Chapter 27 · How Networking Actually Works

Knowledge Check

10 min read

Try to answer before you open the answers. Guessing is fine; checking your guess is how you learn.

QUICK REVIEW (5 minutes)

  1. How long is a MAC address, and what does its first half tell you?
  2. What is the difference between a switch and a router?
  3. How many bits is an IPv4 address, and how many is an IPv6 address?
  4. What does ARP do, and is its question a broadcast or a unicast?
  5. Which DNS record type holds an IPv6 address, and which holds an alias?
  6. What are the four steps of DHCP?
  7. What are the three messages of the TCP handshake?
  8. Which protocol, TCP or UDP, would you choose for a voice call, and why?
  9. What does the default route 0.0.0.0/0 mean?
  10. Why does a home router need port forwarding for incoming connections?

ANSWER KEY — DO NOT READ UNTIL YOU'VE ANSWERED

Click to reveal answers

1. MAC address

48 bits (six hex pairs). The first half (3 bytes) is the OUI: it identifies the maker of the network chip. The second half is the maker's serial number.

2. Switch versus router

A switch forwards frames by MAC address inside one network. A router forwards packets by IP address between different networks.

3. Address sizes

IPv4 is 32 bits (four numbers 0-255). IPv6 is 128 bits (eight groups of hex).

4. ARP

It finds the MAC address for an IP address on the local network. The question ("Who has 192.168.1.1?") is a broadcast. The answer is a unicast.

5. DNS record types

AAAA holds an IPv6 address. CNAME holds an alias (another name). (A holds IPv4.)

6. DHCP

Discover, Offer, Request, Acknowledge (DORA).

7. TCP handshake

SYN, then SYN-ACK, then ACK.

8. Voice call

UDP. A late voice packet is useless; waiting for a resend would make the call stutter, so it is better to skip a lost one.

9. Default route

"For any destination that no other rule matches, send the packet to the default gateway." The prefix length is 0, so it matches everything, and is used only when nothing more specific fits.

10. Port forwarding

NAT keeps a table only for connections that were started from inside. A new connection from outside has no table row, so the router drops it. Port forwarding adds a fixed row that says where to send it.

UNDERSTANDING QUESTIONS

Q1. Why do we need both MAC addresses and IP addresses?

Answer They solve different problems. The **MAC address** delivers a frame across **one local link** (one cable, switch or Wi-Fi network). The **IP address** identifies a device on the **whole Internet** and lets routers choose a path across many networks. The MAC changes at every hop; the IP stays the same from start to end.

Q2. Why does your PC send a packet for a faraway website to the gateway's MAC, not the website's MAC?

Answer After applying the subnet mask, the PC sees that the website is **not on its own network**. MAC addresses only work locally, so the PC ARPs for the **default gateway** and puts the gateway's MAC in the Ethernet frame. The IP packet inside still carries the website's IP address as destination, and the router forwards it onwards.

Q3. Why does DNS use caching with TTL, and what is the downside?

Answer Without caching, every lookup would walk the whole root, TLD and authoritative chain. That is slow and would overload the servers. The **TTL** says how long each answer may be kept. The downside is that when a site changes its IP, some users keep the **old** one until their cache expires.

Q4. Why is the DHCP Discover sent as a broadcast from 0.0.0.0?

Answer At that moment the PC has **no address** yet and does **not know** where the DHCP server is. The only thing it can do is shout to **everyone** on the local network (`255.255.255.255`) using the placeholder source `0.0.0.0`. The server answers, and the PC then gets a real address.

Q5. A stateful firewall allows replies to your browsing automatically. How does it know they are welcome?

Answer When you start a connection, the firewall writes a row in its **state table** (protocol, addresses and ports). A reply that matches that row is part of a conversation you started, so it is allowed. A packet that matches no row and no allow rule is dropped.

SCENARIO QUESTIONS (Troubleshooting)

S1. ipconfig shows the address 169.254.37.12 and no gateway. What happened and what do you check?

Answer No DHCP server answered, so Windows gave itself an **APIPA** address. Check the cable or Wi-Fi connection, whether the router is on, and whether other devices get addresses. Rebooting the router or reconnecting the PC often fixes it.

S2. You can open http://8.8.8.8-style addresses and ping 8.8.8.8 works, but names such as example.com fail. Which layer of the story is broken?

Answer **DNS.** The network, gateway and Internet link work (the IP ping succeeded), but names are not being turned into addresses. Check the **DNS Servers** line in `ipconfig /all`, and try `nslookup example.com` to see if the server answers or times out.

S3. ping 192.168.1.1 (your router) works, but ping 8.8.8.8 fails. Where is the problem?

