How a message travels¶

Exercise how-a-message-travels-annex.pdf · PDF

Send "ok" by WhatsApp to the classmate sitting next to you. It arrives in under a second. In Unit 1 you saw that it did not jump that one metre: it went out to the Internet and came back. So what exactly travelled? And who read what on the way?

Units 1 and 2 were about one computer. From now on, the computer stops being alone. Over the next weeks your group will build a small company network with a real router. Every setting you will type there belongs to one of the layers you meet on this page.

What you will learn

Name the four layers of the TCP/IP model and the seven of the OSI model, and match them
Say which problem each layer solves, with one protocol and one address per layer
Explain encapsulation: each layer wraps the data from above in its own header
Say which layers a switch and a router read
Find the link, internet and ICMP parts in one real line of tcpdump
Why a router does not read your message, and why ping has no port

One message, five problems¶

If you were the engineer, what would you have to solve so that "ok" arrives? Write the problems from the bottom (the cable) to the top (the app):

#	Problem	Who solves it
1	Turn bits into a signal on a cable or in the air	The cable, the radio, the NIC
2	Reach the next device on the same network	Ethernet or Wi-Fi, with a MAC address
3	Cross many networks to the right computer in the world	IP, with an IP address, and routers
4	Inside that computer, give it to the right program, complete and in order	TCP or UDP, with a port
5	Agree on what the message means	The app's own protocol: HTTP, DNS...

Each line is a layer.

A layer is a group of protocols that solves one problem and trusts the layer below for the rest.

Remember from Networks: a protocol is an agreement on how to talk. Here is the new idea: there is not one protocol, there is a stack of them, one on top of the other.

The postal analogy (we keep it for the whole unit)

You write a letter (5). You put it in an envelope with a person's name (4). That goes inside an envelope with a street address (3). The postman of your street carries it to the next building (2), along a road (1). Nobody on the way needs to read the letter.

Careful: the Internet is not one big program

It is a stack of independent protocols. That is why the same web page works over Wi-Fi, a cable or 5G: only the lowest layers change. Everything above them stays the same.

Two models: TCP/IP and OSI¶

The five lines have official names. There are two models, and you need both.

OSI #	OSI layer	TCP/IP layer	Unit of data	Address
7	Application	Application	data / message	a name: `debian.org`
6	Presentation	Application	data / message
5	Session	Application	data / message
4	Transport	Transport	segment (TCP) / datagram (UDP)	port: 443
3	Network	Internet	packet	IP address
2	Data link	Link	frame	MAC address
1	Physical	Link	bits	—

flowchart TB
    subgraph TCPIP ["TCP/IP: 4 layers (what your computer runs)"]
        direction TB
        A["<b>Application</b><br>the letter: HTTP, DNS"]
        T["<b>Transport</b><br>the name on the envelope: port"]
        I["<b>Internet</b><br>the street address: IP"]
        L["<b>Link</b><br>the postman of your street: MAC"]
        A --> T --> I --> L
    end

Two stories¶

TCP/IP. Vint Cerf and Bob Kahn published the design in May 1974. On 1 January 1983 the ARPANET, the ancestor of the Internet, switched to it in one single day. Its four layers (link, internet, transport, application) are written down in RFC 1122 (October 1989). An RFC is one of the public documents where the Internet's rules are written. TCP/IP is what your computer runs.
OSI. A standard of the ISO (ISO 7498), published in 1984, with seven layers. Its own protocols lost the battle; its vocabulary won. When a technician says "a layer 2 problem" or "a layer 3 switch", those numbers are OSI numbers.

A trick to remember OSI, bottom to top: Please Do Not Throw Sausage Pizza Away (Physical, Data link, Network, Transport, Session, Presentation, Application).

Careful: OSI is not what the Internet uses

The Internet runs TCP/IP, with four layers. OSI gave us the names and the numbers. And an honest warning: real apps do not always respect seven tidy layers. The model is a map, not the territory. But it is the map every network technician uses to say where a problem is.

Encapsulation: envelopes inside envelopes¶

Encapsulation is what happens when each layer, going down, adds its own header in front of the data it received from the layer above.

