Internet Protocol

Internet Protocol (IP) provides support at the network layer of the OSI model. All transport protocol data packets such as UDP or TCP are encapsulated in IP data packets to be carried from one host to another. IP is a connection-less unreliable service meaning there is no guarantee that the data will reach the intended host. The datagrams may be damaged upon arrival, out of order, or not arrive at all (Sounds like some mail services, doesn't it?). Therefore the layers above IP such as TCP are responsible for being sure correct data is delivered. IP provides for:

●     Addressing.
●     Type of service specification.
●     Fragmentation and re-assembly.
●     Security.

IP Message Format

IP is defined by RFC 791.

1.  Version (4 bits) - The IP protocol version, currently 4 or 6. 

2.  Header length (4 bits) - The number of 32 bit words in the header 

3.  Type of service (TOS) (8 bits) - Only 4 bits are used which are minimize delay, maximize throughput, maximize reliability, and minimize monetary cost. Only one of these bits can be on. If all bits are off, the service is normal. Some networks allow a set precedences to control priority of messages the bits are as follows:

❍     Bits 0-2 - Precedence.

  ■     111 - Network Control 

  ■     110 - Internetwork Control 

  ■     101 - CRITIC/ECP 

  ■     100 - Flash Override 

  ■     011 - Flash 

  ■     010 - Immediate 

  ■     001 - Priority 

  ■     000 - Routine 

❍     Bit 3 - A value of 0 means normal delay. A value of 1 means low delay. 

❍     Bit 4 - Sets throughput. A value of 0 means normal and a 1 means high throughput. 

❍     Bit 5 - A value of 0 means normal reliability and a 1 means high reliability. 

❍     Bit 6-7 are reserved for future use.

4.  Total length of the IP data message in bytes (16 bits) 

5.  Identification (16 bits) - Uniquely identifies each datagram. This is used to re-assemble the datagram. Each fragment of the datagram contains this same unique number. 

6.  flags (3 bits) - One bit is the more fragments bit

•  Bit 0 - reserved. 
•  Bit 1 - The fragment bit. A value of 0 means the packet may be fragmented while a 1 means it cannot be fragmented. If this value is set and the packet needs further fragmentation, an ICMP error message is generated. 
• Bit 2 - This value is set on all fragments except the last one since a value of 0 means this is the last fragment.

7.  Fragment offset (13 bits) - The offset in 8 byte units of this fragment from the beginning of the original datagram. 

8.  Time to live (TTL) (8 bits) - Limits the number of routers the datagram can pass through. Usually set to 32 or 64. Every time the datagram passes through a router this value is decremented by a value of one or more. This is to keep the datagram from circulating in an infinite loop forever. 

9.  Protocol (8 bits) - It identifies which protocol is encapsulated in the next data area. This is may be one or more of TCP(6), UDP(17), ICMP(1), IGMP(2), or OSPF(89). A list of these protocols and  their associated numbers may be found in the /etc/protocols file on Unix or Linux systems. 

10.  Header checksum (16 bits) - For the IP header, not including the options and data. 

11.  Source IP address (32 bits) - The IP address of the card sending the data. 

12.  Destination IP address (32 bits) - The IP address of the network card the data is intended for. 

13.  Options - Options are: 

❍     Security and handling restrictions

❍     Record route - Each router records its IP address 

❍     Time stamp - Each router records its IP address and time 

❍     Loose source routing - Specifies a set of IP addresses the datagram must go through. 

❍     Strict source routing - The datagram can go through only the IP addresses specified. 

14.  Data - Encapsulated hardware data such as ethernet data.
 

The message order of bits transmitted is 0-7, then 8-15, in network byte order. Fragmentation is handled at the IP network layer and the messages are reassembled when they reach their final destination. If one fragment of a datagram is lost, the entire datagram must be retransmitted. This is why fragmentation is avoided by TCP. The data on the last line, item 14, is ethernet data, or data depending on the type of physical network.

Address Resolution Protocol

ARP and RARP Address Translation

Address Resolution Protocol (ARP) provides a completely different function to the network than Reverse Address Resolution Protocol (RARP). ARP is used to resolve the ethernet address of a NIC from an IP address in order to construct an ethernet packet around an IP data packet. This must happen in order to send any data across the network. Reverse address resolution protocol (RARP) is used for diskless computers to determine their IP address using the network.

