Networking Fundamentals​, Quick Notes – Protocols Part 1

• To view protocol(s) bound to all NIC:
  • CMD > Powershell > Get-NetAdapterBinding| Format-List

Output listing protocols & services bound to all adapters

• To view protocol(s) bound to a particular NIC:
  • CMD > Powershell > Get-NetAdapterBinding – Name “CONNECTIONNAME”| Format-List

Output listing protocols & services bound to a specific adapter – d) TCP/IPv4, C)TCP/IPv6, b) File and Printer sharing for Microsoft Networks, a) Client for Microsoft Networks and others

• TCP/IPv4 is a protocol stack required for IPv4 connections.
• TCP/IPv6 is a protocol stack required for IPv6 connections.
• File and Printer sharing for Microsoft Networks is a service required for sharing folders, printers and other resources (Microsoft Networks & Microsoft Compatible Networks).
• Client for Microsoft Networks is a service required for accessing resources available on remote computers (Microsoft Networks & Microsoft Compatible Networks).

In simple terms:

• Client for Microsoft Networks Service is bound to TCP/IPv4 & TCP/IPv6.
• File and Printer Sharing Service is bound to TCP/IPv4 & TCP/IPv6.
• & D. TCP/IPv4 & TCP/IPv6 is bound to Local Area Connection (which refers to one NIC).

Note: There are many protocols & services bound as per example, not covered here.

IP

• Internet Protocol, Operates at Layer 3.
• Connection-less Protocol.
• Logical Addressing & Routing.
• Doesn’t guarantee delivery of data packets, best efforts model; data integrity handled by TCP or by thenetwork
• Variants
  • IPv4 (IP Version 4)
  • IPv6 (IP Version 6)

IPv4

• Fourth Major Version & First Version for use.
• Uses 32-bit addressing Scheme, 4,294,967,296 (2³²) possible addresses.
• Has two parts – Network ID and Host ID, identified using Subnet Mask.
• IP Address assignments can be Classful or Classless.

Public IP

• Public IP addresses are required for communication on the Internet (Public Network).
• Controlled by Internet Assigned Numbers Authority (IANA).
• IANA is a department operated by ICANN (Internet Corporation for Assigned Names and Numbers).  
• IANA allocates Public IP addresses to RIR (Regional Internet Registries) globally as address blocks.
• Public IP addresses are assigned by Internet Service Providers.

Private IP

• Private IP addresses are reserved for use in private networks (LAN) like home & office networks.
• Private IP address assignments are controlled by the administrator.

Note: Computers/Devices assigned with Private IP addresses cannot communicate with computers/devices assigned with Public IP addresses and Vice Versa; require NAT (Network Address Translation) for communication in such scenarios.

Classful Networks is an addressing scheme introduced in 1981, address space divided into 5 classes:

IP Address Class A, B & C – Network & Host Portions

• Class A
  • First bit set to “0”, leaving the range from 0.0.0.0 to 127.255.255.255 for network ID.
  • Number of Networks: 2⁷– 2 = 126.
  • Number of Hosts Per Network:2²⁴ – 2 = 16,777,214.
  • x.x.x reserved for loopback purposes.
  • Default Subnet Mask: 255.0.0.0 .
  • Private IP Address range: 0.0.0 – 10.255.255.255
• Class B
  • First bit set to “10”, leaving the range from 128.0.0.0 to 191.255.255.255 for network ID
  • Number of Networks: 2¹⁴= 16,384
  • Number of Hosts Per Network:2¹⁶ – 2 = 65,534
  • Default Subnet Mask: 255.255.0.0
  • Private IP Address range: 16.0.0 – 172.31.255.255
• Class C
  • First bit set to “110”, leaving the range from 192.0.0.0 to 223.255.255.255 for network ID
  • Number of Networks: 2²¹= 2,097,152
  • Number of Hosts Per Network: 2⁸-2 = 254
  • Default Subnet Mask: 255.255.255.0
  • Private IP Address range: 168.0.0 – 192.168.255.255
• Class D
  • First bit set to “1110”, leaving the range from 224.0.0.0 to 239.255.255.255 for network ID
  • Reserved for multicast, cannot be used
• Class E
  • First bit set to “1111”, leaving the range from 240.0.0.0 to 255.255.255.255 for network ID
  • Reserved, cannot be used

Note: Cannot use all zeros or ones (binary) for host/network ID.

