Understanding Networks, Network Adapters and the TCP/IP protocol

PsychoFish

New member
Ok, seems like there is some confusion as to what is what in respects to Network adapters and their settings (and what these settings actually do)

MTU (maximum transmission unit) - Is the size of of the largest protocol data unit that the layer can pass onwards
Protocol Data Unit - Generally this is the TCP packet
TCP (Transmission Control Protocol) - TCP provides reliable, ordered, and error-checked delivery of a stream of octets (data) between applications running on hosts communicating over an IP network
IP (Internet Protocol) - IP has the task of delivering packets from the source host to the destination host solely based on the IP addresses in the packet headers
Header - data placed at the beginning of a block of data being transmitted

Your basic TCP/IP header will contain the following information :
- version, that specifies if it's an IPv4 or IPv6 packet
- Internet Header Length, which is the length of the header
- Type of Service, also referred to as Quality of Service (QoS), which describes what priority the packet should have
- length of the packet in bytes (MTU size)
- identification tag to help reconstruct the packet from several fragments
- Followed by 3 bits. The first contains a zero, followed by a flag that says whether the packet is allowed to be fragmented or not (DF: Don't fragment), and a flag to state whether more fragments of a packet follow (MF: More Fragments)
- fragment offset, a field to identify position of fragment within original packet
- Time to live (TTL), which is the number of hops (router, computer or device along a network) the packet is allowed to pass before it dies
- protocol (TCP, UDP, ICMP, etc.)
- Header Checksum, a number used in error detection
- source IP address
- destination address

Now if you're wondering where you get the destination IP if you're going to say www.mygaming.co.za, you will get that from a DNS (Domain Naming System) server which (in the most simple of terms) keeps records of names and the IP address associated with these names . DNS servers also keep track of other DNS servers. Most commonly your ISP will assign a DNS server to you in one way or another. Their DNS server will keep track of the domains/domain names they own/manage and records of other DNS servers. So if you're asking your ISP's DNS server "What is the IP of www.mygaming.co.za?" it might not know, but it will ask another DNS server, etc until a server comes back with an answer.

Some terms that are thrown about:

Jumbo Frames - This is when the MTU is set to a value higher than the default of 1500 bytes, which means that the packet travelling out of your NIC can contain a bigger payload (data). Most NICs will support a maximum MTU of around 9014.
Flow Control - This is used to ease congestion by stopping either sending or receiving of data while packets are being processed.
TCP offload engine or TOE - technology used in network interface cards (NIC) to offload processing of the entire TCP/IP stack to the network controller. It is primarily used with high-speed network interfaces, such as gigabit Ethernet and 10 Gigabit Ethernet, where processing overhead of the network stack becomes significant. In simple terms, it takes load off your CPU and lets your NIC do it's thing.

Ok, i'm spent for now...will take questions, and will provide answers as soon as possible.
 
Great write-up dude. Thanks for sharing. This is information that I can remember studying at one point in my life, but because I'm not working every day with this type of issues or questions, you kind of forget it all.
 
Ok wow that was a lot to take in...

Could you explain how a VPN works? And what it actually does to an ip address...
 
So our business just came to a stand still for nigh on an hour, someone thought it would be a good idea to change our server machine to enable DHCP. Which then led to BSOD on tcpip.sys until I could get onto the machine and restart it, change the setting over again, restart again which takes about 20min each time.

I can understand and explain why business came to a stand still and why clients lost connectivity. I just can't really explain the BSOD. Only way around I could figure out was to disconnect the LAN in order to get the machine back up to make the changes needed.
 
Ok wow that was a lot to take in...

Could you explain how a VPN works? And what it actually does to an ip address...

in the simplest of terms what VPN does is it ecapsulates private packets into a publicly routable packet (after it's encrypted). The VPN endpoints know the public IPs of each other and will adjust the packet headers accordingly, however the payload is actually still a full packet which still contains the source address and destination address.
 
Today... a little bit about IEEE 802.11

It's WiFi ;-)

We've all seen Wireless NICs and Routers have the little 802.11a, 802.11b, 802.11g, 802.11n, 802.11ac or 802.11ad lablels, but what does that actually mean. WiFi radios; yep, they work just like a radio that can send and receive signals. Commonly operate on one of 3 frequencies (2.4GHz, 5GHz and more recently 60GHz). WiFi channels are defined by offsetting the frequency by a couple of MHz (usually a range of about 20-40GHz variance). WiFi signals can dynamically adjust the stream rate (the rate at which packets are allowed to be sent over the link) in steps. Basically the radios negotiate a stream rate based on signal strength and packet losses. For 802.11a these steps are 6Mbit/s, 9Mbit/s, 12Mbit/s, 18Mbit/s, 24Mbit/s, 36Mbit/s, 48Mbit/s and 54Mbit/s. The biggest difference between 802.11a & 802.11g is that a runs on 5GHz frequency and g runs on 2.4GHz. Another difference is that 802.11a only uses Orthogonal frequency-division multiplexing, whereas 802.11g uses Direct-sequence spread spectrum or Orthogonal frequency-division multiplexing (depending on the equipment). These two factors ultimately determine signal quality over distance. Having said that, with extremely good equipment in optimal conditions you will only get between 35m-38m of coverage.

