1. Network type, OSI 7-layer model, protocols (data link, network, transport layer)

Due to the large volume of content, I am currently working on the second post, starting with the ICMP protocol in the network layer. Please check back for the next post!!

I. Overview

NetworkThis encompasses the entire communication process, covering both physical and non-physical aspects. The type of network varies depending on its scale. LAN (Local Area Network)It typically consists of a collection of PC mainframes and workstations, connected via communication lines of 300 meters or less. MAN (Metropolitan Area Network)This configuration connects LANs together as a high-speed backbone, providing data transfer rates comparable to those of a LAN. WAN (Wide Area Network)It can be configured over a wider area than a LAN, using geographically dispersed communication networks. When it comes to network types based on data transmission methods, we will focus on packet-switched networks. ProtocolIn such cases OSI (Open Systems Interconnection) 7-layer modelWhile various protocols can be configured depending on the specific needs, this section will focus on understanding the fundamental concepts, functions, and types of protocols, as well as delving into the protocols of the data link, network, and transport layers. The protocols for the session, presentation, and application layers will be covered later.

II. Networks and Types

NetworkNet: This word combines "net," which means a network, with "work," referring to the interconnected and extended nature of a network. While commonly used in the IT industry, it has become widely known due to its association with computers (PCs) and smartphones. In simple terms, a network can be understood as a communication system that connects two or more computers or smartphones. Networks can be categorized based on their size or the method of data transmission. LAN (Local Area Network), MAN (Metropolitan Area Network), WAN (Wide Area Network)These can be categorized as

1. LAN (Local Area Network)

LAN (Local Area Network) is something most people associate with using the internet at home. It typically connects to a communication line with a speed of 300M or less. While it works well within the home, it's limited to a range where electrical or radio signals can be transmitted accurately. It emerged in the early 1980s as a practical result of research at Xerox, resulting in the development of Ethernet, a method for connecting computers.

2. MAN (Metropolitan Area Network)

Make the LAN operate at high speed. Core; Main supportThis allows for high data transfer rates at the LAN level. So, what exactly is a "backbone"? In simple terms, it's the process of combining several smaller networks to create a large-scale network that can be connected to other network groups using high bandwidth. Think of it as connecting a city or a large campus.

3. WAN (Wide Area Network)

This type of network can connect distant regions, such as different provinces, countries, and continents, using geographically dispersed communication networks. The reason we can access services like Google and Netflix is due to this type of network.

The network transmission method is: Circuit-switched networkWow Packet Switched NetworkHowever, since we are actually using a packet switching network, understanding the concept is sufficient. A packet switching network is a system that PacketThe request is broken down into smaller units, and the person making the request includes the source and destination addresses in the packet. The packet is then sent to the packet exchange network. Packet switchThe packet contains the destination address, and it can be transmitted through multiple paths depending on the network status, ultimately reaching its final destination. A key characteristic is that the communication path is not predetermined.

※ Here, the "sender" and "receiver" addresses refer to IP addresses. The content that will be discussed later will cover this, but it's important to note that IP addresses are transmitted along with MAC addresses.

Ⅲ. The 7 Layers of the OSI (Open Systems Interconnection) Model

The image above OSI (Open Systems Interconnection) 7-layer modelThis was expressed as the OSI 7-layer model, which divides the process of network communication into 7 stages. The first stage is Physical LayerThis transmission occurs through physical equipment (hardware). The second step is Data Link LayerThis involves managing data transmitted in the physical layer, including error and flow control, to ensure reliable information delivery. The third step is: Network LayerThis involves the function of securely and quickly transferring data to its destination (routing). This is the fourth step of Transport LayerThis stage is responsible for ensuring that users at the two locations can reliably exchange data. The fifth stage is... Session LayerWhile similar to the fourth layer, the transport layer, it allows for a more hierarchical logical connection. The sixth layer is... Presentation LayerIn this final step, data is encoded and encrypted in a standard manner. Application LayerThis serves as the final destination for the application process and directly relates to the application service. While it would be beneficial to fully understand this concept, this "Cloud-Based Mobility Integration Security Process" primarily focuses on security issues arising in the "Data Link Layer," "Network Layer," and "Transport Layer." Therefore, we will focus on these layers and explore relevant protocols.

