Use Models to Understand IP Networking

0:00Hello and welcome. My name is Keith Barker and I can still remember back many decades ago when I was first introduced to computer networking. I thought, "My goodness, this is the most amazing thing ever!" And it was and is. Now the problem is, if somebody wants to learn about IP networking, there's a lot to take in and no one's ever just born being an expert at computer networks . So in this set of videos, we'll take a big picture look at the world of IP networking and then we'll proceed to use models to break it down into smaller and easy to understand. parts.

0:00So let's take a moment and take a look at the big picture regarding IP networking. So here's a representation of a network, a beautiful picture with lots of devices. However, for this discussion, I'd like to focus in on just a couple components here in this network topology. So the two devices I'd like to focus on first is a computer. So here's a computer, computer 2, and let's also go ahead and focus on this icon right here, which represents a server. And down here, this computer could be acting as a client. And you know what? That is a great point also to discuss here for a moment regarding networks in general.

0:34If we have some device that's requesting or asking for something, in that moment, that device is acting in the role of a client. So make a note here that says clients request. So let's imagine this client opens up their favorite browser and wants to connect either to a server inside the company or maybe a server out on the internet. And when that website responds back and that computer now gets the information from that server, in that moment, that device that's running that webpage is acting as a server. So the role of servers is providing or giving something.

1:06And this is a very common occurrence with clients running their browsers, going to websites, and those sites that are responding back acting as servers. Or behind the scenes, it's the server that's hosting the website. So here's an example of that. We have this computer that I'm currently sitting at. This is in our lab environment. If we open up a browser, I'll just go ahead and click on the icon here for Chrome, and let me go to the IP address of the server I have here in the company. So I have it here as a bookmark. So I'll click here on the 10.20.0.11 bookmark, and boom, there is the website. So here, the client PC with the browser is acting as the client, and the website that we're hitting at, this IP address, is acting as a server, responding back to us, handing all that information back and feeding it into our browser.

1:47Another interesting fact is that sometimes a server is not just a standalone server. Sometimes that server may be accessing yet another server for information. So for example, if the client connects to the website and that website is asking the client to authenticate, for example, put in a username and a password, maybe when the user supplies that username and password, this server, we'll call it server A, is checking with a database server, server B, to verify whether or not the username and password are correct. So in that instance, this server A is acting as a client as it's making a request to server B for the purpose of verifying the user's password.

2:22So if we look at it in the broad sense of clients and servers with a client requesting something and a server providing something, sometimes one system, for example, this computer right here, computer A, could be acting as a server providing webpages back to the client while at the same time acting as a client over to server B, requesting to see whether or not the username and password were correct that were submitted by the client. So we can think of the clients and servers as roles based on the current activity that's happening. And behind the scenes, there's a lot of additional detail regarding what's happening here at the client as it formulates that request and forwards it into the network.

2:57And also, a lot of details are happening here at the server as it's responding back to that client, including information that might be used by these intermediate devices like switches and routers and firewalls who would be forwarding that traffic between the clients and the server. So if we were to chat and discuss about all the individual components that goes into a request and the response here from the server, and all the forwarding that's done by these network devices, that is a very, very large topic. But fortunately, we can leverage the concept of using a model, and we can carve that whole logical process up into smaller components.

3:32So we can go ahead and focus on this part and then this part, and then this part. And that way, we can get clarity and better understand the overall process and the interrelationship of all these devices and the protocols that are being used by breaking it down piece by piece using a model. And we'll take a closer look at the models in the next video.

0:00So in the previous video, we did an example of a computer like this one right here, communicating with a server like this one right here with the computer two acting as the client and the server acting as a web server feeding the responses back to the client. Now, behind the scenes, what's not so obvious is that this computer who made the request, put a lot of information together before shipping it over the network towards the server. And as far as making the request with all the details that go into it, this is one of the benefits of using a model. And the first thing I'd like to chat with you about, about using a model to describe what this client is doing when it makes a request, is to drive home the point that the model is just a way to break a very complex topic down into smaller and more easy to digest parts.

0:44And one of the most oldest models out there for describing network communications is referred to as the OSI model, which stands for the Open System Interconnection Model. And the OSI model was created in the '70s by an organization called the International Organization for Standardization, whose acronym is ISO. However, at the end of the day, we don't really need to worry about when it was created or the actual organization that created it. We can just remember it as the OSI reference model, the Open System Interconnection model.

1:16And the goal of the OSI reference model was to break down into seven layers, the details of what's going on in a computer or a network system when it's gonna send data across the network. In our example, we had our client that was using a browser, which is a program that's running on this computer. And then these seven layers of the OSI reference model represent logical subsections of what has to be done and put together for that request that the browser's making to be sent out over the network. So I've got good news and better news. The OSI reference model is not what we use today on the internet and our corporate environments.

1:51What we use is a set of protocols called the TCP/IP Protocol Stack. Sometimes it's referred to as the TCP/IP Protocol Suite. Sometimes it's referred to as IP in general, where the IP stands for internet protocol. And if you'll notice the TCP/IP Protocol Stack, it doesn't match up exactly with the OSI reference model. And that's because the OSI reference model is just a reference model where the TCP/IP Protocol Stack is literally a protocol stack that we use on computer networks today, including the internet.

2:23And then I have one additional wow factor, and this is probably the most important takeaway from this specific video, and that is this column right here. Even though we are using the TCP/IP Protocol Suite, the suite of protocols in our corporate environments and on the internet today, when we refer to the actual layers and individual components of our TCP/IP Protocol Suite, we borrow a few of the numbers and names from the OSI reference model. We keep a few of them from the actual TCP/IP Protocol suite, and this is actually how we refer to what we use today.

2:58So what we're using is indeed the TCP/IP Protocol Suite, but we have modified the layers and numbers to make it match a little bit more with the OSI reference model. So about 20 or 30 years ago, I would've said, yeah, it'd be a great idea to memorize all these layers of the OSI reference model. But you know, what I'm gonna say today is that we really don't care about the OSI specifically or the TCP/IP Protocol Stack specifically because when we refer to the TCP/IP Protocol Stack, we are gonna be using this column right here.

