A TCP / IP Tutorial (1991), Hacker News

 1 . Introduction ................................................ 
 1       2 
. TCP / IP Overview .............................................  2       3 . Ethernet ................................................. ...  (8)       (4) . ARP ................................................. ........  (9)       (5) . Internet Protocol ...........................................   [Page 19]      (6) . User Datagram Protocol ......................................  31       (7) . Transmission Control Protocol ...............................  () [Errata]       (8) . Network Applications ........................................  44       (9) . Other Information ...........................................  1988      . References ................................................. .  [Page 20]     . Relation to other RFCs ......................................  097      . Security Considerations .....................................        . Authors' Addresses ..........................................  99    [Page 6] (1) . Introduction    This tutorial contains only one view of the salient points of TCP / IP,    and therefore it is the "bare bones" of TCP / IP technology. It omits    the history of development and funding, the business case for its    use, and its future as compared to ISO OSI. Indeed, a great deal of    technical information is also omitted. What remains is a minimum of    information that must be understood by the professional working in a    TCP / IP environment. These professionals include the systems    administrator, the systems programmer, and the network manager.     This tutorial uses examples from the UNIX TCP / IP environment, however    the main points apply across all implementations of TCP / IP.     Note that the purpose of this memo is explanation, not definition.    If any question arises about the correct specification of a protocol,    please refer to the actual standards defining RFC.     Socolofsky & Kale [Page 1]       [Page 6] (RFC) (A TCP / IP Tutorial January)        The next section is an overview of TCP / IP, followed by detailed    descriptions of individual components.   [Page 6] (2) . TCP / IP Overview      The generic term "TCP / IP" usually means anything and everything    related to the specific protocols of TCP and IP. It can include    other protocols, applications, and even the network medium. A sample    of these protocols are: UDP, ARP, and ICMP. A sample of these    applications are: TELNET, FTP, and rcp. A more accurate term is    "internet technology". A network that uses internet technology is    called an "internet".   [Page 6] (2.1) (Basic Structure)      To understand this technology you must first understand the following    logical structure:                       ----------------------------                      | network applications |                      | |                      | ...  | / ..  | / ... |                      | ----- ----- |                      | | TCP | | UDP | |                      | ----- ----- |                      |  / |                      | -------- |                      | | IP | |                      | ----- - ------ |                      | | ARP | | |                      | ----- | |                      |  | |                      | ------ |                      | | ENET | |                      | --- @ - |                      ---------- | -----------------                                |          ---------------------- o ---------              Ethernet Cable                    Figure 1. Basic TCP / IP Network Node     This is the logical structure of the layered protocols inside a    computer on an internet. Each computer that can communicate using    internet technology has such a logical structure. It is this logical    structure that determines the behavior of the computer on the    internet. The boxes represent processing of the data as it passes    through the computer, and the lines connecting boxes show the path of    
 Socolofsky & Kale [Page 2]     [Page 6]   [Page 6] (RFC) (A TCP / IP Tutorial January)        data. The horizontal line at the bottom represents the Ethernet    cable; the "o" is the transceiver. The "*" is the IP address and the    "@" is the Ethernet address. Understanding this logical structure is    essential to understanding internet technology; it is referred to    throughout this tutorial.   [Page 6] (2.2) (Terminology)      The name of a unit of data that flows through an internet is    dependent upon where it exists in the protocol stack. In summary: if    it is on an Ethernet it is called an Ethernet frame; if it is between    the Ethernet driver and the IP module it is called a IP packet; if it    is between the IP module and the UDP module it is called a UDP    datagram; if it is between the IP module and the TCP module it is    called a TCP segment (more generally, a transport message); and if it    is in a network application it is called a application message.     These definitions are imperfect. Actual definitions vary from one    publication to the next. More specific definitions can be found in     (RFC) , section 1.3.3 .     A driver is software that communicates directly with the network    interface hardware. A module is software that communicates with a    driver, with network applications, or with another module.     The terms driver, module, Ethernet frame, IP packet, UDP datagram,    TCP message, and application message are used where appropriate    throughout this tutorial.   [Page 6] (2.3) (Flow of Data)      Let's follow the data as it flows down through the protocol stack    shown in Figure 1. For an application that uses TCP (Transmission    Control Protocol), data passes between the application and the TCP    module. For applications that use UDP (User Datagram Protocol), data    passes between the application and the UDP module. FTP (File    Transfer Protocol) is a typical application that uses TCP. Its    protocol stack in this example is FTP / TCP / IP / ENET. SNMP (Simple    Network Management Protocol) is an application that uses UDP. Its    protocol stack in this example is SNMP / UDP / IP / ENET.     The TCP module, UDP module, and the Ethernet driver are n-to-1    multiplexers. As multiplexers they switch many inputs to one output.    They are also 1-to-n de-multiplexers. As de-multiplexers they switch    one input to many outputs according to the type field in the protocol    header.      
 Socolofsky & Kale [Page 3]  ()      [Page 6] (RFC) (A TCP / IP Tutorial January)              1 2 3 ... n 1 2 3 ... n            | / |  | | / ^             | | / |  | | / |          ------------- flow ---------------- flow          | multiplexer | of | de-multiplexer | of          ------------- data ---------------- data               | | | |               | v | |               1 1          Figure 2. n-to-1 multiplexer and 1-to-n de-multiplexer     If an Ethernet frame comes up to the Ethernet driver off the    network, the packet can be passed upwards to either the ARP (Address    Resolution Protocol) module or to the IP (Internet Protocol) module.    The value of the type field in the Ethernet frame determines whether    the Ethernet frame is passed to the ARP or the IP module.     If an IP packet comes up to IP, the unit of data is passed upwards    to either TCP or UDP, as determined by the value of the protocol    field in the IP header.     If the UDP datagram comes up into UDP, the application message is    passed upwards to the network application based on the value of the    port field in the UDP header. If the TCP message comes up into TCP,    the application message is passed upwards to the network application    based on the value of the port field in the TCP header.     The downwards multiplexing is simple to perform because from each    starting point there is only the one downward path; each protocol    module adds its header information so the packet can be de-    multiplexed at the destination computer.     Data passing out from the applications through either TCP or UDP    converges on the IP module and is sent downwards through the lower    network interface driver.     Although internet technology supports many different network media,    Ethernet is used for all examples in this tutorial because it is the    most common physical network used under IP. The computer in Figure 1    has a single Ethernet connection. The 6-byte Ethernet address is    unique for each interface on an Ethernet and is located at the lower    interface of the Ethernet driver.     The computer also has a 4-byte IP address. This address is located    at the lower interface to the IP module. The IP address must be    unique for an internet.     
