1

IP over Ethernet
Ethertype FCS Data
Destination
Address
Source Address
6 bytes 6 bytes 2 bytes 46 - 1500 bytes 4 bytes
IP Header Data
IP Packet Field Value
IP Protocol 1 - ICMP
IP Source Address 47.153.217.20
IP Destination Address 47.153.217.23
ICMP Type Echo Request
? ? ?
IP Header
IP Header
Version - The version is a binary number that is four bits long. It indicates which
version of IP is being used. Currently we are using IP version four, although IP
version six will soon make an impact on the networking world.
Total Length - This 16-bit field includes the length of the IP datagram. This
length includes the IP header and also the data itself.
Time to Live - This is often known as TTL. It is a field that indicates how many
hops a data packet should go through before it is discarded. Every successful
pass through a router, known as a hop, decrements this field by one. When it
reaches zero, it is discarded.
Protocol - This 8-bit field indicates which protocol should be used to receive
the data. Some of the more popular protocols such as TCP and UDP are
identified by the numbers 6 and 17 respectively.
Destination IP Address - This 32-bit field holds the IP address of the receiving
computer.
Source IP Address - This 32-bit field holds the IP address of the sending
computer.
Header Checksum - This 16-bit field holds a calculated value that is used to
verify that the header is still valid. Each time a packet travels through a router
this value is recalculated to ensure the header is still indeed valid.



4
Types of IP Flows
Unicast
Flow sent to a single destination
Broadcast
Sent to all devices in network
Indicated by having all 1s in host portion of IP address
eg 47.153.217.255/24
Multicast
Sent to multiple devices that have chosen to receive
that flow
Special IP address range of 224.0.0.0/4
5
Ethernet Switch
PC
Laptop
Server
00-15-60-00-00-01
00-16-6F-00-00-02
00-17-20-00-00-03
Port 1
Port 2
Port 3
Address Resolution Protocol
1 of 4
Used to determine MAC address from an IP address
Ethernet Switch
PC
47.153.217.20
47.153.217.23
Port 1
FF-FF-FF-FF-FF-FF 00-15-60-00-00-01 ARP
Who has IP
47.153.217.23
Source Destination
00-15-60-00-00-01
Port 1
Ether
Type
Ethernet Frame
47.153.217.24
ARP Table
IP Address MAC Address
47.153.217.24 00-16-6F-00-00-02
6
Ethernet Switch
PC
Laptop
Server
00-15-60-00-00-01
00-16-6F-00-00-02
00-17-20-00-00-03
Port 1
Port 2
Port 3
Address Resolution Protocol
2 of 4
Used to determine MAC address from an IP address
Ethernet Switch
PC
47.153.217.20
47.153.217.23
Port 1
FF-FF-FF-FF-FF-FF 00-15-60-00-00-01 ARP
Who has IP
47.153.217.23
Source Destination
00-15-60-00-00-01
Port 1
Ether
Type
47.153.217.24
Not me !
I have it !
7
47.153.217.24
Ethernet Switch
PC
Laptop
Server
00-15-60-00-00-01
00-16-6F-00-00-02
00-17-20-00-00-03
Port 1
Port 2
Port 3
Address Resolution Protocol
3 of 4
Used to determine MAC address from an IP address
Ethernet Switch
PC
47.153.217.20
47.153.217.23
Port 1
00-15-60-00-00-01 00-17-20-00-00-03 ARP
I have IP
47.153.217.23
Source
00-15-60-00-00-01
Port 1
Ether
Type
Destination
8
47.153.217.24
Ethernet Switch
PC
Laptop
Server
00-15-60-00-00-01
00-16-6F-00-00-02
00-17-20-00-00-03
Port 1
Port 2
Port 3
Address Resolution Protocol
4 of 4
Used to determine MAC address from an IP address
Ethernet Switch
PC
47.153.217.20
47.153.217.23
Port 1
00-15-60-00-00-01 00-17-20-00-00-03 ARP
I have IP
47.153.217.23
Source
00-15-60-00-00-01
Port 1
Ether
Type
Destination
OK, IP 47.153.217.23 is
at MAC
00-17-20-00-00-03
9
IP Addressing
IPv4 Addresses are 32 bits or 4 bytes long
Written as 4 decimal numbers separated by . e.g. 10.0.0.1
Internet Assigned Numbers Authority (IANA) allocates IP Addresses.
Certain addresses have special meaning
127.0.0.1 means loopback
255.255.255.255 is broadcast
Originally Classful Addressing: Classes A, B, C, D,
1-126 (Class A)
128 191 (Class B)
192 223 ( Class C)
224- 231 ( Class D)
E.g. Nortel owns an entire Class A subnet, 47.0.0.0/8
Classless Inter-Domain Routing (CIDR)
Subsequently Classless Addressing: Subnetting as required
Allows much more flexibility in management of addresses space
Reserved private IP Addresses
10.0.0.0 10.255.255.255 (or 10.0.0.0/8)
172.16.0.0 172.31.255.255 (or 172.16.0.0/12)
192.168.0.0 192.168.255.255 (or 192.168.0.0/16)

10
IP Address Network mask
Divides the IP Address into a network portion
and a host portion.
47.153.217.1/24
0010 1111 . 1001 1001 . 1101 1001 . 0000 0001
Number of bits in network mask
IP Address in binary
Network Address Host Address
11
IP Address Network mask
Mask can be represented as
the number of bits, eg /24
dotted decimal like an IP address, eg 255.255.255.0