A header is a small block of control information: addresses, numbers, flags. It is the writing on the outside of an envelope. Watch the message grow as it goes down the sender's stack:

                                   [ data "ok" ]        application
                       [ TCP hdr | data "ok" ]          transport   segment
              [ IP hdr | TCP hdr | data "ok" ]          internet    packet
[ Ethernet hdr | IP hdr | TCP hdr | data "ok" | FCS ]   link        frame

The link layer also adds a small tail, the FCS: a checksum to detect bits damaged on the cable. On the receiving computer, the opposite happens: each layer, going up, removes its own header and passes the rest upwards. That is decapsulation.

Who reads what on the way¶

Between your PC and the destination there are devices. They do not open every envelope.

A switch reads only the Ethernet header (the outer envelope, MAC addresses).
A router removes the Ethernet header, reads the IP header, and builds a new Ethernet header for the next network.

flowchart LR
    subgraph S ["Sender PC"]
        SA["App: 'ok'"] --> ST["+ TCP header"] --> SI["+ IP header"] --> SL["+ Ethernet header"]
    end
    SL -->|"frame"| SW["<b>Switch</b><br>reads the MAC<br>(outer envelope)"]
    SW -->|"same frame"| R["<b>Router</b><br>reads the IP,<br>writes a new outer envelope"]
    R -->|"new frame,<br>same packet"| D["<b>Receiver PC</b><br>opens the envelopes<br>bottom to top"]

In the classroom you will act this out with real envelopes: one student per layer, a "switch" and a "router" in the middle. Ask yourself three questions afterwards. Who read the message? Only the two application students. Which envelope changed on the way? The outer one. Which never changed? The IP one: the same addresses from end to end.

Careful: the IP address does not change at each router

The IP addresses stay the same from end to end (there is one exception, NAT, later in the unit). The MAC addresses change at every hop, because each router writes a new outer envelope. And a router works on the IP header only: it does not read your message. Whether somebody could read it is about encryption, also later in the unit.

Lab: the layers in one ping¶

Time to see the envelopes for real. In this unit you use containerlab: a tool that starts small Linux machines as containers (lightweight isolated machines) and cables them exactly as written in a text file. The file lan.clab.yml (on Google Classroom) describes three PCs on one switch, with addresses from your group's plan 10.G.0.0/24. G is your group number, from 1 to 8. Nothing touches the school network.

Start the lab¶

Put the file in a folder ~/labs, open two terminals there, and replace 3 with your group number:

G=3 containerlab deploy -t lan.clab.yml       # 3 = your group number
docker exec -it clab-lan-pc1 bash             # terminal 1: you are now inside pc1
docker exec -it clab-lan-pc2 bash             # terminal 2: you are now inside pc2
ip -br addr                                   # in each one

The prompt changes to root@pc1 and root@pc2. The address of eth1 starts with 10. and your group number.

One ping, three layers¶

Ping sends a tiny "are you there?" message and waits for the answer. It uses ICMP, a helper protocol of the internet layer. tcpdump is a program that prints every message passing through a network card. Start it on pc2 first (it waits for two messages), then ping from pc1:

tcpdump -e -n -v -c 2 -i eth1 icmp            # on pc2
ping -c 1 10.G.0.12                           # on pc1 (G = your group)

pc2 prints something like this (for group 1; your MAC addresses will be different, they are random in every lab):

20:55:42.791097 46:62:c0:ea:cd:fc > 1a:0d:d5:0a:2b:81, ethertype IPv4 (0x0800), length 98:
  (tos 0x0, ttl 64, id 36908, offset 0, flags [DF], proto ICMP (1), length 84)
    10.1.0.11 > 10.1.0.12: ICMP echo request, id 110, seq 1, length 64
20:55:42.791103 1a:0d:d5:0a:2b:81 > 46:62:c0:ea:cd:fc, ethertype IPv4 (0x0800), length 98:
  (tos 0x0, ttl 64, id 39833, offset 0, flags [none], proto ICMP (1), length 84)
    10.1.0.12 > 10.1.0.11: ICMP echo reply, id 110, seq 1, length 64

Read the first message, layer by layer:

Layer	What to look for	In the sample
Link	Source MAC `>` destination MAC, and `ethertype`	`46:62:…:fc > 1a:0d:…:81`, IPv4 (0x0800)
Internet	Source IP `>` destination IP, `ttl`, `proto`	`10.1.0.11 > 10.1.0.12`, 64, ICMP (1)
Above IP	The message itself	ICMP echo request, then echo reply
Sizes	Frame minus packet	98 − 84 = 14 bytes of Ethernet header

The second message is the reply: source and destination are swapped.

