One computer, many doors

In lesson 5.1 the IP address was the street address, and the port was the flat number: which program on the computer a message is for. A program that offers a service tells the computer anything that arrives on this port is mine. That’s called listening.

In this lab:

You’ll fill in the question marks yourself, by asking each host.

ss: who’s listening?

ss (short for socket statistics) lists a computer’s sockets: its open doors and its conversations. The letters after it pick what to show:

So ss -tln means TCP, listening, numbers, and ss -uln the same for UDP.

in one sentence ss -tln lists the TCP ports a computer is listening on; ss -uln the UDP ones.

Two ends of every conversation

When the laptop opens web’s page, the conversation has two sockets: web’s, on its well-known port, and the laptop’s, on a temporary port the laptop picks for this one conversation. Linux picks it from a range it keeps in a file, 32768 to 60999 unless someone changes it. Ask twice and you get two different numbers.

Open, or closed?

Try to connect to a port nobody’s listening on, and web’s own system answers straight away: nobody here. On the laptop, that’s connection refused. It’s a useful answer: the computer is there and reachable, there just isn’t a program behind that door. (A firewall that silently drops the message looks different: no answer at all, until you give up waiting.)

in one sentence Connection refused means the computer answered, but nothing listens on that port.

Names are for people

You don’t remember your friends’ phone numbers; you remember their names, and your phone looks the number up. Computers are the other way round: to send anything, they need the IP address. But people would much rather type networkdoodles.com than a string of numbers.

DNS, the Domain Name System, joins the two. A DNS server is a computer that answers one question, over and over: what’s the IP address for this name? Your computer asks before it sends anything to a name.

in one sentence DNS turns a name into an IP address, so people can use names and computers can use numbers.

Where the laptop gets its DNS server

You’ve already seen it. In task 1.2, DHCP lent the laptop four things, and one was a DNS server: 192.168.2.53. The laptop wrote it in /etc/resolv.conf. Every program on the laptop that needs a name looked up reads that file to know who to ask.

The same file has search lab. It means: if someone types a short name with no dot in it, like web, try web.lab too. That’s why you can type the short name inside a network.

in one sentence The DNS server’s address comes from DHCP and lives in /etc/resolv.conf.

Records

A DNS server keeps a list of names and what goes with them. Each entry is a record. The kind that holds an IPv4 address is an A record (A for address). This lab’s DNS server, dns, reads its A records from one plain file: lab/dns/lab.hosts. In this task you can open it in the box under the guide.

192.168.2.10  web.lab
192.168.2.53  dns.lab
192.168.1.1   r1.lab

On the internet, DNS servers have millions of names, and they ask each other when they don’t know one. This one only knows the names in that file, and it never asks anyone else: the lab has no internet.

Two tools that ask

Both ask the DNS server directly. Other programs, like ping and curl, look the name up quietly first and then use the address.

Asking for directions, one stop at a time

Imagine posting a letter to a town you’ve never been to. Your local post office doesn’t know every street in the country. It only knows letters for that region go to the big sorting office. The sorting office knows which local office to send it to, and that office knows the street. Nobody knows the whole way; each one knows the next stop.

Routers work like that. Each one has a routing table: a list of networks it knows how to reach, and for each one, where to send packets next. That where next is called the next hop.

in one sentence A router doesn’t know the whole path; its routing table says which next hop to send each network to.

How a router fills its routing table

The networks between r1 and r2

The link between the two routers is 10.0.0.0/30: four addresses, two usable, one for each router. That’s the /30 from lesson 3.3, the right size for a cable between two routers.

Behind r2, the servers’ block 192.168.2.0/24 is split with VLSM into two /28s, one per server network: 192.168.2.0/28 for web and 192.168.2.48/28 for dns. r1 doesn’t need to know that. One route, 192.168.2.0/24 via r2, covers both, because both fit inside it.

Routes have to work both ways

A ping is two trips: there, and back. web’s answer goes to 192.168.1.50, the laptop, and every router on the way back needs a route for that network. If one doesn’t have it, the ping goes out fine and the answer is thrown away. From the laptop it looks just the same as if the packet never arrived.

in one sentence Every router on the way there needs a route to the destination, and every router on the way back needs a route to the source.

traceroute: who’s on the way?