1. Data Link Layer

The data link layer receives signals from the physical layer and detects and corrects errors. It primarily detects electrical signals sent by network interface cards (NICs) in the physical layer. The protocol used in this process is: Ethernetas MAC (Media Access Control)This component is responsible for establishing communication based on addresses and forwarding the communication to the network layer.

2. Network Layer

Routing refers to the process of connecting sending and receiving points that exchange real data, and performing navigation functions. This occurs at the network layer. The most important protocol in this layer is: IP (Internet Protocol)Wow ICMP (Internet Control Message Protocol)The router utilizes this protocol to route user messages, and is associated with it. ARP (Address Resolution Protocol), RARP (Reverse Address Resolution Protocol)There is one.

3. Transport Layer

This layer is responsible for establishing direct communication between the two parties involved in exchanging real-time information. Key protocols in this layer include: TCP (Transmission Control Protocol)Egg UDP (User Datagram Protocol)Each layer has its own advantages and disadvantages. Ultimately, the data link layer is responsible for connecting physical devices, the network layer is responsible for host-to-host communication based on the signals from physical devices, and the transport layer is responsible for communication between actual processes.

※ What does "inter-process communication" mean? For example, it refers to the process of transferring data between applications (like a browser) on two different computers. From a developer's perspective, this can be seen as the process of facilitating communication between a server and a browser.

Ⅳ. Protocols (Focusing on Data Link and Network Layers)

Before we delve into the different types of protocols used in each layer, let's first define what a protocol is. ProtocolIt refers to the mutual agreement on how to conduct diplomatic formalities between countries. In terms of computer science, it can be thought of as a set of rules that define how messages are structured and transmitted for communication between different systems. Therefore, a protocol is Syntax, Meaning (Semantics), Order/TimingThese three elements define: (1) the syntax, which specifies the data format and signaling methods; (2) the semantics, which defines various control procedures such as error handling, synchronization, and flow control; and (3) the order, which specifies the communication speed or sequence between the sender and receiver, or within the system and network.

With this definition in mind, as referenced in the materials provided during the lecture, these protocols can perform various functions.

This can be organized as follows. I recommend reading it quickly, and if you encounter related functions, you can skip them for now, as we will cover the protocols in more detail later.

1. Data Link Layer Protocols

The most representative protocols in the data link layer are: EthernetThis allows communication between network hardware (like network interface cards) based on MAC addresses. An Ethernet packet has a minimum size of 64 KBytes and a maximum size of 1,518 KBytes, and its structure can be as shown in the image below.

Because each of these points requires detailed explanation, it would be quite extensive to cover them all individually. Therefore, the most important things to understand are: Destination MAC AddressWow Source MAC AddressIt refers to the destination MAC address, which is the MAC address of the network interface that will receive the packet. You can think of the MAC address as the unique identifier for the network card. As you can see in the first image, the MAC address is enclosed in parentheses. ':'MAC addresses are unique identifiers assigned to network devices, and they are typically set by the hardware manufacturer during the manufacturing process. However, in recent times, it is possible to change these addresses through software drivers.

※ MAC addresses are mapped to IP addresses. However, the IP address is specifically identified as the unique identifier for the server providing the service. Therefore, to prevent hacking attacks that target only the IP address, it is important to not rely solely on the IP address for identification. Store both MAC address and IP address.Therefore, even if only the IP address was changed, access could still be blocked due to the MAC address. However, as MAC addresses became changeable, a type of attack emerged where phishing sites would continuously send requests to the server, effectively swapping their MAC address with the server's IP address.

※ To briefly explain, while this is less common these days, it refers to the situation of sending a letter to grandparents or elderly relatives who live in rural areas. LetterThis defines how a letter is broken down into packets and how it can be delivered through the postal service. ProtocolThis involves utilizing [specific technology/method/resource].

If all destination MAC addresses are 1 (FF:FF:FF:FF:FF:FF:FF), then proceed to the next section. Broadcast packetThis refers to the MAC address of the sending device. The sending MAC address is the MAC address associated with the network interface used to send the packet, which can be thought of as the MAC address of my computer's network card.

