OSI model application, presentation and session layers,
i.e., layers 5, 6, and 7, are grouped into the application layer in the TCP/IP
model.
●​ Transport Layer: This is layer 4.
●​ Internet Layer: This is layer 3. The OSI model’s network layer is called the
Internet layer in the TCP/IP model.
●​ Link Layer: This is layer 2.

The table below shows how the TCP/IP model layers map to the ISO/OSI model layers.

Layer TCP/IP Model

ISO OSI Model Protocols
Number (RFC 1122)

Application Application HTTP, HTTPS, FTP, POP3,

7
Layer Layer SMTP, IMAP, Telnet, SSH,
 Presentation
6
Layer

5 Session Layer

Transport
4 Transport Layer TCP, UDP
Layer

3 Network Layer Internet Layer IP, ICMP, IPSec

2 Data Link Layer Link Layer Ethernet 802.3, WiFi 802.11

1 Physical Layer

Many modern networking textbooks show the TCP/IP model as five layers instead of
four. For example, in Computer Networking: A Top-Down Approach 8th Edition, Kurose
and Ross describe the following five-layer Internet protocol stack by including the
physical layer:

●​ Application
●​ Transport
 ●​ Network
●​ Link
●​ Physical

In the following tasks, we will cover the IP protocol from the Internet layer and the UDP
and TCP protocols from the transport layer.

IP Addresses and Subnets

When you hear the word IP address, you might think of an address like [Link]
or something less common, such as [Link]. In both cases, you are right.
Both of these are IP addresses; IPv4 (IP version 4) addresses to be specific.

Every host on the network needs a unique identifier for other hosts to communicate with
him. Without a unique identifier, the host cannot be found without ambiguity. When
using the TCP/IP protocol suite, we need to assign an IP address for each device
connected to the network.

One analogy of an IP address is your home postal address. Your postal address allows
you to receive letters and parcels from all over the world. Furthermore, it can identify
your home without ambiguity; otherwise, you cannot shop online!

As you might already know, we have IPv4 and IPv6 (IP version 6). IPv4 is still the most
common, and whenever you come across a text mentioning IP without the version, we
expect them to mean IPv4.

So, what makes an IP address? An IP address comprises four octets, i.e., 32 bits. Being
8 bits, an octet allows us to represent a decimal number between 0 and 255. An IP
address is shown in the image below.
At the risk of oversimplifying things, the 0 and 255 are reserved for the network and
broadcast addresses, respectively. In other words, [Link] is the network
address, while [Link] is the broadcast address. Sending to the broadcast
address targets all the hosts on the network. With simple math, you can conclude that
we cannot have more than 4 billion unique IPv4 addresses. If you are curious about the
math, it is approximately 232 because we have 32 bits. This number is approximate
because we didn’t consider network and broadcast addresses.

Looking Up Your Network Configuration

You can look up your IP address on the MS Windows command line using the
command ipconfig. On Linux and UNIX-based systems, you can issue the command
ifconfig or ip address show, which can be typed as ip a s. In the terminal
window below, we show ifconfig.

Terminal
user@TryHackMe$ ifconfig
[...]
wlo1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
inet [Link] netmask [Link] broadcast
[Link]
inet6 fe80::73e1:ca5e:3f93:b1b3 prefixlen 64 scopeid
0x20<link>
ether cc:5e:f8:02:21:a7 txqueuelen 1000 (Ethernet)
RX packets 19684680 bytes 18865072842 (17.5 GiB)
RX errors 0 dropped 364 overruns 0 frame 0
 TX packets 14439678 bytes 8773200951 (8.1 GiB)
TX errors 0 dropped 0 overruns 0 carrier 0 collisions
0

The terminal output above indicates the following:

●​ The host (laptop) IP address is [Link]

●​ The subnet mask is [Link]
●​ The broadcast address is [Link]

Let’s use ip a s to compare how the network card IP address is presented.

