[StuCo 98008]
GNU/Linux for Beginners

Session 9

Networking

By the end of this lecture you will know

Basic networking terminology

The protocols used in modern networks

Some common network applications and servers.

Networking Concepts

Node: a logical data processing unit that is part of a network (e.g. a PC, a server, a router)

Client: anything receiving data from the network

Server: anything that provides data to the network

Protocol: A clearly defined method of communication

Bandwidth: The maximum amount of data that can be exchanged between two nodes in a unit of time (usually one second)

The old way of transferring data

Circuit-switched networks

No sharing of network resources

Guaranteed bandwidth

Static path, defined before the connection takes place

The new and improved way

Packet-switched networks

Information is broken down to network frames (“packets”, in IP)

Resource sharing

Unpredictable path, dynamically constructed

IP Addresses

Each packet has a source and destination address

Example: 192.168.15.48 (decimal notation)

11000000.101010000.00001111.00110000 (binary notation – four 8-bit parts – “octets”)

Boundaries: 0-255 for each octet

Try counting beyond 255 with 8 bits!

DNS

A system to aid humans remember network addresses: Domain Name System

DNS servers keep mappings of IP addresses and easy-to-remember names:

www.cmu.edu. CNAME WEB3.ANDREW.cmu.edu.

WEB3.ANDREW.cmu.edu A 128.2.11.43

Also, aliases of easy-to-remember names for (drums...)EVEN MORE easy-to-remember names

DNS is a hierarchical, (sort of) distributed system

If my DNS server doesn't know an address, it asks its parent DNS server

And so on, up to the root DNS servers (that have all the answers)

Network/Host Addressing

Each address encapsulates two pieces of information

Network ID (e.g. CMU, Scaife Hall)

Host ID (a specific machine)

192.168.15.48/24

The first 24 bits are the network ID

The remaining 8 bits (32-24=8) are the host ID.

Routing

Routers are dedicated nodes that decide how the packets will be delivered to their destination

Shortest path

Fastest path

Route around network failures

Routing tables: where should I forward a packet with an Australian destination address?

Routers have limited knowledge of their environment (impossible to have complete knowledge of the entire Internet's state)

Routes Change All The Time

Source: http://computer.howstuffworks.com/router2.html

Protocols For Packet Transfer

Connectionless

Packets of arbitrary size are dispatched as soon as application provides data.

Nobody knows if they arrived or not.

Example: User Datagram Protocol

Connection-Oriented

A connection is first established between source and destination.

Checks to make sure that everything is transferred properly (sequence numbers, retransmission, timeouts)

Example: Transmission Control Protocol

The OSI Model

I instruct my browser to fetch a web page. It sends an HTTP request down the stack.

TCP breaks it up in segments of optimal size, assigns sequence numbers, and passes the segments down to IP.

IP creates packets, assigns source and destination addresses, and passes them down the stack.

Ethernet frames are created to carry my data to the next node.

My network card translates these frames to electricity and puts them on the wire.

Getting A Web Page

Getting A Web Page (2)

IP Ports

Problem: When a host receives data from the network, it has no way of knowing what application that data is trying to reach.

Solution: Use IP ports and bind applications to “sockets” (IP:port combinations)

E.g. any data sent to 128.2.11.43:80 will be handled by CMU's web server.

Data send to 128.2.11.43:22 will be handled by that machine's SSH daemon

There are 65535 ports.

0-1024 are considered “privileged” - only root can bind applications to them

Network Interfaces

Ethernet (802.3) card

eth0, eth1, etc...

Wireless (802.11) card

wlan0, wlan1, etc...

Modem (PPP, ADSL)

ppp0, ppp1, etc...

Virtual Interfaces!

eth0:1, eth0:2 etc...

InterFace CONFIGuration

/sbin/ifconfig

Mortals simply see information, cannot change stuff

$ /sbin/ifconfig -a	lists all interfaces

# ifconfig eth0 192.168.0.1 up	activate the first ethernet interface and assign it the given address

$ man ifconfig	for more!