Special IP addresses:

• 255.255.255 – Used for broadcasting, particularly DHCP clients.
• 254.x.x – Reserved for APIPA.

Note: Understanding IP addressing may take time, additional tutorials may be explored.

CIDR (Classless Inter-Domain Routing)

• Replacement for classful method of allocating IP addresses and routing.
• Based on variable-length subnet masking (VLSM).
• Network & Host ID determined based on Subnet Mask as assigned by an admin.
• Effective management of IP address and reduced (or optimized) entries in routing tables.

To understand, imagine a network with 10 computers:

If Classful method is used, then for:

IP address range: 10.x.x.x

Default Subnet Mask: 255.0.0.0

# of IP addresses available: 16,777,214

If # of IP hosts or computers = 10

Wastage: 16,777,214 – 10 = 16,777,204

In case of CIDR, VLSM applied:

IP address range: 10.x.x.x

If Subnet Mask (VLSM) = 255.255.255.0

# of IP addresses available: 254

Wastage: 254 – 10 = 244

Converting Binary to Decimal, Simple Method

Reference: Power Factor & Value

• If True, then carry forward the actual value
• If False, then leave the value (Write as “0”)

Example 01: All bits = 1

Example 02: All bits = 0

Example 03: Selective bits = 1

Example to understand Network & Host portions of an IP Address

Computer A

IP address: 10.1.1.1

Subnet Mask: 255.0.0.0

	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1
IP	10	1	1	1
Subnet Mask	255	0	0	0
IP Decimal	0 0 0 0 1 0 1 0	0 0 0 0 0 0 0 1	0 0 0 0 0 0 0 1	0 0 0 0 0 0 0 1
Subnet Mask Decimal	1 1 1 1 1 1 1 1	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0
Network ID	0 0 0 0 1 0 1 0	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0
Network ID	10	0	0	0
Host ID	0	1	1	1

Computer B

IP address: 10.1.1.2

Subnet Mask: 255.0.0.0

	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1
IP	10	1	1	2
Subnet Mask	255	0	0	0
IP Decimal	0 0 0 0 1 0 1 0	0 0 0 0 0 0 0 1	0 0 0 0 0 0 0 1	0 0 0 0 0 0 1 0
Subnet Mask Decimal	1 1 1 1 1 1 1 1	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0
Network ID	0 0 0 0 1 0 1 0	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0
Network ID	10	0	0	0
Host ID	0	1	1	2

Computer C

IP address: 11.1.1.1

Subnet Mask: 255.0.0.0

	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1	128 64 32 16 8 4 2 1
IP	11	1	1	1
Subnet Mask	255	0	0	0
IP Decimal	0 0 0 0 1 0 1 1	0 0 0 0 0 0 0 1	0 0 0 0 0 0 0 1	0 0 0 0 0 0 0 1
Subnet Mask Decimal	1 1 1 1 1 1 1 1	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0
Network ID	0 0 0 0 1 0 1 1	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0	0 0 0 0 0 0 0 0
Network ID	11	0	0	0
Host ID	0	1	1	1

	Network ID	Host ID
Computer A	10	1.1.1
Computer B	10	1.1.2
Computer C	11	1.1.1

In above example, network ID’s for computer A & B is 10 indicating they are on same logical network; computer c is on a different logical network hence require IP routing to communicate with computer A and/or B.

Worksheet

A: Convert Binary to Decimal

Octet 1	Octet 2	Octet 3	Octet 4	IP
00001010	00000000	00000000	00000000	10.0.0.0
00001010	00000000	00000000	00000001	10.0.0.1
10001000	00000000	00000000	00001000
01010101	10001000	00100000	00001001
11001100	00110011	00111100	00001100

Convert Decimal to Binary

IP	Octet 1	Octet 2	Octet 3	Octet 4
10.0.0.1	00001010	00000000	00000000	00000001
202.64.32.8
12.4.8.16
192.168.1.1
222.22.2.22