Terminal
user@TryHackMe$ ip a s
[...]
4: wlo1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc
noqueue state UP group default qlen 1000
link/ether cc:5e:f8:02:21:a7 brd ff:ff:ff:ff:ff:ff
altname wlp3s0
inet [Link]/24 brd [Link] scope global
dynamic noprefixroute wlo1
valid_lft 36795sec preferred_lft 36795sec
inet6 fe80::73e1:ca5e:3f93:b1b3/64 scope link noprefixroute
valid_lft forever preferred_lft forever

The terminal output above indicates the following:

●​ The host (laptop) IP address is [Link]/24

●​ The broadcast address is [Link]

If you are wondering, a subnet mask of [Link] can also be written as /24.
The /24 means that the leftmost 24 bits within the IP address do not change across the
network, i.e., the subnet. In other words, the leftmost three octets are the same across
the whole subnet; therefore, we can expect to find addresses that range from
[Link] to [Link]. Similar to what was mentioned earlier,
[Link] and [Link] are the network and broadcast addresses,
respectively.

Private Addresses
As we are explaining IP addresses, it is useful to mention that for most practical
purposes, there are two types of IP addresses:

●​ Public IP addresses
●​ Private IP addresses

RFC 1918 defines the following three ranges of private IP addresses:

●​ [Link] - [Link] (10/8)

●​ [Link] - [Link] (172.16/12)
●​ [Link] - [Link] (192.168/16)

We presented earlier an analogy stating that a public IP address is like your home
postal address. A private IP address is different; the original idea is that it cannot reach
or be reached from the outside world. It is like an isolated city or a compound, where all
houses and apartments are numbered systematically and can easily exchange mail with
each other, but not with the outside world. For a private IP address to access the
Internet, the router must have a public IP address and must support Network Address
Translation (NAT). At this stage, let’s not worry about understanding how NAT works, as
we will revisit it later in this module.

Before moving on, I recommend memorising the private IP address ranges. Otherwise,
you might see an IP address such as [Link] or [Link] and try to access it
from a public IP address.

Routing
A router is like your local post office; you hand them the mail parcel, and they would
know how to deliver it. If we dig deeper, you might mail something to an address in
another city or country. The post office will check the address and decide where to send
it next. For example, if it is to leave the country, we expect one central office to handle
all shipments abroad.

In technical terms, a router forwards data packets to the proper network. Usually, a data
packet passes through multiple routers before it reaches its final destination. The router
functions at layer 3, inspecting the IP address and forwarding the packet to the best
network (router) so the packet gets closer to its destination.
UDP and TCP
The IP protocol allows us to reach a destination host on the network; the host is
identified by its IP address. We need protocols that would enable processes on
networked hosts to communicate with each other. There are two transport protocols to
achieve that: UDP and TCP.

UDP
UDP (User Datagram Protocol) allows us to reach a specific process on this target host.
UDP is a simple connectionless protocol that operates at the transport layer, i.e., layer
4. Being connectionless means that it does not need to establish a connection. UDP
does not even provide a mechanism to know that the packet has been delivered.

An IP address identifies the host; we need a mechanism to determine the sending and
receiving process. This can be achieved by using port numbers. A port number uses
two octets; consequently, it ranges between 1 and 65535; port 0 is reserved. (The
number 65535 is calculated by the expression 216 − 1.)

A real-life example similar to UDP is the standard mail service, with no delivery
confirmation. In other words, there is no guarantee that the UDP packet has been
received successfully, similar to the case of sending a parcel using standard mail with
no confirmation of delivery. In the case of standard mail, it means a cheaper cost than
the mail delivery options with confirmation. In the case of UDP, it means better speed
than a transport protocol that provides “confirmation.”

But what if we want a transport protocol that acknowledges received packets? The
answer lies in using TCP instead of UDP.