Careful: ping does not use a port

Look for a port in that output: there is none. ICMP travels directly inside IP, with no transport layer. Ports belong to TCP and UDP, which you meet later in the unit.

Extra: read the raw bytes¶

tcpdump -e -n -XX -c 1 -i eth1 icmp           # on pc2
ping -c 1 -s 16 10.G.0.12                     # on pc1

0x0000:  1a0d d50a 2b81 4662 c0ea cdfc 0800 4500  ....+.Fb......E.
0x0010:  002c 9e2d 4000 4001 888b 0a01 000b 0a01  .,.-@.@.........

The first 6 bytes are the destination MAC, the next 6 the source MAC, then 0800 (IPv4). In the second line, 0a01 000b is the source IP in hexadecimal: 0a = 10, 01 = 1, 00 = 0, 0b = 11, so 10.1.0.11. The hex from Binary pays off.

Where people get stuck¶

permission denied on deploy: your user is not in the docker and clab_admins groups. Ask the teacher.
You typed ping in the terminal where tcpdump waits. Read the prompt: root@pc1 or root@pc2.
tcpdump shows nothing: wrong interface. eth0 is containerlab's management cable; the lab cable is eth1.

Clean up¶

exit                                          # in both terminals
containerlab destroy -t lan.clab.yml --cleanup

When docker ps shows no container whose name starts with clab-lan, the lab is gone.

Key takeaways¶

A layer solves one problem and trusts the layer below. TCP/IP has four: link, internet, transport, application. OSI has seven and gives us the numbers ("layer 2", "layer 3").
Each layer has its own unit and address: frame + MAC address (link), packet + IP address (internet), segment + port (transport).
Encapsulation: going down, each layer adds its header in front; going up, decapsulation removes them.
A switch reads only the Ethernet header. A router reads the IP header and writes a new Ethernet header for the next network.
IP addresses stay the same end to end; MAC addresses change at every hop.
containerlab builds the unit's labs from a text file; tcpdump shows every header of a real message.

Quick check¶

1. Which header does a router read to decide where a message goes next?

The Ethernet header
The IP header
The TCP header
The application data

A router works at the internet layer (OSI layer 3): it reads the IP header, then builds a new Ethernet header for the next network. It never needs to read the message itself.

2. What is a frame?

The unit of data of the transport layer
Another word for an IP packet
The unit of the link layer, with a packet inside
The electrical signal on the cable

A frame is what the link layer sends: an Ethernet header, the packet inside, and the FCS checksum at the end. The transport layer's unit is the segment.

3. What does encapsulation mean?

Each layer adds its own header in front of the data from the layer above
The message is encrypted so nobody can read it
The message is cut into seven equal parts
Every router on the way adds one more header

Encapsulation is the envelope inside an envelope: application data, then a TCP header, then an IP header, then an Ethernet header. It has nothing to do with encryption.

4. Which list gives the four TCP/IP layers from bottom to top?

Physical, link, network, transport
Link, transport, internet, application
Internet, link, transport, application
Link, internet, transport, application

Link (next device, MAC), internet (across networks, IP), transport (the right program, port), application (the meaning). Physical, network and the other names are OSI vocabulary.

5. In the envelope relay, which envelope did the router replace?

The outer one, with the MAC addresses
The middle one, with the IP addresses
The smallest one, with the ports
None, it delivered the whole package unchanged

The router removes the Ethernet header (outer envelope) and writes a new one for the next network. The IP addresses stay the same from end to end.

6. Why does the tcpdump output of a ping show no port number?

Because tcpdump hides ports unless you ask for them
Because ICMP travels directly inside IP, with no transport layer
Because the two PCs are on the same switch
Because ping always uses port 0

Ping uses ICMP, a helper of the internet layer that rides directly in the IP packet. Ports belong to TCP and UDP, at the transport layer.

7. You watch a video on YouTube over your home Wi-Fi. Select the two that are true.

The Wi-Fi radio signal and the frame belong to the link layer
The IP addresses in the packets stay the same across every router on the way
Every router on the way reads the video data to decide where to send it
The MAC address of your phone travels all the way to YouTube's server

Radio and frames are the link layer. Routers read only the IP header, and the IP addresses stay end to end. MAC addresses are local: each router writes a new outer envelope, so your MAC stops at the first router.

Next: how does the switch know which door each MAC address lives behind? Ethernet, MAC addresses and switching.