2. Network types, OSI 7-layer model, protocols (data link, network, transport layer)

We will begin with the ICMP protocol in the network layer.

Next up: I'll be exploring how to change network settings (Host-only, NAT, Bridge) in VMware. (And, as a bonus, Tetris???)

I. Overview

Regarding the network layer ICMP (Internet Control Message Protocol), IGMP (Internet Group Management Protocol)There are protocols for this. ICMP is a protocol for error messages that occur during the process of sending and receiving packets, while IGMP is a protocol related to multicast. Transport LayerIt is significantly TCP (Transmission Control Protocol)Egg UDP (User Datagram Protocol)TCP is a reliable, connection-oriented protocol based on a 3-way handshake, while UDP is a connectionless protocol that prioritizes speed. Network servicesOkay. NAT (Network Address Translation)However, this defines both internal and external IP addresses. Next, DHCP (Dynamic Host Configuration Protocol)As mentioned in previous posts, this defines the method for assigning IP addresses.

II. Protocols (Focusing on Network and Transport Layers)

1. Network layer protocols

Continuing from the previous post, this will cover the network layer. ICMP (Internet Control Message Protocol) In terms of the protocol, it controls messages between the host server and the gateway (router) and provides error information. A prominent command that uses ICMP is available.

ping 10.10.10.2

Above ping I want to find out if a given address is the next address in a sequence.(Both IP address and domain name are acceptable)When you enter the IP address, you should see a message similar to the one in the image if the connection is established correctly. However, if the connection cannot be established, an error message will appear. "ping" sends temporary packets to check the server's response status.

IPSince it is a connectionless protocol, there is no guarantee that packets will be reliably transmitted. Therefore, if errors occur in routers or nodes (hosts) and packets fail to reach their destination, it is necessary for the sending side to inform the recipient of the status. The system diagnoses the status and purpose of multiple routers receiving ICMP messages, as well as the status of the destination node. While ICMP is a higher-layer protocol (transport layer) that operates above the IP protocol, similar to TCP and UDP, it also operates above the IP protocol, as discussed in the previous post. TTL (Time To Live)This is related to ICMP packets. Some important aspects to note in the structure of ICMP packets are: ChecksumIt serves to detect errors in packets. It calculates the checksum by incorporating the carry bit operation, resulting in the final checksum value.

※ Please refer to other posts for information on how to calculate the checksum and perform carry bit operations, as I haven't fully understood these concepts yet.

ICMP primarily consists of two types of messages: error messages for reporting errors, and diagnostic messages for question-and-answer communication. ICMP Echo Request The message is used by the sending side to verify whether the transmitted packet has reached the destination node or router. The sending node (the host that sent the request) uses the message to "ICMP Echo Request message"and receive data from the destination node. "ICMP Echo Reply message"The system recognizes that the packet has been successfully transmitted when it receives a response. ICMP Destination Unreachable The message is sent to the sending node when the router is unable to forward a packet from a specific node to its destination. "ICMP Destination Unreachable Message"I am sending it. "This includes reasons why the destination was not reached." If a router fails to find the IP address path to the destination node, it sends this message back to the originating router, allowing the original sender to recognize that the packet has not reached its destination.

※ ReflectionThis is a command in Unix-based operating systems used to print a string to the terminal. Since Linux (Ubuntu) is also based on Unix, this command exists and is frequently used in shell scripts, not just for simple string output.

ICMP Redirect MessageIf the router is configured with an unsuitable path to the destination node, it sends a message to re-specify the optimal path to that node. ICMP Time Exceeded The message explains that, previously, the TTL (Time To Live) value in the IP protocol was used to prevent packets from circulating endlessly within a network. Specifically, it mentions what happens when the TTL value reaches 0. "ICMP Time Exceeded Message"The packet is discarded, and the process is repeated. Each time the packet passes through a router, it decreases by 1. If the packet reaches the final destination node with a value of 0, it means the packet has not been successfully transmitted.

ICMP Source Quench The message refers to using low-speed, wide-area networks (WANs) and specifies a particular router on the WAN side. Bottleneck phenomenonThis can happen, and to mitigate this, the transmit queue value on the sending side should remain at '0', which would result in an inability to transmit. "ICMP Source Quench Message"This message is sent to the transmitting side node, and the transmitting side interprets this message to determine if there is congestion on the line, and then adjusts the number of packets being transmitted.

※ Low-speed, wide-area networkWAN (Wide Area Network): A communication network primarily used to transmit voice data. It utilizes VoIP (Voice over IP), and I recommend researching the concept further.

