Num | 3 |
Name | Network |
Acronim | Not |
PDU | Packet |
What is ‘on it’ | Router |
Function | Structuring and managing a multi-node network, including addressing, routing and traffic control |
Network layer works for the transmission of data from one host to the other located in different networks. It also takes care of packet routing i.e. selection of the shortest path to transmit the packet, from the number of routes available. The sender & receiver’s IP address are placed in the header by network layer.
The functions of the Network layer are :
Netmask depends the range of the network. 1's
in the netmask lockdown the IP address.
Small mask = Large network
Large mask = Small network
128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
---|---|---|---|---|---|---|---|
1 | 1 | 1 | 1 | 1 | 1 | 1 | 1 |
128 | 64 | 32 | 16 | 8 | 4 | 2 | 1 |
---|---|---|---|---|---|---|---|
0 | 0 | 0 | 0 | 0 | 1 | 1 | 1 |
255 | 255 | 255 | 255 |
---|---|---|---|
1111 1111 | 1111 1111 | 1111 1111 | 1111 1111 |
255 | 255 | 255 | 0 |
---|---|---|---|
1111 1111 | 1111 1111 | 1111 1111 | 0000 0000 |
255 | 255 | 252 | 0 |
---|---|---|---|
1111 1111 | 1111 1111 | 1111 1100 | 0000 0000 |
school example
IP 192.168.1.0
Neem je masker 255.255.255.192
Het eerste groene getal pakken
Aftrekken van 256
256-192 = 64
128 64 32 16 8 4 2 1
De stappen van het eerste groene getal zullen 64 zijn
1e
192.168.1.0 NETID
192.168.1.1 LB
192.168.1.63 HB
192.168.1.64 BC
172.168.0.0
255.255.252.0
256-252=4
128 64 32 16 8 4 2 1
1e
172.168.0.0
172.168.0.1
172.168.4.254
172.168.4.255
IP 192.168.100.0
MASK 255.255.255.224
224 aftrekken 255
255.255.255.255
255.255.255.224 -
31
Trek een streep waar het vorige getal tussen past.
128 64 32|16 8 4 2 1
1 subnet
NETID 192.168.100.0
LB 192.168.100.1
HB 192.168.100.30
BC 192.168.100.31
2 subnet
NETID 192.168.100.32
LB 192.168.100.33
HB 192.168.100.62
BC 192.168.100.63
3 subnet
NETID 192.168.100.64
LB 192.168.100.65
HB 192.168.100.94
BC 192.168.100.95
4 subnet
NETID 192.168.100.96
LB 192.168.100.97
HB 192.168.100.126
BC 192.168.100.127
5 subnet
NETID 192.168.100.128
LB 192.168.100.129
HB 192.168.100.158
BC 192.168.100.159
6 subnet
NETID 192.168.100.160
LB 192.168.100.161
HB 192.168.100.190
BC 192.168.100.191
7 subnet
NETID 192.168.100.192
LB 192.168.100.193
HB 192.168.100.222
BC 192.168.100.223
8 subnet
NETID 192.168.100.224
LB 192.168.100.225
HB 192.168.100.253
BC 192.168.100.255
Subnet Table
Octect | Subnet: 128 | Subnet: 192 | Subnet: 224 | Subnet: 240 | Subnet: 248 | Subnet: 252 | Subnet: 254 | subnet: 255 |
---|---|---|---|---|---|---|---|---|
1 | /1 | /2 | /3 | /4 | /5 | /6 | /7 | /8 |
2 | /9 | /10 | /11 | /12 | /13 | /14 | /15 | /16 |
3 | /17 | /18 | /19 | /20 | /21 | /22 | /23 | /24 |
4 | /25 | /26 | /27 | /28 | /29 | /30 | /31 | /32 |
Host Table
Octect | Hosts: | Hosts | Hosts | Hosts | Hosts | Hosts | Hosts | Hosts |
---|---|---|---|---|---|---|---|---|
