Basic Network Concepts

www.huawei.com

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved.

 Foreword
 To understand security technologies, you first need to learn about basic ne
twork concepts, such as basic communication principles, network compone
nts, and common network protocols. With knowledge of these basic conce
pts, you can better understand network security threats and deploy securit
y defense policies.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 3
 Objectives
 Upon completion of this course, you will be able to:
 Describe the working principles of TCP/IP protocols.
 Describe the working principles of common protocols.
 Describe possible security threats to common protocols.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 4
 Contents
1. TCP/IP Architecture
2. Common Network Protocols

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 5
 Architecture of a Typical Campus Network

Egress zone

Core layer

Aggregation
layer
…

Access layer

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 6
 OSI Model
 Objectives
 Design principles
 Advantages

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 7
 7 Layers of the OSI Model
APDU Application layer 7 Provides communications
Top between applications.
three PPDU Presentation layer 6 Processes data formats and
layers encrypts data.

SPDU 5 Establishes, maintains, and

Session layer
manages sessions.

Segment Establishes E2E connections for

Transport layer 4
hosts.

Performs addressing and

Bottom Packet Network layer 3 routing.
four
layers Provides media access and
Frame Data Link layer 2
link management.

Bit Physical layer 1 Transmits bit streams.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 8
 Peer Layer Communications
 Each layer uses the services provided by the lower layer to communicate with the
peer layer.
Application APDU Application
layer layer
Presentation PPDU Presentation
layer layer
SPDU
Session layer Session layer

Transport Segment Transport

layer layer
Packet
Network layer Network layer
Host A Host B
Data Link Frame Data Link
layer layer
Bit
Physical layer Physical layer

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 9
 Mapping Between TCP/IP and OSI
 The TCP/IP protocol stack has a simple hierarchical design and a clear mapping relationship
with the OSI model.
OSI TCP/IP

Application layer

Presentation layer Application layer

Session layer

Transport layer Transport layer

Network layer Internet layer

Data Link layer Network access layer

Physical layer

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 10
 Functions of Each Layer of the TCP/IP

Application HTTP, Telnet, FTP, TFTP, and DNS Provides network interfaces for
layer applications.

TCP/UDP Establishes E2E connections for

Transport layer hosts.

ICMP & IGMP Performs addressing and

Internet layer IP routing.
ARP & RARP

Network Performs physical media

access layer Ethernet, 802.3, PPP, HDLC, and FR access.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 11
 Encapsulation and Decapsulation Processes of th
e TCP/IP

Sender Recipient
Encapsulation Decapsulation

App User data

Application Application
layer layer
TCP App User data
Transport Transport
layer layer

Internet layer
IP TCP App User data Internet
layer

Network access Eth IP TCP App User data Network access

layer layer

1010101101010100101010001110

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 12
 Quintuple
HTTP FTP Telnet SMTP DNS TFTP SNMP

20/21 23 25 53 69 161
80

TCP UDP

IP packet

Source IP address + destination IP address + protocol +

Quintuple

source port + destination port

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 13
 Contents
1. TCP/IP Architecture
2. Common Network Protocols
 Network Layer Protocols
 Transport Layer Protocols
 Application Layer Protocols

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 14
 Common Network Protocols

NMS NetStream

SNMP

ARP

OSPF/RIP

PC 1 PC 2

ICMP
Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 15
 Overview of ARP
 Before sending a data packet to Host C, Host A needs to obtain the MAC a
ddress of Host C.

