James's TCP/IP FAQ - Understanding Network Hardware

This is the third page of a 3 part FAQ on TCP/IP basics. Here is the list of parts (I recommend that they be read in order):

Introduction

In the first two parts of this primer, I talked about IP addressing and routing, and network application port numbers. That may be all the information you need. But if you're interested in learning about how to share an Internet connection, there may be some terms that are new to you (or you may have heard them but not understood what they mean). I will start with some slightly more advanced information about routing - then we'll describe the hardware.

A Little More About Routing

Earlier I talked about routing on an IP network using IP addresses, subnet masks, and router addresses. That all happens at the "network layer" but there are layers below that which come into play. Mainly, the "data link" layer specifies how machine put information on the wire and how they take it in for processing. Just as we use IP addresses to identify computers on an IP network, we also use Media Access Control addresses (MAC) to identify the actual hardware interface of each device on the network.

It's not just a case of every computer having an address - every network interface must have a unique MAC address. And unlike IP addresses which people can easily configure at will, MAC addresses are generally "burned into" the device by the manufacturer. With few exceptions, a MAC address is permanent and unique. The nice part of all this is that human beings rarely need to concern themselves with knowing MAC addresses - they are used by underlying layers of protocol stacks and we are insulated from having to deal with them directly.

Here's an example: Your machine has IP address 192.168.1.1. You want to send information to a machine with IP address 192.168.1.2. Your subnet mask of 255.255.255.0 tells you that your computer is on the same local network segment as the other. Your computer then sends out what is called an Address Resolution Protocol broadcast (ARP) asking for the MAC address of the computer with IP address 192.168.1.2 (and you include your own MAC address in the request). Every machine on the local network sees the broadcast. The machine that "owns" the IP address 192.168.1.2 will send its MAC address back to your machine. Your machine will then formulate a packet containing your own MAC as the source MAC address and the destination computer's MAC address as well (the packet will also still have to show the source and destination IP addresses and port numbers - the MAC addresses are just additional information that has to be there). Even if you are on some type of shared network media, no other machines will bother to accept the packet, because the MAC address will identify the specific machine that should deal with it.

If the destination computer is not on the local subnet (as defined by the IP address and subnet mask), your computer will do one of two things. If you have a route statement configured (such as a default gateway setting), your computer will send a directed ARP request to the router asking for the MAC address of the router's interface on the local network. Once you have retrieved that, you send the packet directly to the router. If you don't have a specific or default route to a router that can carry the traffic, you go back to the broadcast method - sometimes a router can still answer with its MAC address if it is configured to do something called "proxy arp."

Now what was the point of all that? Simply that from the standpoint of the hardware, routing happens at the data link layer using MAC addresses. IP addresses are things that can be configured, changed, etc. - but MAC addresses are fixed and unique.

And now, the hardware...

Hubs

A hub is a passive network appliance that shares all incoming packets with every attached device, creating a common network segment. Basically, it is usually a small box with a bunch of network ports where you can plug in computers or other network devices. There is a common wiring bus that connects all those ports together. Whenever a packet is sent by any computer or device on the hub, every other computer or device "sees" the packet. The only thing that keeps everything straight is MAC addresses - computers ignore packets unless the MAC address matches their own.

Advantages of hubs are that they are cheap and simple. You can get an 8 port unit for well under $50, and there is literally no configuration to do - just plug in your computers and go. Hubs can be "daisy-chained" together to get additional ports on the local network segment as well, providing cheap and easy expansion to an existing segment. The main disadvantage of a hub is that with every packet being seen by every device, there is an increased chance of collisions (when two machines try to talk at once on the network). A few collisions aren't a problem since the computers can retransmit data if needed, but over a certain threshold they begin to degrade performance.

Switches

A switch is an active, intelligent network appliance that creates a common network segment, but which segregates attached devices into separate collision domains. Think of a hub that actually routes packets only to the machines that are supposed to see them - that's a switch. A switch usually makes use of MAC addresses to figure out where to send the packets.

Advantages of switches are that they tend to prevent collisions, allowing network traffic to be driven at substantially higher rates. Disadvantages are that switches are more expensive, and require configuration making them more complex.

Routers

Hubs and switches provide for a local network segment. A router is a device that actually connects two networks together. A router will have multiple network interfaces, at least two - each network interface will have an IP address and subnet mask making it part of the network where it is plugged in. Generally, each of a router's network interfaces will be plugged into a hub or switch.

Routers accept incoming packets from an interface, and then make decisions about where to forward them. Those decisions are made based on routing "tables" which are just basic text lists of routes. A router will often have a default route (just like the default gateway setting on a computer) that tells it where to send packets destined for a network where it doesn't have a specific route.

There's really no sense in talking about the pros and cons of routers - they are what they are. If you need to connect two or more networks together, a router is a must. However, you might be interested to know that a router does not have to be a "black box" network appliance - it could simply be a computer with multiple network cards and some routing software. Windows NT and most versions of Unix (including Linux) include routing functions, and those functions can be added to most other operating systems like Windows 95/98.

Routers can do more than just route - they can do filtering based on source and destination IP addresses and port numbers, blocking all traffic except what you decide to allow (or allowing all but the traffic you decide to block). This is the basic principle behind a firewall. And many routers can do Network Address and Port Translation (NAT, PAT, NAPT) allowing a router to "hide" the real addresses and port numbers of the computers on one side of the router from the network on the other side. This can be useful both for security and for sharing a connection to the Internet.

Firewalls

As mentioned above, a firewall is basically a router with the ability to filter traffic based on IP addresses and port numbers. The kinds of firewalls used in corporations tend to be special purpose devices that are not used as normal routers and have more capabilities than simple packet filtering. But most any router can act as a basic firewall, and there is even software available for home use on a single machine to "firewall" the traffic coming in and out of the computer.

Bridges

I almost didn't mention bridges because they are pretty rare, especially in small networks such as in the home. A bridge is simply a device that extends a local network segment over some kind of intervening link (like a wide area link or an ATM network). Simply put, you can have a computer across town with an IP address and subnet mask that makes it part of a local network segment, even though that computer is not directly plugged into the local hub or switch.

I mention bridges here because that is the basic functionality provided by the type of "ADSL modem" used with TDS Telecom's local ADSL service. Your computer gets an IP address on the TDS local network segment, and the ADSL device acts as a bridge to connect your machine to their network.