Listening Ports

When an application is bound to a port and is listening for incoming connections from any address, your computer is acting as a server

The Routing Table

# route

# route -n (for numerical addresses only)

# route add default gw 10.0.0.1

# route add -net 192.168.0.2 dev eth1

Automatic Interface Configuration

Depends on your distribution

RedHat, Mandrake have graphical tools

Most configuration files under /etc/sysconfig/

Debian, Slackware: command line

DHCP addresses (server-assigned dynamic addresses)

# dhclient eth0 (/etc/dhclient.conf)

# ifup eth0 (configuration files in /etc/network)

DIY interface handling (!)

Just put the commands you need in a script

Network Services

Controlled by scripts under /etc/init.d/

Your runlevel dictates what services are active

# grep initdefault /etc/inittab (this is your default runlevel)

# runlevel (this is your current runlevel)

# ls -l /etc/rc2.d/ (this is what will happen on entering runlevel 2)

start/stop/restart parameters for all scripts

S scripts start services (/etc/rc2.d/S20snort)

K scripts kill services (/etc/rc2.d/K11anacron)

The numbers denote priority in ascending order

Some Common Services

/etc/init.d/httpd (in Red Hat systems) - Apache

/etc/init.d/wu-ftpd – FTP daemon

/etc/init.d/sshd – OpenSSH server

/etc/init.d/xinetd – The Internet Super-Server

Controls lots of small servers

fingerd

talkd

etc...

Configuration file is (usually) /etc/xinetd.conf

Network Troubleshooting Recipe

$ ping 127.0.0.1 – If it fails:

# ifconfig lo 127.0.0.1 up – still no good?

Your local networking, or firewall, is not set up properly.

$ /sbin/ifconfig

If it shows the loopback interface only, the driver for your NIC is not loaded. Look into /etc/modules.conf and the output of
# lsmod

If you see your interface (e.g. eth0), but no IP assigned, ask for one: # dhclient eth0 – or assign one statically with
# ifconfig eth0 10.0.0.57 up

You see the interface, it has an IP, but still you can't talk to the network? $ ping <my_IP_addr> - if it fails, your NIC is bad.

Recipe continued

$ ping <gateway_IP> - Usually $ /sbin/route -n will tell you what your gateway is. If it fails, your cable is bad.

$ host www.cmu.edu – If this fails, your DNS resolution doesn't work. Check /etc/resolv.conf – it should have at least one nameserver's IP listed there, and you should be able to ping that IP.

$ ping www.cmu.edu – If this fails, your gateway is not routing your traffic to the Internet. Talk to your network administrator, your local configuration seems to be fine.

What we covered

Types of networks

Circuit-switched (telephone)

Packet-switched (Internet)

Types of protocols

Connectionless (UDP)

Connection-oriented (TCP)

How hosts are located across the network

Basic networking utilities, services, troubleshooting

Would you consider your cell phone to be a node of the cellular network? (I'd say no, because it doesn't offer services to anyone but you)

Modern telephone networks are circuit-switched from the end user (house, commercial organization) to the local office (the telephone provider's routing equipment).

For long range calls, voice is broken down to frames and transmitted using packet-switched technology.

This is how the Internet works.

There are some IP address ranges that are reserved for experimental/local use, and are not routable. This means that it's impossible to use them on the Internet, and they can be used only on local networks. Network Address Translation (NAT) can be used to allow hosts that use such reserved addresses to communicate with other hosts across the Internet.

The special addresses according to RFC1918 are:

10.0.0.0 – 10.255.255.255 (10/8 prefix)

172.16.0.0 – 172.31.255.255 (172.16/12 prefix)

192.168.0.0 – 192.168.255.255 (192.168/16 prefix)

3Com has an excellent primer on IP addressing. Everything you ever wanted to know about IPv4 but were afraid to ask.