Next, IGMP (Internet Group Management Protocol)There is a protocol in place. Multicast groupBefore discussing multicast, it's important to understand the difference between unicast and broadcast. UnicastThis is a one-to-one relationship where data is transferred from one host to another. Unlike typical IP data transmission, which is unicast, accessing websites like Naver or Google can be considered as unicast. BroadcastingIt transmits data to the entire host on the IP network from the host. Thinking about the concept of classes in the IP protocol, as discussed in a previous post, data is transmitted to all devices within the corresponding network segment, such as "all devices connected to a router." A typical broadcast... '255.255.255.255'and broadcasting to a specific network Direct broadcastingIt is said that to send data to the '211.32.34.0' network, you simply need to specify the destination address as '211.32.34.255'. This means that the data is being sent to a wide range of IP addresses, rather than a specific one. This is primarily used for ARP (Address Resolution Protocol) is used to find a MAC address, while DHCP (Dynamic Host Configuration Protocol) is used to dynamically assign IP addresses. MulticastIt is a hybrid of unicast and broadcast, where a single host transmits a specific host to multiple recipients. The reason for grouping this particular host.This is a multicast group, and because all hosts within this group receive the data, it is highly efficient.

2. Transport Layer Protocol

The most important protocols in this layer are: TCP (Transmission Control Protocol)Egg UDP (User Datagram Protocol)Let's imagine the scenario of writing a letter to grandparents who live in the countryside. I would write this letter, initially on a small piece of paper with a pen, but eventually placing it in an envelope and putting it in the mailbox. At this point, the letter is being prepared for safe delivery, and this is where the OSI 7 layers come into play. Each layer of the OSI model has its own role in ensuring that the letter reaches its destination. The mailbox can be thought of as the first step in the delivery process, similar to how a letter leaves the initial physical layer (the network card). At this point, the post office acts as a gateway (router), and the letter travels through it to reach its final destination. The post office then decides whether to send the letter as regular mail or via registered mail for faster delivery, and it would affix a stamp, which represents TCP and UDP.

To continue with the explanation of TCP, it's a method where the recipient confirms to the sender that they have received the packet and know who sent it.(Three-way handshake)This implies communication through that method. Therefore, Connection-oriented This is referred to as a protocol, which manages data flow, verifies the accuracy of data, and facilitates communication. Its advantages include high reliability, control over data flow, data checksums, and timeout/resend functionality. However, a potential drawback is that it can be slower. However, UDP does not include a confirmation process to ensure that the data has been received correctly after it is sent.(While I can respond, there's no guarantee that my response will be accurate or helpful.)The problem lies in the fact that it only involves sending and doesn't have a concluding step. Non-deterministic It is a protocol that does not require retransmission of data, even if some data is lost during transmission, because there is no communication between the sending and receiving systems. Since it is inherently connectionless, there is no way to know if data has been lost. Instead, The advantages include very fast speed and reduced network load, but the disadvantages can be data loss and a lack of reliability. Because of their speed, both TCP and UDP can be used depending on the specific application. Neither is inherently better than the other.

※ Please choose between the two transmission methods. HeaderThe method of operation needs to be defined.

One of the key concepts in TCP is "Three-way handshake"When a client and server communicate, the client asks the server if it is okay to connect. SYN (Synchronize)It sends the data. The receiving server then receives the data along with the SYN. ACK (Acknowledgement)We send a request and wait for a response. Once the client receives a response, it establishes a connection with the server and sends an ACK (acknowledgement) back to the server to indicate that the connection is successful. This process involves three steps. For example, you could think of the first step as calling a friend's house to check if they are there, the second step as receiving confirmation that they are there, and the third step as informing the friend that you are calling. This connection is maintained continuously until the call is ended. If we were to illustrate this process graphically,

This is what happens. When you try to disconnect... EndThe client requests this from the server. The server responds with an ACK and then sends a FIN. The client, upon receiving the FIN, sends an ACK back, and the connection is terminated. Let's examine this process graphically as well.

This is how it works. SYN contains information about the connection request and is placed in the TCP protocol part of the packet. If the value is 1, it indicates that the connection is being established. ACK contains information about the order of packets from the communication partner. FIN, with a value of 1, indicates that the TCP connection is being terminated, and this number is included in the packet when the client and server terminate the connection.

※ It might seem unnecessary to have a disconnection process. Service providers like Naver offer large-scale services, and they rely on a large number of servers to provide seamless service to users. However, server resources are finite. Therefore, maintaining all connections and keeping them open constantly would inevitably lead to... Server resources are limited.for Because it needs to be connected and disconnected frequently, a shutdown process is necessary to efficiently manage memory.