192.168.1.2/24
00-01-02-03-04-BB

Host A Host C

10.0.0.1/24 10.0.0.3/24
00-01-02-03-04-AA 00-01-02-03-04-CC

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 16
 ARP Request Host B

192.168.1.2/24
00-01-02-03-04-BB

Host A Host C

10.0.0.1/24 10.0.0.3/24
00-01-02-03-04-AA 00-01-02-03-04-CC

ETH_II ARP FCS

Destination IP address: 10.0.0.3
Destination MAC address: Source IP address: 10.0.0.1
FF-FF-FF-FF-FF-FF Destination MAC address: 00-00-00-00-00-00
Source MAC address: 00-01-02-03-04-AA
Operation type: Request

Source MAC address:

00-01-02-03-04-AA

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 17
 ARP Reply (1)
Host B

192.168.1.2/24
00-01-02-03-04-BB

Host A Host C

10.0.0.1/24 10.0.0.3/24
00-01-02-03-04-AA 00-01-02-03-04-CC

Host C>arp -a
Internet address Physical address Type
10.0.0.1 00-01-02-03-04-AA Dynamic

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 18
 ARP Reply (2)
Host B

192.168.1.2/24
00-01-02-03-04-BB

Host A Host C

10.0.0.1/24 10.0.0.3/24
00-01-02-03-04-AA 00-01-02-03-04-CC

ETH_II ARP FCS

Destination IP address: 10.0.0.1
Source IP address: 10.0.0.3
Destination MAC address: Source MAC address: 00-01-02-03-04-AA
00-01-02-03-04-AA Source MAC address: 00-01-02-03-04-CC
Operation type: Reply
Source MAC address:
00-01-02-03-04-CC

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 19
 Gratuitous ARP
 Gratuitous ARP can be used to detect whether IP addresses conflict.
10.0.0.1/24
00-01-02-03-04-AA

Host A

ETH_II ARP FCS

Destination IP address: 10.0.0.1
Source MAC address: Source IP address: 10.0.0.1
00-01-02-03-04-AA Destination MAC address: 00-00-00-00-00-00
Source MAC address: 00-01-02-03-04-AA

Destination MAC address:

FF-FF-FF-FF-FF-FF

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 20
 Introduction to ICMP
 ICMP is used to transmit error, control, and query messages.

Host A
Message

Return Message

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 21
 ICMP Application: Ping (1)

192.168.1.1/24 192.168.1.2/24

Router A Router B

<Router A>ping ?
STRING<1-255> IP address or hostname of a remote system
-a Select source IP address, the default is the IP address of the
output interface
-c Specify the number of echo requests to be sent, the default is
5
-d Specify the SO_DEBUG option on the socket being used
-f Set Don't Fragment flag in packet (IPv4-only)
-h Specify TTL value for echo requests to be sent, the default is
255
-i Select the interface sending packets
…

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 22
 ICMP Application: Ping (2)

[Router A]ping 192.168.1.2

PING 192.168.1.2 : 56 data bytes, press CTRL_C to break
Reply from 192.168.1.2 : bytes=56 Sequence=1 ttl=255 time=340 ms
Reply from 192.168.1.2 : bytes=56 Sequence=2 ttl=255 time=10 ms
Reply from 192.168.1.2 : bytes=56 Sequence=3 ttl=255 time=30 ms
Reply from 192.168.1.2 : bytes=56 Sequence=4 ttl=255 time=30 ms
Reply from 192.168.1.2 : bytes=56 Sequence=5 ttl=255 time=30 ms

--- 192.168.1.2 ping statistics ---

5 packet(s) transmitted
5 packet(s) received
0.00% packet loss
round-trip min/avg/max = 10/88/340 ms

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 23
 ICMP Application: Tracert (1)

30.0.0.2/24

20.0.0.2/24
Router B
Host A Router A Router C Host B

10.0.0.2/24

<Router A>tracert ?
STRING<1-255> IP address or hostname of a remote system
-a Set source IP address, the default is the IP address of the
output interface
-f First time to live, the default is 1
-m Max time to live, the default is 30
-name Display the host name of the router on each hop
-p Destination UDP port number, the default is 33434
-q Number of probe packets, the default is 3
-s Specify the length of the packets to be sent. The default
length is 12 bytes
…

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 24
 ICMP Application: Tracert (2)
 The Tracert command displays each hop that packets pass through during
network transmission.
30.0.0.2/24

20.0.0.2/24

Router B
Host A Router A Router C Host B

10.0.0.2/24

<Router A>tracert 30.0.0.2

Tracert to 30.0.0.2(30.0.0.2), max hops:30, packet length:40, press CTRL_C to
break
1 10.0.0.2 130 ms 50 ms 40 ms
2 20.0.0.2 80 ms 60 ms 80 ms
3 30.0.0.2 80 ms 60 ms 70 ms

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 25
 Routing Protocol Overview
 Routing is the most basic element in a data communications network. It is t
he process of selecting paths on a network through which packets are sent
from a source to a destination.

