Basics
Last updated
Last updated
Physical layer is how we physically connect devices (Ethernet cables, Wireless).
Ethernet cards and Wi-Fi and network hubs all operate at the physical layer.
There are multiple network topologies that we can use to connect devices physically.
Star topology (most common)
Each node is connected to a central node such as a switch
Better performance
Single point of failure
Ring topology
Each node is connected to two other nodes
Data travels in one direction passing through each node to reach its destination
If one node breaks it can disrupt the entire network
Bus topology
Each node is connected to a single cable which all nodes share
The signals travel in both directions
Only one node can transmit at one time
More nodes less performance since all nodes share the same cable
If the main cable breaks it can disrupt the entire network
It is responsible to make devices communicate with each other through the same network but not outside the network.
Each device has its own MAC address (00:11:22:33:44:55) and through this MAC the devices can communicate and send messages to each other.
The first 3 bytes are the manufacturer and the other 3 bytes are the device ID.
The data in network layer 2 (Data Link) is called Frames.
Network switches and Access Points operate at layer 2.
Find MAC address of IP address.
One system broadcast an ARP request to all the systems in the network asking who has this IP address (192.168.1.1), the system that has this IP respond with its MAC address, and then both the systems store each other’s MAC address in their ARP cache so they don’t have to ask again for a while.
The problem with the ARP protocol is that it accepts responses without validation.
Connect separate networks together.
Routers operate at this layer.
Devices at this layer communicate with each other through the IP addresses.
It identifies which part of the IP address is the network identifier and which part is the host identifier.
Classless Inter-Domain Routing (CIDR) is another way to represent the subnet mask.
It’s responsible for routing you from one network to another network and in most cases it will be the first IP in the network.
Automatically assign IP addresses for you, Example:
IP address: 192.168.1.10
Subnet mask: 255.255.255.0
Default gateway: 192.168.1.1
DNS server: 8.8.8.8, 8.8.4.4
In your local network, the DHCP server will be the router itself, but in other enterprise networks, it will be a separate server.
The client sends the DHCP Discover packet to all the network.
DHCP Server (Router) replay with DHCP Offer packet (how about 192.168.1.16).
The client accepts the IP and sends DHCP Request packet with the IP.
DHCP replay with DHCP ACK packet.
Routing is the process of moving packets between networks.
Router is the device that routes the packets between networks.
Router has multiple interfaces and can connect multiple networks at the same time.
Routing Table
It’s a table in the router device like the CAM table in the switch device, which is responsible for determining the next hop (Router) that it should send the packet to it, to reach the final destination. If no route to the destination network is exist, the router will send the packet to its default gateway.
Routing Protocols
Routing protocols are responsible for determining the next hop, shortest path, network changes and link failures.
RIP: determine the shortest path and broadcast the routing table every 30 seconds.
OSPF: detect changes in the network topology and link failures.
BGP: the most widely used protocol, can determine the shortest path and if one route fails, it changes to another route.
Network Address Translation (NAT) it’s a technique for translating one IP address to one or more IP addresses. All the home networks (LAN) are using the NAT protocol.
TTL has a fixed number of almost 64.
It started at 64 and then decrement by 1 at every router (hop or node) until it reached its destination.
This number exists to prevent infinite loops.
Ensure reliable data transfer between hosts.
Determine the successfull transfers and the failed transfers, retransmit the failed ones and reorder the packets to form the original message.
It also provides multiple ports on the same IP address, and it consists of mainly two protocols TCP and UDP.
Ports are used to identify unique services on the same host.
There are 65,536 ports on the TCP protocol and 65,536 ports on the UDP protocol.
Ports(1–1023): Well-known and the most used ports (HTTP, HTTPS, DNS, SMTP, SSH, FTP, TELNET).
Ports(1024–49151): Available ports that can be used.
Ports(49152–65535): Can’t be used because the operating system uses these ports in the outgoing connections.
TCP is the most used protocol. It performs a lot of functions to ensure the validation of data and a reliable connection.
Detect lost or failed data and retransmit it.
Filter if there is duplicate data found.
Reorder the packets if they are unordered.
TCP is designed to ensure accurate delivery not speed.
TCP Flags: It’s a piece of information in the TCP header, added to every packet to help TCP protocol to ensure the accurate delivery (Syn, Ack, Fin, Push, Reset).
UDP operate at the same level as TCP, and is connectionless and stateless which means:
No handshake.
No failure packet detection.
No retransmission.
And because of this UDP is faster than TCP, and it is used in cases where the accuracy is not important like audio/video streaming where one packet lost doesn’t affect the transmission.
Creates and terminates the unique connections between hosts.
It's responsible for encoding and decoding the message and showing the message in the right format (Text, Photo, Video).
Application layer is the end-user interface like web browser, mail client and so on. We will talk about two major application protocols like DNS and HTTP.
It’s used to convert Hostname to IP address like google.com => 172.217.21.78 Operate on UDP port 53.
It’s responsible for transferring the web pages and other files on the World Wide Web Operate on TCP port 80.
HTTP is stateless so if you visit a login page and insert your username and password and now you have access to your account but you closed the page and revisited it, then you will be required to insert your username and password again, it doesn’t remember you, it's stateless.
So now websites use cookies, it’s a piece of information sent in the HTTP header to make the website remember you and don’t ask for your password every time you visit it.
Both are used to retrieve data from the website, but GET passes the variables in the URL and POST passes the variables in the HTTP header.
200: Success
300: Redirect
400: Not Found
