[Computer Network] Speak clearly "Network Layer" in more than 10,000 words

Network layer

4.1 Two services provided by the network layer

What kind of services should the network layer provide? Whether it is connection-oriented or connectionless has caused long-term controversy, but the essence of the debate is: who is responsible for reliable delivery in computer network communications, whether it is the network or the end system. Some people think that it is necessary to learn from the successful way of telecommunication networks, through a connection-oriented way, establish a virtual circuit before connecting, and use this circuit to communicate in communication. Although it is safe and information will not be lost, it is obvious that such a connection is very good. Complex, and the speed may be relatively slow.

So the pioneers of the Internet adopted a brand-new Internet design idea. The core idea is that computers are smarter than phones and are capable of coping with errors. Therefore, with the network layer upwards, only simple, flexible, unconnected, and best-effort delivery are provided. Datagram service. Each packet is sent independently, and the preceding and following packets are irrelevant, not numbered, errors may be lost and repeated, and the delivery time limit is not guaranteed . In this way, the cost of the network is greatly reduced, the operation mode is flexible, and it can be adapted to a variety of applications.

4.2 Internet Protocol IP

There are three other protocols used in conjunction with the IP protocol: 1. Address Resolution Protocol ARP 2. International Control Message Protocol ICMP 3. International Group Management Protocol IGMP

Virtual internet

Using the IP protocol can make the performance-specific network look like a unified network at the network layer. (Can be understood as hiding differences)

Classified IP address

The classified IP address divides the network into a number of fixed classes. Classes A, B, and C are all composed of fixed-length strings. **The first field represents the network number, which represents the network connected to, which is unique within the entire Internet. The second field is the user number, which marks the host (router). The host number is also unique in the range specified by the network number. **So the IP address is unique.

There are 1, 2, and 3 category bits at the front of the network number field of the A, B, and C addresses, which are 0, 10, and 110 respectively. At the same time, the decibel of their host number field is 1 byte, two bytes, and three bytes long.

The IP address also has the following characteristics:

1. The address consists of two parts, which can be said to be hierarchical. When the address manager allocates IP addresses, only the network number is allocated, and the remaining host numbers are allocated by the network number unit. The router only forwards packets according to the network number, so that the number of items in the routing table is reduced, and the storage space of the routing table and the time for searching the routing table are reduced.
2. In fact, the IP address is the interface that identifies a host and a link. When a host is connected to two networks, there should be two IP addresses.
3. A network refers to a collection of hosts with the same network number, and LANs with different network numbers must be interconnected by routers.

IP address and hardware address

1. Only IP datagrams can be seen on the Internet abstracted by the IP layer, and the source and destination addresses are always IP1 and IP2.
2. The router only performs routing selection based on the network number of the IP address of the destination station.
3. In the link layer of the LAN, only MAC frames can be seen
4. The abstract Internet at the IP layer shields the underlying details. As long as problems are discussed at the network layer, a unified and abstract IP address can be used to study the communication between a host and a host or router.

Address Resolution Protocol ARP

The address resolution protocol ARP will set up an ARP cache in the host. This cache stores the mapping table of each host routing IP address to the hardware address, and this mapping table is also updated regularly to solve the problem of data changes in the table (there may be new The host or the host is removed).

When host A sends data to host B, there are generally the following two situations, in simple terms:

1. The IP address of host B exists in the ARP cache of host A. Obviously, in this case, write the IP address directly into the MAC frame and then transmit it.
2. The IP address of host B does not exist in host A. In this case, host A will broadcast an ARP request packet to hosts on the LAN, similar to "My IP address is XXX, MAC address is XXX, and IP address is ZZZ. What is your MAC address", the host that is not the ZZZMAC address will ignore the request packet, and the IP address of host B is the same as the address to be queried in host A, so it writes its own MAC address into the ARP request packet, and Unicast to A. Host B will also store A's IP address and MAC address mapping in his own ARP cache.

The mapping in the ARP cache still has a time to live. Anything that exceeds the time to live will be deleted. This is to prevent the MAC address of a machine from suddenly changing during communication, but the mapping of the IP address and the MAC address remains unchanged, and the two machines cannot communicate with each other.

ARP solves the problem of mapping between the IP address and MAC address of a host or router on the same LAN. If another host is no longer on the LAN, you can use a router as a relay.

IP datagram format

The IP datagram consists of a header and a data part. The fixed part of the header has a length of 20 bytes and has an optional field with variable length.