TCP
TCP (Transmission Control Protocol) is a connection-oriented transport protocol. It uses
various mechanisms to ensure reliable data delivery sent by the different processes on
the networked hosts. Like UDP, it is a layer 4 protocol. Being connection-oriented, it
requires the establishment of a TCP connection before any data can be sent.
In TCP, each data octet has a sequence number; this makes it easy for the receiver to
identify lost or duplicated packets. The receiver, on the other hand, acknowledges the
reception of data with an acknowledgement number specifying the last received octet.

A TCP connection is established using what’s called a three-way handshake. Two flags
are used: SYN (Synchronise) and ACK (Acknowledgment). The packets are sent as
follows:

1.​ SYN Packet: The client initiates the connection by sending a SYN packet to the
server. This packet contains the client’s randomly chosen initial sequence
number.
2.​ SYN-ACK Packet: The server responds to the SYN packet with a SYN-ACK
packet, which adds the initial sequence number randomly chosen by the server.
3.​ ACK Packet: The three-way handshake is completed as the client sends an ACK
packet to acknowledge the reception of the SYN-ACK packet.

Similar to UDP, TCP identifies the process of initiating or waiting (listening) for a
connection using port numbers. As stated, a valid port number ranges between 1 and
65535 because it uses two octets and port 0 is reserved.

Encapsulation
Before wrapping up, it is crucial to explain another key concept: encapsulation. In this
context, encapsulation refers to the process of every layer adding a header (and
sometimes a trailer) to the received unit of data and sending the “encapsulated” unit to
the layer below.

Encapsulation is an essential concept as it allows each layer to focus on its intended

function. In the image below, we have the following four steps:

●​ Application data: It all starts when the user inputs the data they want to send
into the application. For example, you write an email or an instant message and
hit the send button. The application formats this data and starts sending it
according to the application protocol used, using the layer below it, the transport
layer.
●​ Transport protocol segment or datagram: The transport layer, such as TCP or
UDP, adds the proper header information and creates the TCP segment (or
UDP datagram). This segment is sent to the layer below it, the network layer.
 ●​ Network packet: The network layer, i.e. the Internet layer, adds an IP header to
the received TCP segment or UDP datagram. Then, this IP packet is sent to the
layer below it, the data link layer.
●​ Data link frame: The Ethernet or WiFi receives the IP packet and adds the
proper header and trailer, creating a frame.

We start with application data. At the transport layer, we add a TCP or UDP header to
create a TCP segment or UDP datagram. Again, at the network layer, we add the
proper IP header to get an IP packet that can be routed over the Internet. Finally, we
add the appropriate header and trailer to get a WiFi or Ethernet frame at the link layer.

The process has to be reversed on the receiving end until the application data is
extracted.

The Life of a Packet

Based on what we have studied so far, we can explain a simplified version of the
packet’s life. Let’s consider the scenario where you search for a room on TryHackMe.

1.​ On the TryHackMe search page, you enter your search query and hit enter.
2.​ Your web browser, using HTTPS, prepares an HTTP request and pushes it to the
layer below it, the transport layer.
3.​ The TCP layer needs to establish a connection via a three-way handshake
between your browser and the TryHackMe web server. After establishing the
TCP connection, it can send the HTTP request containing the search query.
Each TCP segment created is sent to the layer below it, the Internet layer.
4.​ The IP layer adds the source IP address, i.e., your computer, and the destination
IP address, i.e., the IP address of the TryHackMe web server. For this packet to
reach the router, your laptop delivers it to the layer below it, the link layer.
5.​ Depending on the protocol, The link layer adds the proper link layer header and
trailer, and the packet is sent to the router.
6.​ The router removes the link layer header and trailer, inspects the IP destination,
among other fields, and routes the packet to the proper link. Each router repeats
this process until it reaches the router of the target server.

The steps will then be reversed as the packet reaches the router of the destination
network. As we cover additional protocols, we will revisit this exercise and create a
more in-depth version.
Have you ever wondered how your computer can dynamically configure its network
settings when you turn it on or connect it to a new network? Have you ever wanted to
know how many devices and countries your packets passed through before reaching
their destination? Are you curious how all your home devices can access the Internet
even though your ISP gives you a single IP address?