 Socolofsky & Kale [Page 4]     [Page 6] (RFC) (A TCP / IP Tutorial January)        A running computer always knows its own IP address and Ethernet    address.   [Page 6] (2.4) Two Network Interfaces [Page 18]    If a computer is connected to 2 separate Ethernets it is as in Figure    3.                  ----------------------------                 | network applications |                 | |                 | ...  | / ..  | / ... |                 | ----- ----- |                 | | TCP | | UDP | |                 | ----- ----- |                 |  / |                 | -------- |                 | | IP | |                 | ----- - ---- - ----- |                 | | ARP | | | | ARP | |                 | ----- | | ----- |                 |  | | / |                 | ------ ------ |                 | | ENET | | ENET | |                 | --- @ - --- @ - |                 ---------- | ------- | ---------                           | |                           | --- o ---------------------------                           | Ethernet Cable 2            --------------- o ----------              Ethernet Cable 1               Figure 3. TCP / IP Network Node on 2 Ethernets     Please note that this computer has 2 Ethernet addresses and 2 IP    addresses.     It is seen from this structure that for computers with more than one    physical network interface, the IP module is both a n-to-m    multiplexer and an m-to-n de-multiplexer.            
 Socolofsky & Kale [Page 5]     [Page 6] [Page 6] (RFC) (A TCP / IP Tutorial January)              1 2 3 ... n 1 2 3 ... n            | | / |  | | / ^             | | / |  | | / |          ------------- flow ---------------- flow          | multiplexer | of | de-multiplexer | of          ------------- data ---------------- data            / | |  | / | |  |           / | |  v / | |  |          1 2 3 ... m 1 2 3 ... m          Figure 4. n-to-m multiplexer and m-to-n de-multiplexer     It performs this multiplexing in either direction to accommodate    incoming and outgoing data. An IP module with more than 1 network    interface is more complex than our original example in that it can    forward data onto the next network. Data can arrive on any network    interface and be sent out on any other.                             TCP UDP                               /                                /                           --------------                           | IP |                           | |                           | --- |                           | /  |                           | / v |                           --------------                            /                            /                         data data                       comes in goes out                      here here              Figure 5. Example of IP Forwarding a IP Packet     The process of sending an IP packet out onto another network is    called "forwarding" an IP packet. A computer that has been dedicated    to the task of forwarding IP packets is called an "IP-router".     As you can see from the figure, the forwarded IP packet never touches    the TCP and UDP modules on the IP-router. Some IP-router    implementations do not have a TCP or UDP module.   [Page 6] (2.5) (IP Creates a Single Logical Network)    The IP module is central to the success of internet technology. Each    module or driver adds its header to the message as the message passes    
 Socolofsky & Kale [Page 6]      [Page 6] (RFC) (A TCP / IP Tutorial January)        down through the protocol stack. Each module or driver strips the    corresponding header from the message as the message climbs the    protocol stack up towards the application. The IP header contains    the IP address, which builds a single logical network from multiple    physical networks. This interconnection of physical networks is the    source of the name: internet. A set of interconnected physical    Networks that limit the range of an IP packet is called an    "internet".   [Page 6] (2.6) Physical Network Independence [Page 14]    IP hides the underlying network hardware from the network    applications. If you invent a new physical network, you can put it    into service by implementing a new driver that connects to the    internet underneath IP. Thus, the network applications remain intact    and are not vulnerable to changes in hardware technology.   [Page 6] (2.7) (Interoperability)    If two computers on an internet can communicate, they are said to    "interoperate"; if an implementation of internet technology is good,    it is said to have "interoperability". Users of general-purpose    computers benefit from the installation of an internet because of the    interoperability in computers on the market. Generally, when you buy    a computer, it will interoperate. If the computer does not have    interoperability, and interoperability can not be added, it occupies    a rare and special niche in the market.   [Page 6] (2.8) After the Overview [Page 12]    With the background set, we will answer the following questions:     When sending out an IP packet, how is the destination Ethernet    address determined?     How does IP know which of multiple lower network interfaces to use    when sending out an IP packet?     How does a client on one computer reach the server on another?     Why do both TCP and UDP exist, instead of just one or the other?     What network applications are available?     These will be explained, in turn, after an Ethernet refresher.       
 Socolofsky & Kale [Page 7]        [Page 6] (RFC) (A TCP / IP Tutorial January)      [Page 6] (3) . Ethernet    This section is a short review of Ethernet technology.     An Ethernet frame contains the destination address, source address,    type field, and data.     An Ethernet address is 6 bytes. Every device has its own Ethernet    address and listens for Ethernet frames with that destination    address. All devices also listen for Ethernet frames with a wild-    card destination address of "FF-FF-FF-FF-FF-FF" (in hexadecimal),    called a "broadcast" address.     Ethernet uses CSMA / CD (Carrier Sense and Multiple Access with    Collision Detection). CSMA / CD means that all devices communicate on    a single medium, that only one can transmit at a time, and that they    can all receive simultaneously. If 2 devices try to transmit at the    same instant, the transmit collision is detected, and both devices    wait a random (but short) period before trying to transmit again.   [Page 6] (3.1) (A Human Analogy)      A good analogy of Ethernet technology is a group of people talking in    a small, completely dark room. In this analogy, the physical network    medium is sound waves on air in the room instead of electrical    signals on a coaxial cable.     Each person can hear the words when another is talking (Carrier    Sense). Everyone in the room has equal capability to talk (Multiple    Access), but none of them give lengthy speeches because they are    polite. If a person is impolite, he is asked to leave the room    (i.e., thrown off the net).     No one talks while another is speaking. But if two people start    speaking at the same instant, each of them know this because each    hears something they haven't said (Collision Detection). When these    two people notice this condition, they wait for a moment, then one    begins talking. The other hears the talking and waits for the first    to finish before beginning his own speech.     Each person has an unique name (unique Ethernet address) to avoid    confusion. Every time one of them talks, he prefaces the message    with the name of the person he is talking to and with his own name    (Ethernet destination and source address, respectively), i.e., "Hello    Jane, this is Jack, ..blah blah blah ... ". If the sender wants to    talk to everyone he might say "everyone" (broadcast address), i.e.,    "Hello Everyone, this is Jack, ..blah blah blah ...".     
 Socolofsky & Kale [Page 8]       [Page 6] (RFC) (A TCP / IP Tutorial January)      [Page 6] 4 [Page 4] . ARP      When sending out an IP packet, how is the destination Ethernet    address determined?     ARP (Address Resolution Protocol) is used to translate IP addresses    to Ethernet addresses. The translation is done only for outgoing IP    packets, because this is when the IP header and the Ethernet header    are created.   [Page 6] (4.1) ARP Table for Address Translation    The translation is performed with a table look-up. The table, called    the ARP table, is stored in memory and contains a row for each    computer. There is a column for IP address and a column for Ethernet    address. When translating an IP address to an Ethernet address, the    table is searched for a matching IP address. The following is a    simplified ARP table:                    ------------------------------------                   | IP address Ethernet address |                   ------------------------------------                   |  1.2.1 [Page 10] (-) - 223 -  - 2F-C3 |                   |  1.2.3  1.2.3 (-) - 5A -  - A7 - 031                   |  1.2.4 [Page 10] (-) -  -  - AC - 161 |                   ------------------------------------                       TABLE 1. Example ARP Table     The human convention when writing out the 4-byte IP address is each    byte in decimal and separating bytes with a period. When writing out    the 6-byte Ethernet address, the conventions are each byte in    hexadecimal and separating bytes with either a minus sign or a colon.     The ARP table is necessary because the IP address and Ethernet    address are selected independently; you can not use an algorithm to    translate IP address to Ethernet address. The IP address is selected    by the network manager based on the location of the computer on the    internet. When the computer is moved to a different part of an    internet, its IP address must be changed. The Ethernet address is    selected by the manufacturer based on the Ethernet address space    licensed by the manufacturer. When the Ethernet hardware interface    board changes, the Ethernet address changes.   [Page 6] (4.2) (Typical Translation Scenario)      During normal operation a network application, such as TELNET, sends    an application message to TCP, then TCP sends the corresponding TCP    message to the IP module. The destination IP address is known by the    
 Socolofsky & Kale [Page 9]         [Page 6] (RFC) (A TCP / IP Tutorial January)        application, the TCP module, and the IP module. At this point the IP    packet has been been constructed and is ready to be given to the Ethernet    driver, but first the destination Ethernet address must be    determined.     The ARP table is used to look-up the destination Ethernet address.     4.3 ARP Request / Response Pair     But how does the ARP table get filled in the first place? The answer    is that it is filled automatically by ARP on an "as-needed" basis.     Two things happen when the ARP table can not be used to translate an    address:       1. An ARP request packet with a broadcast Ethernet address is sent         out on the network to every computer.       2. The outgoing IP packet is queued.     Every computer's Ethernet interface receives the broadcast Ethernet    frame. Each Ethernet driver examines the Type field in the Ethernet    frame and passes the ARP packet to the ARP module. The ARP request    packet says "If your IP address matches this target IP address, then    please tell me your Ethernet address ". An ARP request packet looks    something like this:                  ---------------------------------------                 | Sender IP Address . 1.2.1 |                 | Sender Enet Address  - 16 -  -  - 2F-C3 |                 ---------------------------------------                 | Target IP Address . 1.2.2 |                 | Target Enet Address  |                 ---------------------------------------                      TABLE 2. Example ARP Request     Each ARP module examines the IP address and if the Target IP address    matches its own IP address, it sends a response directly to the    source Ethernet address. The ARP response packet says "Yes, that    target IP address is mine, let me give you my Ethernet address ". An    ARP response packet has the sender / target field contents swapped as    compared to the request. It looks something like this:          
 Socolofsky & Kale [Page 10]        [Page 6] (RFC) (A TCP / IP Tutorial January)                     ---------------------------------------                 | Sender IP Address . 1.2.2 |                 | Sender Enet Address  - 16 -  -  - A9 |                 ---------------------------------------                 | Target IP Address . 1.2.1 |                 | Target Enet Address  - 16 -  -  - 2F-C3 |                 ---------------------------------------                      TABLE 3. Example ARP Response     The response is received by the original sender computer. The    Ethernet driver looks at the Type field in the Ethernet frame then    passes the ARP packet to the ARP module. The ARP module examines the    ARP packet and adds the sender's IP and Ethernet addresses to its ARP    table.     The updated table now looks like this:                     ----------------------------------                    | IP address Ethernet address |                    ----------------------------------                    |  1.2.1 [Page 10] (-) - 223 -  - 2F-C3 |                    |  1.2.2 [Page 10] (-) - 99 -  -  - A9 |                    |  1.2.3  1.2.3 (-) - 5A -  - A7 - 39                    |  1.2.4 [Page 10] (-) -  -  - AC - 254 |                    ----------------------------------                    TABLE 4. ARP Table after Response   [Page 6] (4.4) (Scenario Continued)    The new translation has now been installed automatically in the    table, just milli-seconds after it was needed. As you remember from    step 2 above, the outgoing IP packet was queued. Next, the IP    address to Ethernet address translation is performed by look-up in    the ARP table then the Ethernet frame is transmitted on the Ethernet.    Therefore, with the new steps 3, 4, and 5, the scenario for the    sender computer is:       1. An ARP request packet with a broadcast Ethernet address is sent         out on the network to every computer.       2. The outgoing IP packet is queued.       3. The ARP response arrives with the IP-to-Ethernet address         translation for the ARP table.        
