 TCP/IP: hosts using TCP/IP and a PC network software can share the same physical Ethernet cable.
When an Ethernet frame is sent from one host on a LAN to another, it is the 48-bit Ethernet address that determines for which interface the frame is destined. The device driver software never looks at the destination IP address in the IP datagram.
The Address Resolution Protocol provides a mapping from 32-bit IP addresses to link layer address (for example 48-bit Ethernet address) while Reverse Address Resolution Protocol (RARP) maps back the other direction from the link layer address to the IP address.
The fundamental concept behind ARP is that the network interface has a hardware address (a 48-bit value for an Ethernet or token ring interface). Frames exchanged at the hardware level must be addressed to the correct interface. But TCP/IP works with its own addresses: 32-bit IP addresses. Knowing a host's IP address doesn't let the kernel send a frame to that host. The kernel (i.e., the Ethernet driver) must know the destination's hardware address to send it data. The function of ARP is to provide a dynamic mapping between 32-bit IP addresses and the hardware addresses used by various network technologies.
the ARP cache can be examined with
-a shows all entries.
tcpdump can be used to examine packets.
Chapter 5: Reverse Address Resolution Protocol (RARP)
A system without a disk needs a way to obtain its IP address (usually this is obtained at boot from a configuration file).
Each system on a network has a unique hardware address, assigned by the manufacturer of the network interface. The principle of RARP is for the diskless system to read its unique hardware address from the interface card and send an RARP request (a broadcast frame on the network) asking for someone to reply with the diskless system's IP address (in an RARP reply).
Chapter 6: Internet Control Message Protocol (ICMP)
ICMP is often considered part of the IP layer. It communicates error messages and other conditions that require attention. ICMP messages are usually acted on by either the IP layer or the higher layer protocol (TCP or UDP). Some ICMP messages cause errors to be returned to user processes.
There are 15 different values for the type field, which identify the particular ICMP message. Some types of ICMP messages then use different values of the code field to further specify the condition.
Chapter 7: Ping Program
Ping tests whether another host is reachable. It sends an ICMP echo request message to a host, expecting an ICMP echo reply to be returned. Ping also measures the round-trip time to host.
The server echoes the identifier and sequence number fields, and any additional data sent by the client and of interest.
On some systems (bsd/386 version 0.9.4 for example) time may be listed as 0 ms because the available timer only provides 10 ms accuracy.
-r sets the IP record route (RR) in the outgoing IP datagram which contains the ICMP echo request message. this option records the route the datagram takes to its destination.
This functionality can also be obtained used
Chapter 8: Traceroute Program
Traceroute lets us see the route that IP datagrams follow from one host to another. Traceroute also lets us use the IP source route option.
The program sends UDP datagrams starting with TTL 1, increasing the TTL by 1 to locate each router in the path. An ICMP time exceeded is returned by each router when it discards the UDP datagram, and an ICMP port unreachable is generated by the final destination.
-g implement loose and strict source routing, to specify a forced route.
Chapter 9: IP Routing
Datagrams to be routed can be generated on the local host or on some other host (must be configured to act as a router otherwise datagrams received are dropped).
The routing table can be updated by
route command or when ICMP redirect messages are received. The information contained in the routing table drives all decisions made by IP. The kernal maintains the routing table.
The steps IP performs when searching its routing table:
- search for a matching host address
-