3:28And here's what that means. If we're having conversations in the future from right now going forward, and we're talking with somebody and they say, "Oh, from the OSI reference model, that is layer three," which would be right here, or if they're saying, "In the TCP/IP Protocol Stack is the layer two," which is right here. What we're actually doing is referring to this hybrid where we're really using the TCP/IP Protocol Stack, but we're borrowing some of the labels and numbers for the layers from the OSI reference model as we describe and talk about the TCP/IP Protocol Stack. So if we have friends and loved ones or coworkers that talk about the OSI reference model, layer three or layer two, what we're really talking about is layer three right here or layer two as we talk about this hybrid approach to describing and characterizing the actual TCP/IP Protocol Stack that we're using on our networks today.

4:17So as far as models go, the only one we really need to worry about and talk about and get familiar with is this one right here. And we'll continue this discussion by breaking these sections down in the next video.

0:00So now that we've whittled down to one effectively model, slash, protocol stack hybrid, we're gonna focus on this stack in this video. And we could call this the TCP/IP stack or suite. We could call it the IP protocol. And in either case, when we're talking about those, we're referring to this suite of protocols or these sections of this model for the TCP/IP protocol stack that we use and love today. So let's start off with some naming of these different sections that help describe the communications that happen over a network.

0:32And let's start at the top. This level right here is referred to as the application layer. And I remember getting involved with networking back in the 80s when I heard the word application, I thought of like, you know, a program that we'd run on a computer. But in the context of the TCP/IP protocol stack, the application layer is referring to some type of a network service or function that we're looking for. For example, let's take this client again. This client opens up a browser and they go to a website in the background. What that client's really requesting is an application layer service regarding HTTP.

1:04So that's one example of an application layer service called HTTP, and that stands for Hypertext Transfer Protocol or HTTP in uppercase for short. There's also a secure flavor of that, which is called HTTPS, we'll put a slash there with an S, and also it's being used behind the scene as the application layer service when we go to a typical webpage. And there are hundreds and hundreds of different application layer services. And just to round it out a little bit, let's do an example of one other one, and that is DNS, which is an acronym for Domain Name System.

1:40However, I've also heard people pronounce it as Domain Name Service, possibly because it is an application layer service. So regarding what exactly is this application layer service called DNS, Domain Name System, it's sort of like a phonebook. And I just realized as I said that, that perhaps there are people within the sound of my voice that don't actually use a phonebook. But in the old days, if we wanted to, for example, look up the phone number or the address for an organization for an entity, we'd go to a phonebook, look up their name, and it could give us their address or their phone number.

2:11I guess a better example today would be to go to your mobile device and you want to go to a restaurant, so you look up the address. So you know the name of the place, but you need the address, you need to find that information out. So I'll jot that out as learning the address based on the name. So the restaurant, you know the name, and you do a search to figure out what the address is so you can actually go there. So HTTP or HTTPS is an application layer service that delivers webpages. And DNS, Domain Name System, is an application layer service that can give us the address regarding a specific website.

2:41So if this client is going to a website like myfavoritewebsite.com, behind the scenes, it's leveraging DNS, Domain Name System, to return or figure out the actual address so the computer can include that as part of the request before it sends that request into the network. So HTTP and DNS are great examples of application layer services in the TCP/IP protocol suite. So I have put them up here in green just to give a reminder that those are both application layer services. So as we move down the protocol stack, this next section here in this orange color is called Layer 4, and below it is Layer 3 and then Layer 2 and Layer 1.

3:21So if you're thinking, "Oh, do they call the application layer Layer 5?" No, today we just call the application layer in the TCP/IP protocol stack. We just refer to that as the application layer. We don't give it an actual number. So if we think of HTTP and DNS as these services that we want or the applications that we wanna use, each of those applications is associated with a specific set of rules. It's called a protocol here at Layer 4. And that layer in the TCP/IP protocol stack has a name and that is the transport layer. And that's already spelled out right here.

3:52So if we zero in on this section here, the transport layer, there's several different sets of rules or protocols that could be used, and let me go ahead and list a few of them. We have a protocol called Transmission Control Protocol, and its friends just call it TCP for short. Another common protocol at the transport layer or Layer 4 is called User Datagram Protocol, which its friends just like to call it UDP for short. And although there's several other Layer 4 transport protocols that are included as part of the TCP/IP protocol suite, the TCP option and the UDP option are the two most popular.

4:26So if we're sitting at a computer and we're going to a website, the end user doesn't really get to choose or control which Layer 4 protocol is gonna be used, and that's because these application layer services like HTTP and DNS, they are already associated with a very specific Layer 4 protocol, and that's what they're gonna use. So if the user here is sitting at the browser and they're going out to a website leveraging HTTP, in addition for the transport layer section information, that computer is going to include the appropriate protocol at Layer 4.

4:59And using these two application layer services that we've already identified for HTTP, the protocol that's gonna be used at Layer 4 is TCP, Transmission Control Protocol. And if we're using DNS, for example, we wanna find out the actual address being used for a specific website and we're using DNS, when DNS is used at the application layer, at Layer 4, DNS is gonna be using UDP or User Datagram Protocol. So up to this point, we've now identified two very common application layer services as part of the TCP/IP protocol suite.

5:33We've also identified two primary protocols at Layer 4, the transport layer with TCP and UDP being those two that we've mentioned, and identifying the HTTP behind the scenes using TCP at Layer 4 and DNS. The application layer is gonna be using UDP. And to help drive that home, let's go back to our computer here, computer two. Let's go over to our web server again and let's demonstrate both. So here at our computer, let's go ahead and bring up a program. I'll bring up Chrome, a browser. And here in Chrome, let's go to dc-nug.nuggetlab.com.

6:06So I'm putting in here a name of a website that I wanna go to. However, behind the scenes, this computer is also gonna leverage the application layer service of DNS to figure out what is the actual address of that website. And then once the DNS happens, it's gonna follow it up with the actual request for the HTTP, which would give us the webpage, assuming both of those work. So we'll press Enter, and boom. Both of those activities happen in the blink of an eye. And as part of the educational experience, let's go ahead and confirm that together.

6:36So I'm gonna go ahead and close that browser. I'm gonna bring up a Command Prompt, and here the Command Prompt on this Windows computer, I'm gonna do an ipconfig/flushdns. And what this is gonna do, it's gonna tell the computer to go ahead and forget or flush the cache regarding any DNS-related queries it had made. And the reason I'm gonna do that is because I wanna do the DNS again, because if the computer still remembered what the actual address was of that website, it wouldn't bother using DNS and asking again. So now with that in place, I'm gonna use this little tool called Wireshark.

7:08Now, Wireshark is an example of a packet capture utility. Think of it like a visual representation of all the details that's going on when a computer is sending information out to the network. And our focus here is gonna be taking a look at both the DNS information and also the HTTP-related request. So I'll go ahead and start the capture and let me make this a little bit bigger. So this utility called Wireshark is simply gonna help us reinforce the concept of the application layer and the transport layers associated with them.

7:39So let's go ahead and minimize our Command Prompt. And let's go back to our browser. We'll open up Chrome again, and once again, we'll go to dc-nug.nuggetlab.com, which is a computer here in my lab environment. We'll press Enter and I'm gonna go ahead and do a refresh a couple times just to make sure it's really going out to the website, not just pulling it from the local cache memory here on this Windows computer. And now that's done, let's bring back the packet capture. So here at Wireshark, I'm first gonna go ahead and do what's called a display filter by typing in DNS here at the top and pressing Enter, and that's gonna show us just the DNS request.

8:13So there is a lot of DNS requests this computer's making, but the one I'm looking for is right there. So I'm gonna go ahead and double click and make that full screen. And what I wanna point out is that the application layer service is DNS. So if we open that up, it's showing right here in the details, there's a request and the actual query. If we scroll down, we're looking for the address behind this site, dc-nug.nuggetlab.com. So I scooch this down a little bit. So the DNS is the application layer service that we're using, and then behind the scenes, DNS is gonna be using User Datagram Protocol for the Layer 4 information as part of making that request.

8:49So we'll go into further detail on these protocols, but I wanna reinforce for this video, the application layer services as well as the Layer 4 protocols that they are associated with and that they use. So that's the DNS information. Let's go ahead and close that. And let's do a search for HTTP. So I'll type HTTP up here in the top left as a display filter. So it'll just show us that. So here's one that'll work. I'll go ahead and double click on that, we'll open that up. So here the application layer service is HTTP, Hypertext Transfer Protocol, and the Layer 4 protocol that it's using is TCP, Transmission Control Protocol.

9:26So now we've discussed a couple of different application layer services in the TCP/IP protocol stack and their well-known protocols that they're using at the transport layer. Now if you're thinking, "Whoa, whoa, whoa. We need more information, What about Layer 3 and Layer 2 and Layer 1? What about those?" And the answer to that is we're gonna get to that as well because we'll pick up the next part here, the network layer in the next video.

0:00So if we continue our discussion of this client making a request to go to this website, which, in our case, that was dc-nug.nuggetlab.com. That caused the computer to use the DNS service to figure out what the address was for that server. And as part of that, it included UDP information at the layer for the transport layer as part of that request. And then after that was all successful, it then used HTTP to make a web request for the webpage at that server. And when that HTTP request was made at Layer 4, it was leveraging in the background Transmission Control Protocol.

0:35So next, let's take a closer look at the Layer 3 information that would also have to be included by this computer before it sends out a request out to the network. And the primary information here in the network layer is the address information. And I think we're all familiar with addresses. Imagine that we're sending a physical letter to somebody. We're gonna go ahead and put an address on it. So it's probably gonna have their name on there. We're very likely going to include the street name. That's if we want this to be delivered correctly. So we have the street name and also the house number.

1:06And also very likely we put our return information in the upper left-hand corner in case they need to reply back to us or in case the postal delivery service needs to deliver it back to us. And this is an example of an address. So in the world of the TCP/IP protocol stack or the TCP/IP protocol suite, what exactly is an address? Well, it's very much like the address we have here on an envelope. We're gonna have the street name. In the world of IP they call that a network address. So think of a network address very similar to a street name. And then we're also gonna have the house number or the device number on that street.

1:40And so we're gonna refer to that as a host address. So imagine we have a street. Let's go ahead and call this Elm Street. And then we have a house on that street, this is the driveway, and we have a house number. So that information, if we're delivering a piece of mail, we'd put that information on the envelope so it could be delivered correctly. And in the world of IP networks, instead of using a street name literally, we're gonna have an IP network address, which is also going to include the host address, which is like the house number or individual device address on that Common Street.

2:10So gonna go ahead and clean this up a little bit. And let me give you an example. And the example I'm gonna give you is an IP which stands for Internet Protocol Address. And the reason I'm putting here in blue is because I wanna remind us that this information is gonna be kept here in the network section of the TCP/IP protocol stack. And that's also referred to as Layer 3 or the network layer. And the major protocol here is IP, the internet protocol. And there's two different flavors of IP. There is the old traditional flavor called IP version 4, and there is another version called IP version 6.

2:45And visually, they look very, very different than each other. And we'll have further discussions about both of them in greater detail. But for right now, I'd like to give you an example of an IP version 4 address. So let's imagine we're focusing on this computer right here. And let's imagine this computer is on the IP network of 10.10.0. And let's imagine those first three numbers separated by the periods there, that represents the actual street or network. And let's imagine that the actual house number on that street is 50 for this computer right there.

3:17So I'm gonna make a little note that that represents the actual house number, this 50 right here. So I'll put a little dividing line there for a reference, and we'll have a whole separate set of skills based on detailing: How do we know where that dividing line is between the street name or the network number and the actual house address or host address on that network? So let's measure this computer here is 10.10.0.50 and that the server that we're trying to go to is at 10.20.0.100. So that's their IP addresses.

3:48So how in the world does this computer, if we're going to dc-nug.nuggetlab.com, how in the world does this computer learn about the actual IP address? Because it needs to include the IP address in the Layer 3 header information. And the answer is DNS. This computer is gonna use DNS to make a request to a DNS server, somebody who knows the information, and this client's gonna say, "Hey, I need the IP address for dc-nug.nuggetlab.com," at which point the DNS server, who knows that information can respond back to this client, and that's how this client gets the IP address of the destination it's trying to go to.

4:24And there's a couple different ways we could verify that's happening here at computer two. In fact, let me show you. So back here at our client computer, let me go ahead and hit the Up Arrow key. I'm gonna do an ipconfig, space, /flushdns just to make sure this client computer isn't hanging onto anything. And then we'll do an ipconfig/displaydns and we'll press Enter. So this is showing us everything that this computer currently knows about regarding names to IP address mappings. So if we are gonna do a ping, for example, and pinging is a great tool just to verify basic connectivity, let's do a pinging to DC Nug.

4:57So dc-nug.nuggetlab.com, and press Enter. So in the background, I used DNS to resolve that name to IP address. So here, it's showing that the IP address came back as 192.168.1.100. And if we hit the Up Arrow key a couple times and do an ipconfig/displaydns and press Enter, here is showing us that the response that came back for that DNS request actually provided this answer, 192.168.1.100, and it also provided this one as well. Meaning there was two entries, two different IP addresses associated with the name dc-nug.nuggetlab.com.

5:31Also, if we go back to our capture that we did in a previous video and we did a quick filter for DNS. So we look at this request right here for this DNS request, and in fact, we can expand this and take a quick look. So in this query, we're looking for dc-nug.nuggetlab.com. Also in this packet capture is gonna be very kind and tell us where the response is. So I'll click on packet 13, the hyperlink there to take us to packet 13, and here is the response. So for the response here in this response packet, here are the answers.

6:01So if we scroll down, there's the two addresses from a DNS server based on the DNS request that we made. So I'm going to update the IP address here to add 192.168.1.100 as also an address that is used by this server. So once the client made the DNS request and learned about the actual IP address, it included the IP address in the Layer 3 header in that compartment as part of the TCP/IP protocol stack for communicating with that server. So if this was the letter, we'll go ahead and put the letter here.

6:32In the Layer 3 header section, it would have the destination address. And depending on what the computer actually wanted to use, it could use either of those addresses because it got both of those back. It would also include the source information for this computer. So this computer is at 10.10.0.50, and that source and destination information would be included as part of the network layer or Layer 3 header information here as part of the request that this computer's about to send out to the network. Another question that might come up is, "Okay, how exactly do we verify what the local IP address is on this local computer?"

7:07And the answer is we can simply ask it. Now, it's gonna vary a little bit based on whether it's a Macintosh or whether it's a Linux computer or a Windows computer. So since we have our Windows computer up and running, let me show you how simple it is to ask this computer what its IP address is. And it would go something like this. On a Windows computer, it's ipconfig, I-P-C-O-N-F-I-G with no spaces, press Enter. And that's gonna show us the IP address or addresses if there's multiple adapters and multiple addresses on the actual network interface cards. So here on this computer, it has the IP address of 10.10.0.50.

7:41We'll take a closer look at the mechanisms, including the mask and so forth. It's used as part of that. And also this computer has learned that if it needs to get off the local network, for example, if it needs to go out to 10.20 or 23.58.70 or some other address that's not local, it can go ahead and forward the traffic that it's gonna send to its default gateway, and then it's up to the default gateway, also known as a router, to go ahead and forward that traffic in the correct direction towards the final destination. So the takeaway here is that with this command on a Windows computer, ipconfig, it's gonna show us the actual IP address associated with this computer's network card.

8:17So let me go ahead and do a little cleanup here on IL9. So in our example so far, the green represents the application layer. The TCP and UDP are two examples of protocols that can be used at Layer 4 or the transport layer. And now at Layer 3, the network layer, and I'll put this in blue, we have the IP information, including the source and destination IP addresses that are gonna be used for the communications on the network. So that'd be true for an HTTP request and it'd also be true for a DNS request. So the IP information would be logically included right here in the Layer 3 header, including the source and destination addresses.

8:55In fact, we still have a packet capture open from our initial conversation from this computer over to the server. So we can take a look at that right now. So here at our client computer, if we go back to our packet capture, and let me go ahead and do a filter for HTTP in the upper left. So here is an HTTP request, HTTP is using TCP at Layer 4. And then the next layer, which is the network layer, has the information about the IP addresses. So if we open up this packet, let me go ahead and open it up and take a closer look. So here's showing us that in the IP header, effectively the Layer 3 section of the TCP/IP protocol stack, the main ingredients here are the source and destination IP addresses.

9:35So for the source, it's specifying both here and the summary at the top, and also here specifying the source is 10.10.0.50. That's our computer's IP address where it's making the request from. And when we did the capture, we were sending the traffic to the website at 10.20.0.100. And again, the source and destination IP address information is logically included in the Layer 3 component or compartment of the TCP/IP protocol stack. And oftentimes, that's referred to as a IP header. Think of a header as the space or section where we're gonna keep that information.

10:07So this is pretty much the discussion I wish somebody had had with me 25, 30 years ago when I first started getting into IP networking because by breaking it down into these logical sections or components, it's easier to understand those individual components. And if you're wondering, "Well, are we gonna cover the rest here, the data link and the physical layer?" The answer is absolutely yes, and that will be in an upcoming video.

0:00As we work our way down the protocol stack, at the data link layer, there is a fascinating little thing that happens on every single network adapter. And this applies to wired connections, where a physical wired connection that goes into a switch, or if we have a wireless connection, every single network adapter on these computers has it's own address and this is burned in from the factory. So when you get a computer, it has a network interface card, again, whether it's wireless, or a physical network interface card that's physically connected to the network, the manufacturer has burned in a little layer two address.

0:33And as a result, this little address has many different names that it can be referred to as. One is, we could call it a layer two address, or because it's burned in by the manufacturer to the network interface cards, sometimes it's called a burned in address. That's BIA for short. Also because it's part of the physical card, sometimes it's referred to as the physical address, or it can also be referred to as media access control address. But we just abbreviate that as MAC, not to be confused with Macintosh, but rather media access control. And because most of our networking today is with ethernet, sometimes that burned in layer two address is referred to as an ethernet address.

1:07So that is five different terms for that little address that is burned in to the individual network interface cards. Also, the network interface card has it's own acronym that is a NIC for short. So if you see network adapter, network interface card, or NIC, they're referring to the little network adapter that's in these computers that's allowing them to communicate with the network. So one of the cool observations is that in addition to having a layer three logical IP address that we're using to communicate back and forth with, at the individual network interface card, we have an additional address.

1:40Again, we can call it layer two address, or burned in address or physical address or MAC address, or ethernet address. And this is represented by 12 characters, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12. And I got a little bit creative here at the end, because these 12 characters are not written in normal decimal. They are representing hexadecimal characters. Behind the scenes, each hex character represents four bits. So we'll have a further set of discussions regarding binary, and decimal and hexadecimal.

2:11But for now, I just wanna point out that these burned in addresses, these layer two addresses, these ethernet addresses, they are represented by 12 characters, and behind the scenes, that's representing a 48 bit address. And it's up to the manufacturers to make sure that they're all unique. And the way I like to think of it is like this. Let's imagine we have our street. So let's say this is Elm Street, and we have a house on Elm Street, maybe it's house 51, and house 52 and house 53, or in a computer network, this could be network 10.10.0.0.

2:42And this could be host with the IP address ending in 51 and .52 and .53. And the analogy that makes sense for me is imagine that these houses, they don't have their own individual mailboxes right in front of the house. Instead, they have a community mailbox area with multiple slots. Let's say there's slot number one and slot number two, and slot number three and slot number four and so forth. And so the mail carrier, when they deliver the mail to the final destination, they go to the common mailbox area, and then they have to know, for example, slot one, it goes to house 51, or slot three or slot four goes to house 52, or whatever the mapping is there.

3:22And that way the mail person can go ahead, and put the mail in the correct slot. So think of these individual slot numbers, think of those like the individual burned in, or layer two addresses on these computers. So before the computer sends traffic out onto the network, they are going to include at layer two, they're going to include the source, and destination layer two addresses. And again, we could use any of these names as we're specifying those layer two addresses. So at layer three, they're including the source, and destination layer three IP addresses. And at layer two, it's gonna be including in that header, in that section, the source, and destination layer two addresses that that data's gonna need as it progresses it's way through the network.

4:01So one of the questions that may come up is, "How do we tell exactly what the layer two address is on a computer?" And the way you determine that layer two address varies a little bit based on the platform. So because we are currently working with a Windows client, let's take a look for a moment, and identify on this Windows computer right here, exactly what it's layer two address is. So here to command prompt on this Windows computer earlier, we did the command ipconfig to show the local IP address on this computer. And we can use that same command again, ipconfig /all or we could do a all.

4:34And on more modern versions of the Windows operating system, the -all works as well. And what that command does, ipconfig -all or /all, either way is great, that's gonna show us the network interface cards. And it's also gonna show us the layer three information, including the IP address here. And it's also gonna show us the layer two information. So here, it's calling it the physical address, but what we're looking at here is the layer two address, the physical address, the MAC address, the hardware address. They're all referring to this 12 character address that's been assigned by the manufacturer.

5:07That information is gonna be included in the layer two header for any traffic that this computer is sending out to the network. And we can also verify that, because we still have our packet capture open. So we bring back our packet capture here. Here is our HTTP session at the application layer. Here's the transmission control protocol, layer four, here's the internet protocol at layer three. And here is the layer two header information. And the key part here is the source MAC address. Check it out, 14:75:5b:67:83:10, that's this computer, our client computer's MAC address that it included in the layer two header information of traffic before it sends it out to the network.

5:46It's also going to include in the layer two header, the layer two address of the next destination that it needs to forward to. So as far as whose destination layer two address is it going to include, that's a discussion for another set of videos. But for now, I wanna just reinforce the concept that the layer two information includes the source, and destination layer two addresses that are gonna be used by the network devices to forward that traffic onto it's destination. So if we went back to a command prompt, here, we have the default gateway that this computer's gonna use.

6:17So effectively this computer says, "You know what? If I'm gonna send traffic to somebody on a different network." So this computer's on the 10.10.0 network, if we're gonna reach out and talk to a server at 10.20 something, this computer's gonna use it's default gateway, and for the traffic there. And as part of using it's default gateway, this computer would also need to learn the layer two address of it's default gateway. And the method that we're gonna use in IPv4 networking is the protocol called ARP. So on a Windows computer, if we type in ARP, which stands for address resolution protocol, think of it like DNS for layer two.

6:52And on a Windows computer, if we do an arp -a, that'll show us all the cached ARP entries. So right here is showing us that this computer has dynamically learned the layer two address for it's default gateway, 10.10.0.1. And that layer two address is this one right here, ending in 0.0.0.8. And if we go back to our packet capture, that would've been the destination layer two address that this computer included as part of the layer two header. In fact, let's take a peek. So right here in the layer two header information, here, it's showing the destination layer two address is the one ending in 0.0.0.8, which is the corresponding layer two address, the MAC address, hardware address, physical address, ethernet address that's associated with the default gateway's network interface card.

7:34And that's useful because we're gonna need to forward traffic at layer two over to that default gateway, so that when that data gets to the default gateway, it can take that information including what's in the layer three header and forwarding it on towards this final destination. So lemme clean this up a little bit, and here, we'll jot down at layer two that we're including the MAC addresses. Again, we could call that the ethernet addresses, or layer two addresses or physical addresses. And I'm gonna go ahead and choose to use MAC addresses here, including the source and destination MAC addresses.

8:05And we just saw that a moment ago in the layer two header. And that would be true if we're doing HTTP at the application layer or DNS at the application layer. As we get it on the protocol stack, we're including the source, and destination layer two addresses before we're sending this information out on the network to be forwarded to it's final destination. So once this computer has gathered all this information, we then come to the point where we're gonna have to send it, and that's the physical layer which we're gonna chat about in the next clip.

0:00So now as we take a look at all the work our client has done before ever sending the data into the network, it has included the application layer information, whether it's a DNS request or an HTTP or HTTPS request. It's added the appropriate layer for a protocol that's associated and well-known with that application layer service, whether it's TCP or UDP, it's included the source and destination IP addresses at layer three in the layer three header. If it didn't know the destination layer three address, it would do a DNS request to find that information. It would then include at layer two, the source and destination MAC addresses, and then it's finally time to get busy and send the data.

0:36And that's at layer one. So layer one represents the actual connectors and signals and the media that's used to forward that traffic. And so our primary media options here in the world of ethernet networking and high-speed networking today include ethernet and the ethernet standards. And that would include both copper and also fiber optics. And we also have a large portion of our devices now that are using wireless communications as well. So in that sense, the airwaves are acting as part of the physical layer for the communication of that data into the network.

1:11So here's a fair question. Why does this computer who's trying to simply go to a website, why does it have to go through all the work of including source and destination IP addresses and the MAC addresses involved for forwarding that traffic? And the answer is that the devices in the network are gonna be using that information to forward it. And let me give you a sneak peek at what I mean by that. When that information enters the network, a device called a switch, specifically a layer two switch, is gonna be looking at that information in the layer two header, including the source and destination layer two addresses to make a forwarding decision at layer two.

1:44And that's what a traditional layer two switch does, it makes forwarding decisions based on MAC addresses or physical addresses. And then routers, when they receive the data on the network, they're looking at the source and destination IP addresses, and they're making a forwarding decision based on the destination IP address. So in the case of this client talking to the server, the router would look at that layer three information and hopefully if it knew how to forward, it would forward this direction to the firewall who then forward it over to the server. Also, there's some general terms regarding data at those layers. So if somebody's talking about the network layer and the IP address information there, we could call that a packet, for example, a packet of data that's being sent.

2:23If we're focusing and putting our attention into the layer two header information, which includes the source and destination MAC addresses, we could refer to that as a frame of data. And as that data is actually being sent over the network, we could refer to that as just a series of bits being sent over the network like Morse Code, beep, beep, beep, beep, beep, beep, beep, fast, fast, fast, but being sent one bit at a time. Or if we're focused on the TCP or UDP portion of the protocol stack, we could refer to that as a segment. And like many things in life, these are not hard and fast rules.

2:55In fact, most of the time with casual conversations, we're gonna be just talking about packets being sent back and forth over the network, regardless if we're focusing on layer two or some other aspect of the traffic that's being sent. So if we wanna be literal, we can talk about packets at layer three and frames at layer two. Or if we just hear somebody talk about packets, we need more information or context to make sure we understand exactly what they're talking about. Because somebody could say, we're saying a packet as a DNS request over to a DNS server, or we're saying a packet over to a HTTP server for web services.

3:29And so take the actual terms here with a little grain of salt. So we get to have future sets of discussions, you and I, regarding details at the application layer and at these various layers of the protocol stack. And the key takeaway for this set of videos is just to be aware of the types of content that are gonna be included at these various layers of the TCP protocol stack and that it's up to the clients to gather and collect and put all that information together. And this process is referred to as encapsulation. And the reason it's referred to that is because we're starting with the client making some type of request, but then they're adding the TCP information in the case of HTTP, they're adding IP information and they're adding the layer two address information.

4:09And so we're adding on and encapsulating the original request with this additional content before we send it. And the reverse process happens when the traffic is finally delivered to the server. It'll take a look at the layer two information, say, oh, that destination is my MAC address. It'll then continue to look at the layer three information, say, oh, that destination is my IP address. It'll then take a look at the layer four and the server will say, yep, I'm running HTTPS on the well-known ports associated with this TCP protocol. And at that point it can then go ahead and respond back. And that process of opening up the traffic and looking at all the individual parts as it goes up is referred to as deencapsulation.

4:44And again, we'll have more discussions in future sets of videos regarding additional detail on TCP/IP and how those components interact and work together.

0:00One of the best ways to help reinforce the concept and to build skills is hands -on practice and that's exactly what you and I get to do right now in this hands-on lab. And for this lab, although there's a lot of network objects shown here in this topology, we are going to focus our attention right here on this Windows 11 computer that is called Client-Nug. And so to help make sure that we are on the same page, the same sheet of music, let me show you from the lab environment exactly how to access this little virtual machine. So here in the lab environment, here in the upper right hand corner is our little shortcut for client-nug.

0:34So if we go ahead and double click on client-nug right there, it'll bring up the window for that virtual machine. So this is our client-nug VM and I also have a little copy of our topology right here for added convenience. So if you want to double click on this icon here for the lab topology, you can open that up if you want a little smaller, you can zoom in and out using these controls in the bottom right right here. And again, this is just a convenience right here in the lab environment. It's the same topology that we also have in the skill itself. So again, this little virtual machine right here that we're not working with represents this little PC in our topology.

1:06And for this lab, we're going to do most of our work from right here from this client-nug machine. So with that in mind, let's go back to our lab tasks and take a look at what we 're asked to do in this lab. So on this Windows 11 client-nug computer, I would love you to identify what is the layer three IP address is currently assigned to this computer. And then secondly, it also like you to identify what is the layer two MAC address. That's the burned in hardware address, sometimes called the physical address or the layer two address or the burned in address. And both of these can be discovered on a Windows computer by using the command IP config in a space, then either a slash all or you can also on the current version of Windows, you can also do a dash all and either option slash all or dash all will give you not just the layer three information, but a whole bunch of other details, including the layer two address regarding the network interface card on that computer.

1:56I'd also encourage you to jot down whatever that IP address is that you discover on that computer, whether that's an online document that you're using or a physical piece of paper, either way is great, but make a note of what the layer three address is and also what the layer two address is associated with the network interface card on that Windows 11 computer. And there's two reasons for that one, I want you to be able to identify what those addresses are and also remember that they're associated with layer three and layer two from the protocol stack. And then secondly, we're going to be leveraging that information later on when we take a look at a packet capture. All right, so let me clean that up just a little bit.

2:28And the next thing I'd love you to do right here on this client and machine is to open Chrome. There's a shortcut on the taskbar. We're going to go ahead and show you that real quick. So here on our client and a computer right here, I've got on the taskbar, a little shortcut for Chrome. So that is right here. You can go ahead and click on that once to go ahead and open it up or you can also double click if you choose to double click on the shortcut here on the desktop. So as an example, I'm going to go ahead and click on Chrome in the taskbar. There it is. And then here I have a bookmark for server one dot nuggetlab.com. So what I'd love you to do is simply click on that bookmark right here for server one.

3:02And that's going to open up the web page that server one is providing. So what 's happening is we're going to be sitting at client nug and the actual web page we're opening up is from this server over here, server one. And this is the actual URL is being used behind that bookmark. Now behind the scenes, one of the magical things that's going to happen is this client needs to figure out, okay, what is the actual IP address behind this URL server one dot nugget lab.com. So in the background, the client is going to be making a DNS request to ask a DNS server, hey, what is that IP address? And then after that, it can then go ahead and start making its communication requests for HTTP traffic for web services to the IP address that it learned from DNS. And because in this lab, my focus is for us to reinforce the concept of the protocol stack. What I've done is I 've created a capture packet from wire shark that includes the DNS request and the HTTP request from this client to the DNS and web server. So long story short, once you open up this URL, the DNS and the HTTP as a result of that are going to happen in the background. And then what I 'd like you to do is open up that capture packet. And I'd like you to identify from that capture that wire shark capture the following for packet number one that's inside this capture file. I'd like you to identify what is the application layer protocol? Is it

4:18HTTP or is it DNS or is it HTTPS or is it SSH or is it some other application layer protocol? It'll be shown inside the packet capture. And that is again for packet number one. Now once you've answered that question, I'd like you to reinforce our knowledge of layer four of the TCP/AP protocol suite by identifying from packet number two, what is the transport layer protocol that's being used at layer four? And then for packet number three, I'd like you to identify at the network layer, what is the source IP address included as part of that packet? And again, the goal here is to help reinforce the concept of behind the scenes, this logical protocol stack, this logical network model that we're using to communicate back and forth over a network. And then for packet number four and the packet capture, I'd like you to identify at the data link layer, that's layer two, I'd like you to identify what is the destination layer to address for the packet shown here in entry number four in this packet capture. And just to make sure that you know exactly where this packet capture is, let me show you that as well. So back in the lab environment here in the client and the computer, I'm going to minimize the browser there. And I 'll go ahead and also minimize the command line there. And here on the desktop is that capture file called DNS plus HTTP capture. So once you've opened up that web page that

5:35goes to the server, I'd like you to then go ahead and open up this capture file simply by double clicking it right here on the desktop of the client and a computer. And just to confirm that's all in order, let me go ahead and double click on DNS and HTTP capture. And there it is. So we have four packets that are shown here. And what I want you to do is by taking a look at each of these, we can look at the details at each of the layers of the protocol stack. For example, in packet number three here, if we click on that, it's showing us that the application layer services HTTP. And that's using at layer four, the TCP protocol. So you can go ahead and collapse or expand these to take a closer look. So up here, you click on the actual entry itself. And then down here, you can expand each of the individual sections. And for this packet capture that I did, I captured the traffic right here as is going in and out of this network interface card on our windows client machine. So that my friend is the lab exercise, have some fun with it. And then once you're done, you identify the application layer protocol in packet number one and the transport layer protocol and packet number two and so forth. Please feel free to join me and they'll walk through where we'll walk through the entire process together. So have some fun and I'll see you when you are ready.

0:00In this walkthrough, our objective is to walk through the lab tasks. Then what we can do is we can compare what we discover and glean here in this walkthrough with the results you got when you did the lab on your own. The goal here in this lab is to help reinforce the concept of the IP protocol stack, and the actual functions and the layers associated with various protocols as computers like this client and that computer right here communicates with a server over here. With that in mind, let's go to our lab environment and let's do this walk through together. So here in the lab environment, I'm going to go ahead for convenience.

0:32I'm going to double click on the icon for the lab topology right there. And then I'm going to make it a little bit smaller and go ahead and simply move it over the right a little bit so I have it in eyesight all the time. Great, great, great switch right there. And then we're going to move our attention up in the upper right hand corner to client-nug. We'll double click on it to open up the interface for that Windows 11 client machine. So here is client-nug right here. We'll give that a minute to initialize and I'm going to scootch this a little bit to the left as well. Fantastic, so the first task asks us to identify the layer two and layer three addresses associated with the network interface card on this client-nug computer.

1:08So to do that, we're going to open up the command prompt. So I've got a shortcut there on the taskbar. And if we run the command IP config as currently shows right here, that's going to show us information such as the IP address. So we got that part, that's 10, 10, 0, 50, fantastic. However, what it's not showing us is not showing us what the layer two address is. So for that, what we're going to do is the same command IP config, but this time do a dash all. Or if you're in older version of Windows, you might need to do a slash all. Either way works great because we're here on a Windows 11 computer.

1:39And this in addition to showing us the IPV for address right here, which is 10 dot 10 dot 0 dot 50 for our little client-nug machine. It's also showing us what the layer two address is. So on this network interface card, this physical address, which goes by many different names, such as the layer two address or the MAC address, meaning media access control address or the burned in address. Those are all referring to this 12 character address and behind the scenes that 12 characters that's in hex. And it actually represents 48 bits of data.

2:09And we'll get it more into hex when we look at IPV six. But for now, I just want to be aware that that is the layer two address on this network interface card. And the IP address is the layer three address. And we've now just completed this first two tasks as far as the lab goes. The next task was asking us to go ahead and in Chrome, open the bookmark up to the server. So we'll go ahead and I'm going to click on the taskbar icon for Chrome to open it up right here inside of our client-nug computer. And then we'll go ahead and in the upper left hand corner, I've got the bookmark right here for server one dot nuggetlab.com using HTTP.

2:42So we'll go ahead and click on that bookmark right there. And that presents the web page being served up by that server. So client nug is acting as the client in this case. And our server one is acting as in this example, the web server. So I'll go ahead and close that. And then the lab is asking us to open this file right here, the DNS and HTTP capture file. So I'm going to go ahead and double click on that capture file on the desktop. And there it is. And now I've got four packets in this capture and the lab is asking us regarding packet number one.

3:12So I'm going to go ahead and click right here on packet number one. The details for that packet are just played down here. That is the application layer protocol being used in that packet. So right here it's showing us that it's using DNS. So that is the application layer service or the application layer protocol that 's being carried in this specific packet domain name system. And that's the service that allows us to discover from a DNS server what the actual IP address is behind a name. So when we went to server one dot nuggetlab.com, we made a DNS request that said, hey, I need the IP address associated with that host and as a result, we got a response back that gave us the information about the IP address behind that server.

3:53And that's here in packet two, but that's going a little bit beyond what we asked in the lab. So in the lab, it just asks us what is the application layer protocol for packet number one and it is DNS. That's the application layer service. Then for packet number two, the lab is asking us what is the transport layer protocol used for packet number two. So here is packet number two. And what that is, that's the actual response from the DNS server. And so if we look here in the details for that packet capture at the application layer is DNS and then at the layer four at the transport layer, it's using UDP.

4:25And that is the layer four protocol that the original flavor of DNS is going to use as it communicates between a client and a server. Now there are some more advancements as time marches forward, but that is like the classic layer for protocol used with traditional DNS user, data gram protocol. Or as its friends like to call it UDP. So for this one, this is layer three, the network layer, we're asked to identify what is the source IP address that'd be the layer three address in packet number three. So let's go back to our client and a computer. We'll go to that packet capture.

4:56We'll click on packet number three. And let's take a look at the details for the network layer in that packet capture. Also, if you want this output bigger or smaller, there's options up here in the menu bar on top to make it bigger by clicking the plus symbol there on the magnifying glass or smaller by clicking on the negative. Please don't want us to see in the lab. So what we want to do is we want to make sure that packet number three right here is selected, which it is. So if we run through this, we have the HTTP. That's the application layer service. And that layer four, we have TCP. And then here at layer three, the internet protocol, that's our actual question in the lab.

5:28Let's expand that. I'm going to scooch this up just a little bit as well. It gives a little more room here. It's asking what is the source IP address. In fact, even without expanding that, we can see right here the source address in this packet is 10, 10, 0, 50 and the destination layer three address at layer three shown in this packet is 10, 40, 0, 100. So the answer to the question in the lab is for packet number three at layer three, the source address is 10 dot 10 dot 0 dot 50. So from our previous discovery, we would know that, hey, that's the IP address that source address is the IP address associated with the client nugg windows 11 computer that we're currently sitting at.

6:03And then the destination is 10 dot 40 dot 0 dot 100 and based on the application layer service here of HTTP, that's very likely our web server because that's exactly what we're sending over. And that's an HTTP request to that server. But again, for the lab, they're just asking about the source address, which is 10, 10, 0, 50. And then the fourth question is what is the layer two or the data link layer destination address for packet number four. So we'll go ahead and simply click on packet number four. We'll simply go ahead and take a look here at the layer two information. Now, it says ethernet two.

6:35That just so happens that it's also referring to layer two of the protocol stack. But just be aware where it says ethernet two, that is not meaning OSI or model layer two, it just happens to be another iteration of ethernet protocol over time. But hey, if it helps us remember, if we see ethernet two that that's referring to the layer two information, that's a win. We can use that as well. So here in the ethernet header is showing us the source layer two address and also the destination layer two address. So the destination layer two address here in the packet capture is this one right here.

7:06So this is the actual layer two address. And then this part here where it says Microsoft, that's just the wire shark packet capture helping us to identify that, hey, these first six characters are associated with Microsoft. But the actual layer two address is this one right here. And this layer two address, the destination layer two address happens to match up with the actual layer two address of the client and the computer. So that means that this frame of data at layer two was being sent to the layer two address of this Windows computer client nug. And to verify that we could go back to our command line here and just confirm the layer two address.

7:41So it's going to look at the last four characters there, 0408 and sure enough, that's the last four characters here as well. So the purpose of this hands on lab, which focused right here from the perspective of client nug is to help reinforce that when clients connect to servers and devices communicate over a network, there are a series of protocols that are being used and help structure make sense of that. We use a network model where each of the layers has a specific responsibility like layer two with layer two addresses and layer three with IP addresses.

8:12And at the transport layer protocols like TCP and UDP and at the application layer application layer services like DNS and HTTP. And as we continue this journey together, you and I are going to have a lot of opportunities to get much more hands on practice, not only with end devices like, for example , Windows clients and Windows servers, but also as we proceed together, we'll have more opportunities to deal with infrastructure devices like Cisco layer two switches that make forwarding decisions based on layer two information. And we'll take a look at layer three routers, which are making forwarding decisions based on layer three IP addresses.

8:47And again, the takeaway from this lab and this set of videos, it's helped reinforce the concept that behind the scenes, we are using network models to make sense of and to categorize the individual components and functions that need to happen to move data across a network. And in this example, we're using the protocol called IP, which is short for internet protocol. So thanks for joining me in this set of videos and for this hands on lab. And I look forward to seeing you my friend in another set of videos and another lab in the very near future. Until then, remember to smile, continue having fun, keep putting in the time and I'll see you in the next video or lab.

9:23Until then, I hope this has been informative and I'd like to thank you for viewing.