{"id":2751,"date":"2019-06-01T20:54:10","date_gmt":"2019-06-01T18:54:10","guid":{"rendered":"http:\/\/miro.borodziuk.eu\/?p=2751"},"modified":"2019-08-30T05:45:14","modified_gmt":"2019-08-30T03:45:14","slug":"network-fundamentals","status":"publish","type":"post","link":"http:\/\/miro.borodziuk.eu\/index.php\/2019\/06\/01\/network-fundamentals\/","title":{"rendered":"Network Fundamentals"},"content":{"rendered":"<p>The Open Systems Interconnection (OSI) Model is a standard used by networking manufacturers globally. It was created and published in 1984; it splits all network communications into seven layers. Each layer serves the layer that&#8217;s above it plus the layer beneath it which adds additional capabilities.<\/p>\n<p><!--more--><\/p>\n<p>Data between two devices travels down the stack on the device&#8217;s A-side (wrapped at each layer) and gets transmitted before moving up the stack at the devices B-side (where the wrapping gets stripped away at every stage). This data wrapping process is called encapsulation.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2781 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/OSI.jpg\" alt=\"\" width=\"626\" height=\"539\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/OSI.jpg 626w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/OSI-300x258.jpg 300w\" sizes=\"(max-width: 626px) 100vw, 626px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>At <span style=\"color: #3366ff;\">Layer 1<\/span> (Physical), networks use a shared medium where devices can transmit signals and listen.<br \/>\nLayer 1 showcases how data gets received and transmitted while taking into consideration the medium, voltages, and RF details.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2783 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Layer1.jpg\" alt=\"\" width=\"570\" height=\"678\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Layer1.jpg 570w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Layer1-252x300.jpg 252w\" sizes=\"(max-width: 570px) 100vw, 570px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">IPv4 addresses<\/span> are how two devices can communicate at layer 4 and above of the 051 seven-layer model. IP addresses (IPs) are actually 32-bit binary values but are represented in dotted-decimal notation to make them easier for humans to read and understand.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2784 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/IPAddress.jpg\" alt=\"\" width=\"616\" height=\"579\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/IPAddress.jpg 616w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/IPAddress-300x282.jpg 300w\" sizes=\"(max-width: 616px) 100vw, 616px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Subnetting<\/span> is a process of breaking a network down into smaller subnetworks. You might be allocated a public range for your business or decide on a private range for a VPC. Subnetting allows you to break it into smaller allocations for use in smaller networks (e.g., VPC subnets).<br \/>\nIf you pick 10.0.0.0\/16 for your VPC, it&#8217;s a single network from 10.0.0.0 to 10.0.255.255 and offers 65,536 addresses. That VPC could have a single subnet within it that&#8217;s also 10.0.0.0\/16.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2785 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Subnet.jpg\" alt=\"\" width=\"608\" height=\"335\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Subnet.jpg 608w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Subnet-300x165.jpg 300w\" sizes=\"(max-width: 608px) 100vw, 608px\" \/><br \/>\nWith a certain size of VPC, increasing the prefix creates two smaller networks. Increasing again creates four even smaller networks. Increasing again creates eight even smaller \u2014 and so on.<\/p>\n<p>You won&#8217;t need to know this from memory \u2014 there are plenty of cheat sheets available to help you along the way.<\/p>\n<p>&nbsp;<\/p>\n<p>Local device-to-device <span style=\"color: #3366ff;\">communication<\/span> takes place using Ll (Physical) and L2 (Data Link) using MAC addresses and physical 0&#8217;s and I &#8216;s. This doesn&#8217;t scale across LANs, so a method of network-to-network transit is needed. IP routing provides this. The method used depends on if the two devices are local, in a known remote network, or in an unknown network.<\/p>\n<p>IP-to-IP communication that occurs locally doesn&#8217;t use a router. ARP is used to find the MAC address for the destination IP address. The IP packet is created at L3 and passed to L2, where it&#8217;s encapsulated inside an ethernet (L2) frame. The frame is sent to the destination MAC address. Once received, the L2 frame is removed and the IP packet is passed to L3.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2786 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Local.jpg\" alt=\"\" width=\"608\" height=\"350\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Local.jpg 608w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Local-300x173.jpg 300w\" sizes=\"(max-width: 608px) 100vw, 608px\" \/><br \/>\nIf Instance A wants to communicate with Instance B, it can use its IP and subnet mask to determine if B is local. If it&#8217;s not, then the following process occurs:<\/p>\n<ul>\n<li>&#8220;A&#8221; generates an L3 packet \u2014 the SRC is the IP-&#8220;A&#8221;, the DST is IP-&#8220;B&#8221;<\/li>\n<li>&#8220;A&#8221; knows its default gateway (Router) IP, so it uses ARP to find the Router MAC<\/li>\n<li>&#8220;A&#8221; passes the L3 packet to L2, wraps it in an L2 frame, and sends this to the R-MAC address (not the MAC address of B)<\/li>\n<li>&#8220;R&#8221; receives this, strips away the Layer 2 frame, and checks the DST IP<\/li>\n<li>It knows the network of IP-&#8220;B&#8221; because it&#8217;s connected to it<\/li>\n<li>&#8220;R&#8221; uses ARP to find the MAC of &#8220;B,&#8221; generates a frame TO &#8220;B&#8221;, puts the unaltered IP packet inside, and sends to MAC-&#8220;B&#8221;<\/li>\n<li>&#8220;B&#8221; receives the frame, strips it way and passes the packet to L3<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2787 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Known.jpg\" alt=\"\" width=\"630\" height=\"183\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Known.jpg 630w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Known-300x87.jpg 300w\" sizes=\"(max-width: 630px) 100vw, 630px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Routing<\/span> works equally well whether the network of the remote instance is known or not. In this case, Instance A is attempting to communicate with Instance C.