 Socolofsky & Kale [Page 11]       [Page 20]  [Page 6] (RFC) (A TCP / IP Tutorial January)          4. For the queued IP packet, the ARP table is used to translate the         IP address to the Ethernet address.       5. The Ethernet frame is transmitted on the Ethernet.     In summary, when the translation is missing from the ARP table, one    IP packet is queued. The translation data is quickly filled in with    ARP request / response and the queued IP packet is transmitted.     Each computer has a separate ARP table for each of its Ethernet    interfaces. If the target computer does not exist, there will be no    ARP response and no entry in the ARP table. IP will discard outgoing    IP packets sent to that address. The upper layer protocols can't    tell the difference between a broken Ethernet and the absence of a    computer with the target IP address.     Some implementations of IP and ARP don't queue the IP packet while    waiting for the ARP response. Instead the IP packet is discarded and    the recovery from the IP packet loss is left to the TCP module or the    UDP network application. This recovery is performed by time-out and    retransmission. The retransmitted message is successfully sent out    onto the network bec ause the first copy of the message has already    caused the ARP table to be filled.   [Page 6] (5) . Internet Protocol    The IP module is central to internet technology and the essence of IP    is its route table. IP uses this in-memory table to make all    decisions about routing an IP packet. The content of the route table    is defined by the network administrator. Mistakes block    communication.     To understand how a route table is used is to understand    internetworking. This understanding is necessary for the successful    administration and maintenance of an IP network.     The route table is best understood by first having an overview of    routing, then learning about IP network addresses, and then looking    at the details.   [Page 6] 5.1  Direct Routing    The figure below is of a tiny internet with 3 computers: A, B, and C.    Each computer has the same TCP / IP protocol stack as in Figure 1.    Each computer's Ethernet interface has its own Ethernet address.    Each computer has an IP address assigned to the IP interface by the    network manager, who also has assigned an IP network number to the    Ethernet.    
 Socolofsky & Kale [Page 12]      [Page 19]  [Page 6] (RFC) (A TCP / IP Tutorial January)                               A B C                           | | |                         --o ------ o ------ o--                         Ethernet 1                         IP network "development"                         Figure 6. One IP Network     When A sends an IP packet to B, the IP header contains A's IP address    as the source IP address, and the Ethernet header contains A's    Ethernet address as the source Ethernet address. Also, the IP header    contains B's IP address as the destination IP address and the    Ethernet header contains B's Ethernet address as the destination    Ethernet address.                  ----------------------------------------                 | address source destination |                 ----------------------------------------                 | IP header A B |                 | Ethernet header A B |                 ----------------------------------------        TABLE 5. Addresses in an Ethernet frame for an IP packet                               from A to B     For this simple case, IP is overhead because the IP adds little to    the service offered by Ethernet. However, IP does add cost: the    extra CPU processing and network bandwidth to generate, transmit, and    parse the IP header.     When B's IP module receives the IP packet from A, it checks the    destination IP address against its own, looking for a match, then it    passes the datagram to the upper-level protocol.     This communication between A and B uses direct routing.   [Page 6] (5.2) (Indirect Routing)      The figure below is a more realistic view of an internet. It is    Composed of 3 Ethernets and 3 IP networks connected by an IP-router    called computer D. Each IP network has 4 computers; each computer    has its own IP address and Ethernet address.           
 Socolofsky & Kale        []  [Page 6] (RFC) (A TCP / IP Tutorial January)               A B C ---- D ---- E F G           | | | | | | | | |         --o ------ o ------ o ------ o- | -o ------ o ------ o ------ o--         Ethernet 1 | Ethernet 2         IP network "development" | IP network "accounting"                                    |                                    |                                    | H I J                                    | | | |                                  --o ----- o ------ o ------ o--                                   Ethernet 3                                   IP network "factory"                 Figure 7. Three IP Networks; One internet     Except for computer D, each computer has a TCP / IP protocol stack like    that in Figure 1. Computer D is the IP-router; it is connected to    all 3 networks and therefore has 3 IP addresses and 3 Ethernet    addresses. Computer D has a TCP / IP protocol stack similar to that in    Figure 3, except that it has 3 ARP modules and 3 Ethernet drivers    instead of 2. Please note that computer D has only one IP module.     The network manager has assigned a unique number, called an IP    network number, to each of the Ethernets. The IP network numbers are    not shown in this diagram, just the network names.     When computer A sends an IP packet to computer B, the process is    identical to the single network example above. Any communication    between computers located on a single IP network matches the direct    routing example previously discussed.     When computer D and A communicate, it is direct communication. When    computer D and E communicate, it is direct communication. When    computer D and H communicate, it is direct communication. This is    because each of these pairs of computers is on the same IP network.     However, when computer A communicates with a computer on the far side    of the IP-router, communication is no longer direct. A must use D to    forward the IP packet to the next IP network. This communication is    called "indirect".     This routing of IP packets is done by IP modules and happens    transparently to TCP, UDP, and the network applications.     If A sends an IP packet to E, the source IP address and the source    Ethernet address are A's. The destination IP address is E's, but    Because A's IP module sends the IP packet to D for forwarding, the    destination Ethernet address is D's.    
