Find us on Google+ Bypass The Security: Journey of IP Packet

Sunday 28 September 2014

Journey of IP Packet

The Journey of An IP Packet in a Local Network


THE JOURNEY OF AN IP PACKET IN A LOCAL NETWORK
This is a good time now to discuss what exactly happens in journey of an IP packet, typically we can say
what happens when we PING an IP Address, or in a Network Communication process. In this Post, we
are going to discuss what happens in a Locally in Local Network.

Lets say Bob and Sally, they are sitting in a company, and both of them are connected to the same network, or same broadcast domain.
Lets say Bob’s PC has an IP address 10.0.0.5/8 and Sally has got 10.0.0.10/8. Both of them are in the same network, connected by a Switch, and Bob sitting in his own cabin tried to ping Sally who is her own different cabin, so Bob opened up his command prompt and typed C:\ping 10.0.0.10
Now lets see what happens in this ping process…

1.     When Bob pinged, ICMP creates an echo request payload.
2.     ICMP hands that payload to IP, which creates a packet. This packet contains Source IP Address,Destination IP address and a protocol field, which tells the receiving host whom it should hand the payload to, in this case ICMP.
3.     Once the packet is created, IP determines whether the Destination IP is on a remote network or local network, in this case local network.
4.     On a local network, hosts communicate with MAC address, now the packet is created, Bobs PC would check the ARP cache to find if Sallys MAC address is known. If known its good, the packet is handed to Data Link Layer where a frame would be created and the Source MAC address would be the MAC address of Bob and Destination MAC address would be Mac address of Sallys PC.
In this we will assume that Bob dsnt know the MAC address of Sally, so here is what will be done now, Bob would send an ARP request which is a Broadcast. On the Local Network, it says “Hello Everyone, I am looking for the MAC address of Sally, whos IP address is 10.0.0.10 and my MAC address is xc.xc.xc.xc.xc.xc”, Switch hears the broadcast, and sends this broadcast to everyone, in this process, Switch learns that Bob is connected to, lets say fastethernet 0/0 on its interface, and then Switch sends the broadcast out to all active interface, Sally PC gets the broadcast message and says “Hey ,I am Sally, and my IP address 10.0.0.10, here is MAC Address aa.bb.cc.dd.ee.ff” Sally’s replies to the broadcast of Bob through the Switch, in this process Switch again learned that Sally is connected to, lets say fastethernet 0/1 on its interface, and all other devices that were on the networks drops the broadcast, because it was not meant for them. So our Switch, being very smart, learned that Bob is connected to  fa0/0 and Sally is connected to f0/1.
5.     Bob’s PC learns that MAC address of Sally is aa.bb.cc.dd.ee.ff, and stores this information in its ARP cache.
6.     Now that bob has learned sallys MAC address, in next ping, after the packet is created with Source and Destination IP, the packet is handed down to Data Link Layer, and a Frame is created with Source and Destination MAC Address, with an ether-type field(protocol), which is here IP, and at the end an FCS field is added to the frame.
7.     The Frame is handed down to the Physical Layer to put on a physical medium, which is a Straight-through cable.
8.     The Frame is received by the Switch on its F0/0 port, Switch checks the destination MAC Address(Sally), and checks its CAM Table, it knows on which port Sally is connected from its CAM table which is fa0/1.
9.     Switch sends the frame out through fa0/1, Sallys PC recieves the Frame, on receiving the frame it runs a CRC and matches the result with the FCS field on the frame, then it checks the destination MAC address of the frame, which was Sallys MAC address, next the Ether-type field is checked to determine whom to hand the packet at the network layer, in this case IP.
10.  Network Layer check the detination IP address, which was Sallys IP address, next the protocol field is checked to determine whom the payload should be handed, in this case ICMP.
11.  The Payload is handed to ICMP, which understands that its an echo request. ICMP responds to this immediately discarding the packet and generating a new payload as an echo reply.
12.  In this same way, the echo reply is sent to Bob. But while Sally replying to the echo request, Sallys PC changes the Source and Destination IP Address, where Sally is the Source and Bob is the destination.
13.  Bob recieves the reply, and the second reply is a success.
14.  The same process continues for two more times, with a success.

So this is how a PING works on a local network.


No comments:

Post a Comment