Senior Acquisitions Editor: Kenyon Brown Development Editor: Kim Wimpsett

0xxxxxxx

If we turn the other 7 bits all off and then turn them all on, we’ll find the

Class A range of network addresses:

00000000 = 0

01111111 = 127

So, a Class A network is defined in the first octet between 0 and 127, and

it can’t be less or more. Understand that 0 and 127 are not valid in a Class

A network because they’re reserved addresses, which I’ll explain soon.

Network Address Range: Class B

In a Class B network, the RFCs state that the first bit of the first byte must

always be turned on but the second bit must always be turned off. If you

turn the other 6 bits all off and then all on, you will find the range for a

Class B network:

10000000 = 128

10111111 = 191

As you can see, a Class B network is defined when the first byte is

configured from 128 to 191.

Network Address Range: Class C

For Class C networks, the RFCs define the first 2 bits of the first octet as

always turned on, but the third bit can never be on. Following the same

process as the previous classes, convert from binary to decimal to find the

range. Here’s the range for a Class C network:

11000000 = 192

11011111 = 223

So, if you see an IP address that starts at 192 and goes to 223, you’ll know

it is a Class C IP address.

Network Address Ranges: Classes D and E

The addresses between 224 to 255 are reserved for Class D and E

networks. Class D (224–239) is used for multicast addresses and Class E

(240–255) for scientific purposes, but I’m not going into these types of

addresses because they are beyond the scope of knowledge you need to

gain from this book.

Network Addresses: Special Purpose

Some IP addresses are reserved for special purposes, so network

administrators can’t ever assign these addresses to nodes.

Table 3.4

lists

the members of this exclusive little club and the reasons why they’re

included in it.

Table 3.4

Reserved IP addresses

>Address

>Function

Network address of

all 0s

Interpreted to mean “this network or segment.”

Network address of

all 1s

Interpreted to mean “all networks.”

Network 127.0.0.1

Reserved for loopback tests. Designates the local

node and allows that node to send a test packet to

itself without generating network traffic.

Node address of all

0s

Interpreted to mean “network address” or any host

on a specified network.

Node address of all

1s

Interpreted to mean “all nodes” on the specified

network; for example, 128.2.255.255 means “all

nodes” on network 128.2 (Class B address).

Entire IP address

set to all 0s

Used by Cisco routers to designate the default

route. Could also mean “any network.”

Entire IP address

set to all 1s (same as

255.255.255.255)

Broadcast to all nodes on the current network;

sometimes called an “all 1s broadcast” or local

broadcast.

Class A Addresses

In a Class A network address, the first byte is assigned to the network

address and the three remaining bytes are used for the node addresses.

The Class A format is as follows:

network.node.node.node

For example, in the IP address 49.22.102.70, the 49 is the network

address and 22.102.70 is the node address. Every machine on this

particular network would have the distinctive network address of 49.

Class A network addresses are 1 byte long, with the first bit of that byte

reserved and the 7 remaining bits available for manipulation

(addressing). As a result, the maximum number of Class A networks that

can be created is 128. Why? Because each of the 7 bit positions can be

either a 0 or a 1, thus 2

7

, or 128.

To complicate matters further, the network address of all 0s (0000

0000) is reserved to designate the default route (see

Table 3.4

in the

previous section). Additionally, the address 127, which is reserved for

diagnostics, can’t be used either, which means that you can really only

use the numbers 1 to 126 to designate Class A network addresses. This

means the actual number of usable Class A network addresses is 128

minus 2, or 126.

The IP address 127.0.0.1 is used to test the IP stack on an

individual node and cannot be used as a valid host address. However,

the loopback address creates a shortcut method for TCP/IP

applications and services that run on the same device to communicate

with each other.

Each Class A address has 3 bytes (24-bit positions) for the node address

of a machine. This means there are 2

24

—or 16,777,216—unique

combinations and, therefore, precisely that many possible unique node

addresses for each Class A network. Because node addresses with the two

patterns of all 0s and all 1s are reserved, the actual maximum usable

number of nodes for a Class A network is 2

24

minus 2, which equals

16,777,214. Either way, that’s a huge number of hosts on a single network

segment!

Class A Valid Host IDs

Here’s an example of how to figure out the valid host IDs in a Class A

network address:

All host bits off is the network address: 10.0.0.0.

