36 Images Explaining Basic Network Knowledge

Introduction

Click the “Shenzhen Network and Information Security Industry Association” official account below to follow and set it as aStarred. Reply in the background with [Technical] to apply for joining the technical exchange group in the network security industry.

OSI and TCP/IP are very basic yet extremely important knowledge; many knowledge points are interconnected based on them. As the foundation, the deeper you master them, the smoother your understanding of higher layers will be.Today’s article on basic network science will unfold based on the OSI layers.

1Basic Computer Networks1Classification of Computer Networks

Based on the scope of the network: Wide Area Network (WAN), Metropolitan Area Network (MAN), Local Area Network (LAN);

Based on the users of the network: Public network, Private network.

2Hierarchical Structure of Computer NetworksComparison of the TCP/IP four-layer model and the OSI architecture:

3Basic Principles of Hierarchical Design

• Each layer is independent of each other;
• Each layer needs to have sufficient flexibility;
• Complete decoupling between layers.

4 Performance Indicators of Computer Networks

Rate: bps=bit/s;

Delay: transmission delay, propagation delay, queuing delay, processing delay;Round-trip time RTT: the time for a data packet to travel back and forth in end-to-end communication.2Physical LayerFunction of the Physical Layer: Connects different physical devices and transmits bit streams. This layer provides a reliable physical medium for data transmission for upper-layer protocols. In simple terms, the physical layer ensures that raw data can be transmitted over various physical media.Physical Layer Devices:

• Repeater: regenerates signals in the same local area network; the two-port segment must use the same protocol; 5-4-3 rule: In 10BASE-5 Ethernet, a maximum of 4 repeaters can be cascaded, and only 3 of the 5 segments can connect to hosts;

• Hub: regenerates and amplifies signals in the same local area network (multi-port repeater); half-duplex, cannot isolate collision domains or broadcast domains.

Basic Concept of Channels: A channel is a medium for transmitting information in one direction; a communication circuit includes a sending channel and a receiving channel.

• Simplex communication channel: can only communicate in one direction, with no feedback in the reverse direction;
• Half-duplex communication channel: both parties can send and receive information, but not simultaneously;
• Full-duplex communication channel: both parties can send and receive simultaneously.

3Data Link Layer1Overview of the Data Link Layer

The data link layer provides services to the network layer based on the services provided by the physical layer, with its most basic service being the reliable transmission of data from the network layer to the target machine’s network layer at adjacent nodes.The data link layer provides reliable transmission over unreliable physical media.

The functions of this layer include: physical addressing, framing of data, flow control, error detection of data, retransmission, etc.Important knowledge points about the data link layer:

• The data link layer provides reliable data transmission for the network layer;
• The basic data unit is a frame;
• Main protocols: Ethernet protocol;
• Two important device names: Bridge and Switch.

Framing: A “frame” is the basic unit of data in the data link layer:Transparent transmission: “Transparency” means that even if control characters are present in the frame data, they should be treated as if they do not exist. This means adding an escape character ESC before the control character.

2Error Detection in the Data Link Layer

Error detection: Parity check, Cyclic Redundancy Check (CRC)

• Parity check – Limitations: Cannot detect errors when two bits are wrong.
• Cyclic Redundancy Check: Generates a fixed-length checksum based on the data being transmitted or stored.

3Maximum Transmission Unit (MTU)

Maximum Transmission Unit (MTU) refers to the maximum size of a data frame at the data link layer, which is limited by the MTU.

Path MTU: Determined by the minimum MTU in the links.4Detailed Explanation of Ethernet Protocol

MAC Address: Each device has a unique MAC address, which is 48 bits long and represented in hexadecimal.

Ethernet protocol: A widely used local area network technology, it is a data link layer protocol that facilitates the data frame transmission between adjacent devices:

Classification of Local Area Networks:

Ethernet IEEE 802.3

• The first widely deployed high-speed local area network;
• Fast data rates;
• Low hardware costs and low network construction costs.

Ethernet Frame Structure

• Type: Identifies the upper-layer protocol (2 bytes);
• Destination and Source Address: MAC address (6 bytes each);
• Data: Encapsulated upper-layer protocol packets (46~1500 bytes);
• CRC: Cyclic Redundancy Code (4 bytes);
• Minimum Ethernet Frame: The minimum Ethernet frame is 64 bytes; the Ethernet frame consists of 18 bytes excluding the data part; the minimum data part is 46 bytes.