47.153.217.1/24
0010 1111 . 1001 1001 . 1101 1001 . 0000 0001
Number of bits in network mask
1111 1111 . 1111 1111 . 1111 1111 . 0000 0000
network mask
in binary
Notation
255.255.255.0
network mask
in decimal
Troubleshooting a Classful network
20.20.20.20/8
Subnet Mask : 255.0.0.0
Network : 20.0.0.0
Hosts : 20.0.0.0 20.255.255.255
Broadcast Id : 20.255.255.255
Number of Hosts : ( 2 ~ n 2 )
Where n = number of hosts bit
Troubleshooting a Classless Network
(CIDR) : Helps saving IP addresses
192.168.100.1/26 ( Subnetwork in Class C
network)
Last Octet decimal ( 11000000) = 192
Subnet Mask : 255.255.255.192
Number of Subnetworks : ( 2 ~ N -2)
(2 ~ 2 2 ) = 2 subnetworks
Number of Hosts per subnetwork = 2 ~ 6
2=62 hosts per subnetwork
Troubleshooting a Classless Network
(CIDR)
256 192 = 64 is the size of each subnetwork
Subnetworks are :
192.168.100.64 subnetwork ID
Hosts : 192.168.100.65 126
Broadcast IP : 192.168.100.127
192.168.100.128 subnetwork ID
Hosts : 192.168.100.129 190
Bdcst IP : 192.168.100.191

15
IP Routing
Send IP packet to appropriate interface based
on the destination address in that packet
47.153.217.1/24
202.15.5.1/24
47.153.218.1/24
IP Router
Interface eth0
Interface eth2
Interface eth1
16
IP Routing
Routing table is used to determine
where to send packet.
Router learns directly connected
routes by itself.
Router learns other network
routes via Static or Dynamic
routing protocols.
Routing Table
Destination Network Interface
202.15.5.0/24 Eth0
47.153.217.0/24 Eth1
47.153.218.0/24 Eth2
Routing Table
47.153.217.1/24
202.15.5.1/24
47.153.218.1/24
IP Router
Interface eth0
Interface eth2
Interface eth1
17
IP Router
IP Packet Routing
47.153.217.23
47.153.218.20

Eth0
Eth2
Eth1
Source IP Destination IP
1
2
Destination
Network
Interface
202.15.5.0/24 Eth0
47.153.217.0/24 Eth1
47.153.218.0/24 Eth2
IP Routing
Switching Function of Router is the process
used by a router to switch a packet from an
incoming interface to an outgoing interface on
the same router
A packet received by a router will do the following:
Strips off layer 2 headers
Examines destination IP address located in Layer 3
header to find best route to destination
Re-encapsulates layer 3 packet into layer 2 frame
Forwards frame out exit interface

19
Types of IP Routes
Static
IP routes that are configured in a router or device
and do not change
Typically used in end devices PC
Dynamic
IP routes that change based on network
connectivity
Typically used in routers
Volatility
Router Paths and Packet Switching
As a packet travels from one networking device to another
The Source and Destination IP addresses NEVER
change
The Source & Destination MAC addresses CHANGE
as packet is forwarded from one router to the next
TTL field decrement by one until a value of zero is
reached at which point router discards packet
(prevents packets from endlessly traversing the
network)
Router Paths and Packet Switching
Router Paths and Packet Switching
Path determination and switching function
details. PC1 wants to send something to PC 2.
Step 1 - PC1 encapsulates packet into a frame -
frame contains R1s destination MAC address

Router Paths and Packet Switching
Step 2 - R1 receives Ethernet frame
R1 sees that destination MAC address matches
its own MAC
R1 then strips off Ethernet frame
R1 Examines destination IP
R1 consults routing table looking for destination
IP
After finding destination IP in routing table, R1
now looks up next hop IP address
R1 re-encapsulates IP packet with a new
Ethernet frame
R1 forwards Ethernet packet out Fa0/1 interface
Router Paths and Packet Switching
Router Paths and Packet Switching
Step 3 - Packet arrives at R2
R2 receives Ethernet frame
R2 sees that destination MAC address matches its own MAC
R2 then strips off Ethernet frame
R2 Examines destination IP
R2 consults routing table looking for destination IP
After finding destination IP in routing table, R2 now looks up next hop IP
address
R2 re-encapsulates IP packet with a new data link frame
R2 forwards Ethernet packet out S0/0 interface
Router Paths and Packet Switching
Step 4 - Packet arrives at R3
R3 receives PPP frame
R3 then strips off PPP frame
R3 Examines destination IP
R3 consults routing table looking for destination IP
After finding destination IP in routing table, R3 is directly connected to
destination via its fast Ethernet interface
R3 re-encapsulates IP packet with a new Ethernet frame
R3 forwards Ethernet packet out Fa0/0 interface
Step 5 - IP packet arrives at PC2 - frame is dencapsulated and processed by upper
layer protocols
Summary
Routers determine a packets path to its destination by
the following:
Receiving an encapsulated frame & examining destination
MAC address.
If the MAC address matches then Frame is de-encapsulated
so that router can examine the destination IP address.
If destination IP address is in routing table or there is a
static route then Router determines next hop IP address.
Router will re-encapsulate packet with appropriate layer 2
frame and send it out to next destination.
Process continues until packet reaches destination.
Note - only the MAC addresses will change the source and
destination IP addresses do not change.

How Trace Route Works: TTLs

Trace Route works by setting the TTL for a ICMP
Echo Request packet to 1, sending it towards the
requested destination host, and listening for the
ICMP Echo reply. When the initiating machine
receives a "time exceeded" response, it examines
the packet to determine where the packet came
from - this identifies the machine one hop away.
Then the tracing machine generates a new packet
with TTL 2, and uses the response to determine
the machine 2 hops away, and so on.