2. Network Layer Protocols

The protocols in the network layer are, for example: IP (Internet Protocol)Wow ICMP (Internet Control Message Protocol)There is information about IP and ICMP protocols, but it is necessary to understand the MAC addresses associated with previous data link layer protocols before delving into these protocols. ARP (Address Resolution Protocol)This explanation aims to clarify how ARP (Address Resolution Protocol) works. ARP is used to determine the MAC address of a network interface in order to reach the target system. How can you find the MAC address of the other system? This is the answer to the question, and it also explains why Ethernet packets can have a destination MAC address. ARP is A protocol that maps IP addresses and MAC addresses.It maps not only my computer's IP address and MAC address, but also the IP address and MAC address of the recipient (server) to whom I want to send a message. First, ARP RequestIt sends a packet and, based on the IP address, identifies the destination's MAC address. ARP Response Through this process, once the destination MAC address is received, it is stored in the MAC address table, allowing the system to reference the table and transmit data when requesting the same destination. When sending an ARP request, it uses the broadcast intended for later processing to prompt the recipient host to respond.

arp -a

※ This command displays both the IP address and MAC address in Linux-Ubuntu.

IP addresses are added to packets written using the Ethernet protocol. However, before we proceed, it's important to understand that... Source Address, Destination Address, Type of Service (TOS), Time To Live (TTL), Protocol There are a few key elements: Source and Destination Address represent the IP addresses of the sender and receiver, respectively. TOS (Type of Service) defines the priority that the router uses to process packets. The priority level is defined by... Minimum delay, maximum throughput, maximum reliability, and minimum cost.This allows you to set the value, with a default of 0. "Minimum delay" refers to minimizing the actual transmission delay, while "maximum transmission unit" represents the maximum data size that can be transmitted. "Maximum reliability" refers to measures taken to minimize errors and enhance the reliability of communication. "Minimum cost" indicates the ability to use various routing paths at the lowest possible cost. This relates to QOS (Quality of Service) services, meaning that by paying more, you can guarantee a higher priority. The TOS (Transmission Order) field is what allows you to achieve this priority.

TTL (Time To Live) is a field in the IP header that specifies how many routers a packet can pass through before being discarded. Each time a packet passes through a router, the TTL value decreases by 1. When the TTL reaches 0, the packet is discarded. This is relevant to the ICMP protocol, which is a higher-layer protocol in the IP stack. The ICMP stack also includes protocols like IGMP and TCP, UDP.

※ On Linux-Ubuntu ifconfig (equivalent to ipconfig on Windows)By entering this, you can find the Ethernet address (MAC address) and IP address. In the image above, "inet" refers to the IP address, and "ether" refers to the MAC address. I would like to add some additional explanation here: RX, TX RX packets represent the number of packets successfully received, while TX packets represent the number of packets successfully sent. Errors, dropped, and overruns indicate the severity of errors, the number of dropped packets, and the number of overruns, respectively. The number of dropped packets may increase if the system is under a DDoS attack.

If you would like more information about the `ifconfig` command, up/downThis allows you to start and stop the network.

ifconfig hw ether 바꿀값

The MAC address can be changed. You can also change the IP address using the `ifconfig` command, but it will be reset upon reboot. IP You can view information using commands like `ifconfig` (or `ip addr`), and you can also modify the MAC and IP addresses.

Now, let's delve into the address system of IP protocols.

That's a big one. Five classesThese are categorized as follows. First, IP addresses, which we are likely familiar with, are represented as 32-bit binary numbers, with a dot (.) separating each 8-bit segment. This is the format we typically see when configuring a router. '192.168.0.1'An IP address is composed of a series of numbers. As shown in the image, each class is divided based on which part of the network address is designated, starting from the leftmost digit. Classes D and E are not typically used for public networks and are usually reserved for private (personal) networks, which are implemented using classes A, B, and C. Each class has a different number of devices that can belong to it, with class A being the largest and class C being the smallest. The commonly seen "192.168.0.1" also belongs to class C, where the first field can range from 192 to 223.

