Cisco Certifications

CCNA Syllabus:
https://learningnetwork.cisco.com/docs/DOC-4976

CCIE Security Syllabus:
https://learningnetwork.cisco.com/docs/DOC-7504

CCIE Routing & Switching Syllabus:
https://learningnetwork.cisco.com/docs/DOC-4374

Network packet flow

For a long time, I was thinking of updating the network packet flow, but couldn't get time. I came across the following excellent discussion on it. I'm copy pasting it here for(myself :-)) now. I will trim it in near future. till then please go through the nice explanation done here:

+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

SystemsGM,

I'm assuming that WS1 and WS2 are in seperate networks based on your description.

The scenario of:

WS1 <-Ethernet-> SW1 <-Ethernet-> R1 <-Serial-> R2 <-Ethernet-> SW2 <-Ethernet-> WS2

WS1 IP: 192.168.1.2/24

WS2 IP: 192.168.2.2/24

R1 ethernet interface IP: 192.168.1.1/24

R2 ethernet interface IP: 192.168.2.1/24

WS1 has a packet of IP data destined for WS2.

The first thing WS1 does is determine if the destination of the IP packet is on the same network as itself. If it is, it checks its ARP table to determine if it already has a MAC address that corresponds with the destination IP address and puts that MAC address as the destination MAC for the outbound ethernet frame. If there is no MAC address in the local ARP table for the destination IP address, it sends an ARP request out the ethernet interface requesting 'whomever owns IP address x.x.x.x, please respond with your MAC address'.

If the destination IP address is on a different network, in this case it is, the workstation determines that the packet must be forwarded to the default gateway to be routed to the destination network.

WS1 has 192.168.1.1 as the default gateway, so it verifies if it has the MAC address for that IP address in its local ARP table. If it does not, it sends an ARP request asking 'whomever owns 192.168.1.1, please respond with your MAC address', in which the router will reply with it's MAC address for it's ethernet interface.

WS1 will then put the frame on the ethernet wire with a source MAC address of itself, and a destination MAC address of the ethernet interface of R1.

SW1 will forward the frame based on it's internal MAC forwarding table to the ethernet port that R1 is connected to on the switch. The switch does not alter or strip any layer 2 MAC address information.

R1 will receive the frame on its ethernet interface and will strip off the layer 2 MAC address information and look at the destination IP address and forward/route the packet accordingly.

If a route for a network that contains the 192.168.2.2 (destination IP) is in its routing table, it will forward the packet.

Let's assume that R1 has the 192.168.2.0/24 network in its routing table and the best way to that network is through its serial interface to R2. It will then forward the packet to R2 through that serial interface.

At this point, all of the previous layer 2 information is completely stripped from the packet. The source and destination IP address are kept in tact.

R2 receives the packet (technically a layer 2 frame) on its serial interface and checks the destination IP address of the packet, which in this case is 192.168.2.2. It has a directly connected ethernet interface that is associated/assigned the network that the destination IP address falls within, so it will prepare that packet to be forwarded out its ethernet interface.

The first thing that R2 does is check its local ARP table to determine if it knows what layer 2 MAC address is assigned to 192.168.2.2. If it doesn't have an entry, it will send and ARP request out the ethernet interface, with which WS2 will respond with its MAC address.

Once the destination MAC address is determined for WS2, R2 will add layer 2 information to the IP packet (encapsulating) making it a layer 2 ethernet frame with the source MAC address the MAC address of the ethernet interface of R2 and the destination MAC address the MAC address of WS2. Once the ethernet frame is created, it is forwarded out R2's ethernet interface to SW2.

SW2 then checks its MAC forwarding table to determine which port the destination MAC (WS2) is associated with, and will forward that frame to the port that WS2 is connected.

WS2 then receives the frame, strips the layer 2 information off and processes the IP packet accordingly.

Sorry for such a long winded explanation. Hopefully it was of some use.

Basic rule to remember - source and destination IP address never change between the source and destination device (unless you have a NAT device in the path), but the layer 2 information can change. Layer 2 information doesn't change until the packet has to traverse a layer 3 device (router).

HTH

Mike Morris

-----------------------------------------------------------

Hi guys,

great discussion here, you brought up a question I had long time ago. Is the MAC address of the switch ever attached to any packet/frame? I never heard the author say something like this, but since there are so many MAC addresses on the switch (one/port), what are those for?

As for systemGM, here is the answer to your question:

Let's start with your example, (of one router, 2 switches, and 2 PCs).

1. PC1 want to send PC2 some data, so the data moves from Layer 7, where data was generated, down to Layer 4. Now segmentation occurs, and L4 header is placed in front of the data. This is a segment.

2. The data continues its way down and come to L3, where destination IP address (IP address of PC2) and source IP address (IP address of PC1) is put inside the L3 header, which wraps around L4 Header + data. This is packet.