PC 1 PC 2

Routing protocols

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 26
 Introduction to OSPF
 No loop
 Fast convergence
 Good scalability
 Supporting authentication
RTB Site B
RTA

OSPF
OSPF

Site A

RTC

OSPF

Site C

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 27
 Introduction to SNMP
 SNMP is used to transmit management information between the network management syst
em (NMS) and managed devices. NMS

SNMP

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 28
 SNMP Architecture
 SNMP includes the NMS, agent, and MIB.
 An agent is a process performed on the managed devices.
 A MIB is a database that contains variables maintained by managed devices.

Managed device

NMS
Execute
SNMP
MIB
Agent Notify

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 29
 Enterprise Network O&M

Branch 1

Branch 2

HQ

 Understand the traffic trend of all branches IT engineer: Branch 1 has exhausted its
bandwidth on the XYZ port. We need to
and identify the devices and branches that purchase a new device to expand the
need expansion. network capacity.
Supervisor: Are you sure we need to
 Analyze the distribution of branch traffic id expand the capacity? Is the network fully
entify the value points for capacity expansi optimized or is the service application
developing rapidly?
on. IT engineer: I have detailed network
application development reports for
 Rank changes in branch traffic and allocate each branch ...
existing network resources accordingly.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 30
 NTA Concept and Functions
 Basic concept
 The eSight Network Traffic Analyzer (NTA) is a software-only solution. No hardware probe is require
d, and no additional investment is needed. The NetFlow, NetStream, and sFlow protocols are used t
o collect and analyze common IP packets, provide a customer analysis report, and monitor network-
wide traffic in real time. This is a powerful tool for enterprise O&M management.
 Functions
 The eSight NTA provides a convenient way to monitor and analyze networks. By using the IP networ
k traffic information provided by network devices that support NetFlow, NetStream, and sFlow, the
eSight NTA analyzes network-wide traffic, provides traffic analysis reports, and displays traffic analys
is results in various charts. This helps users learn about network-wide traffic, including the traffic dist
ribution, and detect abnormal network traffic.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 31
 NetStream Overview
 NetStream is a Huawei-patented technology used to collect and distribute statistics about network traff
ic. The NDE sends the obtained statistics to the NSC for further processing, and sends the statistics to t
he NDA for analysis. The results of the analysis provide a basis for network accounting and planning.

NDE NSC

NDA

NetStream stream
NDE
NSC

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 32
 Contents
1. TCP/IP Architecture
2. Common Network Protocols
 Network Layer Protocols
 Transport Layer Protocols
 Application Layer Protocols

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 33
 Establishing TCP Connections
 Three-way handshake

SY N
(seq
=a)

q =b,
(se
,A CK
S YN =a +1)
Client ack Server

ACK
(seq
ack= =a+1,
b+1
)

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 34
 Disconnecting TCP Connections
 4-way handshake
FIN (
seq=
a)

k = a +1)
eq = b, ac
s
ACK (
k= a +1)
e q =c, a c
Client IN ,A CK (s Server
F

ACK (
seq=
a +1, a
ck =c+1
)

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 35
 Contents
1. TCP/IP Architecture
2. Common Network Protocols
 Network Layer Protocols
 Transport Layer Protocols
 Application Layer Protocols

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 36
 Common Application Layer Protocols

DNS server
FTP server

Web server

Mail server

PC

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 37
 How DNS Works
 Domain name resolution is performed by a dedicated domain name system (DNS). The DNS involves the following ty
pes of servers:
?
Root server ess om
ddr awei.c

a
IP u er
Top-level domain name server I don't know is the ww.h S serv Root server
at ow

N
about this. I Wh ing t
d c o mD
on e .
Recursive server have to ask the f th X.X.
esp

rr o
experts. co es s X.X.
s
a ddr i
 Cache server IP
 The IP:X.X.X.X
What is the IP address corresponding to
I'd like to visit www.huawei.com.
www.huawei.com?