<\/p>\n<p>Instance A knows Instance C is not local, so it creates an IP packet with a dst of Instance C. It passes the packet down to L2 and asks for it to be addressed to the MAC address of Router A (its default router\/route).<\/p>\n<p>Router A strips the L2 frame and reviews the destination address of the L3 packet. It doesn&#8217;t know Network 3, so it has no knowledge of how to get there. It does have a &#8220;default router,&#8221; which is Router B. It creates an L2 frame with a dst MAC of Router B and wraps it around the unchanged packet.<\/p>\n<p>The internet uses a routing protocol called Border Gateway Protocol (BGP). This protocol exchanges routes. Router C would advertise Network 3, and Router B would learn about Network 3 via Router C. Router B would advertise Network 3 via Router C. Router A would learn all Router B&#8217;s routes and all routes it knows about.<\/p>\n<p>Router C receives the L2 frame, strips it away, and reviews the L3 packet. It now knows it&#8217;s in the same network, and it finds the MAC address of the DST IP address of C. A new L2 frame is created, with a dst MAC address of C, and it forwards it in.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-2788\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Routing.jpg\" alt=\"\" width=\"314\" height=\"823\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Routing.jpg 314w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Routing-114x300.jpg 114w\" sizes=\"(max-width: 314px) 100vw, 314px\" \/><\/p>\n<p>At scale, this is how the Internet works: Unchanged packets being passed around from router to router, each time using a new L2 connection.<\/p>\n<p>&nbsp;<\/p>\n<p>A <span style=\"color: #3366ff;\">firewall<\/span> is a device that historically sits at the border between different networks and monitors traffic flowing between them. A firewall is capable of reading packet data and either allowing or denying traffic based on that data.<\/p>\n<p>Firewalls establish a barrier between networks of different security levels and historically have been the first line of defense against perimeter attacks.<\/p>\n<p>What data a firewall can read and act on depends on the OSI layer the firewall operates at:<\/p>\n<ul>\n<li>Layer 3 (Network): Source\/destination IP addresses or ranges<\/li>\n<li>Layer 4 (Transport): Protocol (TCP\/UDP) and port numbers<\/li>\n<li>Layer 5 (Session): As layer 4, but understand response traffic<\/li>\n<li>Layer 7 (Application): Application specifics (e.g., HTML paths, images)<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-2790\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Firewall.jpg\" alt=\"\" width=\"588\" height=\"323\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Firewall.jpg 588w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Firewall-300x165.jpg 300w\" sizes=\"(max-width: 588px) 100vw, 588px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p>A<span style=\"color: #3366ff;\"> proxy server<\/span> is a type of gateway that sits between a private and public network (e.g., the Internet). A proxy server is something that generally needs application support and is configured in the operating system, a web browser, or another application.<\/p>\n<p>The client makes a connection to the proxy server, and the proxy makes a connection to the destination server. Proxy servers can provide filtering (child safety, malware, removing adult content) or it can act as a web cache, speeding up web access for a large organization at a remote site.<\/p>\n<p>Proxy servers can also choose to pass on traffic or not based on things network layer appliances can&#8217;t, like username or elements of a corporate identity \u2014 department, age, security privilege, or the DNS name rather than IP.<\/p>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2791 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Proxy.jpg\" alt=\"\" width=\"591\" height=\"325\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Proxy.jpg 591w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/Proxy-300x165.jpg 300w\" sizes=\"(max-width: 591px) 100vw, 591px\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"color: #3366ff;\">Network address translation<\/span> (NAT) is a method of remapping source IPs or destination IPs of packets. It can be used in a number of ways.<\/p>\n<ul>\n<li>Static NAT: A private IP is mapped to a public IP (what IGWs do)<\/li>\n<li>Dynamic NAT: A range of private addresses are mapped onto one or more public (used by your home router and NAT gateways)<\/li>\n<\/ul>\n<p><img loading=\"lazy\" decoding=\"async\" class=\"size-full wp-image-2753 aligncenter\" src=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/NAT.jpg\" alt=\"\" width=\"616\" height=\"564\" srcset=\"http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/NAT.jpg 616w, http:\/\/miro.borodziuk.eu\/wp-content\/uploads\/NAT-300x275.jpg 300w\" sizes=\"(max-width: 616px) 100vw, 616px\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>The Open Systems Interconnection (OSI) Model is a standard used by networking manufacturers globally. It was created and published in 1984; it splits all network communications into seven layers. Each layer serves the layer that&#8217;s above it plus the layer beneath it which adds additional capabilities.<\/p>\n","protected":false},"author":1,"featured_media":2793,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[78],"tags":[],"_links":{"self":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/2751"}],"collection":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/comments?post=2751"}],"version-history":[{"count":7,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/2751\/revisions"}],"predecessor-version":[{"id":2817,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/posts\/2751\/revisions\/2817"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/media\/2793"}],"wp:attachment":[{"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/media?parent=2751"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/categories?post=2751"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/miro.borodziuk.eu\/index.php\/wp-json\/wp\/v2\/tags?post=2751"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}