1 | /1 2147483648 | /2 1073741824 | /3 536870912 | /4 268435456 | /5 134217728 | /6 67108864 | /7 33554432 | /8 16777216 |
2 | /9 8388608 | /10 4194304 | /11 2097152 | /12 1048576 | /13 524288 | /14 262144 | /15 131072 | /16 65536 |
3 | /17 32768 | /18 16384 | /19 8192 | /20 4096 | /21 2048 | /22 1024 | /23 512 | /24 256 |
4 | /25 128 | /26 64 | /27 32 | /28 16 | /29 8 | /30 4 | /31 2 | /32 1 |
Willdcard Mask Table
Slash | Netmask | Wildcard Mask |
---|---|---|
/32 | 255.255.255.255 | 0.0.0.0 |
/31 | 255.255.255.254 | 0.0.0.1 |
/30 | 255.255.255.252 | 0.0.0.3 |
/29 | 255.255.255.248 | 0.0.0.7 |
/28 | 255.255.255.240 | 0.0.0.15 |
/27 | 255.255.255.224 | 0.0.0.31 |
/26 | 255.255.255.192 | 0.0.0.63 |
/25 | 255.255.255.128 | 0.0.0.127 |
/24 | 255.255.255.0 | 0.0.0.255 |
/23 | 255.255.254.0 | 0.0.1.255 |
/22 | 255.255.252.0 | 0.0.3.255 |
/21 | 255.255.248.0 | 0.0.7.255 |
/20 | 255.255.240.0 | 0.0.15.255 |
/19 | 255.255.224.0 | 0.0.31.255 |
/18 | 255.255.192.0 | 0.0.63.255 |
/17 | 255.255.128.0 | 0.0.127.255 |
/16 | 255.255.0.0 | 0.0.255.255 |
/15 | 255.254.0.0 | 0.1.255.255 |
/14 | 255.252.0.0 | 0.3.255.255 |
/13 | 255.248.0.0 | 0.7.255.255 |
/12 | 255.240.0.0 | 0.15.255.255 |
/11 | 255.224.0.0 | 0.31.255.255 |
/10 | 255.192.0.0 | 0.63.255.255 |
/9 | 255.128.0.0 | 0.127.255.255 |
/8 | 255.0.0.0 | 0.255.255.255 |
/7 | 254.0.0.0 | 1.255.255.255 |
/6 | 252.0.0.0 | 3.255.255.255 |
/5 | 248.0.0.0 | 7.255.255.255 |
/4 | 240.0.0.0 | 15.255.255.255 |
/3 | 224.0.0.0 | 31.255.255.255 |
/2 | 192.0.0.0 | 63.255.255.255 |
/1 | 128.0.0.0 | 127.255.255.255 |
/0 | 0.0.0.0 | 255.255.255.255 |
Subnet to calculate 192.168.1.X/25
/25 is on row 4 of our subnet table, this means the first 3 octets of our netmask are locked down and the last octect is unknown.
255.255.255.?
Our unknown octet has the value 128 as seen on the header of the Subnet Table.
This means our netmask is 255.255.255.128.
There are 128 hosts using this netmask as seen in Host Table.
2 of those are not usable, the broadcast (BC) and Network ID(NETID), this means there are 126 usable hosts in this subnet. We start counting these hosts from 0.
To define our range of usable hosts we will use the Lowest Usable (LU) and the Highest Usable (HU). This means our LU in this case will be 192.168.1.1 and our HU will be 192.168.1.126.
First Subnet
NETID 192.168.1.0
LU 192.168.1.1
HU 192.168.1.126
BC 192.168.1.127
Second Subnet
NETID 192.168.1.128
LU 192.168.1.129
HU 192.168.1.254
BC 192.168.1.255
Subnet to calculate 10.0.X.X/10
/10 is on row 2 of the subnet table, this means the first octet of our netmask are locked down to 255, the second octect is unknown and the rest are locked down to 0.
255.?.0.0
Our unknown octect has the value of 192 as seen in the header of the subnet table.
This means our netmask is 255.192.0.0.
There are 4194304 hosts using this netmask as seen in the host table.