Answer Your PC and the router can talk, so the local network is fine. The problem is **beyond the router**: the Internet connection (ISP, modem or the router's WAN side), or a wrong gateway. Use `tracert 8.8.8.8` to see where it stops (probably at hop 1 or 2).

S4. A web server you run at home is not reachable from outside, but works from inside your home. What would you check?

Answer Incoming connections need a **port forwarding** rule on the router that sends the port to the server's **private** IP (give that PC a DHCP reservation so the IP does not change). Also check the **Windows firewall** has an allow rule for that program, and whether the provider uses **CGNAT** (a WAN address starting with `100.64`... or a private range), which blocks incoming connections.

S5. netstat -ano shows a program listening on 0.0.0.0:3389 that you did not expect. What is it, and what would you do?

Answer Port 3389 is **Remote Desktop (RDP)**. Listening on `0.0.0.0` means any address on the PC can accept connections. Find the owning program through the **PID** in Task Manager, decide whether you really need Remote Desktop, and if not, turn the feature off in Windows settings. Never forward 3389 on the router to the Internet. Keep the firewall on.

INTERVIEW QUESTIONS

I1. Walk me through what happens when you type a website name into a browser (network side only).

Answer DHCP has already given the PC an IP, mask, gateway and DNS. The PC asks **DNS** for the site's IP. It sees the IP is not local, so it **ARPs** for the gateway's MAC. It opens a **TCP** connection (three-way handshake) to port 443 from an ephemeral port. The data is wrapped in a segment, a packet and a frame. The router performs **NAT**, then forwards the packet hop by hop (TTL minus 1 each time). The server's reply returns the same way, and the NAT table sends it to the right PC and port.

I2. What is the difference between TCP and UDP? Give a use for each.

Answer TCP is connection-oriented and reliable: handshake, sequence numbers, acknowledgements, retransmission, ordered delivery, flow and congestion control. Use it for web, email, file transfer. UDP is connectionless with an 8-byte header and no guarantees. Use it for DNS, DHCP, voice or video calls, games.

I3. Explain subnetting: what does 192.168.1.0/24 mean and how many hosts can it hold?

Answer The first 24 bits are the network part, the last 8 bits identify hosts. Mask 255.255.255.0. There are 2⁸ = 256 addresses, minus the network address (.0) and the broadcast address (.255), so **254 usable hosts** (.1 to .254).

I4. What is NAT, and why can it not be called a firewall?

Answer NAT rewrites the private addresses and ports of outgoing packets to the router's public address and remembers each connection in a table so replies can be mapped back. Unsolicited incoming traffic is dropped because there is no table row, which looks like protection, but NAT was designed to save IPv4 addresses. It has no rules about what is allowed, does not look at programs, and can be bypassed by port forwarding or by traffic that is part of an allowed connection. A real firewall is a separate feature.

I5. How does a switch learn where devices are, and what happens with an unknown destination?

Answer For every frame that arrives, the switch records the **source MAC** and the **port** it came in on. When a frame arrives for a MAC that is in the table, it is sent only to that port. For an **unknown** destination (or a broadcast), the switch **floods** the frame out of all other ports. The reply then teaches the switch where that device is.

PRACTICAL TASK

Draw a one-page "map of my home network". Using the results from the Practical Lab, draw boxes for your PC, your router (gateway), your DNS server and the Internet. Write on each box its IP address and, for your PC and the gateway, the MAC address. Draw lines between them and label each line with the protocol that uses it (for example "ARP: who has the gateway?", "DNS: UDP port 53", "web: TCP port 443"). Finally, add the first three hops from tracert.

Why This Matters

When "the Internet is down", you can use your map to ask: is it my PC, the local link, the router, the DNS or the provider? The troubleshooting ladder in Section 8.3 tests one box after another. A map in your head turns a vague problem into a precise one.

CHAPTER SUMMARY

  • The NIC connects a PC to the network (PCIe card or board chip, with a MAC and PHY, using DMA and interrupts). Its MAC address (48 bits) names it on the local network.
  • Ethernet frames carry data across one local link. Layers wrap data as Data, Segment, Packet and Frame (encapsulation).
  • Switches forward by MAC; routers forward by IP between networks; hubs are obsolete.
  • IP addresses work across networks: IPv4 has 32 bits, IPv6 has 128. The subnet mask (CIDR, for example /24) splits network and host. The default gateway leads out.
  • ARP turns an IP into a MAC on the local network. DNS turns names into IPs, with caching and TTL. DHCP hands out addresses by DORA, with leases.
  • TCP is reliable (handshake, ACKs, retransmission); UDP is light and fast. Ports (0-65535) pick the program; a socket is IP + port + protocol.
  • Routing uses a table with longest-prefix match and a default route, hop by hop with TTL. NAT shares one public address with a table of port mappings. Firewalls allow or drop by rules; stateful ones track connections.