If you want to know the answers to these questions, among others, then this room is for
you.

This room is the second room in a series of four rooms about computer networking:

●​ Networking Concepts
●​ Networking Essentials (this room)
●​ Networking Core Protocols
●​ Networking Secure Protocols

Learning Prerequisites
To benefit from this room, we recommend that you know the following:
 ●​ ISO OSI model and layers
●​ TCP/IP model and layers
●​ Ethernet, IP, and TCP protocols

In other words, starting this room after Networking Concepts is the recommended
approach.

Learning Objectives
The objective of this room is to teach you about various standard protocols and
technologies that glue things together:

●​ Dynamic Host Configuration Protocol (DHCP)

●​ Address Resolution Protocol (ARP)
●​ Network Address Translation (NAT)
●​ Internet Control Message Protocol (ICMP)
●​ Ping
●​ Traceroute

DHCP: Give Me My Network Settings

You went to your favourite coffee shop, grabbed your favourite hot drink, and opened
your laptop. Your laptop connected to the shop’s WiFi and automatically configured the
network, so you could now work on a new TryHackMe room. You didn’t type a single IP
address, yet your device is all set up. Let’s see how this happened.

Whenever we want to access a network, at the very least, we need to configure the
following:

●​ IP address along with subnet mask

●​ Router (or gateway)
●​ DNS server

Whenever we connect our device to a new network, the above configurations must be
set according to the new network. Manually configuring these settings is a good option,
especially for servers. Servers are not expected to switch networks; you don’t carry your
domain controller and connect it to the coffee shop WiFi. Moreover, other devices need
to connect to the servers and expect to find them at specific IP addresses.
Having an automated way to configure connected devices has many advantages. First,
it would save us from manually configuring the network; this is extremely important,
especially for mobile devices. Secondly, it saves us from address conflicts, i.e., when
two devices are configured with the same IP address. An IP address conflict would
prevent the involved hosts from using the network resources; this applies to local
resources and the Internet. The solution lies in using Dynamic Host Configuration
Protocol (DHCP). DHCP is an application-level protocol that relies on UDP; the server
listens on UDP port 67, and the client sends from UDP port 68. Your smartphone and
laptop are configured to use DHCP by default.

DHCP follows four steps: Discover, Offer, Request, and Acknowledge (DORA):

1.​ DHCP Discover: The client broadcasts a DHCPDISCOVER message seeking

the local DHCP server if one exists.
2.​ DHCP Offer: The server responds with a DHCPOFFER message with an IP
address available for the client to accept.
3.​ DHCP Request: The client responds with a DHCPREQUEST message to
indicate that it has accepted the offered IP.
4.​ DHCP Acknowledge: The server responds with a DHCPACK message to
confirm that the offered IP address is now assigned to this client.

The following packet capture shows the four steps explained above. In this example, the
client gets the address [Link].

Terminal
user@TryHackMe$ tshark -r [Link] -n
1 0.000000 [Link] → [Link] DHCP 342 DHCP
Discover - Transaction ID 0xfb92d53f
2 0.013904 [Link] → [Link] DHCP 376 DHCP
Offer - Transaction ID 0xfb92d53f
 3 4.115318 [Link] → [Link] DHCP 342 DHCP
Request - Transaction ID 0xfb92d53f
4 4.228117 [Link] → [Link] DHCP 376 DHCP ACK
- Transaction ID 0xfb92d53f

In the DHCP packet exchange, we can notice the following:

●​ The client starts without any IP network configuration. It only has a MAC address.
In the first and third packets, DHCP Discover and DHCP Request, the client
searching for a DHCP server still has no IP network configuration and has not yet
used the DHCP server’s offered IP address. Therefore, it sends packets from the
IP address [Link] to the broadcast IP address [Link].
●​ As for the link layer, in the first and third packets, the client sends to the
broadcast MAC address, ff:ff:ff:ff:ff:ff (not shown in the output
above). The DHCP server offers an available IP address along with the network
configuration in the DHCP offer. It uses the client’s destination MAC address. (It
used the proposed IP address in this example system.)

At the end of the DHCP process, our device would have received all the configuration
needed to access the network or even the Internet. In particular, we expect that the
DHCP server has provided us with the following:

●​ The leased IP address to access network resources

●​ The gateway to route our packets outside the local network
●​ A DNS server to resolve domain names (more on this later)

ARP: Bridging Layer 3 Addressing to Layer 2 Addressing

We have stated in the Networking Concepts room that as two hosts communicate over
a network, an IP packet is encapsulated within a data link frame as it travels over layer
2. Remember that the two common data link layers we use are Ethernet (IEEE 802.3)
and WiFi (IEEE 802.11). Whenever one host needs to communicate with another host
on the same Ethernet or WiFi, it must send the IP packet within a data link layer frame.
Although it knows the IP address of the target host, it needs to look up the target’s MAC
address so the proper data link header can be created.

As you would remember, a MAC address is a 48-bit number typically represented in

hexadecimal notation; for example, 7C:DF:A1:D3:8C:5C and 44:DF:65:D8:FE:6C
are two MAC addresses on my network.
However, the devices on the same Ethernet network do not need to know each other’s
MAC addresses all the time; they only need to know each other’s MAC addresses while
communicating. Everything revolves around IP addresses. Consider this scenario: You
connect your device to a network, and if the network has a DHCP server, your device is
automatically configured to use a specific gateway (router) and DNS server.
Consequently, your device knows the IP address of the DNS server to resolve any
domain name; moreover, it knows the IP address of the router when it needs to send
packets over the Internet. In all this scenario, no MAC addresses are revealed.
However, two devices on the same Ethernet cannot communicate without knowing each
other’s MAC addresses.

As a reminder, in the screenshot below, we see an IP packet within an Ethernet frame.

The Ethernet frame header contains:

●​ Destination MAC address

●​ Source MAC address
●​ Type (IPv4 in this case)

Address Resolution Protocol (ARP) makes it possible to find the MAC address of
another device on the Ethernet. In the example below, a host with the IP address
[Link] wants to communicate with another system with the IP address
[Link]. It sends an ARP Request asking the host with the IP address
[Link] to respond. The ARP Request is sent from the MAC address of the
requester to the broadcast MAC address, ff:ff:ff:ff:ff:ff as shown in the first
packet. The ARP Reply arrived shortly afterwards, and the host with the IP address
[Link] responded with its MAC address. From this point, the two hosts can
exchange data link layer frames.

Terminal
user@TryHackMe$ tshark -r [Link] -Nn
1 0.000000000 cc:5e:f8:02:21:a7 → ff:ff:ff:ff:ff:ff ARP 42
Who has [Link]? Tell [Link]
2 0.003566632 44:df:65:d8:fe:6c → cc:5e:f8:02:21:a7 ARP 42
[Link] is at 44:df:65:d8:fe:6c

If we use tcpdump, the packets will be displayed differently. It uses the terms ARP
Request and ARP Reply. For your information, the output is shown in the terminal
below.

Terminal
user@TryHackMe$ tcpdump -r [Link] -n -v
17:23:44.506615 ARP, Ethernet (len 6), IPv4 (len 4), Request
who-has [Link] tell [Link], length 28
17:23:44.510182 ARP, Ethernet (len 6), IPv4 (len 4), Reply
[Link] is-at 44:df:65:d8:fe:6c, length 28

An ARP Request or ARP Reply is not encapsulated within a UDP or even IP packet; it is
encapsulated directly within an Ethernet frame. The following ARP Reply shows this.
ARP is considered layer 2 because it deals with MAC addresses. Others would argue
that it is part of layer 3 because it supports IP operations. What is essential to know is
that ARP allows the translation from layer 3 addressing to layer 2 addressing.