2 of those are not usable, the broadcast (BC) and Network ID(NETID), this means there are 4194302 usable hosts in this subnet. We start counting these hosts from 0.
To define our range of usable hosts we will use the Lowest Usable (LU) and the Highest Usable (HU). Since this is a bigger range the Wildcard Mask can be used to make this easier.
To get our wildcard mask we inverse of our mask. Our wildcard mask is 0.63.255.255. See Wildcard Mask table.
This means our LU in this case will be 10.0.0.1 and our HU will be 10.63.255.254.
NETID 10.0.0.0
LU 10.0.0.1
HU 10.63.255.254
BC 10.63.255.255
NETID 10.64.0.0
LU 10.64.0.1
HU 10.127.255.254
BC 10.127.255.255
NETID 10.128.0.0
LU 10.128.0.1
HU 10.191.255.254
BC 10.191.255.255
NETID 10.192.0.0
LU 10.192.0.1
HU 10.255.255.254
BC 10.255.255.255
IP Addresses identify both a network as well as host on a network. Depending on the class of a network, certain amount of bits in the IP (32 bits overall) are allocated for network adressing and the rest is for: adressing the host on the network.
Furthermore, looking at the IP itself, you can tell which class of IP it is, using the following rules:
Class | Binary Prefix | First Octet of dotted-decimal must be | Excluded Addresses |
---|---|---|---|
A | 0 | 0 to 127 | 10.% and 127.% |
B | 10 | 128 to 191 | 172.16.% to 172.31.% |
C | 110 | 192 to 223 | 192.168.% to 192.168.% |
D (Multicast) | 1110 | 224 to 239 | |
E (Experimental) | 11110 | 240 to 254 |
Additional, Special IP Rules:
255.255.255.255
can also be used to broadcast on a current network.10.%
172.16.%
- 172.31.%
192.168.%
- 192.168.%
169.254.%
to 169.%
CIDR notation indicates how many bits are taken in the mask by network + subnet. Remembering that overall there are 32 bits, the remaining bits can be used for host addresses. For instance: /25 indicates that 32-25 = 7 bits are available for the host portion, making 2^7=128 (in reality 128-2 = 126) host addresses available for assignment. The full CIDR address includes an IP (usually: lowest IP) of the range, e.g.: 192.168.100.14/24
CIDR: 212.100.105.0/22
Steps:
Figure-out netmask.
Since 32-22 = 10, first two octets are all 1’s, last one is all 0’s and first six bits of the third octet are 1’s. Calculating 128+64+32+16+8+4 = 252, the final netmask is: 255.255.252.0
. Obviously, here we remembered bit weights: 128,64,32,16,8,4,2,1 by heart, but if you don’t, you just need to remember 128
is the high bit and the rest are sequence of dividing by 2 until 1.
Calculate IP range of the range.
Knowing our netmask, we know that the lowest IP will have the same number in the first two octets as the example IP: 212.100.%. Since last octet is not masked, lowest IP will have it as zero, so we just need to figure-out lowest allowed number in the third octet. Third octet (252) in binary is: ‘1111 - 1100’ which would enforce that the first six bits of the example IP are the same for all IPs in range. 105 in binary is: ‘0110 - 1001’, therefore the lowest number with fixed six bits is: ‘0110-1000’ (64+32+8=104) and highest is: ‘0110 - 1011’ (64+32+8+2+1=107), where bolded-out part is the fixed part. Considering this, the final range is: 212.100.104.0 - 212.100.107.255.
There’re also some really nice online calculators for these, e.g.: http://www.ipaddressguide.com/cidr
Please note: as a practical matter most commonly, CIDR ranges do indicate the lowest IP, since lowest IP is the network IP and the highest is broadcast IP, for that network. However, as we saw - we can calculate the proper range even if any other IP from the range is given (possibly: by mistake).
An old version of the stun spec (RFC3489) defined the following NAT variations:
Full Cone: A full cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Furthermore, any external host can send a packet to the internal host, by sending a packet to the mapped external address.
Restricted Cone: A restricted cone NAT is one where all requests from the same internal IP address and port are mapped to the same external IP address and port. Unlike a full cone NAT, an external host (with IP address X) can send a packet to the internal host only if the internal host had previously sent a packet to IP address X.