Address Resolution Protocol (ARP)

In an earlier section, there was an example where a chat program was written to communicate between

two servers. To send data, the user (Tom) would type text into a dialog box, hit send and the following

happened:

1. The program passed Tom's typed text in a buffer, to the socket.

2. The data was put inside a TCP data packet with a TCP header added to the data. This header

    contained a source and destination port number along with some other information and a

    checksum.

3. The TCP packet was be placed inside an IP data packet with a source and destination IP address

    along with some other data for network management.

4. The IP data packet was placed inside an ethernet data packet. This data packet includes the

    destination and source address of the network interface cards (NIC) on the two computers. The

    address here is the hardware address of the respective cards and is called the MAC address.

5. The ethernet packet was transmitted over the network line.

6. With a direct connection between the two computers, the network interface card on the intended

     machine, recognized its address and grabbed the data.

7. The IP data packet was extracted from the ethernet data packet.

8. The TCP data packet was extracted from the IP data packet.

9. The data was extracted from the TCP packet and the program displayed the retrieved data (text) in

     the text display window for the intended recipient to read.

In step 4 above, the IP data was going to be placed inside an ethernet data packet, but the computer

constructing the packet does not have the ethernet address of the recipient's computer. The computer that is sending the data, in order to create the ethernet part of the packet, must get the ethernet hardware (MAC) address of the computer with the intended IP address. This must be accomplished before the ethernet packet can be constructed. The ethernet device driver software on the receiving computer is not programmed to look at IP addresses encased in the ethernet packet. If it did, the protocols could not be independent and changes to one would affect the other. This is where address resolution protocol (ARP) is used. Tom's computer sends a network broadcast asking the computer that has the recipient's IP address to send it's ethernet address. This is done by broadcasting. The ethernet destination is set with all bits on so all ethernet cards on the network will receive the data packet. The ARP message consists of an ethernet header and ARP packet. The ethernet header contains:

1. A 6 byte ethernet destination address.

2. A 6 byte ethernet source address.

3. A 2 byte frame type. The frame type is 0806 hexadecimal for ARP and 8035 for RARP

The encapsulated ARP data packet contains the following:

1. Type of hardware address (2 bytes). 1=ethernet.

2. Type of protocol address being mapped( 2 bytes). 0800H (hexadecimal) = IP address.

3. Byte size of the hardware address (1 byte). 6

4. Byte size of the protocol address (1 byte). 4

5. Type of operation. 1 = ARP request, 2=ARP reply, 3=RARP request, 4=RARP reply.

6. The sender's ethernet address (6 bytes)

7. The sender's IP address (4 bytes)

8. The recipient's ethernet address (6 bytes)

9. The recipient's IP address (4 bytes)

When the ARP reply is sent, the recipient's ethernet address is left blank.

In order to increase the efficiency of the network and not tie up bandwidth doing ARP broadcasting, each computer keeps a table of IP addresses and matching ethernet addresses in memory. This is called ARP cache. Before sending a broadcast, the sending computer will check to see if the information is in it's ARP cache. If it is it will complete the ethernet data packet without an ARP broadcast. Each entry normally lasts 20 minutes after it is created. RFC 1122 specifies that it should be possible to configure the ARP cache timeout value on the host. To examine the cache on a Windows, UNIX, or Linux computer type "arp -a".

If the receiving host is on another network, the sending computer will go through its route table and determine the correct router (A router should be between two or more networks) to send to, and it will substitute the ethernet address of the router in the ethernet message. The encased IP address will still have the intended IP address. When the router gets the message, it looks at the IP data to tell where to send the data next. If the recipient is on a network the router is connected to, it will do the ARP resolution either using it's ARP buffer cache or broadcasting.

Reverse Address Resolution Protocol (RARP)

As mentioned earlier, reverse address resolution protocol (RARP) is used for diskless computers to determine their IP address using the network. The RARP message format is very similar to the ARP format. When the booting computer sends the broadcast ARP request, it places its own hardware address in both the sending and receiving fields in the encapsulated ARP data packet. The RARP server will fill in the correct sending and receiving IP addresses in its response to the message. This way the booting computer will know its IP address when it gets the message from the RARP server.