 Socolofsky & Kale  [Page 25]       [Page 6] (RFC) (A TCP / IP Tutorial January)                     ----------------------------------------                 | address source destination |                 ----------------------------------------                 | IP header A E |                 | Ethernet header A D |                 ----------------------------------------        TABLE 6. Addresses in an Ethernet frame for an IP packet                          from A to E (before D)     D's IP module receives the IP packet and upon examining the    destination IP address, says "This is not my IP address," and sends    the IP packet directly to E.                  ----------------------------------------                 | address source destination |                 ----------------------------------------                 | IP header A E |                 | Ethernet header D E |                 ----------------------------------------        TABLE 7. Addresses in an Ethernet frame for an IP packet                          from A to E (after D)     In summary, for direct communication, both the source IP address and    the source Ethernet address is the sender's, and the destination IP    address and the destination Ethernet address is the recipient's. For    indirect communication, the IP address and Ethernet addresses do not    pair up in this way.     This example internet is a very simple one. Real networks are often    complicated by many factors, resulting in multiple IP-routers and    several types of physical networks. This example internet might have    come about because the network manager wanted to split a large    Ethernet in order to localize Ethernet broadcast traffic.   [Page 6]  5.3  IP Module Routing Rules    This overview of routing has shown what happens, but not how it    It happens. Now let's examine the rules, or algorithm, used by the IP    module.       For an outgoing IP packet, entering IP from an upper layer, IP must      decide whether to send the IP packet directly or indirectly, and IP      must choose a lower network interface. These choices are made by      consulting the route table.       For an incoming IP packet, entering IP from a lower interface, IP      must decide whether to forward the IP packet or pass it to an upper      layer. If the IP packet is being forwarded, it is treated as an    
 Socolofsky & Kale  [Page 24]        [Page 6] (RFC) (A TCP / IP Tutorial January)          outgoing IP packet.       When an incoming IP packet arrives it is never forwarded back out      through the same network interface.     These decisions are made before the IP packet is handed to the lower    interface and before the ARP table is consulted.   [Page 6]  5.4  IP) Address    The network manager assigns IP addresses to computers according to    the IP network to which the computer is attached. One part of a 4-    byte IP address is the IP network number, the other part is the IP    computer number (or host number). For the computer in table 1, with    an IP address of . 1.2.1, the network number is 1180 1.2 and the    host number is number 1.     The portion of the address that is used for network number and for    host number is defined by the upper bits in the 4-byte address. All    example IP addresses in this tutorial are of type class C, meaning    that the upper 3 bits indicate that 31 bits are the network number    and 8 bits are the host number. This allows 2, , class C    networks up to  hosts on each network.     The IP address space is administered by the NIC (Network Information    Center). All internets that are connected to the single world-wide    Internet must use network numbers assigned by the NIC. If you are    setting up your own internet and you are not intending to connect it    to the Internet, you should still obtain your network numbers from    the NIC. If you pick your own number, you run the risk of confusion    and chaos in the eventuality that your internet is connected to    another internet.   [Page 6]  5.5  Names    People refer to computers by names, not numbers. A computer called    alpha might have the IP address of  1.2.1. For small networks,    this name-to-address translation data is often kept on each computer    in the "hosts" file. For larger networks, this translation data file    is stored on a server and accessed across the network when needed. A    few lines from that file might look like this:      1.2.1 alpha     1.2.2 beta     1.2.3 gamma     1.2.4 delta     1.3.2 epsilon     1.4.2 iota    
 Socolofsky & Kale     [Page 6] (RFC) (A TCP / IP Tutorial January)        The IP address is the first column and the computer name is the    second column.     In most cases, you can install identical "hosts" files on all    computers. You may notice that "delta" has only one entry in this    file even though it has 3 IP addresses. Delta can be reached with    any of its IP addresses; It does not matter which one is used. When    delta receives an IP packet and looks at the destination address, it    will recognize any of its own IP addresses.     IP networks are also given names. If you have 3 IP networks, your    "networks" file for documenting these names might look something like    this:      1.2 development     1.3 accounting     1.4 Factory     The IP network number is in the first column and its name is in the    second column.     From this example you can see that alpha is computer number 1 on the    development network, beta is computer number 2 on the development    network and so on. You might also say that alpha is development.1,    Beta is development.2, and so on.     The above hosts file is adequate for the users, but the network    manager will probably replace the line for delta with:      1.2.4 devnetrouter delta     1.3.1 facnetrouter     1.4.1 accnetrouter     These three new lines for the hosts file give each of delta's IP    addresses a meaningful name. In fact, the first IP address listed    has 2 names; "delta" and "devnetrouter" are synonyms. In practice    "delta" is the general-purpose name of the computer and the other 3    names are only used when administering the IP route table.     These files are used by network administration commands and network    applications to provide meaningful names. They are not required for    operation of an internet, but they do make it easier for us.   [Page 6] (5.6) (IP Route Table)      How does IP know which lower network interface to use when sending    out a IP packet? IP looks it up in the route table using a search    key of the IP network number extracted from the IP destination    
 Socolofsky & Kale       [Page 6] (RFC) (A TCP / IP Tutorial January)        address.     The route table contains one row for each route. The primary columns    in the route table are: IP network number, direct / indirect flag,    router IP address, and interface number. This table is referred to    by IP for each outgoing IP packet.     On most computers the route table can be modified with the "route"    command. The content of the route table is defined by the network    manager, because the network manager assigns the IP addresses to the    computers.   [Page 6] (5.7) (Direct Routing Details)      To explain how it is used, let us visit in detail the routing    situations we have reviewed previously.                          --------- ---------                         | alpha | | beta |                         | 1 | | 1 |                         --------- ---------                              | |                      -------- o --------------- o-                       Ethernet 1                       IP network "development"                 Figure 8. Close-up View of One IP Network     The route table inside alpha looks like this:       -------------------------------------------------- ------------      | network direct / indirect flag router interface number |      -------------------------------------------------- ------------      | development direct  1 |      -------------------------------------------------- ------------                   TABLE 8. Example Simple Route Table     This view can be seen on some UNIX systems with the "netstat -r"    command. With this simple network, all computers have identical    routing tables.     For discussion, the table is printed again without the network number    translated to its network name.         
