IP addressing and subnets — exam-style exercises with masks, classes, fragments and ARP (and the DHCP ports I got the wrong way round)

Answer: Users should not need to know how the networks are interconnected · No particular topology is imposed · The internetwork is independent of the user interface

The idea of the internetwork is to make many different physical networks look like one. To do that, it hides how they are joined, imposes no topology and does not depend on the user interface.

Answer: The network the destination belongs to (10.200.1.0), and it looks for the next router

A router does not keep a route for every device in the world: it keeps networks. It works out the destination’s network and looks up the next hop in its table.

• T — An IPv4 address takes 4 bytes
• F — The laptop’s IP is the same as its Wi-Fi card’s MAC
• T — In 10.110.7.24 each of the four numbers is one byte written in decimal
• F — IPv6 uses 64-bit addresses
• T — The IP identifies the device’s connection to the network, not the device itself

IPv4 has 32 bits (4 bytes) and IPv6 128. The IP is not the card’s physical address (the MAC), and what it identifies is the connection: a router with three interfaces has three IPs.

• 10.110.7.24 → Class A
• 172.30.3.5 → Class B
• 193.145.138.32 → Class C
• 224.0.0.9 → Class D (multicast)

The first byte is enough: 0-127 is A (starts with 0), 128-191 is B (10), 192-223 is C (110) and 224-239 is D (1110).

A class B address starts with 10, a class C one with 110 and a multicast (class D) one with 1110.

Each class adds a 1 in front: A = 0, B = 10, C = 110, D = 1110. That is why the first byte of a class C goes from 192 (11000000) to 223 (11011111).

Answer: Class B

Convert it to binary: 191 = 10111111. The first two bits are 10, so it is class B. It is the last class B value for the first byte: 192 is already C.

• T — IP does not set up a connection before sending data
• F — IP reorders datagrams that arrive out of order
• T — Two datagrams from the same transfer can take different paths
• F — IP guarantees that no duplicate datagrams arrive
• F — If a datagram is lost, IP asks for it to be resent

IP is connectionless and does no sequence control, no flow control and no error recovery. It decides the route of each datagram separately, so there may be losses, disorder and duplicates: TCP, further up, takes care of that.

Answer: datagram

It is the datagram: since it carries source and destination in its header, each one is handled independently.

• IHL → Header length, in 32-bit words
• Total length → Size of the whole datagram, in bytes
• Identification → Number shared by all the fragments of the same datagram
• Time to live → Stops a datagram going round the network forever
• Fragment offset → Position of the fragment’s data inside the original datagram

The next router’s MAC is not in the IP header: it goes in the frame of the network access layer.

Answer: 5

IHL counts 32-bit (4-byte) words: 20 / 4 = 5. It is the minimum value.

Answer: 24 bytes

Always multiply by 4: IHL × 4 = header bytes.

Answer: It cannot fragment it: it discards it and tells the source with an ICMP “fragmentation needed” message

DF (Don’t Fragment) set to 1 forbids splitting the datagram. If it does not fit, the router drops it and ICMP tells the source (the “fragmentation needed” code).

• T — MF = 1 in a fragment means more fragments follow
• T — The last fragment of a datagram has MF = 0
• F — Bit 0 of the flags must be 1
• T — With DF = 0 the datagram can be fragmented

The flags are 3 bits: bit 0 is reserved and is 0, bit 1 is DF (1 = don’t fragment) and bit 2 is MF (1 = more fragments, 0 = last).

400 + 400 + 200 = 1000. Each offset is the sum of the previous data: 0, 400 and 400 + 400 = 800. Only the last one has MF = 0. (In the real header it would be stored in 8-byte units: 0, 50 and 100.)

• T — Fragments are joined at the destination device
• F — Every router along the way reassembles and fragments again
• T — If a fragment is lost, the destination cannot rebuild the datagram and discards it when its timer runs out
• F — All the fragments of a datagram have to take the same path

Reassembling at the destination frees routers from the work and lets each fragment take its own path. The downside: it is less efficient, and a single lost fragment makes all the others useless.