MAC Address (Physical Address, Local Area Network Address)

• MAC address length is 6 bytes, 48 bits;
• MAC addresses are unique, with each network adapter corresponding to one MAC address;
• Typically represented in hexadecimal, with each byte represented as a hexadecimal number, connected by – or :;
• MAC Broadcast Address: FF-FF-FF-FF-FF-FF.

4Network LayerThe purpose of the network layer is to achieve transparent data transfer between two end systems, with specific functions including addressing and routing, establishing, maintaining, and terminating connections. Data exchange technology is based on message switching (mostly replaced by packet switching): using a store-and-forward method, the unit of data exchange is the message.Many protocols are involved in the network layer, including the most important protocol, which is the core protocol of TCP/IP – the IP protocol. The IP protocol is very simple, providing only unreliable, connectionless delivery services. The main functions of the IP protocol include: connectionless datagram transmission, datagram routing, and error control.Protocols that work in conjunction with the IP protocol to implement its functions include the Address Resolution Protocol (ARP), Reverse Address Resolution Protocol (RARP), Internet Control Message Protocol (ICMP), and Internet Group Management Protocol (IGMP).We will summarize specific protocols in the following sections, focusing on the network layer:1. The network layer is responsible for routing data packets between subnets. Additionally, the network layer can implement congestion control, internetworking, and other functions;2. The basic data unit is the IP datagram;3. Major protocols included:

• IP protocol (Internet Protocol);
• ICMP protocol (Internet Control Message Protocol);
• ARP protocol (Address Resolution Protocol);
• RARP protocol (Reverse Address Resolution Protocol).

4. Important devices: Routers.Router-related protocols:

1Detailed Explanation of the IP Protocol

The IP protocol is the core protocol of the Internet network layer.

The emergence of virtual interconnected networks: The actual computer networks are complex; physical devices use the IP protocol to mask the differences between physical networks; when hosts in the network connect using the IP protocol, they do not need to pay attention to network details, thus forming a virtual network.The IP protocol transforms complex physical networks into a virtually interconnected network; it also resolves the issue of data packet transmission paths in the virtual network.Among them, the version refers to the version of the IP protocol, occupying 4 bits, such as IPv4 and IPv6;The header length indicates the length of the IP header, occupying 4 bits, with a maximum value of 15;The total length indicates the total length of the IP datagram, occupying 16 bits, with a maximum value of 65535;TTL indicates the lifespan of the IP datagram in the network, occupying 8 bits;The protocol indicates what specific protocol the IP data carries, such as TCP or UDP.2IP Protocol Forwarding Process

3Subnetting of IP Addresses

Class A (8 network bits + 24 host bits), Class B (16 network bits + 16 host bits), Class C (24 network bits + 8 host bits) can be used to identify hosts or routers in the network, Class D is used for group broadcast addresses, and Class E is reserved.

4 Network Address Translation (NAT) Technology

Used in private networks where multiple hosts access the Internet through a single public IP, which slows down the consumption of IP addresses but increases the complexity of network communication.

NAT Working Principle:For IP datagrams going out from the internal network, replace their IP address with a legitimate public IP address owned by the NAT server and record the replacement relationship in the NAT translation table;

For IP datagrams returning from the public Internet, retrieve the NAT translation table based on the destination IP address and use the retrieved internal private IP address to replace the destination IP address, then forward the IP datagram to the internal network.

5ARP and RARP Protocols

The Address Resolution Protocol (ARP) provides dynamic mapping from the IP address of a network adapter to the corresponding hardware address. It can convert the 32-bit address at the network layer to a 48-bit MAC address at the data link layer.

ARP is plug-and-play, and an ARP table is automatically built without the need for system administrators to configure it.

RARP (Reverse Address Resolution Protocol) can convert a 48-bit MAC address at the data link layer to a 32-bit address at the network layer.

6Detailed Explanation of ICMP Protocol

The Internet Control Message Protocol (ICMP) can report error messages or exceptions, with ICMP messages encapsulated in IP datagrams.

Applications of ICMP Protocol:

• Ping application: Troubleshooting network failures;
• Traceroute application: Can probe the path IP datagrams take in the network.