The IP address of www.huawei.com. is The IP address of the .huawei.com DNS
Z.Z.Z.Z. server is Y.Y.Y.Y.
Client Cache server Top-level domain
cor
 res What name server
p on i
First access din s the
The g to wIP ad
IP a
ddr ww dres
I remember it
ess .hu s
aw IP:Y.Y.Y.Y
this time. of w ei.c
is Z ww om
.Z.Z .hu ?
.Z. awe
i.co
m.
I'd like to visit www.huawei.com again.
Recursive server

The IP address of www.huawei.com. is

Z.Z.Z.Z.
Client Cache server

Second access

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 38
 How FTP Works
 FTP provides an effective way to upload and download files between a server and a client.
 When used to transmit data, FTP establishes a control connection and a data connection between the s
erver and the client..

User User interface

Control connection

Process control Process control

Data connection

File system Data transmission Data transmission File system

process process

Client Server

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 39
 FTP Transmission Mode (1)
 FTP supports two modes: active mode and passive mode. In active mode, which is used by d
efault, the client sets up the control connection and the server sets up the data connection. I
n passive mode, the client sets up both connections. Users can switch the mode through co
mmands.
 FTP connection setup in active mode:

Control connection
Temporary port Port 21
Data connection
Temporary port Port 20

FTP Client FTP Server

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 40
 FTP Transmission Mode (2)
 FTP connection setup in passive mode:

Control connection
Temporary port Port 21
Data connection
Temporary port Temporary port

FTP Client FTP Server

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 41
 HTTP/HTTPS: Basic Components of a Web Appli
cation
 The web is built on a client-server architecture and relies on three essential technologies:
 Using Hypertext Markup Language (HTML), used to describe a file
 Using Uniform Resource Locator (URL), used to specify the file location
 Using Hypertext Transfer Protocol (HTTP), used for client-server communication

HTTP/HTTPS

Client Server

Displays on the client.

Access URL:
www.huawei.com HTML file

The URL specifies the server file.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 42
 How HTTP Works
 HTTP is a stateless protocol that uses a request-response method for communication.

① Hi.
What can I do for you?
③ I need the XXX file. ②
GET /http://class/xxxx HTTP/1.1

⑤ Do you have a key? ④

Yes, &……%@ (#
⑥
OK. This is the file you want.
HTTP/1.1 200 OK
 HTTP has two types of packets:
 Request packet: sent from the client to the server.
 Response packet: returned from the server to the client.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 43
 SMTP, POP3, IMAP: How Mail Is Sent and Receiv
ed
 SMTP defines how PCs send mail to an SMTP server and how mail is transferred between SMTP servers.
 Post Office Protocol 3 (POP3) and Internet Mail Access Protocol (IMAP) specify how PCs manage and download mail o
n the mail server through client software.
 SMTP and POP3 (or IMAP) are deployed on the mail server by an administrator, and mail client software (such as Micr
osoft Outlook or Foxmail) is installed on a user's PC.

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 44
 Quiz
1. Which of the following is not in the TCP/IP model?
A. Data link layer
B. Transport layer
C. Session layer
D. Application layer

2. Which of the following packets is the first packet of the TCP three-way handsha
ke?
A. SYN+ACK
B. SYN
C. ACK
D. FIN

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 45
 Summary
 TCP/IP Architecture
 Common Network Protocols

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 46
 Thank You
www.huawei.com

Copyright © 2018 Huawei Technologies Co., Ltd. All rights reserved. Page 47