Random Network+ Question #8

Discussion in 'Network+' started by Mitzs, May 29, 2005.

  1. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    "Because addressing is a Network layer concept, the protocols that deal with addressing can be found at this layer. The address resolution protocol (ARP) is responable for resolving an IP address to the Mac address of the receiving host."
    David groth Network + Studyguide page 87
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS
  2. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    ok one more clue.
    It is native to MS networks.
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS
  3. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    Well MAC addresses are all layer 2, and they are addressing, I think the source is refering primarily to Logical addressiong (IP/IPX) not Physical addressing

    Whilst ARP does make use of IP in its mapping, its sends out MAC addressed packets not IP ones, and uses its own tables to maintain the relationship
    thus making it a Layer 2 protocol

    So not sure what the whole excerpt says, but may be worth contacting the publisher ;)


    Hmm, cant believe I didnt think of it before
    Netbios is a MS Native, non routable connectionless protocol
    but theres some debate as to what layer it operates, lol, sources claim from 2 to 5, so im not holding my breath
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  4. mrobinson52

    mrobinson52 Security Maven Gold Member

    194
    9
    74
    Ethernet
    is a protocol that operates at the MAC layer, which is one of the two Data Link Layers, along with the Logical Link Control Layer

    This better be right or someone gets sent to bed without dinner! :D
     
    Certifications: A+, Network+, MCSA:Security, Security+
    WIP: CISSP
  5. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    Already been there, it was wrong :)
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  6. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    sorry mom it is not ethernet either. If I'm wrong than you better contact sybex and tell them you want a refund on my old network book. Do you think they will? It been falling apart for ages I have used it so much. :biggrin
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS
  7. tripwire45
    Honorary Member

    tripwire45 Zettabyte Poster

    13,493
    180
    287
    How much time do we have to get the answer sorted, mitzs?
     
    Certifications: A+ and Network+
  8. punkboy101
    Honorary Member

    punkboy101 Back from the wilderness

    942
    2
    62
    I'm with ryan on this, I think it is NetBios. Non routable (layer3), but will cross a bridge (layer2).

    Come on Mitz, don't keep us in suspence, what is it?
     
    Certifications: CCNA
    WIP: Nada
  9. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    I'm sorry I don't agree with you here Phoenix. Arp works with both IP and Macs. It is a translator so to speak. It is resloving addressing issues between the IP and Mac. That is a network layer.
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS
  10. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    I said I would post it on tuesday. :)
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS
  11. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    actually PB im very unsure as to the answer at present, ive spent the better part of the last 2 hours researching the netbios and netbeui protocol lol, and netbios doesnt operate at layer 2
    however netbeui isnt really a protocol, its based on a series of extensions to the Netbios protocol, meaning theres no actual RFC for it for me to research, and web based info is sketchy at best beng im getting level ranges from 3 - 5 :)

    I am pretty sure about the ARP one though, and I have poured through the RFC to make sure

    Packet format:
    --------------

    To communicate mappings from <protocol, address> pairs to 48.bit
    Ethernet addresses, a packet format that embodies the Address
    Resolution protocol is needed. The format of the packet follows.

    Ethernet transmission layer (not necessarily accessible to
    the user):
    48.bit: Ethernet address of destination
    48.bit: Ethernet address of sender
    16.bit: Protocol type = ether_type$ADDRESS_RESOLUTION
    Ethernet packet data:
    16.bit: (ar$hrd) Hardware address space (e.g., Ethernet,
    Packet Radio Net.)
    16.bit: (ar$pro) Protocol address space. For Ethernet
    hardware, this is from the set of type
    fields ether_typ$<protocol>.
    8.bit: (ar$hln) byte length of each hardware address
    8.bit: (ar$pln) byte length of each protocol address
    16.bit: (ar$op) opcode (ares_op$REQUEST | ares_op$REPLY)
    nbytes: (ar$sha) Hardware address of sender of this
    packet, n from the ar$hln field.
    mbytes: (ar$spa) Protocol address of sender of this
    packet, m from the ar$pln field.
    nbytes: (ar$tha) Hardware address of target of this
    packet (if known).
    mbytes: (ar$tpa) Protocol address of target.

    As you can see the packet is a Layer 2 packet using 48 bit mac addresses, not a layer 3 packet
    im also trying to get hold of an ethereal packet capture to show you all

    The full RFC is availble at http://www.ietf.org/rfc/rfc0826.txt?number=826 for those of you who really want to read it :)

    Mitz, you seem to be confusing the fact that just because a protocol/packet can contain certain data not of its layer, it doesnt mean it operates at that perticular layer, as ive said, ARP contains IP addresses only as variables in the data portion of the packet, it is not a layer 3 packet, it is not reliant on IP (infact it is used to resolve IPX to MAC, as well as many other protocols to MAC addresses)
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  12. tripwire45
    Honorary Member

    tripwire45 Zettabyte Poster

    13,493
    180
    287
    Drumroll please. :wink:

    Time to make sure all your ducks are in a row, Mitzs.
     