7 Overview of Routing in the Network Layer

Requirements for Routing Algorithms:

Correct and complete, computationally as simple as possible, adaptable to changes in the network, stable, and fair.Autonomous System (AS):Refers to a group of network devices under a management organization, with autonomous management of the internal network, providing one or more ingress and egress points. The routing protocol within the autonomous system is the Interior Gateway Protocol (IGP), such as RIP, OSPF, etc.; the routing protocol outside the autonomous system is the Exterior Gateway Protocol (EGP), such as BGP.Static Routing:Manually configured, high difficulty and complexity.Dynamic Routing:

• Link State Routing Algorithm (LS): Quickly converges by sending information to all neighboring routers; a global routing selection algorithm, each router must construct the entire network topology when calculating routes; uses Dijkstra’s algorithm to find the shortest path from the source to the destination network; Dijkstra’s algorithm;
• Distance Vector Routing Algorithm (DV): Converges slowly by sending information to all neighboring routers, may have loops; based on the Bellman-Ford equation (B-F equation).

8RIP Protocol in Interior Gateway Routing Protocol

The Routing Information Protocol (RIP) [Application Layer], based on the distance vector routing algorithm, suitable for small networks in smaller autonomous systems; RIP messages are encapsulated in UDP datagrams.

Characteristics of RIP Protocol:

• RIP uses hop count as a metric for path measurement (each router maintains distance records to other routers);
• The cost of RIP is defined between the source router and the destination subnet;
• RIP has a maximum network diameter of 15 hops;
• Exchanges all information with neighbors, active every 30 seconds (broadcast).

9OSPF Protocol in Interior Gateway Routing Protocol

The Open Shortest Path First Protocol (OSPF) [Network Layer], based on the link state routing algorithm (i.e., Dijkstra’s algorithm), suitable for large-scale autonomous systems and large networks, directly encapsulated in IP datagrams for transmission.

Advantages of OSPF Protocol:

• Security;
• Supports multiple paths of equal cost;
• Supports differentiated cost metrics;
• Supports unicast and multicast routing;
• Hierarchical routing.

Comparison of RIP and OSPF (Routing algorithms determine their nature):

10BGP Protocol in Exterior Gateway Routing Protocol

BGP (Border Gateway Protocol) [Application Layer]: A protocol that runs between autonomous systems, finding a good route: initially exchanges all information, then only exchanges changed portions, BGP is encapsulated in TCP segments.

5Transport LayerThe first end-to-end layer, i.e., host-to-host. The transport layer is responsible for segmenting upper-layer data and providing end-to-end, reliable or unreliable transmission.Additionally, the transport layer must handle end-to-end error control and flow control issues.The task of the transport layer is to optimally utilize network resources based on the characteristics of the communication subnet, providing functions for establishing, maintaining, and terminating transmission connections between the session layers of two end systems, responsible for end-to-end reliable data transmission.At this layer, the protocol data unit for information transmission is called a segment or message.The network layer only transmits data packets from the source node to the destination node based on network addresses, while the transport layer is responsible for reliably delivering data to the corresponding port.Key points of the network layer:

• The transport layer is responsible for segmenting upper-layer data and providing end-to-end, reliable or unreliable transmission as well as end-to-end error control and flow control issues;
• Main protocols included: TCP protocol (Transmission Control Protocol), UDP protocol (User Datagram Protocol);
• Important device: Gateway.

1Detailed Explanation of UDP Protocol

UDP (User Datagram Protocol) is a very simple protocol.Characteristics of UDP Protocol:

• UDP is a connectionless protocol;
• UDP cannot guarantee reliable data delivery;
• UDP is message-oriented;
• UDP has no congestion control;
• UDP header overhead is very small.

UDP Datagram Structure:Header: 8B, four fields/2B [Source Port | Destination Port | UDP Length | Checksum] Data Field: Application Data.

2Detailed Explanation of TCP Protocol

TCP (Transmission Control Protocol) is a very complex protocol in computer networks.Functions of TCP Protocol:

• Segments and reassembles application layer messages;
• Realizes multiplexing and decomposition for the application layer;
• Implements end-to-end flow control;
• Congestion control;
• Transport layer addressing;
• Performs error detection on received messages (both header and data parts are checked);
• Implements end-to-end reliable data transmission control between processes.