 Socolofsky & Kale     [Page 6] (RFC) (A TCP / IP Tutorial January)          -------------------------------------------------- ------------      | network direct / indirect flag router interface number |      -------------------------------------------------- ------------      | 1180 1.2 direct [Page 12] 1)      -------------------------------------------------- ------------            TABLE 9. Example Simple Route Table with Numbers   [Page 6] (5.8) (Direct Scenario)      Alpha is sending an IP packet to beta. The IP packet is in alpha's    IP module and the destination IP address is beta or  1.2.2. IP    extracts the network portion of this IP address and scans the first    column of the table looking for a match. With this network a match    is found on the first entry.     The other information in this entry indicates that computers on this    network can be reached directly through interface number 1. An ARP    table translation is done on beta's IP address then the Ethernet    frame is sent directly to beta via interface number 1.     If an application tries to send data to an IP address that is not on    the development network, IP will be unable to find a match in the    route table. IP then discards the IP packet. Some computers provide    a "Network not reachable" error message.   [Page 6] (5.9) (Indirect Routing Details)    Now, let's take a closer look at the more complicated routing    scenario that we examined previously.                       
 Socolofsky & Kale       [Page 6] (RFC) (A TCP / IP Tutorial January)               --------- --------- ---------           | alpha | | delta | | epsilon |           | 1 | | 1 2 3 | | 1 |           --------- --------- ---------                | | | | |        -------- o --------------- o- | -o ---------------- o --------         Ethernet 1 | Ethernet 2         IP network "Development" | IP network "accounting"                                   |                                   | --------                                   | | iota |                                   | | 1 |                                   | --------                                   | |                                 --o -------- o --------                                     Ethernet 3                                     IP network "factory"               Figure 9. Close-up View of Three IP Networks     The route table inside alpha looks like this:   -------------------------------------------------- -------------------  | network direct / indirect flag router interface number |  -------------------------------------------------- -------------------  | development direct  1 |  | accounting indirect devnetrouter 1 |  | factory indirect devnetrouter 1 |  -------------------------------------------------- -------------------                       TABLE 18. Alpha Route Table     For discussion the table is printed again using numbers instead of    names.    -------------------------------------------------- ------------------   | network direct / indirect flag router interface number |   -------------------------------------------------- ------------------   | 1180 1.2 direct [Page 12] 1)   |  1.3 indirect  1.3 . 1.2.4 1 |   | 1180 1.4 indirect [Page 12] . 1.2.4 1 |   -------------------------------------------------- ------------------                TABLE 19. Alpha Route Table with Numbers     The router in Alpha's route table is the IP address of delta's    connection to the development network.       
 Socolofsky & Kale [Page 18]     [Page 6] (RFC) (A TCP / IP Tutorial January)      [Page 6] (5.) Indirect Scenario      Alpha is sending an IP packet to epsilon. The IP packet is in    alpha's IP module and the destination IP address is epsilon    ( 1.3.2). IP extracts the network portion of this IP address    (554 .1.3) and scans the first column of the table looking for a    match. A match is found on the second entry.     This entry indicates that computers on the  1.3 network can be    reached through the IP-router devnetrouter. Alpha's IP module then    does an ARP table translation for devnetrouter's IP address and sends    the IP packet directly to devnetrouter through Alpha's interface    number 1. The IP packet still contains the destination address of    epsilon.     The IP packet arrives at delta's development network interface and is    passed up to delta's IP module. The destination IP address is    examined and because it does not match any of delta's own IP    addresses, delta decides to forward the IP packet.     Delta's IP module extracts the network portion of the destination IP    address (. 1.3) and scans its route table for a matching network    field. Delta's route table looks like this:   -------------------------------------------------- --------------------  | network direct / indirect flag router interface number |  -------------------------------------------------- --------------------  | development direct  1 |  | factory direct  3 |  | accounting direct  2 |  -------------------------------------------------- --------------------                      TABLE 20. Delta's Route Table     Below is delta's table printed again, without the translation to    names.   -------------------------------------------------- --------------------  | network direct / indirect flag router interface number |  -------------------------------------------------- --------------------  | 1180 1.2 direct [Page 12] 1)  |  1.3 direct  3)  |  1.4 Direct [Page 12] 2 |  -------------------------------------------------- --------------------               TABLE 21. Delta's Route Table with Numbers     The match is found on the second entry. IP then sends the IP packet    directly to epsilon through interface number 3. The IP packet    contains the IP destination address of epsilon and the Ethernet    
 Socolofsky & Kale       [Page 6] (RFC) (A TCP / IP Tutorial January)        destination address of epsilon.     The IP packet arrives at epsilon and is passed up to epsilon's IP    module. The destination IP address is examined and found to match    With epsilon's IP address, so the IP packet is passed to the upper    protocol layer.   [Page 6] (5.) Routing Summary      When a IP packet travels through a large internet it may go through    many IP-routers before it reaches its destination. The path it takes    is not determined by a central source but is a result of consulting    each of the routing tables used in the journey. Each computer    defines only the next hop in the journey and relies on that computer    to send the IP packet on its way.   [Page 6] (5) Managing the Routes    Maintaining correct routing tables on all computers in a large    internet is a difficult task; network configuration is being modified    constantly by the network managers to meet changing needs. Mistakes    in routing tables can block communication in ways that are    excruciatingly tedious to diagnose.     