1. Version: the IP protocol version used.
2. Header length: 4 digits in total, up to 15 in decimal. A unit represents 4 bytes. Since the fixed length of the header is 20 bytes, the minimum value of the header length area is 5. If the extra length is not a multiple of 4, the padding part will automatically add 0 to ensure the header The length is a multiple of 4 bytes.
3. Differentiated Services: This attribute is useless.
4. Total length, record the total length of the IP datagram. There are 16 bits, so the maximum length of the datagram is 65535 bytes, which is actually impossible. The data link layer below each IP layer specifies the MTU. Data larger than the MTU must be transmitted in fragments. During fragment transmission, a copy of the datagram header must be placed in the header of each fragment.
5. Identification: It is not a number , but only used to mark the record. In the case of fragmented transmission, the identification is used to determine which datagram fragments belong to the original datagram.
6. Logo: Three, only two are meaningful at present. Lowest bit MF: Indicates that there are more fragments to follow. The middle bit DF indicates whether fragmentation can be performed, and a value of 0 indicates that fragmentation is possible.
7. Slice offset: Point out the relative position of the data slice in the original packet. The slice offset is based on 8 bytes as the offset unit, which means that except for the last data slice, the length of the other data slices is 8 Multiples of.
8. Time to live: Prevent datagrams from going around in the network without restrictions, and destroy them as soon as the time to live is reached. The survival time represents the "hop limit", which means that it can pass through a few routers at most. Without a router, the survival time is -1.
9. Protocol: This protocol indicates which protocol the data carried by the datagram belongs to, so that the IP layer of the destination host knows which upper layer protocol to deliver the IP datagram to for processing.
10. Header checksum: This field is used to check the header of the datagram. The data part is not checked, and CRC is not used.
11. Source address: 12 bits, all you know.
12. Destination address: 12 digits, all you know.
13. Variable part: There are various uses, the function is very rich, and it is not explained in detail. But it is also because of the variable part, which increases the overhead of the router to process the datagram.

The process of forwarding packets at the ip layer

Although all packet forwarding on the Internet is based on the network where the destination host is located, in most cases, a special case is allowed, that is, specifying a route to a specific destination host. This type of routing is called a specific host route .

There is also a default route. The simple understanding is to look up other items in the routing table. If no suitable one is found, the default route is used to deliver the datagram to the next hop indicated by the default route. This is applicable to a network. Few external connections.

When a router receives the datagram to be forwarded and obtains the IP address of the next hop from the routing table, it does not fill this data into the IP datagram, but sends it to the network interface software of the data link layer. The interface software will The IP address is converted into a MAC address through ARP, the MAC address is placed in the header of the MAC frame, and then forwarded to the next-hop router according to the hardware address.

The process of IP forwarding is not to know the forwarding path directly, but to take one step at a time.

4.3 Dividing subnets and constructing supernets

Subnet

• From secondary address to tertiary address

  From the second-level address to the third-level address, why divide subnets.

  1. The utilization rate of IP addresses is low, and a company may apply for Class B addresses, resulting in a lot of waste of addresses.
  2. Assigning a network number to each physical network will make the routing table too large and inefficient.
  3. The secondary IP address is not flexible enough, and the speed of emergency network opening is slow.

  Therefore, since 1985, the subnet number field has been added to the IP address, and the IP address has been changed from two levels to three levels. It is more flexible to use. This is called subnetting. At present, subnetting has become the official standard of the Internet.

The subnet number is separated from the host number.

• Subnet mask

  It cannot be seen from the IP datagram header that the network of the source host or the destination host is divided into subnets. Therefore, one more thing is needed to determine the network address, that is, the subnet mask.

  To make a long story short, the typical feature of the subnet mask is that the first bits are all 1, and the following bits are all 0. It is mainly used to determine the forwarding network address, and the destination IP address and the subnet mask are bitwise AND operated according to the subnet mask. The characteristics of the netmask, the host number and 0 phase and all become 0, the rest is the network number and 1 phase and equal to the network address itself, the obtained network address is compared with the network address on the router routing table, The router knows whether to forward.

  The jump when using the subnet is very similar to the previous one:

Construct a super network (no classification system CIDR)

• Network prefix

  The main features of CIDR:

  1. The concept of traditional ABC address division is eliminated, and the concept of subnetting is eliminated.
  2. The IP address is composed of a network prefix and a host number, and the slash method is invented (the slash represents the first few 1s of the mask).

  There are many addresses in a CIDR address block, and the CIDR address block is used in the routing table to find the destination network. This kind of address aggregation is called route aggregation.

• Longest prefix match

  When looking up the routing table in the routing table, more than one matching result may be obtained. In this case, the longest matching result must be selected.

  Matching involves matching algorithms. The simplest algorithm is to directly extract M bits from the address for each possible network prefix length, and then find a match related to M bits in the router. This algorithm is simple, but once the router If there is no address in the file, the algorithm has to be executed 32 times, which is inefficient.