Characteristics of TCP Protocol:

• TCP is a connection-oriented protocol;
• TCP is a byte stream-oriented protocol;
• A TCP connection has two ends, i.e., point-to-point communication;
• TCP provides reliable transmission services;
• TCP protocol provides full-duplex communication (each TCP connection can only be one-to-one).

Structure of TCP Segments:

Maximum segment length: The maximum length of application layer data encapsulated in a segment.TCP Header:

• Sequence number field: The TCP sequence number is assigned to each byte of application layer data;
• Acknowledgment number field: The expected byte sequence number of data to be received from the other party, i.e., the byte corresponding to this sequence number has not been received, identified as ack_seq;
• The minimum length of the TCP segment header is 20B, and the maximum is 60 bytes. However, the length must be a multiple of 4B.

Function of TCP Flags:

3Basic Principles of Reliable Transmission

Basic Principles:

• Possible issues in data transmission over unreliable transmission channels: bit errors, out-of-order, retransmission, loss;
• Measures taken to achieve reliable data transmission based on unreliable channels.

Error detection: Using coding to detect bit errors during packet transmission.Acknowledgment: The receiving end provides feedback on the reception status to the sender.Retransmission: The sender resends data that the receiver has not correctly received.Sequence number: Ensures data is submitted in order.Timer: Addresses data loss issues.Stop-and-wait protocol: The simplest reliable transmission protocol, but it does not have high utilization of the channel.Continuous ARQ (Automatic Repeat reQuest) protocol: Sliding window + cumulative acknowledgment, significantly improves channel utilization.

Reliable Transmission of TCP Protocol:

Based on the continuous ARQ protocol, in certain situations, retransmission efficiency is not high, and some bytes that have already been successfully received may be retransmitted.

Flow Control of TCP Protocol:

Flow control: Ensures that the sender’s transmission rate is not too fast, and the TCP protocol uses a sliding window to implement flow control.

4Congestion Control of TCP Protocol

Difference between Congestion Control and Flow Control:Flow control considers the control of communication volume point-to-point, while congestion control considers the entire network, which is a global consideration. Methods of congestion control: Slow start algorithm + Congestion avoidance algorithm.Slow Start and Congestion Avoidance:

• [Slow Start] The congestion window grows exponentially from 1;
• When the threshold is reached, it enters [Congestion Avoidance], growing by +1;
• [Timeout], the threshold becomes half of the current cwnd (cannot be <2);
• Then from [Slow Start], the congestion window grows exponentially from 1.

Fast Retransmit and Fast Recovery:

• If the sender receives three duplicate ACKs in a row, it performs [Fast Retransmit] without waiting for the timer to expire;
• Performs [Fast Recovery], the threshold becomes half of the current cwnd (cannot be <2), and from this new ssthresh point enters [Congestion Avoidance].

5Three-way Handshake of TCP Connection (Important)

Instructions for TCP Three-way Handshake:Common Interview Question: Why is Three-way Handshake Necessary?

• First handshake: The client sends a request, at this point the server knows the client can send;
• Second handshake: The server sends a confirmation, at this point the client knows the server can send and receive;
• Third handshake: The client sends a confirmation, at this point the server knows the client can receive.

Establishing Connection (Three-way Handshake):First: The client sends a connection request segment to the server, establishing a connection request control segment (SYN=1), indicating that the sequence number of the first data byte to be transmitted is x, this sequence number represents the sequence number of the entire segment (seq=x); the client enters SYN_SEND (synchronization sending state);Second: The server sends back a confirmation segment, agreeing to establish the new connection (SYN=1), the acknowledgment number field is valid (ACK=1), the server tells the client that the segment sequence number is y (seq=y), indicating that the server has received the client’s segment with sequence number x, and is ready to accept the client’s segment with sequence number x+1 (ack_seq=x+1); the server moves from LISTEN to SYN_RCVD (synchronization received state);Third: The client confirms the same connection with the server. The acknowledgment number field is valid (ACK=1), the sequence number of this segment from the client is x+1 (seq=x+1), and the client expects to receive the server’s segment with sequence number y+1 (ack_seq=y+1); when the client sends ack, the client enters ESTABLISHED state; when the server receives the client’s ack, it also enters ESTABLISHED state; the third handshake can carry data.6 Four-way Handshake of TCP Connection (Important)

Releasing Connection (Four-way Handshake)