ICMP: Troubleshooting Networks

Internet Control Message Protocol (ICMP) is mainly used for network diagnostics and
error reporting. Two popular commands rely on ICMP, and they are instrumental in
network troubleshooting and network security. The commands are:

●​ ping: This command uses ICMP to test connectivity to a target system and
measures the round-trip time (RTT). In other words, it can be used to learn that
the target is alive and that its reply can reach our system.
●​ traceroute: This command is called traceroute on Linux and UNIX-like
systems and tracert on MS Windows systems. It uses ICMP to discover the
route from your host to the target.

Ping
You may have never played ping-pong (table tennis) before; however, thanks to ICMP,
you can now play it with the computer! The ping command sends an ICMP Echo
Request (ICMP Type 8). The screenshot below shows the ICMP message within an IP
packet.

The computer on the receiving end responds with an ICMP Echo Reply (ICMP Type 0).
Many things might prevent us from getting a reply. In addition to the possibility of the
target system being offline or shut down, a firewall along the path might block the
necessary packets for ping to work. In the example below, we used -c 4 to tell the
ping command to stop after sending four packets.

Terminal
user@TryHackMe$ ping [Link] -c 4
PING [Link] ([Link]) 56(84) bytes of data.
64 bytes from [Link]: icmp_seq=1 ttl=63 time=11.2 ms
64 bytes from [Link]: icmp_seq=2 ttl=63 time=3.81 ms
64 bytes from [Link]: icmp_seq=3 ttl=63 time=3.99 ms
64 bytes from [Link]: icmp_seq=4 ttl=63 time=23.4 ms

--- [Link] ping statistics ---

4 packets transmitted, 4 received, 0% packet loss, time 3003ms
rtt min/avg/max/mdev = 3.805/10.596/23.366/7.956 ms
The output shows no packet loss; moreover, it calculates the minimum, average,
maximum, and standard deviation (mdev) of the round-trip time (RTT).

Traceroute
How can we make every router between our system and a target system reveal itself?

The Internet protocol has a field called Time-to-Live (TTL) that indicates the maximum
number of routers a packet can travel through before it is dropped. The router
decrements the packet’s TTL by one before it sends it across. When the TTL reaches
zero, the router drops the packet and sends an ICMP Time Exceeded message (ICMP
Type 11). (In this context, “time” is measured in the number of routers, not seconds.)

The terminal output below shows the result of running traceroute to discover the
routers between our system and [Link]. Some routers don’t respond; in other
words, they drop the packet without sending any ICMP messages. Routers that belong
to our ISP might respond, revealing their private IP address. Moreover, some routers
respond and show their public IP address, and this would let us look up their domain
name and discover their geographic location. Finally, there is always a possibility that an
ICMP Time Exceeded message gets blocked and never reaches us.

Terminal
user@TryHackMe$ traceroute [Link]
traceroute to [Link] ([Link]), 30 hops max, 60 byte
packets
1 _gateway ([Link]) 4.414 ms 4.342 ms 4.320 ms
2 [Link] ([Link]) 5.849 ms 5.830 ms 5.811 ms
3 [Link] ([Link]) 11.130 ms 11.111 ms 11.093 ms
4 [Link] ([Link]) 6.156 ms 6.138 ms 6.120 ms
5 * * *
6 * * *
7 * * *
8 [Link] ([Link]) 5.667 ms 8.165 ms 6.861 ms
9 [Link] ([Link]) 50.811 ms
52.857 ms [Link] ([Link]) 52.798 ms
10 [Link] ([Link]) 93.351 ms
79.897 ms 79.804 ms
11 [Link] ([Link]) 62.935
ms 62.908 ms 64.313 ms
12 [Link] ([Link])
141.816 ms 141.782 ms 141.757 ms
13 [Link] ([Link]) 145.786
ms [Link] ([Link]) 141.701
ms 147.586 ms
14 [Link] ([Link])
148.692 ms [Link]
([Link]) 141.615 ms
[Link] ([Link]) 148.168
ms
15 [Link] ([Link]) 141.100 ms
[Link] ([Link]) 140.360 ms
[Link] ([Link]) 140.638 ms
16 [Link] ([Link]) 140.574 ms 140.543 ms
140.514 ms
17 [Link] ([Link]) 140.488 ms 139.397 ms
141.854 ms

The traversed route might change as we rerun the command.