Hey, you haven't talked about n or ac! Ok, so 802.11n is my favorite WiFi flavour, it is dual band (2.4GHz & 5GHz) with a stream rate between 7.2Mbit/s (which incidentally is 3G speed) and 150Mbit/s (which incidentally is faster than older copper networks). 802.11n and ac both also support multiple-input and multiple-output (MIMO) which allows for more than one stream of data to go to/from a WiFi adapter. This is how 300Mbit/s 802.11n CAN be achieved. Why do I say can? Because BOTH devices need to be MIMO enabled and should have TWO antennas that can operate independently. 802.11n also has greater reach (but don't expect 150Mbit/s throughput 70m from the device).

802.11ac ONLY operates on the 5GHz frequency, BUT has a maximum stream rate of 866.7Mbit/s (yes that is very fast)...however it's range is half of what 802.11n can give.

Ok, that's it for today.
 
So our business just came to a stand still for nigh on an hour, someone thought it would be a good idea to change our server machine to enable DHCP. Which then led to BSOD on tcpip.sys until I could get onto the machine and restart it, change the setting over again, restart again which takes about 20min each time.

I can understand and explain why business came to a stand still and why clients lost connectivity. I just can't really explain the BSOD. Only way around I could figure out was to disconnect the LAN in order to get the machine back up to make the changes needed.

All windows updates installed ?

Also is this a virtual system yet ?

The BSOD is a little worrying, that is a sign of bad drivers or worse a problem in Windows files just waiting to become a crash.
Lastly, DHCP not on the server ?!?!?!?!
 
All windows updates installed ?
Also is this a virtual system yet ?
The BSOD is a little worrying, that is a sign of bad drivers or worse a problem in Windows files just waiting to become a crash.
Lastly, DHCP not on the server ?!?!?!?!

Yes.
Yes.
Yeah, I jot it down to bad drivers. Probably also explains why I get a BSOD on startup, hence having to start up with F8 and selecting Disable Driver Signature Enforcement.
I know right, I dunno what he was thinking.
 
Yes.
Yes.
Yeah, I jot it down to bad drivers. Probably also explains why I get a BSOD on startup, hence having to start up with F8 and selecting Disable Driver Signature Enforcement.
I know right, I dunno what he was thinking.

Could be worse, you could have SBS2011 with Exchange running but having a 3rd party app collecting mail , even running 3 virtual machines inside of it... Sometimes SysAdmins scare the living shit out of me :(
 
Nice info regarding the wifi... we work with 2.4 and 5ghz AP's here quite often, wifi tech is awesome :) have yet to come across 60ghz., as well as me believing that ac was the newest step, not ad. oh well, learn something new everyday :)
 
Nice info regarding the wifi... we work with 2.4 and 5ghz AP's here quite often, wifi tech is awesome :) have yet to come across 60ghz., as well as me believing that ac was the newest step, not ad. oh well, learn something new everyday :)

I use 2.4 ghz with no problems and everything I have seems to support it more than 5 ghz.
 
well yea 2.4 is pretty much the standard. Until this thread I thought 5ghz was a fairly new standard, since smartphones and non-enterprise are only now catering for it.
 
well yea 2.4 is pretty much the standard. Until this thread I thought 5ghz was a fairly new standard, since smartphones and non-enterprise are only now catering for it.

I got my TP-Link especially for the 2.4 ghz so I could make a Nintendo Zone for my 3ds and works quite well :D.
 
How about creating a Virtual Network with your laptop so that you can share your internet with a 3G dongle?

netsh wlan set hostednetwork mode=allow ssid=YourVirtualNetworkName key=YourNetworkPassword
netsh wlan start hostednetwork

My issue is sometimes the internet connection is shared, sometimes it isn't.
 
I don't want this thread to die!!

So, here is a question. Can someone explain the uses and reasons for the different port allocations for network traffic? I know there are hundreds of ports specifically for certain services and functions for both TCP and UDP, but I've always just known what the basics ports were allocated to, but no real understanding of the significance thereof.
 
Back
Top