The most important (non-security-related) problem of the current Internet infrastructure is the ever-growing size of routing tables.

Such things happen when a proof-of-concept technology finds itself twenty years later on steroids, supporting orders of magnitude more users/data/services than originally envisioned.

Depending on local conditions, problems along the way, policy changes between Internet Service Providers etc, the way from A to B is not always the same.

Connectionless protocols (like UDP) are very fast, inexpensive (in terms of processing needed) and easy to deploy.

Connection-oriented protocols (like TCP) provide for reliability, flow and error control, so they have to perform lots of checks:

Checksums, to make sure that the packets reached the other side unharmed

Sequence number counting, to make sure that packets reached the destination in the right order, and that all of them reached it.

Dynamic retransmission timing, which decides how long to wait to re-send a packet that seems to have been lost during transit (not acknowledged by destination)

These protocols are extremely hard to design and implement properly, and known attacks and problems exist with the current TCP/IP implementation.

Each layer of the OSI model knows nothing about what's happening over or below it. Layers have clearly defines interfaces, through which they pass data to their neighbors

This is the advantage of a layered approach – changes in the implementation of the Transport Layer have no effect on the Network Layer – thus IP doesn't care whether it's carrying TCP or UDP or SUPERDUPER data – it just encapsulates whatever chunks of data are passed to it, and sends them to the lower layers.

The user types http://www.cmu.edu in the browser. The browser (an application, at OSI layer 7) asks the networking stack to initiate an HTTP connection with this address. But first the numerical IP has to be found, so a DNS request is sent to the DNS server. The local routing table of the kernel tells the network layer that the packets should be sent to the default gateway, since the address is obviously on another network (128.2.* versus 203.151.* which is the local network).

The gateway has no clue where 128.2.* would be, so it just forwards the request to its default gateway, the ISP's router. That router has an entry for 128.* networks in its tables, saying that the Pittsburgh Super Computing Center routers know about 128.* stuff. So it forwards the traffic there. The PSCC router knows that 128.2.* traffic should be sent to CMU's border router. That router then knows how to find CMU's web server on the local network. Mission accomplished – all that in a split second.

Multiple applications cannot bind on the same port (i.e. two different web servers can't be listening on port 80)

For a list of well known port/service mappings, check out the file /etc/services

With the command

$ /sbin/ifconfig -a

you will see all interfaces that are available in your system. If something doesn't show up, look in the output of

# lsmod

Most likely the driver hasn't been loaded.

There is an entire section in the Linux Network Administrator's Guide about the various functions of /sbin/ifconfig. You can find it at http://tldp.org/LDP/nag2/x-087-2-iface.ifconfig.html

On a client machine that should not be providing any services to other hosts across the network, there should be no (LISTEN) flags and asterisks on the same line.

The last line of output shown, means that exim3 is listening for SMTP connections from the host called “debian” only. That's my local machine, and thus presents no problem.

But the third line has an asterisk, and then the www port (80) and the LISTEN flag. This means that anyone can connect to that port from the Internet. Unless you have good reason to be providing such services, there should be no socket listening for traffic from the wild on your machine.

The second command tells the Linux kernel to send any packets that it doesn't know how to immediately deliver, to the host 10.0.0.1

Thus, this host will act as our default gateway.

In a home environment, your default gateway is usually provided by your ISP.

Session 9 - Networking

[StuCo 98008] Introduction to GNU/Linux

gnu linux network tcp/ip udp packet-switched

This lecture introduces us to basic networking concepts. Concepts include:
+ Network topologies
+ Network protocols (specifically TCP/IP and UDP)
+ The OSI model
+ IP addressing
+ Routing
+ The Domain Name System
+ Network interfaces under GNU/Linux
We'll also discuss some basic servers (OpenSSH daemon, Apache web server, FTP servers etc) and how they can be used/administered.

2003-10-10T16:23:49