1. TCP/IP protocol stack
Four-layer model
The TCP/IP protocol follows a four-layer model concept: application layer, transport layer, interconnection layer, and network interface layer.
Network interface layer: The base layer of the model is the network interface layer. Responsible for the sending and receiving of data frames, which are independent network information transmission units. The network interface layer puts the frame on the network, or removes the frame from the network.
Interconnection layer: The interconnection protocol encapsulates data packets into internet datagrams and runs necessary routing algorithms.
There are four interconnection protocols:
Internet Protocol IP: Responsible for addressing and routing data packets between the host and the network.
Address Resolution Protocol ARP: Obtain the hardware host address in the same physical network.
Internet Control Message Protocol ICMP: Send messages and report transmission errors of data packets.
Interconnection Group Management Protocol IGMP: Used by IP hosts to report host group members to the local multicast router.
Transport layer: The transport protocol provides a communication session between computers. The choice of transmission protocol depends on the data transmission method.
Two transmission protocols:
Transmission Control Protocol TCP: Provides reliable communication connections for applications. It is suitable for transferring a large amount of data at one time. And suitable for applications that require a response.
User Datagram Protocol UDP: Provides connectionless communication and does not guarantee reliable transmission of packets. It is suitable for transmitting a small amount of data at a time, and the reliability is the responsibility of the application layer.
Application layer: Applications access the network through this layer.
Network interface technology
IP uses the network device interface specification NDIS to submit IP to the network interface layer to support WAN and local network interface technologies.
Serial line protocol
TCP/IPG generally uses the internet serial line protocol SLIP or the point-to-point protocol PPP for data transmission on the serial line.
===============================
2. ARP
To communicate on the network, the host must know the hardware address of the other host. Address resolution is the process of mapping the host IP address to a hardware address. The address resolution protocol ARP is used to obtain the hardware addresses of hosts on the same physical network.
The host IP address resolves to the hardware address:
(1) When a host wants to communicate with another host, it initiates an ARP request. When the IP determines that the IP address is local, the source host searches the ARP cache for the hardware address of the target host.
(2) If the mapping is not found, ARP creates a request. The source host's IP address and hardware address will be included in the request. The request is broadcasted so that all local hosts can receive and process it.
(3) Every host on the local network receives the broadcast and looks for a matching IP address.
(4) When the target host determines that the IP address in the request matches its own, it directly sends an ARP reply to pass its own hardware address to the source host. Update its ARP cache with the source host's IP address and hardware address. After receiving the answer, the source host establishes communication.
Resolve remote IP address
Hosts in different networks communicate with each other, and the ARP broadcast is the default gateway of the source host.
If the destination IP address is a remote network host, ARP will broadcast the address of a router.
(1) When the communication request is initialized, it is known that the target IP address is a remote address. The source host is searched in the local routing table. If not, the source host is considered to be the IP address of the default gateway. Find the gateway that matches the ARP cache
(2) If no record of the gateway is found, ARP will broadcast a request for the gateway address instead of the address of the target host. The router responds to the ARP request of the source host with its own hardware address. The source host sends the data packet to the router for transmission to the target host's network, and finally reaches the target host.
(3) On the router, the IP determines whether the target IP address is local or remote. If it is local, the router uses ARP (cache or broadcast) to obtain the hardware address. If it is remote, the router looks up the gateway in its routing table, and then uses ARP to obtain the gateway's hardware address. The data packet is sent directly to the next target host.
(4) After the target host receives the request, it forms an ICMP response. Because the source host is on the remote network, the gateway of the source host network will be searched in the local routing table. After finding the gateway, ARP gets its hardware address.
(5) If the hardware address of this gateway is not in the ARP cache, it is obtained through ARP broadcast. Once it obtains the hardware address, the ICMP response is sent to the router and then to the source host.
ARP cache
In order to reduce the amount of broadcast, ARP saves the address mapping in the cache for backup. The ARP cache stores dynamic items [next] and static items. Dynamic items are automatically added and deleted, while static items remain in CACHE until the computer is restarted.
The ARP cache always reserves the hardware broadcast address (0xffffffffffffh) as a permanent entry for the local subnet.
This item enables the host to receive ARP broadcasts. When viewing the cache, the item will not be displayed.
The life cycle of each ARP cache record is 10 minutes, and it will be deleted if it is not used within 2 minutes. When the cache capacity is full, delete the oldest record.
Add static (permanent) records
By adding static ARP entries, the number of ARP requests to access the host can be reduced.
ARP packet structure
The fields of the ARP structure are as follows:
Hardware type-the type of hardware (network access layer) used.
Protocol type-the protocol in the parsing process uses the value of the ether type.
Hardware address length-the byte length of the hardware address. For Ethernet and token ring, the length is 6 bytes.
Protocol address length-the length of the protocol address byte, the length of IP is 4 bytes.
Operation number--Specify the field of the current operation.
Sender's hardware address-the sender's hardware address.
Our other product:
