MODULE 8 - CERTIFICATION CYBER OPS ASSOCIATE Flashcards
MAC and IP Destination on Same Network There are two primary addresses assigned to a device on an Ethernet LAN:
– Physical address (the MAC address)
– Logical address (the IP address)
Physical address (the MAC address) :
This is used for Ethernet NIC to Ethernet NIC communications on the same network.
MAC and IP Destination on Same Network There are two primary addresses assigned to a device on an Ethernet LAN:
– Physical address (the MAC address)
– Logical address (the IP address)
Logical address (the IP address) :
This is used to send the packet from the original source to the final destination. IP addresses are used to identify the address of the original source device and the final destination device.
The destination IP address may be on the same IP network as the source or may be on a remote network.
Note: Most applications use DNS (Domain Name System) to determine the IP address when given a domain name such as www.cisco.com. DNS is discussed in a later module.
Logical address (the IP address) :
This is used to send the packet from the original source to the final destination. IP addresses are used to identify the address of the original source device and the final destination device.
The destination IP address may be on the same IP network as the source or may be on a remote network.
Note: Most applications use DNS (Domain Name System) to determine the IP address when given a domain name such as www.cisco.com. DNS is discussed in a later module.
Ethernet MAC addresses, have a different purpose.
These addresses are used to deliver the data link frame with the encapsulated IP packet from one NIC to another NIC on the same network.
If the destination IP address is on the same network, the destination MAC address will be that of the destination device.
The figure shows the Ethernet MAC addresses and IP address for PC-A sending an IP packet to the file server on the same network.
Ethernet MAC addresses, have a different purpose.
These addresses are used to deliver the data link frame with the encapsulated IP packet from one NIC to another NIC on the same network.
If the destination IP address is on the same network, the destination MAC address will be that of the destination device.
The figure shows the Ethernet MAC addresses and IP address for PC-A sending an IP packet to the file server on the same network.
The Layer 2 Ethernet frame contains:
– Destination MAC address
– Source MAC address
The Layer 3 IP packet contains:
– Source IP address
– Destination IP address
The Layer 2 Ethernet frame contains:
– Destination MAC address
– Source MAC address
The Layer 3 IP packet contains:
– Source IP address
– Destination IP address
The Layer 2 Ethernet frame contains:
– Destination MAC address
This is the MAC address of the file server’s Ethernet NIC.
– Source MAC address
This is the MAC address of PC-A’s Ethernet NIC.
The Layer 2 Ethernet frame contains:
– Destination MAC address
– Source MAC address
The Layer 3 IP packet contains:
– Source IP address
– Destination IP address
The Layer 3 IP packet contains:
– Source IP address
This is the IP address of the original source, PC-A.
– Destination IP address
This is the IP address of the final destination, the file server.
The Layer 3 IP packet contains:
– Source IP address
This is the IP address of the original source, PC-A.
– Destination IP address
This is the IP address of the final destination, the file server.
Communicating on a Local Network
https://snipboard.io/UwENei.jpg
The Layer 3 IP packet contains:
– Source IP address
This is the IP address of the original source, PC-A.
– Destination IP address
This is the IP address of the final destination, the file server.
Communicating on a Local Network
https://snipboard.io/UwENei.jpg
Destination on Remote Network : When the destination IP address is on a remote network, the destination MAC address will be the address of the host’s default gateway.
The default gateway address is the address of the router’s NIC, as shown in the figure. Using a postal analogy, this would be similar to a person taking a letter to their local post office. They only need to leave the letter at the post office.
It then becomes the responsibility of the post office to forward the letter on towards its final destination. The figure shows the Ethernet MAC addresses and IPv4 addresses for PC-A.
It is sending an IP packet to a file server on a remote network. Routers examine the destination IPv4 address to determine the best path to forward the IPv4 packet. This is similar to how the postal service forwards mail based on the address of the recipient.
When the router receives the Ethernet frame, it de-encapsulates the Layer 2 information. Using the destination IP address, it determines the next-hop device, and then encapsulates the IP packet in a new data link frame for the outgoing interface.
Along each link in a path, an IP packet is encapsulated in a frame specific to the particular data link technology associated with that link, such as Ethernet.
If the next-hop device is the final destination, the destination MAC address will be that of the device’s Ethernet NIC.
How are the IPv4 addresses of the IPv4 packets in a data flow associated with the MAC addresses on each link along the path to the destination? This is done through a process called Address Resolution Protocol (ARP).
Communicating to a Remote Network :
https://snipboard.io/R5z8cp.jpg
ARP ARP Overview
If your network is using the IPv4 communications protocol, the Address Resolution Protocol, or ARP, is what you need to map IPv4 addresses to MAC addresses.
This topic explains how ARP works. Every IP device on an Ethernet network has a unique Ethernet MAC address.
When a device sends an Ethernet Layer 2 frame, it contains these two addresses:
– Destination MAC address
– Source MAC address
Destination MAC address :
The Ethernet MAC address of the destination device on the same local network segment.
If the destination host is on another network, then the destination address in the frame would be that of the default gateway (i.e., router). Source MAC address :
The MAC address of the Ethernet NIC on the source host. The figure illustrates the problem when sending a frame to another host on the same segment on an IPv4 network.
https://snipboard.io/2mEyRT.jpg
Destination MAC address :
The Ethernet MAC address of the destination device on the same local network segment.
If the destination host is on another network, then the destination address in the frame would be that of the default gateway (i.e., router).
Source MAC address : The MAC address of the Ethernet NIC on the source host. The figure illustrates the problem when sending a frame to another host on the same segment on an IPv4 network.
https://snipboard.io/2mEyRT.jpg
To send a packet to another host on the same local IPv4 network, a host must know the IPv4 address and the MAC address of the destination device.
Device destination IPv4 addresses are either known or resolved by device name. However, MAC addresses must be discovered.
A device uses Address Resolution Protocol (ARP) to determine the destination MAC address of a local device when it knows its IPv4 address.
ARP provides two basic functions: Resolving IPv4 addresses to MAC addresses Maintaining a table of IPv4 to MAC address mappings
ARP Functions
When a packet is sent to the data link layer to be encapsulated into an Ethernet frame, the device refers to a table in its memory to find the MAC address that is mapped to the IPv4 address.
This table is stored temporarily in RAM memory and called the ARP table or the ARP cache.
The sending device will search its ARP table for a destination IPv4 address and a corresponding MAC address.
If the packet’s destination IPv4 address is on the same network as the source IPv4 address, the device will search the ARP table for the destination IPv4 address.
If the destination IPv4 address is on a different network than the source IPv4 address, the device will search the ARP table for the IPv4 address of the default gateway.
The sending device will search its ARP table for a destination IPv4 address and a corresponding MAC address.
If the packet’s destination IPv4 address is on the same network as the source IPv4 address, the device will search the ARP table for the destination IPv4 address.
If the destination IPv4 address is on a different network than the source IPv4 address, the device will search the ARP table for the IPv4 address of the default gateway.
In both cases, the search is for an IPv4 address and a corresponding MAC address for the device.
Each entry, or row, of the ARP table binds an IPv4 address with a MAC address.
We call the relationship between the two values a map. This simply means that you can locate an IPv4 address in the table and discover the corresponding MAC address.
The ARP table temporarily saves (caches) the mapping for the devices on the LAN.
In both cases, the search is for an IPv4 address and a corresponding MAC address for the device.
Each entry, or row, of the ARP table binds an IPv4 address with a MAC address.
We call the relationship between the two values a map. This simply means that you can locate an IPv4 address in the table and discover the corresponding MAC address.
The ARP table temporarily saves (caches) the mapping for the devices on the LAN.
If the device locates the IPv4 address, its corresponding MAC address is used as the destination MAC address in the frame.
If there is no entry is found, then the device sends an ARP request. watch a video on the ARP function.
ARP Operation -
ARP Request An ARP request is sent when a device needs to determine the MAC address that is associated with an IPv4 address, and it does not have an entry for the IPv4 address in its ARP table.
ARP messages are encapsulated directly within an Ethernet frame. There is no IPv4 header. The ARP request is encapsulated in an Ethernet frame using the following header information:
Destination MAC address –
This is a broadcast address FF-FF-FF-FF-FF-FF requiring all Ethernet NICs on the LAN to accept and process the ARP request.
Source MAC address –
This is MAC address of the sender of the ARP request.
Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process.
Destination MAC address –
This is a broadcast address FF-FF-FF-FF-FF-FF requiring all Ethernet NICs on the LAN to accept and process the ARP request.
Source MAC address –
This is MAC address of the sender of the ARP request.
Type - ARP messages have a type field of 0x806. This informs the receiving NIC that the data portion of the frame needs to be passed to the ARP process.
Because ARP requests are broadcasts, they are flooded out all ports by the switch, except the receiving port.
All Ethernet NICs on the LAN process broadcasts and must deliver the ARP request to its operating system for processing.
Every device must process the ARP request to see if the target IPv4 address matches its own.
A router will not forward broadcasts out other interfaces. Only one device on the LAN will have an IPv4 address that matches the target IPv4 address in the ARP request.
All other devices will not reply.
