Internet Engineering Task Force

If you read my article on the OSI model, you got a good overview on communications from that model's perspective, however how does that relate to TCP/IP? We're going to take it a step furthermore and get into the idea behind the two address concept. How does an IP address and a MAC address work at the same time? If you want to hijack sessions and all sorts of lulz of that sort, you need to understand these concepts. Let's get into it, mates!

Good way to understand what a protocol is

A good way to understand what a protocol is, would be to view it like a language. If people were network interfaces and all spoke their own language, there would be no way for them to properly communicate. A protocol works the same way, by agreeing to use certain methods or standards, many groups can build and create things that can all communicate with each other. So when you see TCP/IP protocol, think of it like a collection of rules computers must all follow to allow the millions and millions of networked machines called the Internet to function.

OSI is all in all used today to describe network communication and for standards to unite, during the TCP model is used to show relation between the various protocols it contains. Below is a diagram of how the two map out to each other.

Layers one and two of the OSI model are considered to both be physical and local, so they are simply grouped at the same time as the Network Interface Layer in accordance with TCP/IP. The Network layer is just renamed the Internet layer and carries the same functions. Following that, you can see layers five through seven of OSI have been compiled into the Application layer, as in other words where they operate.

UDP sounds pretty bad right now, nevertheless listen to this: services like VoIP (Voice over Internet Protocol) and online games are too fast for TCP. Imagine you were playing Halo and you dropped a packet or two. Can you stop and wait for it? Clearly not. You would see a little jump in the frame rate and you'd keep going. If you had to wait for it to get back to you, you would surely be fragged. The same applies if you were talking to your mate on Skype and you dropped a few packets; it makes no sense to pause the conversation to retrieve them.

Every single packet being sent around has two addresses inside of it-an Internet Protocol and a Media Access Control address. An IP address actually only identifies your network, as all internal IP addresses are as a matter of fact private and handled by Network Address Translation at the router. You might have an IP address from your ISP of 201.95.87.98 that identifies your network, and your actual computer might have a private, inside-the-network address of 192.168.1.67.

This is done so that many devices, like your PlayStation and your computer, can get on the Internet together, during only needing one IP address. If every single device online today had its own address, we would have already ran out of new ones to use!

So, where does a MAC address come in? As things now stand, IP addresses are to no avail inside of your network, as your machines don't use them to talk to each other.

The network layer

Where IP addressing functions at the network layer, MAC addressing works at the data link layer. It's a slight oversimplification, however one can think of IP addressing as supporting the software implementation and MAC addresses as supporting the hardware implementation of the network stack. The MAC address as a rule remains fixed and follows the network device, yet the IP address changes as the network device moves from one network to another.

So, how in the world does this to tell the truth work? Your network maintains a mapping between the IP address of a device and its MAC address. This mapping is known as the ARP Table.

ARP stands for Address Resolution Protocol and it is used to associate a Network layer address with a Data Link layer address.

Let's say you have some data to send. When the data gets to the Network layer, it will put on the destination IP address. All of this info is passed down to the Data Link layer where it is taken and placed within a data link frame.

The IP address

Based on the IP address and subnet mask, your computer should be able to figure out if the destination IP is local to your network or not. If the IP is local, your computer will look in its ARP table, the table where the responses to previous ARP requests are cached, to find the MAC address.

If it's not there, at the time your computer will broadcast an ARP request to find out the MAC address for the destination IP. Since this request is broadcast, all machines on the network will receive it and examine the contents. If the IP address in the request is their own, they'll reply back. On receiving this information, your computer will update its ARP table to include the new information and will then and there send out the frame addressed with the destination hosts MAC address.

With all this talk about protocols, I'm sure you have some questions about specific ones you have come across. It turns out the Internet Engineering Task Force has put at the same time a memorandum describing, collecting, and categorizing details about protocols, innovation, and ideas on how the actual Internet functions. This is needed because there's no one authority that mandates certain protocols to be used over other ones, and to tell the truth, you can create and submit your own for review and use!

We are another step furthermore in giving you the skills you need to navigate the Internet like a pro. If some of this didn't quite make sense, I encourage you to check out our OSI model and Intro to IP Addresses articles for some more back knowledge. Then in the series, we will look at penetration attacks that work on these ideas!