3. When data reaches L2, source MAC address (PC1's MAC address) and destination MAC address (Router's MAC address) is placed in the data link header. Note that layer 2 has a FCS trailer. This is a frame.

4. The frame is translated (from human language) to bits (computer language, 0 and 1) and send out on the physical media toward the switch.

Theoretically, the frame = (L2 header (L3 header (L4 header (data) ) ) L2 trailer)

Sw1 receives the bits, translated back to the frame and read the L2 header. After reading it, Sw1 now knows this frame is destined for the router and forward the frame to the interface that is connected to the router. L2 header remains intact and the frame is again translated into bits and send out to the router.

Router now receives the bits, turn it into a frame. Router now knows the frame is for itself, and discard the frame. This is like you received a letter for you, and you open it to see the content. After L2 header and trailer are discarded, what is left is L3 header, which contains the destination IP address. After reading the destination IP address and know that the packet isn't for the router, the router then made a decision to forward the packet. Following the previous analogy, you have received a letter for you, but it's titled to your best friend; of course you would want to give it to her. This is what routers do, they receive things never intended for them, and forward the things to where they are supposed to be. It's a little pathetic if you think about it.

Okay, now the router has made a decision where to send this packet, again, it wraps it up into a frame, which now has source MAC address of the router and the destination MAC address of PC2 (remember that MAC addresses are obtain using ARP). The frame turns into bits and send to Sw2.

Sw2 receives the frame, read L2 header and matches the destination MAC address to an entry in its CAM table (equivalent to routing tables for routers). Once an entry has been found, the frame is forwarded out on corresponding interface.

PC2 now receives the frame, decapsulate it 3 times (bits -> frame -> packet -> segment) until it becomes data only and can be read by PC2's application programs.

In summary, from PC1 to router: S MAC = PC1's MAC, D MAC = router's MAC, S IP = PC1's IP, D IP = PC2's IP. From router to PC 2: S MAC = router's MAC, D MAC = PC2's MAC, S IP = PC1's IP, D IP = PC2's IP

Best,

A

+++++++++++++++++++++++++++++++++++++++++++++++

Reference:

https://learningnetwork.cisco.com/thread/11735

Proxy Server

A proxy server, also known as a "proxy" or "application level gateway", is a computer that sits between a client and a server to intercept requests. There are several uses of a proxy server, but the most common is to speed network traffic by caching pages or files that are requested often. By doing so, the proxy server can deliver the request quickly, only polling the server when required. In this way, a proxy server not only speeds up network traffic, but also relieves server load. Major Internet hubs and Internet Service Providers (ISPs) employ dozens of proxy servers.

With proxy server an enterprise can ensure security, administrative control, and caching service.

A proxy server is associated with or part of a gateway server that separates the enterprise network from the outside network and a firewall server that protects the enterprise network from outside intrusion.

Some proxy servers are a group of applications or servers that block common Internet services. For example, an HTTP proxy intercepts web access, and an SMTP proxy intercepts email.

Note: Do not confuse a proxy server with a NAT (Network Address Translation) device. A proxy server connects to, responds to, and receives traffic from the Internet, acting on behalf of the client computer, while a NAT device transparently changes the origination address of traffic coming through it before passing it to the Internet.

For those who understand the OSI (Open System Interconnection) model of networking, the technical difference between a proxy and a NAT is that the proxy server works on the transport layer (layer 4) or higher of the OSI model, whereas a NAT works on the network layer (layer 3).

References:
http://www.wisegeek.com/what-is-a-proxy-server.htm
http://whatis.techtarget.com/definition/0,,sid9_gci212840,00.html
http://kb.iu.edu/data/ahoo.html

Port forwarding

There are a couple of concepts you need to know before you can understand port forwarding. I'm going to make a couple broad statements that are almost always true. For simplicity lets assume they are true for now.

1.) Every device on the internet has at least one ip address. The IP address is a number that is used to identify a device. For more information on ip addresses refer to our What is an IP Address page.

2.) Every IP address is divided up into many ports. When one computer sends data to another computer, it sends it from a port on an ip address to a port on an ip address. For more information on ports refer to our What is a Port page.

3.) A port can only be used by one program at a time.

Now that we've got those general concepts out of the way let's talk about NAT. NAT is an acronym for Network Address Translation. NAT takes one ip address and basically breaks it into many ip addresses.

[img]http://www.portforward.com/help/BasicNetwork.jpg[\img]

Here the external ip address is broken into two internal ip addresses. The first ip address "IP Address1" is the gateway. While "IP Address2" is the ip address of the first computer. Take note that the router has two ip addresses. It has the external ip address, and an internal ip address which acts as the gateway for every computer on the network.