A command used to determine the status of a process or server running within an operating system. 'netstat'It is located above. '-anp'This is an optional feature. "a"This refers to the entire concept. 'n'This refers to an IP address. "p"This refers to the process. It's the connection process between a client and a server, as explained during the TCP three-way handshake. LISTENIt's helpful to know this: "LISTEN" means that the server is configured to accept connections from any source on the network, specifically when it receives a request on the local address '0.0.0.0:80'. '0.0.0.0'This refers to all IP addresses, and "127.0.0.1" directly represents the local host's IP address. On the left, you'll find familiar terms like TCP and UDP. These indicate how servers connect, and while TCP and UDP are familiar, the "6" appended to them might be unfamiliar. The difference between TCP and TCP6 lies in whether they use the IPv4 or IPv6 address system. Therefore, TCP uses the familiar "0.0.0.0" IP address, while TCP6 uses... ':::'It is currently in that state.

Just as '0.0.0.0' represents all IP addresses, ':::' represents all IP addresses in IPv6. And below LISTEN ESTABLISHEDThis indicates that the connection has been successfully established. Specifically, '0.0.0.0:80' means that: Port numberThis represents the port number. The port number must be unique across all servers currently running on the operating system. In other words, a service can only have one port number. Typically, websites use port 80 for all services, and each protocol and server may have a specific default port, which is helpful to know. Protocol port numbers are defined to be between 0 and 40. Clients also have port numbers, and the browser automatically assigns them when connecting, ensuring that they don't conflict. If you don't see an IP address at the bottom, it means that the process is running internally within the operating system. You might see "unix" on the left, and this indicates that the process is running internally. There are many processes with "unix," and many internal processes run when Windows boots. If you know the startup programs, it will be easier to understand. Processes that perform functions like shared folders, display the Windows screen, or make it easier to control with a mouse or keyboard are all internal processes that appear as "unix" in Linux.

※ If the service is functioning normally and you are accessing it with the correct port number, but are unable to connect to the server, please check your firewall settings!

※ This relates to the specific characteristics of Linux commands. "|" This allows for the execution of commands in sequence. Therefore, after the `netstat -anp` command, add a pipe symbol (`|`) and then enter the search command `grep` along with the search term. This will output only the relevant entries from the running servers or active processes.

Since we've discussed the process, let's introduce a few more related commands: 'ps -ef'Option 'e' displays all process information, while option 'f' provides more detailed information.

If you can identify the PID here, you can use the command to terminate the process. "Kill the process with the specified process ID"By entering this, you can terminate the process, and the '9' option forces it to stop.

※ "w" You can also check connection information using commands.

Ⅲ. Network Services

1. NAT (Network Address Translation)

Previously, I discussed the concepts of internal and external IP addresses when initially setting up the network. Internal IP addressIt is an IP address that is shared among devices connected through the same router. External IP addressThis was the IP address required to access external services like Naver and Google. This internal IP address was then converted to an external IP address. MappingThere's a specific method for doing this. NATNAT (Network Address Translation) maps one internal IP address to one external IP address in a one-to-one relationship. Static NATand dynamically mapping multiple internal and external IP addresses. Dynamic Network Address TranslationStatic NAT is used because it allows communication from the outside to the inside, as it already has a pre-defined external IP address. This is useful for service providers who need to be accessible from the outside using a specific external IP address. Dynamic NAT, on the other hand, creates a pool of external IP addresses and dynamically maps unused IP addresses. This method is used when the number of external IP addresses is less than the number of internal IP addresses, as it allows for one-to-one mapping. However, if the number of external IP addresses is less than the number of internal IP addresses, and an external IP is already in use, it cannot be mapped to a new, incoming internal IP.

2. DHCP (Dynamic Host Configuration Protocol)

DHCP serverAs I've mentioned before, this function is responsible for requesting and assigning IP addresses to devices that need to be part of the same network. For example, when you connect your laptop to a cafe's Wi-Fi, a DHCP server is involved in the connection process. BroadcastingI ask, "What is your IP address?" The DHCP server responds by providing its own IP address and the range of IP addresses it can assign. Because this process involves broadcasting, all devices on the same network can receive this message. Once the device knows which IP addresses are available, it requests one, and the DHCP server then assigns it, along with any related information. Network InformationThis process can be represented visually as follows:

Review

Over the course of almost half a day, I covered topics such as network types, the OSI 7-layer model, data links, and protocols within the network and transport layers. I still have a lot more to learn, and I realize how vast the field of networking truly is. 😔 While it's a shame that I couldn't cover everything in such a short time, I'm satisfied with what I've learned so far and plan to continue studying to fill in the gaps.