Computer network notes-1

Computer network notes

ARP

1. Introduction to the basic concepts of ARP

ARP: Address Resolution Protocol
Address resolution is the process of discovering the mapping relationship between two addresses.
ARP provides dynamic mapping from network layer addresses to related hardware addresses

2. MAC address learning process

ARP address resolution occurs in the encapsulation process of the TCP/IP protocol stack from the upper layer to the lower layer. (The third layer encapsulates the IP, the second layer encapsulates the MAC) For
example, the communication process between host A and host B:
1. Determine the IP of host B according to the content of the routing table on host A, and check whether there is a corresponding in the local ARP cache. MAC address
2. If the mapping is not found, it will initiate an ARP request frame (including its own IP and MAC, the requested IP) that asks B’s MAC address, and broadcast it to the local network.
3. After the switch receives the frame, it will The MAC address and port establish a mapping relationship, and generate a corresponding mapping entry, save it in the MAC address table of the switch, and broadcast the frame (except the receiving port).
4. The host on the network checks whether it matches the requested IP, and does not respond if it does not match. If host B matches, the mapping relationship between host A's MAC address and IP will be updated to its own ARP table entry, and an ARP response will be returned through the port in the form of unicast.
5. After receiving the unicast response from host B, the switch updates the source MAC address and corresponding port of the data frame sent by host B to its forwarding table, and then checks its forwarding table to find that the target MAC corresponds to a certain port. Then send back to the target host through this port.

3. MAC address spoofing

The MAC address learning process of the switch is that the switch checks the source MAC address of the received data packet and finds the matching item in the MAC address table. If it does not match, the switch will re-record the MAC address and the port that received the data frame. When sending a forged packet, MAC spoofing is implemented. MAC spoofing will cause a host to fail to receive data and prevent any computer in the LAN from using the network.

Solution:
(For important hosts) Use static entries to avoid ARP requests/responses when searching for the MAC address of a specific IP.

IGMP

IGMP: Internet Group Management Protocol
multicast: multicast

Recipients indicate the traffic they wish to receive by specifying the multicast address and the list of alternative sources. This information is maintained as a soft state in the host and router.
ARP usually determines its MAC address based on the destination IPv4 address. In multicast, an IP multicast address is directly mapped to some corresponding MAC addresses.
In order to effectively carry IP multicast in the link layer network, there should be a one-to-one mapping between data packets and addresses in the IP layer and link layer frames.
IANA has a multicast address space (specifically, 224.0.0.0~239.255.255.255). The
multicast address range is 01:00:5e:00:00:00~01:00:5e:ff:ff:ff.
The IP group address to IEEE 802 MAC address mapping rule is: the first 9 bits are bit replacement, and the last 23 bits are bit duplication.

IGMP is used to let the multicast router know which hosts currently belong to which multicast group. The
multicast router periodically sends IGMP requests to each connected subnet to determine the multicast status.
The host responds with a report to indicate the multicast status; if the status changes, the host can also actively send a report.

Routing table content

destination Destination network segment
Netmask Subnet mask
Gateway Gateway next hop router's ingress ip
Interface Interface to reach the destination of the router's egress ip
Metric Hop number preferentially select the interface with the lowest hop number

TCP/UDP difference

Feature comparison

TCP features
- Advantages
  1. Before transmitting data, there is a three-way handshake to establish a connection
  2. When transmitting data, there are confirmation, window, retransmission, and congestion control mechanisms
  3. After transmitting data, disconnecting is used to save system resources
- Disadvantages
  Slow, low efficiency, high system resource usage, and easy to be attacked.
  Reasons:
  1. TCP connection before data transmission and some mechanisms when transmitting data will consume a lot of time.
  2. Each TCP connection occupies the system's CPU, memory and other resources.
UDP features
- Advantages
  Fast, slightly safer than TCP
  Stateless transmission protocol, very fast data transmission
- Disadvantages
  Unstable, unreliable
  , easy to lose packets when the network quality is poor

Basic difference

Connection-based and connectionless
TCP requires more system resources (system CPU, memory) and less UDP;
UDP program structure is relatively simple
Streaming mode (TCP) and datagram mode (UDP); TCP is oriented to byte streams, in fact TCP treats data as a series of unstructured byte streams; UDP is message-oriented
TCP provides reliable services. The data transmitted through the TCP connection has no errors, no loss, no duplication, and arrives in order; UDP does its best to deliver, that is, reliable delivery is not guaranteed
The logical communication channel of TCP is a full-duplex reliable channel, while UDP is an unreliable channel

Application scenarios

TCP application scenario:
There are requirements for the quality of network communication, and the data must be accurately transmitted to the other party, such as
HTTP, HTTPS, FTP and other file transfer protocols
POP, SMTP and other mail transmission protocols.
Telnet, SSH
UDP application scenarios:
1. Datagram-oriented
2. Network data is mostly short messages
3. Have a large number of Clients
4. No special requirements for data security
5. The network burden is very heavy, but the response speed is high
6. Long video, Real-time system

Reasons for UDP unreliability

UDP has only one socket receiving buffer and no socket sending buffer, that is, as long as there is data, it will be sent, regardless of whether the other party can accept it correctly. After the other party's socket receiving buffer is full, the new datagram cannot enter the socket receiving buffer, and the datagram will be discarded. UDP has no flow control, so UDP data transmission is unreliable.
The sending frequency is too fast to solve the packet loss:
sleep is set during the process of sending the packet , and the program starts to monitor after the program is executed. After receiving a data packet, it returns to the listening state in the shortest time.
Solution of packet loss caused by large sending packet: The
sent packet exceeds mtu, which may exceed the receiver's buffer and cause packet loss. Set the socket receiving buffer
to solve the huge packet loss of sending packet:
split into small packets and send one by one