    Certifications: A+ and Network+
  13. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    Here is an ethereal capture
    as you can see
    the addressing data stops at ETHERNET II, and continues onto protocol specific data (ie the ARP packet)

    this concludes that this is indeed a layer 2 protocol, I will shortly show a packet that involves layer 3 addressing to highlight the difference

    [​IMG]


    Here below we find a DNS packet
    and as you can see there are extra encapsulation layers of both IP followed by UDP before we get to the protocol specific data
    [​IMG]
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  14. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    Yes but Phoenix ARP is maping between the IP and Macs.

    http://routergod.com/ccnabootcamp/osi.html
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS
  15. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    No Mitz
    ARP is predominantly MAC to IP
    it was infact designed to resolve MACs to any higher layer protocol
    atleast, any that supported its requests, as at the time of its inception there were many more competing protocols in use, where as now we see IP has taken its de facto stance in the industry

    please read the above RFC for a full protocol breakdown and its intended use

    you may be thinking of RARP or Reverse ARP, which is used by routers to find IP addresses of hosts based on MAC (it broadcasts at layer 3 and asks for a specific mac addresses to respond),this is so it knows where to route, it doesnt need to know a MAC address as a switch would handle this

    ARP broadcasts at layer 2 and asks for a specific IP addresse to resond, this is used by a host, as its on the same segment as many nodes generally

    as displayed by the above packet capture

    I especially like this bit

    This is done using ARP or Address Resolution Protocol. The router sends out a broadcast on the subnet saying "which one of you guys is using IP address such and such?". Since it is a broadcast, all hosts on the subnet hear the router ask this question, every host checks its IP configuration to see if it is the host the router's asking about. The host that has to IP address in question, responds to the router with it's MAC address

    Ok if its sending out an IP broadcast asking who has an IP somethings wrong and getting a MAC in return somethings not quite right, it needs to be asking a group of IPs who has this MAC and get a MAC in return, this is RARP

    otherwise its broadcasting to a bunch of MACs asking who has which IP and getting an IP in response (me! its me! im that IP!!!!)

    whilst i trust the majority of internet sources, I'm not really going to take one over an RFC and a packet capture as conclusive evidence

    A Breakdown of the above ARP packet for those interested
    a 60 byte frame was picked up on the wire at 01:51:16.blahblah on May 31st 2005
    The frame number was 12
    and it was an arp packet encapsulated in an ethernet frame
    then are the frame specific details (layer 2)
    Source mac was 00:01:4e:00:c4:87 sent to ALL hosts on the segment (dst: ff:ff:ff:ff:ff:ff:ff)
    Type was ARP
    Trailer was padded
    then the protocol data
    it was an ARP Request
    for an Ethernet network, looking for an IP address
    it was sent from 00:01:4e:00:c4:87 (which has an IP of 192.168.2.20, which is protocol data not addressing information)
    it was broadcast to ALL nodes on the segment via a layer 2 broadcast (ff:ff:ff:ff:ff:ff)
    it was looking for a computer with the IP address of 192.168.2.180)
    and only that machine should respond
    with its MAC address

    Thus ARP has determined that 192.168.2.180 is whichever node responded with its MAC and can match them in its ARP table
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  16. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    No phoenix. :D I'm having fun.

    ARP is responable for resolving an IP to a mac address receiving host. Therefore it must talk with the ip first to even receive such a quest. I think it spends = time between the two. :biggrin
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS
  17. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    I'm sorry ryan i"m not understanding this. All this proves is that the mac is on layer 2. Where does it say the ARP is resolving at layer 2?
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS
  18. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    unfortunatly mitz ARP spends no time at the above layers, as depicted by the packet capture
    i can post the response of the ARP request if you want, but its pretty similar

    Talking with IP? ofcourse it talks with above protocols, but it does not operate at those layers, the other protocols do!
    ARP is a layer 2 protocol that operates at layer 2 on behalf of higher layer protocols, this is the very essence of the OSI model

    IP doesnt need to know about MACS, but an Ethernet Card needs to know where the hell to send the IP packet it just encapsulated, ARP accomplishes this
    but it is independant of IP/IPX/Any other protocol using ARP for resolution
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  19. Phoenix
    Honorary Member

    Phoenix 53656e696f7220 4d6f64

    5,749
    200
    246
    Heres a bit of an encapsulation overview for our members new to networking to follow along

    IP is a layer 3 protocol, it works on 32bit IP address (displayed as 4x 8 bit blocks, or octets)
    however Ethernet cards nativly use 48bit MAC addresses, and operate at layer 2 (and eventually 1)

    So heres a quick scenario

    IP packages up his/her data from above, TCP, SMB, all the way up to that mp3 file your trying to copy to your laptop, it all gets packeged up by IP, at Layer 3, it stamps it with a source and destination address, however this is in its native tounge of IP, which as we know is a 32 bit octec, shoves it in the post box and passes it down to layer 2 to carry on

    Layer 2 picks it up and goes 'blimey, what the hell is he playing at, what sort of address is this? i cant read that gibberish, so he gets out his megaphone and goes 'alright you bunch o twits, who the hell is <gibberish 32bit ip address>, one lucky node blushes and responds 'sorry guv, thats me, must of been mislabled, wont happen again' so the network card adds the new mac address, and drops it onto the line, whilst also making a note that <node1 = gibberish32bit address1>

    next time node 1 sees the dodgy gibberish address he knows exactly who to blame, and who to send the package too


    its a bit lamens terms, ill try tidy it up if its still confusing, its 3am :(
     
    Certifications: MCSE, MCITP, VCP
    WIP: > 0
  20. Mitzs
    Honorary Member

    Mitzs Ducktape Goddess

    3,286
    85
    152
    ok you have raised enough doubts in me about arp that I'm going to research it more. At this point I'm not sure who is right. Go to bed phoenix. I need you to be rested up in case it turns out that I'm right. :biggrin
     
    Certifications: Microcomputers and network specialist.
    WIP: Adobe DW, PS

Share This Page

Loading...
  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.