In lesson 2.3 you tried tracert (on Windows) or traceroute (Mac and Linux) on your own computer. Here’s how it works.

Every packet carries a number called its TTL, time to live. Each router that passes the packet on takes 1 off it, and if it reaches 0, the router throws the packet away and sends a small message back to the sender: time exceeded, from the router’s own address. (That’s what stops a packet going round in circles for ever if the routes are wrong.)

traceroute uses this on purpose. It sends a packet with TTL 1: the first router drops it, and its message says who it is. Then TTL 2: the second router answers. And so on, until the destination itself answers. One line per stop.

in one sentence traceroute sends packets that run out of time one router further each time, so each router on the way says who it is.

The story

Somebody set up broken-pc by hand, instead of letting DHCP do it. They typed its IP address right: 192.168.1.30. But they typed the prefix as /16 instead of /24, and they forgot the gateway completely. Now its owner says: “I can print, but I can’t get to the website.”

That’s a real kind of fault, and it’s worth knowing well: a wrong prefix doesn’t break everything, which makes it harder to spot. You’ll find it the way an engineer would: look at what the computer believes, test, and compare with a computer that works.

What the prefix decides

From lesson 3.2: before sending anything, a host compares the destination’s network part with its own.

• Same network? Send it straight there: ARP for the destination’s MAC address (task 2.1).
• Different network? Send it to the default gateway.

The prefix decides where the network part ends, so it decides the answer. With /24, broken-pc’s network is 192.168.1.0/24: 192.168.1.0 to 192.168.1.255. With /16 it’s 192.168.0.0/16: everything from 192.168.0.0 to 192.168.255.255. That includes the printer, which is right, but it also includes web, at 192.168.2.10, which is wrong.

in one sentence The prefix decides which addresses a host thinks are on its own network, and so whether it ARPs for them or uses the gateway.

Two different error messages

ping tells you how it failed, and the two messages mean different things:

in one sentence Host unreachable: it ARPed and got no answer. Network unreachable: it has no route at all.

A gap in the story

Here’s something the lessons skipped. When the laptop sends to the printer, it knows the printer’s IP address: 192.168.1.20. But on the cable, every frame needs a to MAC address too (lesson 1.1), and that’s what the switch reads (lesson 2.1). Nobody typed the printer’s MAC address into the laptop. So how does the laptop know it?

It asks.

ARP: asking the room

Think of a classroom on the first day. You know someone called Sam is in your class, but not which face is Sam’s. So you ask the whole room: “Which one of you is Sam?” Sam puts a hand up and says “Me!”, and now you know who to pass your note to. You remember, so you don’t have to ask again tomorrow.

Computers do the same, with ARP, the Address Resolution Protocol. (Resolution here means working out: working out a MAC address from an IP address.)

1. The laptop shouts a broadcast to everyone on its network, to the MAC address ff:ff:ff:ff:ff:ff: “Who has 192.168.1.20? Tell 192.168.1.50.”
2. Every host hears it, and only the printer answers, just to the laptop: “192.168.1.20 is at aa:aa:aa:22:22:22.”
3. The laptop writes that down, and sends its frames to aa:aa:aa:22:22:22.

It’s the same shout, then whisper pattern as DHCP in lesson 4.1.

in one sentence ARP asks everyone on the network who has this IP address?, and the one that has it answers with its MAC address.

The neighbour table

The laptop keeps the answers in a list, so it doesn’t have to shout before every frame. Linux calls it the neighbour table (a neighbour is another host on your own network: next door). Older books call it the ARP cache or ARP table. Each entry is an IP address, the MAC address that goes with it, and a state:

in one sentence The neighbour table is the host’s list of this IP address is at that MAC address, for its own network.

What about hosts on other networks?

ARP is a shout, and shouts stop at the router (lesson 2.2). So the laptop can only ARP for hosts on its own network. For anything else it uses the rule from lesson 3.2: different network, so send it to the gateway. Which means the frame needs the gateway’s MAC address, not the faraway host’s. Keep that in mind for the challenge.