Answer: 10.110.12.0

The first three bytes of the mask are 255 (all ones) and go through unchanged; the last one is 0 and sets the byte to zero: 10.110.12.0.

Answer: Directly: it is on the same network, so it asks for its MAC with ARP and sends it the frame

Same AND, same network: direct delivery. The router does not even notice.

Answer: The laptop thinks 10.110.12.5 is on its network, asks for its MAC with ARP in classroom 7 and nobody answers

10.110.12.5 AND 255.255.0.0 = 10.110.0.0, the same as the laptop’s network with that mask. So it tries direct delivery and the ARP request gets no answer, because the device is on another network.

• Direct → The destination is on a network the device is connected to
• Indirect with static tables → The administrator writes the routes by hand and they do not change on their own
• Indirect with dynamic tables → Routers exchange information every so often and recalculate the routes

Direct = same network, no router. Indirect = through routers, with tables that can be static (by hand, they do not adapt to changes) or dynamic (they build themselves and adapt).

Answer: The destination network · The address of the next router (or the interface’s IP if the network is connected)

The minimum is two columns: destination network and next hop. Fuller tables add the mask and a cost.

Correct order:

1. Take the destination IP from the datagram
2. AND that IP with the row’s mask
3. Compare the result with the row’s destination network
4. If it matches, send the datagram to that row’s next hop
5. If no row matches, discard the datagram

It is the algorithm in the notes: row by row, N = ID AND mask; if N matches the row’s network, it is sent; if the rows run out, it is discarded.

Answer: It is the default route: any IP AND 0.0.0.0 gives 0.0.0.0, so it picks up everything else

With the mask all zeros, the AND always gives 0.0.0.0, which matches the row’s network. If it came first, it would swallow every datagram.

The mask has 32 bits: a bit set to 1 means that bit belongs to the network identifier and a bit set to 0 means it belongs to the host identifier.

Ones mark the network (and subnet) and zeros the host. The notes also call the host the station.

192 = 11000000: two more bits for the subnet and 6 for the host. Each subnet has 2⁶ = 64 addresses, so they go up in steps of 64. The first one (all zeros) is the network and the last (all ones) the broadcast: that leaves 64 − 2 = 62 hosts.

Answer: 10.110.7.64

100 AND 192: 01100100 AND 11000000 = 01000000 = 64. The subnet is 10.110.7.64 (from .64 to .127).

Answer: 14

Count the zeros in the mask (h) and work out 2^h − 2.

• ARP → Finds the MAC that corresponds to an IP on the same network
• RARP → A device that only knows its MAC asks a server for its IP
• ICMP → Carries error and control messages back to the source
• DHCP → Gives a device its network configuration when it connects
• DNS → Translates a name like www.ulpgc.es into an IP address

ARP goes from IP to MAC and RARP the other way round (Reverse). ICMP reports errors, DHCP configures and DNS translates names. No protocol reassembles fragments at the routers: it happens at the destination.

Correct order:

1. The laptop sends the whole network an ARP request with the IP 10.110.7.1 and its own IP-MAC pair
2. Every device in the classroom receives the request
3. The router recognises its IP and replies only to the laptop with its MAC
4. The laptop stores the IP-MAC pair in its ARP cache
5. IP can now deliver the datagram in a frame addressed to that MAC

Question by broadcast, direct answer and a cache so it does not ask again. Since the request carries the laptop’s IP-MAC pair, the router can note it down too.

Correct order:

1. DHCPDISCOVER: the client looks for servers by broadcast
2. DHCPOFFER: each server offers an address
3. DHCPREQUEST: the client asks for the offer it chose
4. DHCPACK: the chosen server confirms the allocation

Discover, Offer, Request, Ack (DORA). If the server cannot fulfil it, it answers DHCPNACK and the client starts again; if the client sees with ARP that the IP is already in use, it sends DHCPDECLINE.