All host bits on is the broadcast address: 10.255.255.255.

The valid hosts are the numbers in between the network address and the

broadcast address: 10.0.0.1 through 10.255.255.254. Notice that 0s and

255s can be valid host IDs. All you need to remember when trying to find

valid host addresses is that the host bits can’t all be turned off or on at the

same time.

Class B Addresses

In a Class B network address, the first 2 bytes are assigned to the network

address and the remaining 2 bytes are used for node addresses. The

format is as follows:

network.network.node.node

For example, in the IP address 172.16.30.56, the network address is

172.16 and the node address is 30.56.

With a network address being 2 bytes (8 bits each), you get 2

16

unique

combinations. But the Internet designers decided that all Class B network

addresses should start with the binary digit 1, then 0. This leaves 14 bit

positions to manipulate, therefore 16,384, or 2

14

unique Class B network

addresses.

A Class B address uses 2 bytes for node addresses. This is 2

16

minus the

two reserved patterns of all 0s and all 1s for a total of 65,534 possible

node addresses for each Class B network.

Class B Valid Host IDs

Here’s an example of how to find the valid hosts in a Class B network:

All host bits turned off is the network address: 172.16.0.0.

All host bits turned on is the broadcast address: 172.16.255.255.

The valid hosts would be the numbers in between the network address

and the broadcast address: 172.16.0.1 through 172.16.255.254.

Class C Addresses

The first 3 bytes of a Class C network address are dedicated to the

network portion of the address, with only 1 measly byte remaining for the

node address. Here’s the format:

network.network.network.node

Using the example IP address 192.168.100.102, the network address is

192.168.100 and the node address is 102.

In a Class C network address, the first three bit positions are always the

binary 110. The calculation is as follows: 3 bytes, or 24 bits, minus 3

reserved positions leaves 21 positions. Hence, there are 2

21

, or 2,097,152,

possible Class C networks.

Each unique Class C network has 1 byte to use for node addresses. This

leads to 2

8

, or 256, minus the two reserved patterns of all 0s and all 1s,

for a total of 254 node addresses for each Class C network.

Class C Valid Host IDs

Here’s an example of how to find a valid host ID in a Class C network:

All host bits turned off is the network ID: 192.168.100.0.

All host bits turned on is the broadcast address: 192.168.100.255.

The valid hosts would be the numbers in between the network address

and the broadcast address: 192.168.100.1 through 192.168.100.254.

Private IP Addresses (RFC 1918)

The people who created the IP addressing scheme also created private IP

addresses. These addresses can be used on a private network, but they’re

not routable through the Internet. This is designed for the purpose of

creating a measure of well-needed security, but it also conveniently saves

valuable IP address space.

If every host on every network was required to have real routable IP

addresses, we would have run out of IP addresses to hand out years ago.

But by using private IP addresses, ISPs, corporations, and home users

only need a relatively tiny group of bona fide IP addresses to connect

their networks to the Internet. This is economical because they can use

private IP addresses on their inside networks and get along just fine.

To accomplish this task, the ISP and the corporation—the end user, no

matter who they are—need to use something called Network Address

Translation (NAT), which basically takes a private IP address and

converts it for use on the Internet. NAT is covered in Chapter 13,

“Network Address Translation (NAT).” Many people can use the same

real IP address to transmit out onto the Internet. Doing things this way

saves megatons of address space—good for us all!

The reserved private addresses are listed in

Table 3.5

.

Table 3.5

Reserved IP address space

>Address Class >Reserved Address Space

Class A

10.0.0.0 through 10.255.255.255

Class B

172.16.0.0 through 172.31.255.255

Class C

192.168.0.0 through 192.168.255.255

You must know your private address space to become Cisco

certified!

So, What Private IP Address Should I Use?

That’s a really great question: Should you use Class A, Class B, or even

Class C private addressing when setting up your network? Let’s take

Acme Corporation in SF as an example. This company is moving into

a new building and needs a whole new network. It has 14

departments, with about 70 users in each. You could probably

squeeze one or two Class C addresses to use, or maybe you could use a

Class B, or even a Class A just for fun.

The rule of thumb in the consulting world is, when you’re setting up a

corporate network— regardless of how small it is—you should use a

Class A network address because it gives you the most flexibility and

growth options. For example, if you used the 10.0.0.0 network

address with a /24 mask, then you’d have 65,536 networks, each with

254 hosts. Lots of room for growth with that network!