According to this concept, devices connected to the router have the same network fields, but only the host portion differs. For Class C, the first three fields represent the network address, so whether it's a home or an educational institution, all devices connected to the router in that location have the same network address. This means that they can share their results with other devices using the network address assigned to them. However, the last field, the host address, has a value that cannot be used, typically The first number (0) and the last number (255)The '0' identifies the network segment, and '255' is the network address for broadcasting. Broadcasting, which we will discuss later, is essentially a one-to-many communication, where a packet is sent to all devices within the same network segment.

※ Additionally Subnet MaskThere is. You can see the netmask in the image below, which is the subnet mask. The subnet mask helps to further divide the network ranges assigned to each class, allowing for the identification of more IP addresses. In the case of Class C, for example, if you divide the last field, the host ID, into two bits, '255.255.255.0'For example, Subnet 1 would be 192.168.1.1 to 192.168.1.254, and Subnet 2 would be 192.168.2.1 to 192.168.2.254.

The reason for using subnet masks to divide addresses in this way is: IPv4 (Internet Protocol version 4)Wow IPv6 (Internet Protocol version 6)Understanding this allows us to comprehend the existing address system that has been described so far, which is IPv4.

※ Interestingly, there was also an IPv5. While it's likely no longer in use, there's a fascinating reason why it existed.

The original IPv4 system could accommodate approximately 4.3 billion IP addresses, but initially, there was no concern about this being insufficient. However, as networks developed and devices like smartphones, tablets, laptops, PCs, and smartwatches, as well as various health-related equipment and machinery, became commonplace, the need for more IP addresses became apparent. This led to the development of IPv6, which uses a separate address system and represents addresses with 128 bits. Both IPv4 and IPv6 are currently in use.

※ There are additional protocols related to IP protocols that are worth knowing. DNS (Domain Name System)There is a DNS server. Application Layer ProtocolsHowever, it's closely related to IP addresses, as it converts complex IP addresses into domain names that are easier for us to understand. DomainThis refers to an identifier, and the domain name address is www.naver.com, Like www.google.com We are referring to the addresses that allow us to easily access Naver or Google by simply entering them into the address bar. Visit www.naver.com Although I know this, in reality, the ".com" extension is actually present. '.'The root domain is where the domain name address begins. You may occasionally see a trailing "..." at the end. 'kr'It is a national domain.

As you can see in the image above, the "dig" command was used. This command retrieves information from the configured name server. In this case, the name server is 127.0.0.53. Name ServerA domain name server (DNS) is a server that translates a human-readable domain name into an IP address that computers can understand. When you enter the domain name of a website you want to visit, the DNS server finds the website's IP address, and this process involves contacting multiple DNS servers.

nslookup 도메인이름주소

nslookupThere is a command in Iran that requests the domain name address from a name server to obtain the IP address.

www.naver.com You should see the canonical version next to this. From www.naver.com You can just think of it as a nickname.

※ DNS Spoofing DNS (Parody/Satire) There is a network attack targeting Iran, where attackers exploit DNS servers. When a regular user requests an IP address from a DNS server, the attackers modify the DNS server's response to send the user Incorrect IP addressThis technique involves creating a fake website that looks legitimate, and then directing users to it. This can be used to steal users' important information.

* There is a command to find the routing path to a specific IP address. In Windows, it's called 'tracert', and in Linux, it's 'traceroute'. In Linux, you need to install the 'traceroute' package.

※ In addition to the `dig` command, another way to check the name server is to examine the `/etc/resolv.conf` file. If you send a ping to the name server listed in this file and it doesn't work, try changing it to Google's name server, 8.8.8.8. If it still doesn't work, there may be an issue with your internet connection.

Simply replace the nameserver section as shown in the image.

The next protocol to be introduced after IP is ICMP (Internet Control Message Protocol). However, due to the extensive discussion so far, I would like to continue this topic in the next post...

Review

I usually post every weekday, but I haven't posted in the last few days. This is partly because the material covered in class was quite challenging, and I wanted to focus on understanding it thoroughly. I do feel like I've missed some things, and I haven't been able to cover everything, but I've tried my best. I'm also considering posting the entire two days' worth of theoretical lessons at once, but I'm just going to post it as is.🥲 It's a lot, so please look forward to Part 2!