Unit 3 Networking Field Guide

1. What a network is

Use this on Day 1, and any time you mix up a switch and a router.

Layouts. Star: everything connects to one central switch. Bus: one shared cable. Ring: each device connects to two neighbors in a loop. Mesh: many direct links, so traffic can go around a failure.

In the sandbox: a computer's gateway is the address of the router on its own LAN. It is where the computer sends anything that is not on its own LAN.

2. IP addresses and MAC addresses

Use this on Day 2, and whenever the sandbox complains about an address.

An IPv4 address is four numbers from 0 to 255 separated by dots, like 192.168.1.23. It changes when a device joins a different network. A MAC address is six bytes in hex, like 3C:22:FB:9A:10:5E, built into the network card. The first three bytes name the manufacturer.

The rule the sandbox uses

Everything on one LAN shares the first three numbers (the network part) and has a different last number. For example, 192.168.1.10 and 192.168.1.11 are on the same LAN. 192.168.1.10 and 192.168.2.10 are not, so they need a router between them. Every address must be unique.

3. Bits, bytes, and hexadecimal

Use this on Day 3, in the Hex Tutorial, and any time you read a hex dump.

A bit is a 0 or a 1. A byte is 8 bits. Each place is worth double the one to its right: 128, 64, 32, 16, 8, 4, 2, 1. Add up the places that hold a 1.

Hex is base 16: the digits 0 to 9 and the letters A to F. One hex digit stands for 4 bits, so two digits make one byte.

4. The TCP/IP model and packet headers

Use this on Day 3, and whenever you open a packet in the sandbox.

Each layer adds its own header in front of the data. A packet in the sandbox is a stack: Ethernet, then IPv4, then TCP or UDP, then the data.

Ethernet header (14 bytes)

IPv4 header (20 bytes, starts after the Ethernet header)

UDP header (8 bytes) and TCP header (20 bytes)

5. Ports, protocols, and firewall rules

Use this on Day 4, whenever a packet is refused or blocked, and when you write firewall rules.

A server only answers on ports it is listening on. TCP port 443 and UDP port 443 are different doors, so the protocol has to match too.

A firewall rule allows or denies traffic. The firewall checks its rules from the top, and the first rule that matches decides. A rule for any matches every packet, so put it last. A firewall only sees packets that cross it, so computers inside the LAN can still reach each other.

1. allow port 443
2. deny port 80
3. allow any

6. Reading a result in the Network Sandbox

Use this whenever you press Send and want to know what happened and why.

What changes from step to step

Cleartext or encrypted? On ports 80, 21, and UDP the data bytes are readable text. On ports 443 and 22 they look scrambled. That is exactly what someone capturing the packet would see.

7. TCP, UDP, FTP, and sending files

Use this on Day 4 and Day 5, and before you use Send a file.

FTP

FTP is not a transport protocol. It runs on TCP. It uses a control connection on port 21 for commands and a separate data connection for the file. In the sandbox it uses passive mode: the server tells the client a high data port (50000). Your cheat sheet lists FTP as 20/21, which is the older active mode. The login and every command cross the network as cleartext, including the password.

Reading the file transfer results

Bigger files lose more. Every packet has the same chance of being lost, so a 50 MB file (tens of thousands of packets) almost always loses some. Even 1% loss damages a UDP file that big.

8. If something is not working: a checklist

Use this when the Network check panel lists a problem, or a packet says No route or Refused.

Back to the Networking Lab, the Hex Tutorial, or the Network Sandbox.