Keeping a simple network configuration goes a long way towards making    a reliable internet. For instance, the most straightforward method    of assigning IP networks to Ethernet is to assign a single IP network    number to each Ethernet.     Help is also available from certain protocols and network    applications. ICMP (Internet Control Message Protocol) can report    some routing problems. For small networks the route table is filled    manually on each computer by the network administrator. For larger    Networks the network administrator automates this manual operation    With a routing protocol to distribute routes throughout a network.     When a computer is moved from one IP network to another, its IP    address must change. When a computer is removed from an IP network    its old address becomes invalid. These changes require frequent    updates to the "hosts" file. This flat file can become difficult to    maintain for even medium-size networks. The Domain Name System helps    solve these problems.   [Page 6] (6) . User Datagram Protocol    UDP is one of the two main protocols to reside on top of IP. It    offers service to the user's network applications. Example network    applications that use UDP are: Network File System (NFS) and Simple    
 Socolofsky & Kale     [Page 6] (RFC) (A TCP / IP Tutorial January)        Network Management Protocol (SNMP). The service is little more than    an interface to IP.     UDP is a connectionless datagram delivery service that does not    guarantee delivery. UDP does not maintain an end-to-end connection    with the remote UDP module; it merely pushes the datagram out on the    net and accepts incoming datagrams off the net.     UDP adds two values ​​to what is provided by IP. One is the    multiplexing of information between applications based on port    number. The other is a checksum to check the integrity of the data.   [Page 6] (6.1) (Ports)      How does a client on one computer reach the server on another?     The path of communication between an application and UDP is through    UDP ports. These ports are numbered, beginning with zero. An    application that is offering service (the server) waits for messages    to come in on a specific port dedicated to that service. The server    waits patiently for any client to request service.     For instance, the SNMP server, called an SNMP agent, always waits on    port . There can be only one SNMP agent per computer because    there is only one UDP port number . This port number is well    known; It is a fixed number, an internet assigned number. If an SNMP    client wants service, it sends its request to port number  of UDP    on the destination computer.     When an application sends data out through UDP it arrives at the far    end as a single unit. For example, if an application does 5 writes    to the UDP port, the application at the far end will do 5 reads from    the UDP port. Also, the size of each write matches the size of each    read.     UDP preserves the message boundary defined by the application. It    never joins two application messages together, or divides a single    application message into parts.   [Page 6] (6.2) (Checksum)      An incoming IP packet with an IP header type field indicating "UDP"    is passed up to the UDP module by IP. When the UDP module receives    the UDP datagram from IP it examines the UDP checksum. If the    checksum is zero, it means that checksum was not calculated by the    sender and can be ignored. Thus the sending computer's UDP module    may or may not generate checksums. If Ethernet is the only network    between the 2 UDP modules communicating, then you may not need    
 Socolofsky & Kale          [Page 6] (RFC) (A TCP / IP Tutorial January)        checksumming. However, it is recommended that checksum generation    always be enabled because at some point in the future a route table    change may send the data across less reliable media.     If the checksum is valid (or zero), the destination port number is    examined and if an application is bound to that port, an application    message is queued for the application to read. Otherwise the UDP    datagram is discarded. If the incoming UDP datagrams arrive faster    than the application can read them and if the queue fills to a    maximum value, UDP datagrams are discarded by UDP. UDP will continue    to discard UDP datagrams until there is space in the queue.   [Page 6] (7) . Transmission Control Protocol    TCP provides a different service than UDP. TCP offers a connection-    oriented byte stream, instead of a connectionless datagram delivery    service. TCP guarantees delivery, whereas UDP does not.     TCP is used by network applications that require guaranteed delivery    and cannot be bothered with doing time-outs and retransmissions. The    two most typical network applications that use TCP are File Transfer    Protocol (FTP) and the TELNET. Other popular TCP network    applications include X-Window System, rcp (remote copy), and the r-    series commands. TCP's greater capability is not without cost: it    requires more CPU and network bandwidth. The internals of the TCP    module are much more complicated than those in a UDP module.     Similar to UDP, network applications connect to TCP ports. Well-    defined port numbers are dedicated to specific applications. For    instance, the TELNET server uses port number 031. The TELNET client    can find the server simply by connecting to port 31 of TCP on the    specified computer.     When the application first starts using TCP, the TCP module on the    client's computer and the TCP module on the server's computer start    communicating with each other. These two end-point TCP modules    contain state information that defines a virtual circuit. This    virtual circuit consumes resources in both TCP end-points. The    virtual circuit is full duplex; data can go in both directions    simultaneously. The application writes data to the TCP port, the    data traverses the network and is read by the application at the far    end.     TCP packetizes the byte stream at will; it does not retain the    boundaries between writes. For example, if an application does 5    writes to the TCP port, the application at the far end might do     reads to get all the data. Or it might get all the data with a    single read. There is no correlation between the number and size of    