[img]http://www.portforward.com/help/NetworkVisibility.jpg[\img]

Excuse my rough drawing. Computers on the internal network can only "see" internal ip addresses. So computers on the internal network can not send data directly to a computer outside of the network. When a computer on the network wants to send data to a computer outside of the network, it sends the data to the gateway. Remember the gateway is the internal ip address of the router. The router then takes this data and sends it out to the computer on the internet. The router sends the data out of the external ip address. The same thing is true of computers on the internet. A computer outside of the network can not "see" a computer inside of the network. They can only "see" and send data to the external ip address of the router. The router must then decide what to do with this data. Lucky for us NAT takes care of most of the work for us. There are some programs that NAT was not designed to work with, those are the programs we need to set up port forwarding for. Okay take a deep breath! We are on to port forwarding.

Now that you understand the general concepts of a network, explaining port forwarding is easy. When a computer on the internet sends data to the external ip address of the router, the router needs to know what to do with the data. Port Forwarding simply tells the router which computer on the local area network to send the data to. When you have port forwarding rules set up, your router takes the data off of the external ip address:port number and sends that data to an internal ip address:port number. Port Forwarding rules are created per port. So a rule set up for port 53 will only work for port 53.

A port can only be used by one program at a time! Think of how this rule interacts with NAT. Well you've only got one external ip address on your router. When computer 1 is using port 500, it is using port 500 on it's internal ip address. If you have set up a port forwarding rule for computer 1 and port 500, the external ip address's port 500 is also in use. This means that you can only use port 500 on one computer on the network at a time. Using port 500 on two computers at the same time would violate the one program rule, and your data would get messed up. Most routers require you to specify an internal ip address to forward ports to, just for this reason. Some do not, so be aware of this. Port Forwarding rules will only work for one computer at a time!

Reference:
http://portforward.com/help/portforwarding.htm

Switching & Routing

Difference b/w Switching & Routing.
In short, If packet forwarding is dependent on mac then your doing switching and if it IP then your doing routing.

Difference between L3 switch and a Router.
Router does forwarding through S/W algoritms whereas L3 does through inbuilt ASICs.
In latest trend, any forwarding done in h/w is named as a switch :-).

L2 switch is a bridge which forward the packets based on MAC address.

Switch is faster than a router because forwarding is built in h/w.

bridges can’t block a broadcast (where a data packet is sent to all nodes on a network). Broadcasts can consume a great deal of bandwidth. Routers are able to block broadcasts, so they provide security and assist in bandwidth control.

Switching:
Ethernet is fundamentally what we call a shared technology.And that is, all users of a given LAN segment are fighting for the same amount of bandwidth.

A by-product that we have in any Ethernet network is something called collisions. And this is a result of the fundamental characteristic of how any Ethernet network works.Basically, what happens in an Ethernet network is that many stations are sharing the same segment. So what can happen is any one of these stations can transmit at any given time.And if 2 or more stations try to transmit at the same time, it's going to result in what we call a collision.

It's also important to understand fundamentally how transmissions can occur in the network. There's basically three different ways that we can communicate in the network.
1. Unicast
2. Broadcast
3. Multicast

in shared bandwidth, Broadcasts Consume Bandwidth & Processor Performance.







References:
http://www.e-tutes.com/index.html
http://www.e-tutes.com/lesson8/networking_fundamentals_lesson8_1.htm
http://www.tcpipguide.com/

IP Fragmentation

Encapsulation:
When a host or router handles a datagram, the IP software determines the next hop to which the datagram should be sent. Thus a datagram could traverse many physical networks, each with their own frame formats. An IP datagram is encapsulated in the data area of the frame.

MTU:
The basic fact in networking is that not all networking technologies were created equal. One of the differences between various layer-2 technologies is the maximum payload (commonly called Maximum Transmission Unit – MTU) a layer-2 frame can transport.

Fragmentation:
IP uses a technique called fragmentation to solve the problem of heterogeneous MTUs. When a datagram is larger than the MTU of the network over which it must be sent, it is divided into smaller fragments which are each sent separately.

Path MTU Discovery: The generic solution to the IP fragmentation issues should be the Path MTU Discovery that was issued as an RFC.
It works by setting the DF (Don't Fragment) option in the IP headers of outgoing packets. Any device along the path whose MTU is smaller than the packet will drop such packets and send back an ICMP "Destination Unreachable (Datagram Too Big)" message containing its MTU, allowing the source host to reduce its assumed path MTU appropriately. The process repeats until the MTU is small enough to traverse the entire path without fragmentation.

References:
http://penguin.dcs.bbk.ac.uk/academic/networks/network-layer/fragmentation/index.php
http://www-inteng.fnal.gov/Integrated_Eng/software/locsys/syscode/ipsoftware/IPFragmentation.html
http://www.nil.si/ipcorner/IP_Fragmentation/