• T — ICMP reports the error to the device that sent the original datagram
• T — ICMP messages travel inside the data field of an IP datagram
• T — ping uses ICMP’s echo request and echo reply messages
• F — In DHCP, the client listens on UDP port 67
• T — DHCP’s dynamic allocation lends the address for a period of time

ICMP only reports to the original source, not to the routers along the way. ping sends echo requests (type 8) and receives replies (type 0). In DHCP the server listens on 67 and the client on 68.

Answer: Automatic allocation

Automatic = for good; dynamic = a timed loan. Careful: the name is misleading, because the server does both without any human involved.

Model answer:

ARP (Address Resolution Protocol) obtains the physical (MAC) address of a device on the same network from its IP address. When a device A has to deliver a datagram to B and only knows its IP, A’s ARP process sends an ARP request by broadcast with B’s IP and with A’s own IP-MAC pair. Every device on the network receives the request, but only B recognises its IP and answers A directly with an ARP reply containing its MAC. A stores the IP-MAC pair in its ARP cache (you can see it with arp -a), so the following datagrams do not need to ask, and the IP process can now deliver the datagram in a frame addressed to that MAC. If the destination is on another network, what is asked for is the router’s (the gateway’s) MAC. The reverse operation, getting an IP from a MAC, is done by RARP with the help of a server.

If you tell it with an example (the laptop asking for its gateway), you gain clarity and lose nothing.

Model answer:

Routing is the network-layer function that decides the path of datagrams between networks. It is direct when the destination is on a network the device is connected to: it is delivered without going through any router (the MAC is found with ARP and the frame is sent). It is indirect when the destination is on another network: the datagram is handed to the next router, which decides again. To decide, the routing table is used, which has at least the destination network and the next hop (or “direct”), and usually the mask and a cost too. The router takes the destination IP from the datagram and, row by row, ANDs it with the mask; if the result matches the row’s network, it sends the datagram to its next hop, and if no row matches, it discards it. The 0.0.0.0 row with mask 0.0.0.0 is the default route and goes last. Tables can be static, written by hand and not adapting to changes, or dynamic, built automatically by routers exchanging information every so often.

A worked example (10.200.1.80 AND 255.255.255.0 = 10.200.1.0) shows you have understood it.

Model answer:

Subnets make it possible to use a single network identifier for several physical networks: some of the most significant bits of the host (station) part are used to identify the subnet. From outside it looks like one network, and inside the router shares traffic out among the subnets. The subnet mask has 32 bits: it is 1 in the bits that identify the network (subnet included) and 0 in the ones that identify the host. A bitwise AND between an IP and its mask gives the network it belongs to. For example, the faculty has the network 10.110.0.0 and uses the third byte for the classroom with the mask 255.255.255.0: the laptop 10.110.7.24 is in the subnet 10.110.7.0 (classroom 7) and the printer 10.110.12.5 in 10.110.12.0 (classroom 12), so between them traffic has to go through the router. In each subnet, the address with all host bits at 0 is the network address and the one with them all at 1 is the broadcast address, so 2^h − 2 hosts fit (with 8 host bits, 254).

The definition from the notes is the first two sentences; the example and the calculations are what push the mark up.

Model answer:

Every network has an MTU, the maximum size a frame can carry. If a datagram does not fit in the next network’s MTU, the router splits it into fragments, each with its own IP header. All the fragments carry the same identification; the fragment offset field says which part of the original datagram their data belongs to, and the MF flag is 1 in all of them except the last, which has MF = 0. If the DF flag is 1, the datagram cannot be fragmented. For example, 1400 bytes of data on a network with MTU 620 come out as three fragments of 600, 600 and 200 bytes with offsets 0, 600 and 1200. In TCP/IP, reassembly happens at the destination device. Advantages: each fragment can be routed separately, through different networks, and routers are not overloaded. Disadvantages: it is less efficient and, if a single fragment is lost, the destination cannot rebuild the datagram (the reassembly timer runs out) and the whole datagram is lost.

What people forget most in the exam: saying where reassembly happens and why that is an advantage.