Identify Network & Host ID for IP addresses

IP address	Subnet Mask	Network ID	Host ID
10.1.5.1	255.0.0.0
10.6.1.5	255.0.0.0
10.10.10.5	255.255.0.0
10.10.11.6	255.255.0.0

• View all IP Addresses:
  • CMD > ipconfig

Output listing a) IPv4 Address, b)Subnet Mask & c) Default Gateway

• View all IP Addresses (all details):
  • CMD > ipconfig /all

Output listed a) IPv4 Address assigned by the DHCP server, b) Subnet Mask, c) Lease details, d) Gateway’s IP, e) DHCP Server’s IP address & f) DNS Server’s IP address

• View IP addresses for all connections:
  • CMD > netsh interface ip show config

Output listed using NETSH

• CMD > netsh interface ipv4 show addresses

Output listing IPv4 addresses

• View IPv4 addresses:
  • CMD > Powershell >Get-NetIPAddress -AddressFamily IPv4

Output listing IPv4 Addresses for Wired (Left) & Wireless (Right) Connections

• View network configuration, including usable interfaces, IP addresses, and DNS servers:
  • CMD > Powershell >Get-NetIPConfiguration -All

Output listing network configuration, including usable interfaces, IP addresses, and DNS servers

IPv6

• Most recent version of the Internet Protocol.
• 128 bit addressing scheme.
• 2¹²⁸, or approximately 3.4×10³⁸
• Designed to replace IPv4.
• IPv6 hosts can configure themselves automatically.
• Represented in 8 groups, example: 2001:0db8:85a3:0042:1000:8a2e:0370:7334, displayed through 4 hexadecimal values.

IPv6: Address in 8 groups and 4 hexadecimal values

Note: IPv6 is bit complex for beginners, not covered here.

• View IP address:
  • CMD > ipconfig /all

Output listing IPv6 Address

• View only IPv6 Addresses:
  • CMD > netsh interface ipv6 show addresses

Output listing IPv6 Addresses

• View IPv6 Addresses:
  • CMD > Powershell > Get-NetIPAddress -AddressFamily IPv6

Output listing IPv6 Addresses

DHCP

IP addresses are assigned manually (Static) or automated using DHCP service (Dynamic) by an administrator; assigning IP addresses manually to each computer in a medium or large network is tedious (and increases chances of duplicates due to human error), and using DHCP service is the preferred method as it reduces administrative efforts. Network configuration details such as addresses of DNS servers, IP Gateway, etc. can be pushed along to IP clients.

DHCP is widely used in almost every home & office network. DHCP is also used in places that require temporary connectivity such as hotspots (IP addresses are reassigned to different clients time-to-time).

• Dynamic Host Configuration Protocol, automates IP address assignments.
• DHCP Service is usually included in Wi-Fi/Home Routers, Server Operating Systems, Enterprise Routers & Layer 3 Switchesbut require specific technical expertise to configure depending on the product. DHCP service is mostly automated on devices designed for home use, requiring no administrative effort or technical expertise.
• Connection-less, UDP Ports 67 & 68.
• IP addresses are “leased” for a particular duration (like 2 hour or 2 days) as set by the administrator. IP assigned through DHCP are renewed once the lease expires. There are no guarantees that a DHCP client will receive the same IP as before during renewals (except if it is reserved through a specific mechanism). Lease duration may be adjusted depending on business cases; for example, shorter lease duration like 60 minutes can be set for hot-spots or guest networks at office/home.

DHCP Server (service) 192.168.2.1, allocating IP address to wired and wireless clients from the DHCP range 192.168.1.2 to 192.168.1.254

In above scenario:

• DHCP Server is assigned the IP 192.168.2.1.
• DHCP range is configured to assign 192.168.2.2 to168.2.50 for its clients.
• Wired clients receive IP address from DHCP server.
• Wireless AP is assigned  with static IP 192.168.2.5
• Wireless clients receive IP address from DHCP Server through the Wireless Access Point.

DHCP Process (DORA)

1. DHCPDISCOVER – Client broadcasts, requesting for IP.
2. DHCPOFFER – DHCP Server(s) responds with IP.
3. DHCPREQUEST – DHCP client replies to DHCP server that has sent first (if there are multiple DHCP Servers).
4. DHCPACK – DHCP Server sends acknowledgment to DHCP client, based on its selection.

Link-Local Address

If there are NO IP address assigned (static or dynamic), modern operating systems self-assign an IP address in the range of 169.254.x.x (Subnet mask set as 255.255.0.0) automatically.  This facility is designed as a fallback mechanism for devices to self-assign non-conflicting IP address automatically in order to communicate with each other.

• Reserved IP range: 169.254.0.0 – 169.254.255.255.
• Also referred to as “Auto-IP” or “APIPA”.
• Range can also be manually assigned by the administrator.

For example:

1. DHCP is set to assign 192.168.1.1 to 192.168.1.254.
2. DHCP server fails to issue IP addresses to its clients.
3. DHCP clients self-assign non-conflicting unique IP addresses automatically (DHCP Client 1 may self-assign 169.254.1.12, DHCP Client 2 may self-assign 169.254.3.30 and so on).
4. DHCP clients can communicate with each other (but may not browse the Internet, etc.)

Note: APIPA (Automatic Private IP Addressing) is a term used in Microsoft Windows.

• Check if a computer is configured as a DHCP Client
  • CMD > ipconfig /all Check status: DHCP Enabled: Yes(Indicates its a DHCP client)

Output listing a) DHCP status

Example

• IPv4 address: IP address assigned by the DHCP Server (from DHCP pool 192.168.1.1 to 192.168.1.254).
• Subnet Mask: Subnet Mask assigned by the DHCP Server.
• DHCP Lease:
  • Lease Obtained: Start date & time as set on DHCP Server.
  • Lease Expires: End date & time as set on DHCP Server.
• Default Gateway: IP through which packets to be routed, if the host is on an external network. To communicate with example.com or example.org, 192.168.1.2 will send the packet to 192.168.1.1 which in turn is sent to external host/network.
• DHCP Server: IP address of the DHCP Server.
• DNS Server: IP address of the DNS server. To resolve example.com’s IP address, 192.168.1.2 will send name resolution request to 192.168.1.1; 192.168.1.1 will process the request (internal cache or external DNS) and reply to 192.168.1.2.

Note: IP address range, Subnet Mask, DHCP Lease duration & DNS Server values can be set on a DHCP Server or any device such as a SOHO Router that supports DHCP Service.

• To check if DHCP is enabled or disabled
  • CMD > Powershell > Get-NetIPInterface

Output listing DHCP Status (last column)

• To check DHCP status for a particular adapter
  • CMD > Powershell > Get-NetIPInterface -InterfaceIndex IFINDEX#

Output listing status for a specific adapter using IFINDEX

Microsoft Windows 7 & above include facility to trace network events, through the NETSH utility; this facility can be helpful in understanding and diagnosing network related issues.

• Use NETSH to collect & view DHCP events
• CMD > netsh dhcpclient trace dump

Input to create DHCP trace dump

• View DHCP log file: C:\Windows\System32\LogFiles\WMI\

Folder containing log files

• Open dhcpv4trace.txt & dhcpv6trace.txt in a text editor to observe DHCP process

Computer Names (Microsoft Windows)

• Each computer must have a unique name.
• Also referred to as “hostname”, “NetBIOS name” or “Computer Name”.
• Limited to 15 characters.
• To View or change Computer name:
  • START > RUN > SYSDM.CPL

• Select “Change…” (If computer name needs to be changed).
• Specify a name under “Computer name:” (for example: LAB01).
• Select “OK” Twice and Select “Close”.
• Restart the computer.
• View Computer name:
  • CMD > hostname

Output displaying Computer Name

PING is a command line utility used for testing reach-ability of a host. PING uses ICMP (Internet Control Message Protocol) to send echo request packets, reports statistical summary including round-trip duration, packet loss & errors. This utility works at Network Layer.

ICMP Reference (https://tools.ietf.org/html/rfc792).