But if you’re setting up a home network, you’d opt for a Class C

address because it is the easiest for people to understand and

configure. Using the default Class C mask gives you one network with

254 hosts—plenty for a home network.

With the Acme Corporation, a nice 10.1.×.0 with a /24 mask (the × is

the subnet for each department) makes this easy to design, install,

and troubleshoot.

IPv4 Address Types

Most people use the term broadcast as a generic term, and most of the

time, we understand what they mean—but not always! For example, you

might say, “The host broadcasted through a router to a DHCP server,”

but, well, it’s pretty unlikely that this would ever really happen. What you

probably mean—using the correct technical jargon—is, “The DHCP client

broadcasted for an IP address and a router then forwarded this as a

unicast packet to the DHCP server.” Oh, and remember that with IPv4,

broadcasts are pretty important, but with IPv6, there aren’t any

broadcasts sent at all—now there’s something to look forward to reading

about in Chapter 14!

Okay, I’ve referred to IP addresses throughout the preceding chapters

and now all throughout this chapter, and even showed you some

examples. But I really haven’t gone into the different terms and uses

associated with them yet, and it’s about time I did. So here are the

address types that I’d like to define for you:

Loopback (localhost) Used to test the IP stack on the local computer.

Can be any address from 127.0.0.1 through 127.255.255.254.

Layer 2 broadcasts These are sent to all nodes on a LAN.

Broadcasts (layer 3) These are sent to all nodes on the network.

Unicast This is an address for a single interface, and these are used to

send packets to a single destination host.

Multicast These are packets sent from a single source and transmitted

to many devices on different networks. Referred to as “one-to-many.”

Layer 2 Broadcasts

First, understand that layer 2 broadcasts are also known as hardware

broadcasts—they only go out on a LAN, but they don’t go past the LAN

boundary (router).

The typical hardware address is 6 bytes (48 bits) and looks something

like 45:AC:24:E3:60:A5. The broadcast would be all 1s in binary, which

would be all Fs in hexadecimal, as in ff:ff:ff:ff:ff:ff and shown in

Figure

3.21

.

FIGURE 3.21

Local layer 2 broadcasts

Every network interface card (NIC) will receive and read the frame,

including the router, since this was a layer 2 broadcast, but the router

would never, ever forward this!

Layer 3 Broadcasts

Then there are the plain old broadcast addresses at layer 3. Broadcast

messages are meant to reach all hosts on a broadcast domain. These are

the network broadcasts that have all host bits on.

Here’s an example that you’re already familiar with: The network address

of 172.16.0.0 255.255.0.0 would have a broadcast address of

172.16.255.255—all host bits on. Broadcasts can also be “any network and

all hosts,” as indicated by 255.255.255.255, and shown in

Figure 3.22

.

FIGURE 3.22

Layer 3 broadcasts

In

Figure 3.22

, all hosts on the LAN will get this broadcast on their NIC,

including the router, but by default the router would never forward this

packet.

Unicast Address

A unicast is defined as a single IP address that’s assigned to a network

interface card and is the destination IP address in a packet—in other

words, it’s used for directing packets to a specific host.

In

Figure 3.23

, both the MAC address and the destination IP address are

for a single NIC on the network. All hosts on the broadcast domain would

receive this frame and accept it. Only the destination NIC of 10.1.1.2

would accept the packet; the other NICs would discard the packet.

FIGURE 3.23

Unicast address

Multicast Address

Multicast is a different beast entirely. At first glance, it appears to be a

hybrid of unicast and broadcast communication, but that isn’t quite the

case. Multicast does allow point-to-multipoint communication, which is

similar to broadcasts, but it happens in a different manner. The crux of

multicast is that it enables multiple recipients to receive messages

without flooding the messages to all hosts on a broadcast domain.

However, this is not the default behavior—it’s what we can do with

multicasting if it’s configured correctly!

