If you are not a child of the School of network engineering, you have a blank understanding of network. I have heard of TCP/IP before. Seriously, it seems a headache, but the protocol is dead. I am familiar with it after reading it several times.
Read the book and learn about the TCP/IP concepts. Otherwise, the subsequent work will not proceed.
The TCP/IP protocol is divided into four layers.
- Application Layer-- Telent, FTP, HTTP, SMTP
- Transport Layer-- TCP, UDP (ICMP, IGMP)
- Network Layer-- IP, ARP
- Link Layer-- Device Drivers (PPP, Ethernet, FDDI, etc)
Note: ARP is a channel at the network layer and link layer. The ICMP and IGMP protocols in parentheses are classified as network layers. Let's take a look at several important protocols.
Ethernet protocolThe Ethernet II standard is an old Ethernet standard. Later, IEEE created the 802.3 standard. First, let's look at the encapsulation of Ethernet II frames. I wanted to draw a picture intuitively based on the book. I don't know how to draw it. I can use any software to draw it like that. Ah.
- Header:For 8 bytes, the first seven bytes are consecutive 0xaa, used for synchronization, and then a 0xab, which indicates the starting position of the frame. It provides the functions of synchronization and forward division.
- Target address:The length is 6 bytes, indicating the address of the target node. It may be unicast, multicast, or broadcast address. unicast is a physical address, also known as a MAC address. Generally, the broadcast address is 0xff 0xff 0xff 0xff 0xff. The broadcast address can pass through the bridge, but cannot pass through the gateway.
- Source Address:It is the same as above, but it can only be a unicast address.
- Ethernet Type:The length is two bytes, which indicates the protocol on the server Load balancer. 0x0800 indicates IP, 0x0806 indicates ARP, 0x8035 indicates RARP, 0x86dd indicates IPv6, and 0x880b indicates PPP (Ethernet-based PPP ).
- Payload:The maximum load of an Ethernet II frame is 1500 bytes, and the minimum is 46 bytes.
- Frame check sequence:The length is 4 bytes, used to check the integrity of frames. The principle is the same as that of the PPP frame check sequence.
The following is an frame encapsulation.
- Header, target address, Source Address: Same as Ethernet II.
- Length: The number of bytes starting from DSAP to the last digit of the payload. The maximum value is 1500, and the minimum value is 46.
- DSAP: The length is 1 byte, indicating the protocol type of the next layer of the target node, for example, snap is 0xaa.
- SSAP: Same as DSAP, it indicates the protocol type at the next layer of the source node.
- Widget: The length may be 2 bytes, or 1 byte. Depending on the reliable transmission service at this layer, a single byte is an unreliable connection service, and a 2 byte is a connection-oriented reliable service. However, IP messages and ARP messages do not use connection-oriented reliable services. Therefore, their controls are expressed in 1 byte and 0x03.
It can be seen that the difference between Ethernet II and 802.3 is that the Ethernet type changes to the frame length. The DSAP, SSAP, and controls of up to frames can all be considered as part of the Ethernet II frame payload. When you receive a frame of data, you can determine whether it is an Ethernet II frame or an IEEE 802.3 frame based on the Ethernet Type of the Ethernet II frame. If it is greater than or equal to 1500 (0x05dc), it is an Ethernet II frame, less than 1500 is equivalent to frames.ARP ProtocolThe Address Resolution Protocol serves as a bridge between the IP protocol and the LAN protocol. It applies to lan and is based on access sharing and broadcast technologies. This Protocol resolves the node IP address to the corresponding MAC address (also called the physical address). It can find the MAC address corresponding to the IP address in the LAN and save it for sending and use. It is based on the data link layer protocol, but not the network layer protocol. ARP consists of two frames,Request frame and response Frame. The former is to find the MAC address corresponding to the IP address in the network. The latter is the number of MAC addresses corresponding to the IP address. The process is like this. The request frame is sent by the node where the IP address is to be sent. It is a broadcast message and can be received by all nodes in the subnet. After each node receives the packet, if the target IP address is the same as its own IP address, an ARP response is sent; otherwise, an ARP response is thrown away. When the node sending the request frame receives the response message, it knows the MAC address of the other party and can send the IP Message. Check againARP cache tableIt is a cache table that stores the IP addresses in the network and the corresponding MAC addresses. When sending an IP report, first check whether the target IP address in the ARP cache table has a corresponding MAC address. If yes, send the request directly. Otherwise, send the ARP request frame to the network and wait for the ARP response frame. If no response is received from Apr, the IP address sending will be canceled. In another case, when you receive the correct ARP response frame, update the ARP cache table and send the IP address. Each table entry in the ARP cache table has oneSurvival timeThe survival time corresponds to the system time. If the table item survival time is 0, the table item is invalid, returns the time when the MAC address corresponding to the correct IP address is obtained after the ARP request frame is resending. The Ethernet Type of ARP frames is 0x0806. ARP frames do not contain IP frames. ARP frames cannot pass the IP router. The following describes the structure of ARP frames.
- Hardware type: 2 bytes, indicating the protocol of the data link layer. For example, 0x0001 indicates Ethernet.
- Protocol Type: 2 bytes, indicating the protocol to be parsed. For example, 0x0800 indicates the IP protocol, indicating the IP protocol when ARP reports the protocol to be parsed.
- Hardware address Length: 1 byte, indicating the length of the physical address, in bytes. For example, if the length of the Ethernet address is 6 bytes, this field is 0x06.
- Protocol address Length: 1 byte, indicating the length of the Protocol address to be parsed, in bytes. For example, if the IP address length of the IP protocol is 4 bytes, this field is 0x04.
- Operation: 2 bytes, which indicates the type of the ARP frame. For example, 0x0001 indicates the ARP request frame, 0x0002 indicates the ARP response frame, and 0x0008 indicates the ARP request frame is reversed, 0x0009 indicates reverse ARP response frame (reverse ARP frame is used only for Frame Relay ).
- Sender hardware address: The length is equal to the value of the hardware address length. For example, the length of Ethernet is 6 bytes. In Ethernet, It is the MAC address of the sending end node.
- Sender Protocol address: The length is equal to the value of the Protocol address length. For example, the IP protocol is 4 bytes. When the IP protocol is used, it is the IP address of the current node.
- Receiver hardware address: The length is equal to the value of the hardware address length. For example, the length of Ethernet is 6 bytes. In Ethernet, It is the MAC address of the receiver node. If the request frame is sent, It is 0 x, 0 x, 0 x, 0 x, 0x00.
- Receiver Protocol address: The length is equal to the value of the Protocol address length. For example, the IP protocol is 4 bytes. When the IP protocol is used, it is the IP address of the receiver node.