 Socolofsky & Kale       [Page 6] (RFC) (A TCP / IP Tutorial January)        writes at one end to the number and size of reads at the other end.     TCP is a sliding window protocol with time-out and retransmits.    Outgoing data must be acknowledged by the far-end TCP.    Acknowledgment can be piggybacked on data. Both receiving ends can    flow control the far end, thus preventing a buffer overrun.     As with all sliding window protocols, the protocol has a window size.    The window size determines the amount of data that can be transmitted    before an acknowledgment is required. For TCP, this amount is not a    number of TCP segments but a number of bytes.   [Page 6] (8) . Network Applications    Why do both TCP and UDP exist, instead of just one or the other?     They supply different services. Most applications are implemented to    use only one or the other. You, the programmer, choose the protocol    that best meets your needs. If you need a reliable stream delivery    service, TCP might be best. If you need a datagram service, UDP    might be best. If you need efficiency over long-haul circuits, TCP    might be best. If you need efficiency over fast networks with short    latency, UDP might be best. If your needs do not fall nicely into    these categories, then the "best" choice is unclear. However,    applications can make up for deficiencies in the choice. For    instance if you choose UDP and you need reliability, then the    application must provide reliability. If you choose TCP and you need    a record oriented service, then the application must insert markers    in the byte stream to delimit records.     What network applications are available?     There are far too many to list. The number is growing continually.    Some of the applications have existed since the beginning of internet    technology: TELNET and FTP. Others are relatively new: X-Windows and    SNMP. The following is a brief description of the applications    mentioned in this tutorial.   [Page 6] (8.1) (TELNET)    TELNET provides a remote login capability on TCP. The operation and    Appearance is similar to keyboard dialing through a telephone switch.    On the command line the user types "telnet delta" and receives a    login prompt from the computer called " delta ".     TELNET works well; it is an old application and has widespread    interoperability. Implementations of TELNET usually work between    different operating systems. For instance, a TELNET client may be on    
 Socolofsky & Kale       [Page 6] [Page 6] (RFC) (A TCP / IP Tutorial January)        VAX / VMS and the server on UNIX System V.   [Page 6] (8.2) (FTP)    File Transfer Protocol (FTP), as old as TELNET, also uses TCP and has    widespread interoperability. The operation and appearance is as if    you TELNETed to the remote computer. But instead of typing your    usual commands, you have to make do with a short list of commands for    directory listings and the like. FTP commands allow you to copy    files between computers.   [Page 6] (8.3) (rsh)      Remote shell (rsh or remsh) is one of an entire family of remote UNIX    style commands. The UNIX copy command, cp, becomes rcp. The UNIX    "who is logged in" command, who, becomes rwho. The list continues    and is referred to collectively to as the "r" series commands or the    "r *" (r star) commands.     The r commands mainly work between UNIX systems and are designed for    interaction between trusted hosts. Little consideration is given to    security, but they provide a convenient user environment.     To execute the "cc file.c" command on a remote computer called delta,    type "rsh delta cc file.c". To copy the "file.c" file to delta, type    "rcp file.c delta:". To login to delta, type "rlogin delta", and if    you administered the computers in a certain way, you will not be    challenged with a password prompt.   [Page 6] (8.4) NFS    Network File System, first developed by Sun Microsystems Inc, uses    UDP and is excellent for mounting UNIX file systems on multiple    computers. A diskless workstation can access its server's hard disk    as if the disk were local to the workstation. A single disk copy of    a database on mainframe "alpha" can also be used by mainframe "beta"    if the database's file system is NFS mounted on "beta".     NFS adds significant load to a network and has poor utility across    slow links, but the benefits are strong. The NFS client is    implemented in the kernel, allowing all applications and commands to    use the NFS mounted disk as if it were local disk.   [Page 6] (8.5) SNMP    Simple Network Management Protocol (SNMP) uses UDP and is designed    for use by central network management stations. It is a well known    fact that if given enough data, a network manager can detect and    
 Socolofsky & Kale       [Page 6] (RFC) (A TCP / IP Tutorial January)        diagnose network problems. The central station uses SNMP to collect    this data from other computers on the network. SNMP defines the    format for the data; it is left to the central station or network    manager to interpret the data.   [Page 6] (8.6) (X-Window)    The X Window System uses the X Window protocol on TCP to draw windows    on a workstation's bitmap display. X Window is much more than a    utility for drawing windows; It is entire philosophy for designing a    user interface.   [Page 6] (9) . Other Information    Much information about internet technology was not included in this    tutorial. This section lists information that is considered the next    level of detail for the reader who wishes to learn more.       o administration commands: arp, route, and netstat      o ARP: permanent entry, publish entry, time-out entry, spoofing      o IP route table: host entry, default gateway, subnets      o IP: time-to-live counter, fragmentation, ICMP      o RIP, routing loops      Domain Name System   [Page 6] () . References     Comer, D., "Internetworking with TCP / IP Principles, Protocols,        and Architecture ", Prentice Hall, Englewood Cliffs, New Jersey,        USA, .     [] Feinler, E., et al, DDN Protocol Handbook, Volume 2 and 3 , DDN        Network Information Center, SRI International,  Ravenswood        Avenue, Room EJ , Menlow Park, California, USA, 9424.      Spider Systems, Ltd., “Packets and Protocols”, Spider Systems        Ltd., Stanwell Street, Edinburgh, U.K. EH6 5NG, .   [Page 6]  Relation to other RFCs      This RFC is a tutorial and it does not UPDATE or OBSOLETE any other    RFC.   [Page 6]  Security Considerations    There are security considerations within the TCP / IP protocol suite.    To some people these considerations are serious problems, to others    they are not; It depends on the user requirements.    
 Socolofsky & Kale         [Page 6] (RFC) (A TCP / IP Tutorial January)        This tutorial does not discuss these issues, but if you want to learn    more you should start with the topic of ARP-spoofing, then use the    "Security Considerations" section of  (RFC) to lead you to more    information.   [Page 6] [Page 6]  . Authors' Addresses    Theodore John Socolofsky    Spider Systems Limited    Spider Park    Stanwell Street    Edinburgh EH6 5NG    United Kingdom     Phone:      from UK  - 1991 -       from USA 0  -  -  - 1991 -     Fax:      from UK  - 1991 - 1991      from USA 0  -  -  - 1991 - 1991     EMail: [email protected]      Claudia Jeanne Kale    19 Gosford Place    Edinburgh EH6 4BJ    United Kingdom     Phone:      from UK  - 1991 -       from USA 0  -  -  - 1991 -    EMail: [email protected]                  Socolofsky & Kale []   [Page 18]  (Html ​​markup produced by rfcmarkup 1.)  d, available from        https://tools.ietf.org/tools/rfcmarkup/ 
             [Page 6]   (Read More)