Multicast works by sending messages or data to IP multicast group

addresses. Unlike with broadcasts, which aren’t forwarded, routers then

forward copies of the packet out to every interface that has hosts

subscribed to that group address. This is where multicast differs from

broadcast messages—with multicast communication, copies of packets, in

theory, are sent only to subscribed hosts. For example, when I say in

theory, I mean that the hosts will receive a multicast packet destined for

224.0.0.10. This is an EIGRP packet, and only a router running the

EIGRP protocol will read these. All hosts on the broadcast LAN, and

Ethernet is a broadcast multi-access LAN technology, will pick up the

frame, read the destination address, then immediately discard the frame

unless they’re in the multicast group. This saves PC processing, not LAN

bandwidth. Be warned though—multicasting can cause some serious LAN

congestion if it’s not implemented carefully!

Figure 3.24

shows a Cisco

router sending an EIGRP multicast packet on the local LAN and only the

other Cisco router will accept and read this packet.

FIGURE 3.24

EIGRP multicast example

There are several different groups that users or applications can

subscribe to. The range of multicast addresses starts with 224.0.0.0 and

goes through 239.255.255.255. As you can see, this range of addresses

falls within IP Class D address space based on classful IP assignment.

Summary

If you made it this far and understood everything the first time through,

you should be extremely proud of yourself! We really covered a lot of

ground in this chapter, but understand that the information in it is

critical to being able to navigate well through the rest of this book.

If you didn’t get a complete understanding the first time around, don’t

stress. It really wouldn’t hurt you to read this chapter more than once.

There is still a lot of ground to cover, so make sure you’ve got this

material all nailed down. That way, you’ll be ready for more, and just so

you know, there’s a lot more! What we’re doing up to this point is

building a solid foundation to build upon as you advance.

With that in mind, after you learned about the DoD model, the layers,

and associated protocols, you learned about the oh-so-important topic of

IP addressing. I discussed in detail the difference between each address

class, how to find a network address and broadcast address, and what

denotes a valid host address range. I can’t stress enough how important it

is for you to have this critical information unshakably understood before

moving on to Chapter 4!

Since you’ve already come this far, there’s no reason to stop now and

waste all those brainwaves and new neural connections. So don’t stop—go

through the written labs and review questions at the end of this chapter

and make sure you understand each answer’s explanation. The best is yet

to come!

Exam Essentials

Differentiate between the DoD and the OSI network models.

The DoD model is a condensed version of the OSI model, composed of

four layers instead of seven, but is nonetheless like the OSI model in that

it can be used to describe packet creation and devices and protocols can

be mapped to its layers.

Identify Process/Application layer protocols. Telnet is a terminal

emulation program that allows you to log into a remote host and run

programs. File Transfer Protocol (FTP) is a connection-oriented service

that allows you to transfer files. Trivial FTP (TFTP) is a connectionless

file transfer program. Simple Mail Transfer Protocol (SMTP) is a

sendmail program.

Identify Host-to-Host layer protocols. Transmission Control

Protocol (TCP) is a connection-oriented protocol that provides reliable

network service by using acknowledgments and flow control. User

Datagram Protocol (UDP) is a connectionless protocol that provides low

overhead and is considered unreliable.

Identify Internet layer protocols. Internet Protocol (IP) is a

connectionless protocol that provides network address and routing

through an internetwork. Address Resolution Protocol (ARP) finds a

hardware address from a known IP address. Reverse ARP (RARP) finds

an IP address from a known hardware address. Internet Control Message

Protocol (ICMP) provides diagnostics and destination unreachable

messages.

Describe the functions of DNS and DHCP in the network.

Dynamic Host Configuration Protocol (DHCP) provides network

configuration information (including IP addresses) to hosts, eliminating

the need to perform the configurations manually. Domain Name Service

(DNS) resolves hostnames—both Internet names such as

www.lammle.com

and device names such as Workstation 2—to IP

addresses, eliminating the need to know the IP address of a device for

connection purposes.

Identify what is contained in the TCP header of a connection-

oriented transmission. The fields in the TCP header include the

source port, destination port, sequence number, acknowledgment

number, header length, a field reserved for future use, code bits, window

size, checksum, urgent pointer, options field, and finally, the data field.

Identify what is contained in the UDP header of a

connectionless transmission. The fields in the UDP header include

only the source port, destination port, length, checksum, and data. The

smaller number of fields as compared to the TCP header comes at the

expense of providing none of the more advanced functions of the TCP

frame.

Identify what is contained in the IP header. The fields of an IP

header include version, header length, priority or type of service, total

length, identification, flags, fragment offset, time to live, protocol, header

checksum, source IP address, destination IP address, options, and finally,

data.