To check local computer (IPv4):

• • CMD > ping -4 COMPUTERNAME(or)

Observe computer name resolved to an IP address & replies

• CMD > ping -4 localhost (or)

Output indicates successful replies, observe LOCALHOST resolved to 127.0.0.1

• CMD > ping 127.0.0.1 (or)

Output based on default loopback address

• CMD > ping 128.128.200

Observe results based on any IPv4 loopback range

• To check local computer (IPv6):
  • CMD > ping COMPUTERNAME (or)

Observe computer name resolved to an IPv6 address & replies

• CMD > ping -6 LOCALHOST

Output indicates successful replies, observe LOCALHOST resolved to ::1 (loopback address for IPv6)

Interpreting PING Echo replies, a general approach (additional steps required to understand specific issue):

• Reply from…- Indicates the host has replied.
• Request Timed Out- Indicates a variety of situations:
  • Firewall blocking request.
  • Remote host configured not to respond.
  • Remote host may be down.
• Destination Host Unreachable- Indicates no route to the remote host.
• Network Unreachable- Indicates a there is no route to that particular network.

• To check a domain name using IPv4
  • CMD > ping -4 domainname

Input to test connectivity to a remote device or computer using IPv4

• To check a domain name using IPv6 (If available)
  • CMD > ping -6 domainname

Input to test connectivity to a remote device or computer using IPv6

• To check using a IPv4 address (and to resolve to a domain name)
  • CMD > ping -a IPv4

Input to test connectivity using IPv4 address, and to resolve associated domain name

PING limits 4 echo requests by default, which can be increased or decreased.

• For 5 requests (IPv4)
  • CMD >ping -4 -n # domainname

Input to limit max. 5 requests

• For unlimited (until interruption) requests (IPv4) – Use CTRL+C to stop
  • CMD > ping -4 -t domainname

Output listing 6 replies, a) break applied using CTRL+C

IP Routing

• Process of data transfer by selecting a path between networks.
• Routers exchange data to maintain a route table.
• Routers route packets from source to destination based on the forwarding table.
• Types
  • Static Routing
    • Packets are routed only through fixed path set by an administrator.
    • Packets may not reach the destination if there is problem in fixed path.
    • Suitable for smaller networks or network setups that never change.
  • Dynamic Routing
    • Path automatically determined based on routing table.
    • Packets may take different routes to reach the destination.
    • Alternate path selected automatically if there are traffic or network problems.
    • Suitable for medium, large & very large networks.
    • Utilize protocols such as RIP, OSPF, etc.

Scenario: Two logical networks (192.168.2.x & 192.168.3.x), connected via Router

• OSPF (Open Shortest Path First) uses link state routing algorithm to find the best shortest route; widely used on large enterprise and service provider networks.
• RIP (Routing Information Protocol) uses hop count to find shortest path.

Note: “Hop” refers to passing of packet from one network to another, in general lesser the hop faster the network performance as the path is shorter.

Packets are routed to external IP networks, through the IP specified in “Default Gateway”.

• View Gateway IP:
  • CMD >ipconfig /all

Output listing a) Default Gateway IP address

ROUTE command is used for viewing, setting up & modifying (for static routing) routing tables.

• View Route Table (IPv4):
  • CMD > route -4 print

Output listing IPv4 route table (cache)

• View Route Table (IPv6):
  • CMD > route -6 print

Output listing IPv6 Route Table (Cache)

• View Routing Table (IPv4 & IPv6):
  • CMD > netstat -r

Output displaying IPv4 & IPv6 table

TRACERT (also known as Trace Route) is a command used for viewing route information and transit delays. A packet may take multiple hops from source to destination, which can be viewed through TRACERT.

A packet may take different path from source to destination

• View route taken (IPv4):
  • CMD > tracert -4 domainname

Output listing route taken by a packet using IPv4

• View route taken (IPv6):
  • CMD > tracert -6 domainname

Output listing route taken by a packet using IPv6

• View route without displaying domain names
  • CMD > tracert -ddomainname

Output listing route without resolving domain names

• Set maximum hops (IPv4)
  • CMD >  tracert -4 -h #hopsdomainname

Output listing with results – maximum 5 hops

PATHPING is a more than a combination of both PING & TRACERT, provides detailed statistics between each path from source to destination; helps in understanding routing & related issues such as packet loss & delays.

• View statistics (IPv4):
  • CMD > pathping -4 domainame

Output listing results of route & packet statistics for IPv4

• View statistics (IPv6):
  • CMD > pathping -6 domainname

Output listing results of route & packet statistics for IPv6