Port Restricted Cone: A port restricted cone NAT is like a restricted cone NAT, but the restriction includes port numbers. Specifically, an external host can send a packet, with source IP address X and source port P, to the internal host only if the internal host had previously sent a packet to IP address X and port P.
Symmetric: A symmetric NAT is one where all requests from the same internal IP address and port, to a specific destination IP address and port, are mapped to the same external IP address and port. If the same host sends a packet with the same source address and port, but to a different destination, a different mapping is used. Furthermore, only the external host that receives a packet can send a UDP packet back to the internal host.
Additional research can be found in RFC5780
ccding/go-stun may be helpful to figure out your nat type(s).
NAT bindings should not be considered to be deterministic:
Hole punching is an easy way to circumvent a NAT. Peers try to establish a direct connection by learning their respective public addresses using a 3rd party server. The 3rd party server is also used to keep the NAT binding alive.
The hole punching examples below can be used to get through the Full Cone, Restricted Cone and Port Restricted Cone NAT types. Symmetric NATs require more complex processes. However, this NAT type is more rare and can still be circumvented using a TURN server to relay traffic.
First establisch a local connection by listening using net.ListenUDP
. Next use WriteTo
and ReadFrom
to send and receive packets to and from the desired remote addresses.
TCP hole punching is a little more involved. In order to keep the NAT binding alive the same local TCP port should be used. This can be done by setting the SO_REUSEADDR and SO_REUSEPORT socket options on most operating systems. Sadly this isn’t well supported until go1.11 as discussed in golang/go#9661. Starting from go1.11 the flag can be set using the Dialer.Control function.
Example (dial.go):
var d net.Dialer
d.Control = controlOnConnSetup
func controlOnConnSetup(network string, address string, c syscall.RawConn) error {
return nil
}
For Unix (dial_unix.go):
// +build darwin dragonfly freebsd linux netbsd openbsd solaris
func controlOnConnSetup(c syscall.RawConn, addr Addr) error {
var operr error
fn := func(s uintptr) {
operr = syscall.SetsockoptInt(int(s), syscall.SOL_SOCKET, syscall.SO_REUSEADDR, 1)
if operr != nil {
return
}
operr = syscall.SetsockoptInt(int(s), syscall.SOL_SOCKET, syscall.SO_REUSEPORT, 1)
if operr != nil {
return
}
}
if err := c.Control(fn); err != nil {
return err
}
if operr != nil {
return operr
}
return nil
}
For Windows (dial_windows.go):
func controlOnConnSetup(network string, address string, c syscall.RawConn) error {
var operr error
fn := func(s uintptr) {
handle := syscall.Handle(fd)
operr = syscall.SetsockoptInt(handle, syscall.SOL_SOCKET, syscall.SO_REUSEADDR, 1)
if operr != nil {
return
}
}
if err := c.Control(fn); err != nil {
return err
}
if operr != nil {
return operr
}
return nil
}
Following chart summarises which types of candidates contribute to a successful NAT traversal in each combination of local and remote NAT types.
Open | F.Cone | R.Cone | PR.Cone | Symmetric | |
---|---|---|---|---|---|
Open | host | srflx or prflx | srflx or prflx | srflx or prflx | prflx |
F.Cone | srflx or prflx | srflx | srflx | srflx | srflx and prflx |
R.Cone | srflx or prflx | srflx | srflx | srflx | srflx and prflx |
PR.Cone | srflx or prflx | srflx | srflx | srflx | relay |
Symmetric | prflx | srflx and prflx | srflx and prflx | relay | relay |
> 1024
my local ip | my local port | my external ip | my external port | external ip |
---|---|---|---|---|
192.168.3.1 | :1025 | 9.2.1.33 | :1025 | 188.1.3.15 |
192.168.3.2 | :1025 | 9.2.1.33 | :1026 | 188.1.3.15 |
192.168.3.3 | :1025 | 9.2.1.33 | :1027 | 188.1.3.15 |