First: The client sends a release connection segment to the server, indicating that the data transmission is complete and requesting to release the connection (FIN=1), with the sequence number of the first data byte being x (seq=x); the client’s state changes from ESTABLISHED to FIN_WAIT_1 (waiting for termination state 1);Second: The server sends a confirmation segment to the client, confirming the sequence number field is valid (ACK=1), with the sequence number of transmitted data being y (seq=y), and the server expects to receive the client’s data with sequence number x+1 (ack_seq=x+1); the server’s state changes from ESTABLISHED to CLOSE_WAIT (waiting for closure); the client, upon receiving the ACK segment, changes from FIN_WAIT_1 to FIN_WAIT_2;Third: The server sends a release connection segment to the client, requesting to release the connection (FIN=1), confirming the sequence number field is valid (ACK=1), indicating that the server expects to receive the client’s data with sequence number x+1 (ack_seq=x+1); indicating that the first byte of data transmitted by itself is y+1 (seq=y+1); the server’s state changes from CLOSE_WAIT to LAST_ACK (final confirmation state);Fourth: The client sends a confirmation segment to the server, confirming the sequence number field is valid (ACK=1), indicating that the client’s transmitted data sequence number is x+1 (seq=x+1), indicating that the client expects to receive the server’s data with sequence number y+1+1 (ack_seq=y+1+1); the client’s state changes from FIN_WAIT_2 to TIME_WAIT, waiting for 2MSL time, and then enters CLOSED state; the server, upon receiving the last ACK, changes from LAST_ACK to CLOSED.Why do we need to wait for 2MSL?

• The last message has not been acknowledged;
• Ensure that the sender’s ACK can reach the receiver;
• If no acknowledgment is received within 2MSL time, the receiver will retransmit;
• Ensure that all messages of the current connection have expired.

6Application LayerProvides an interface for operating systems or network applications to access network services. Key points of the application layer:

• The basic unit of data transmission is the message;
• Main protocols included: FTP (File Transfer Protocol), Telnet (Remote Login Protocol), DNS (Domain Name System), SMTP (Simple Mail Transfer Protocol), POP3 (Post Office Protocol), HTTP (Hypertext Transfer Protocol).

1 Detailed Explanation of DNS

DNS (Domain Name System) [C/S, UDP, Port 53]: Solves the problem of complex and hard-to-remember IP addresses, storing and completing the mapping of domain names to IP addresses for the hosts under its jurisdiction.

Order of Domain Name Resolution:

• Browser cache;
• Check the local hosts file;
• Router cache;
• Check DNS servers (local domain, top-level domain, root domain) -> iterative resolution, recursive query.

IP -> DNS service -> easy-to-remember domain name.Domain names consist of dots, letters, and numbers, divided into top-level domains (com, cn, net, gov, org), second-level domains (baidu, taobao, qq, alibaba), and third-level domains (www) (12-2-0852).

2Detailed Explanation of DHCP Protocol

DHCP (Dynamic Host Configuration Protocol): A local area network protocol, an application layer protocol that uses UDP. Its purpose is to automatically assign IP addresses to users temporarily connecting to the local area network.

3Detailed Explanation of HTTP Protocol

File Transfer Protocol (FTP): Control connection (port 21): Controls transfer information (connection, transfer requests) in 7-bit ASCII format. The entire session remains open.

HTTP (HyperText Transfer Protocol) [TCP, Port 80]: A reliable data transmission protocol, where the browser establishes a TCP connection before sending or receiving messages to the server; HTTP uses the TCP connection method (HTTP itself is connectionless).HTTP Request Message Methods:

• GET: Requests specified page information and returns the entity body;
• POST: Submits data to the specified resource for processing;
• DELETE: Requests the server to delete the specified page;
• HEAD: Requests to read the header information of the URL, only returns the message header;
• OPTIONS: Requests information about some options;
• PUT: Stores a document under the specified URL.

(1) Structure of HTTP Operations

(2) Detailed Explanation of HTTPS Protocol

HTTPS (Secure) is a secure version of HTTP, using port 443. Based on the HTTP protocol, it provides encryption for data processing, verifies the identity of the other party, and protects data integrity.The NIS Research Institute compiled and edited this article.If you need to reprint, please leave a message in the background.Source: Network Engineer’s Notes

·END·

Shenzhen Network Security AssociationSubscription Account: NIS Research Institute

For more information, please follow the “Association Service Center” official account.