The switch doesn’t need ARP

The switch never asks anyone anything. It learns by watching the from MAC address of every frame that comes in, and writes down which port it came from: its MAC address table, from lesson 2.1. So after the laptop and the printer have talked, the switch knows both their ports.

Four things, on loan

In lesson 4.1 you watched a laptop plug in with no address and come out with four things, after four messages (Discover, Offer, Request, Ack):

1. an IP address and its subnet mask;
2. a default gateway: the router, the way out to other networks;
3. a DNS server: the computer that turns names into addresses (task 3.2 is all about it);
4. a lease: how long it can keep them before it has to ask again.

The lab’s laptop did exactly that when the lab started. Task 1.1 found the first one with ip addr. This task finds the other three, then makes it ask again so you can watch.

in one sentence DHCP lends a host an address and mask, a gateway and a DNS server, for the length of a lease.

Where a computer keeps them

Linux keeps each one in a different place, and each has its own way to look:

cat prints a file (it’s short for concatenate, an old word for joining files together). /etc/resolv.conf is the file where Linux writes down which DNS server to ask. The DHCP client fills it in.

in one sentence The address is in ip addr, the gateway in ip route, the DNS server in /etc/resolv.conf.

The client and the server

Two programs do DHCP. On the laptop, a DHCP client asks; here it’s called udhcpc (micro DHCP client: it’s a small one). On r1, a DHCP server answers, from a pool: a list of addresses it’s allowed to hand out, plus the gateway and DNS server to go with them. r1 writes down who has which address in its bindings: a binding ties an address to one host’s MAC address.

in one sentence The client on the laptop asks; the server on r1 answers from its pool and writes down the binding.

Keeping a desk free for one student

Remember the new student in lesson 4.1, asking where to sit? Most students take any free desk. But the teacher might keep desk 10 for one student, every day: whoever else comes in first, that desk is theirs.

DHCP can do that too. It’s called a reservation: the server keeps one address for one MAC address, and gives it to nobody else. People reserve addresses for things that others need to find, like printers, so the address never changes.

in one sentence A reservation keeps one address for one MAC address, so that host always gets the same one.

A terminal: typing to a computer

Most of the time you use a computer by pointing and clicking. Network engineers mostly type instead. They open a terminal: a window where you type a command (an instruction, one line long), press Enter, and the computer types its answer back underneath.

The terminal shows a prompt when it’s ready for your next command. In this lab the prompt says which computer you’re on, so you always know who you’re talking to:

laptop:~#

You type after the #. (The ~ means my home folder; you can ignore it.)

in one sentence A terminal is a window where you type a command and the computer types its answer back.

Logging in to another computer

The lab’s first tab, Topology, draws the lab network: every computer, the switch and the routers, and the cables between them. Hover over one to see what it is, what it runs, where each of its ports is cabled, and whether it’s running.

Click one, and a terminal on that computer opens in a tab of its own, named after it: click laptop and you get a laptop tab. That’s logging in: everything you type in that tab goes to the laptop, and the laptop answers. The prompt says which computer you’re on: laptop:~# on a host, r1# on a router.

You can have several computers open at once, each in its own tab, and switch between them by clicking the tabs. Clicking the computer on the Topology tab again takes you back to its tab. When you’re done with one, close its tab with its ×.

in one sentence Click a computer on the Topology tab to log in to it: its terminal opens in a tab named after it.

Interfaces: the computer’s name for its network cards

In lesson 1.1 you met the network card: the part of a host that sends and receives. A computer calls each of its network cards an interface, and gives each one a short name. On Linux, the system these hosts run, the names look like this:

Each lab host has one real network card, eth1, with a cable to the switch (or, for the servers, to r2).

in one sentence Linux calls a network card an interface; here the real one is eth1.

ip addr: what does this card know about itself?

The command ip addr (short for IP address) lists every interface, and for each one its MAC address and its IP addresses. It’s the first command an engineer types on a computer that won’t connect, because it answers the first questions: is the card up, does it have an address, and which network is it on?