  In order to improve efficiency, binary clue search will be adopted. Find out the unique prefix corresponding to each IP address to construct a binary tree, so that each address corresponds to a unique leaf node. Now consider two cases. The first is that there is no corresponding destination IP address in the routing table, so that when searching, the corresponding unique prefix will not be found, and the search can be stopped directly. The second is that the leaf can be found. Node. At this time, the destination address and the mask of the leaf node must be ANDed to see if they can match.

4.4 International Control Message Protocol ICMP

In order to more effectively forward IP datagrams and increase the chance of successful delivery, the international control message protocol ICMP is used at the Internet layer. ICMP allows hosts or routers to report errors and provide reports on exceptions. ICMP is the standard protocol of the Internet. But ICMP is not a high-level protocol, it is an IP layer protocol, and it is encapsulated in the data part of the IP datagram.

Types of ICMP messages

There are two types of ICMP messages, namely ICMP error messages and ICMP query messages.

The first 4 bytes of the ICMP message are in a unified format, and there are three fields: type, code, and checksum. The next 4 bytes are related to the content of ICMP. And according to the different content, the transmission of the data field is also different.

The following is the format of the ICMP error message:

The following are the situations in which messages should not be sent:

Application examples of ICMP

The ping command and tracert command are examples of ICMP applications, and are examples of the application layer directly using ICMP at the network layer.

The principle of the ping command: Send 4 ICMP echo request messages to the destination host, and wait for the destination host to send back.

The principle of the tracert command: It continuously sends IP datagrams to the destination host, and the UDP user datagrams that cannot be interacted are encapsulated in the data packets. Constantly set the value of TTL to 1, 2, 3, 4... In this way, after the TTL expires on the way, the router will send back the packet that has exceeded the time, and when it reaches the destination host, it will send back the unreachable packet, so the function is realized .

4.5 Internet routing protocol

• Internal Gateway Protocol RIP

  It is a distributed vector-based routing protocol. The distance to the directly connected network is 1, and the others are incremented by 1. The maximum distance can only contain 15 routers. When the distance is equal to 16, it is equal to unreachable. Therefore, RIP is only a small The internet. You cannot choose multiple routes between two networks. Even if one route is faster, always choose the route with fewer routers.

Good news travels quickly, but bad news travels slowly. The biggest advantage is that the implementation is simple and the overhead is relatively small.

• Internal Gateway Protocol OSPF

  Use a distributed link state protocol.

The fast convergence of the update process is its advantage.

4.8 Virtual Private Network VPN and Network Address Translation NAT

• Virtual Private Network VPN

  The local address needed in the actual life production needs:

  1. The IP address that a company can apply for is much smaller than the IP address that the organization can assign to him. Many hosts in the company only need internal communication and do not need to connect to the external Internet, because it does not access the outside, and the external Internet is not So safe.
  2. If a large number of internal hosts in the company randomly allocate IP addresses, if they suddenly want to access the outside world, their IP addresses may be the same as the external IP addresses.

  In order to solve these problems, and to meet the needs of a large number of local addresses, RCF1918 specified some private network addresses. They specified some IP addresses as internal private addresses and cannot be used to access the outside. When the router encounters a private address, Do not forward them.

  A network using such a dedicated IP can become a dedicated Internet. In the dedicated Internet in many different places, there are likely to be many IP addresses that are duplicated, because they may all use the internal dedicated IP addresses mentioned above.

  Now a new demand has arisen. A company may have multiple agencies distributed in various places, and employees may also be distributed in various places. Then how to meet the security needs of internal communications?

  The first case is to find a dedicated organization to set up a dedicated line, which is obviously too expensive; the second method is to use the Internet, and different internal organizations communicate on the Internet, just like the company’s intranet, but the real Internet is used, and the image is called virtual Private network.

  VPN uses tunnel counting. The simple principle is to encrypt datagrams used for internal communication. After receiving the internally encrypted datagrams, the router will encapsulate the encrypted datagrams into datagrams on the Internet and send it out. Communication between agencies.

• Network Address Translation NAT

  This technology is used when a host with a local address inside accesses the outside, and he just changed the address. Therefore, he needs to use a dedicated NAT router. This router must have an IP that can access the outside. When the internal machine wants to access the outside, the NAT router directly converts the internal address into an IP address that can access the outside.

There will be a map table in the NAT router to record the mapping between the two IPs. Only when the internal host accesses the outside, it will record when it reaches the router, so the outside cannot access the inside.

When NAPT performs address conversion, different hosts use different ports. In the original NAT, one host can only correspond to one external IP, but multiple hosts with NAPT can correspond to one external IP, provided that the port of the external IP is not Was used up.