Routing
Consider the network diagram shown below. It only has three networks; however, how
can the Internet figure out how to deliver a packet from Network 1 to Network 2 or
Network 3? Although this is an overly simplified diagram, we need some algorithm to
figure out how to connect Network 1 to Network 2 and Network 3 and vice versa.

Let’s consider a more detailed diagram. The Internet would be millions of routers and
billions of devices. The network below is a tiny subset of the Internet. The mobile user
can reach the web server; however, for this to happen, each router across the path
needs to send the packets via the appropriate link. Obviously, there is more than one
path, i.e., route, connecting the mobile user and the web server. We need a routing
algorithm for the router to figure out which link to use.
The routing algorithms are beyond the scope of this room; however, we will briefly
describe a few routing protocols so that you become familiar with their names:

●​ OSPF (Open Shortest Path First): OSPF is a routing protocol that allows
routers to share information about the network topology and calculate the most
efficient paths for data transmission. It does this by having routers exchange
updates about the state of their connected links and networks. This way, each
router has a complete map of the network and can determine the best routes to
reach any destination.
●​ EIGRP (Enhanced Interior Gateway Routing Protocol): EIGRP is a Cisco
proprietary routing protocol that combines aspects of different routing algorithms.
It allows routers to share information about the networks they can reach and the
cost (like bandwidth or delay) associated with those routes. Routers then use this
information to choose the most efficient paths for data transmission.
●​ BGP (Border Gateway Protocol): BGP is the primary routing protocol used on
the Internet. It allows different networks (like those of Internet Service Providers)
to exchange routing information and establish paths for data to travel between
these networks. BGP helps ensure data can be routed efficiently across the
Internet, even when traversing multiple networks.
●​ RIP (Routing Information Protocol): RIP is a simple routing protocol often used
in small networks. Routers running RIP share information about the networks
they can reach and the number of hops (routers) required to get there. As a
result, each router builds a routing table based on this information, choosing the
routes with the fewest hops to reach each destination.

NAT
As discussed in the Networking Concepts room, we calculated that IPv4 can support a
maximum of four billion devices. With the increase in the number of devices connected
to the Internet, from computers and smartphones to security cameras and washing
machines, it was clear that the IPv4 address space would be depleted quickly. One
solution to address depletion is Network Address Translation (NAT).

The idea behind NAT lies in using one public IP address to provide Internet access to
many private IP addresses. In other words, if you are connecting a company with
twenty computers, you can provide Internet access to all twenty computers by using a
single public IP address instead of twenty public IP addresses. (Note: Technically
speaking, the number of IP addresses is always expressed as a power of two. To be
technically accurate, with NAT, you reserve two public IP addresses instead of
thirty-two. Consequently, you would have saved thirty public IP addresses.)

Unlike routing, which is the natural way to route packets to the destination host, routers
that support NAT must find a way to track ongoing connections. Consequently,
NAT-supporting routers maintain a table translating network addresses between internal
and external networks. Generally, the internal network would use a private IP address
range, while the external network would use a public IP address.

In the diagram below, multiple devices access the Internet via a router that supports
NAT. The router maintains a table that maps the internal IP address and port number
with its external IP address and port number. For instance, the laptop might establish a
connection with some web server. From the laptop perspective, the connection is
initiated from its IP address [Link] from TCP source port number 15401;
however, the web server will see this same connection as being established from
[Link] and TCP port number 19273, as shown in the translation table. The router
does this address translation seamlessly.

Closing Notes
View Site
This room introduced various protocols that we constantly use directly or indirectly. We
have covered ICMP, DHCP, ARP, NAT, and routing. Although we use the Internet daily
without coming across most of this room’s acronyms, these protocols are the foundation
for a functional network.