5.4 IP Addressing & Fundamental Network Protocols

IP Addressing & Fundamental Network Protocols

Exam Focus: Logical addressing and transport protocols dictate how every computer locates, identifies, and transmits information across local subnets and the global Internet. For the CompTIA Tech+ (FC0-U71) examination, candidates must thoroughly understand 32-bit IPv4 dotted-decimal formatting, subnet mask functions, default gateways, RFC 1918 private address ranges, APIPA diagnostic symptoms, 128-bit IPv6 representations, the DHCP DORA process, DNS name resolution, TCP versus UDP transport characteristics, and well-known application port numbers.

---

IPv4 Addressing Architecture & Subnet Masks

Every device connected to an Internet Protocol (IP) network requires a logical identifier called an IP address. Under IPv4 (Internet Protocol Version 4), this identifier is a 32-bit binary number.

IPv4 Address Structure:
Binary:   11000000 . 10101000 . 00000001 . 01100100  (32 total bits)
Octets:   Octet 1  . Octet 2  . Octet 3  . Octet 4   (4 octets of 8 bits each)
Decimal:    192    .   168    .    1     .   100     (Dotted-decimal format)

• Dotted-Decimal Notation: For human readability, the 32 bits are divided into four 8-bit groups called octets, separated by periods. Because an 8-bit byte can represent values from 00000000 to 11111111 in binary, the decimal value of each octet ranges from 0 to 255. The theoretical IPv4 address space spans $2^{32} \approx 4.29 \text{ billion}$ addresses.
• The Two Components of an IP Address: Every IP address is logically divided into two distinct parts:
  1. Network ID: Identifies the specific physical or logical network/subnet to which the device belongs. All hosts residing on the same local physical network share the identical Network ID.
  2. Host ID: Uniquely identifies the specific individual host device or interface on that network.
• Subnet Masks: How does a computer determine where the Network ID ends and the Host ID begins? It applies a subnet mask. A subnet mask is also a 32-bit binary number. Consecutive binary 1s designate the network bits, while consecutive binary 0s designate the host bits.
  • Dotted-Decimal Subnet Mask: E.g., 255.255.255.0 in binary is 11111111.11111111.11111111.00000000 (24 network bits, 8 host bits).
  • Classless Inter-Domain Routing (CIDR) Notation: Expresses the subnet mask by appending a forward slash followed by the count of active network bits (e.g., /24).

Common Subnet Mask Formats

• The Default Gateway:
  • Definition: The default gateway is the IP address of the local router interface attached to the client's local subnet (e.g., 192.168.1.1).
  • Function: When a host computer prepares to send a packet, it compares the destination IP address against its own IP address and subnet mask using a mathematical binary AND operation. If the destination is on the local subnet, the host sends the packet directly to the local destination via Layer 2 switch forwarding. If the destination resides on an external network or the Internet, the host sends the packet directly to the default gateway, which routes the packet toward the foreign destination.
  • Diagnostic Symptom: If a computer has a missing or misconfigured default gateway, it can communicate normally with other computers and printers on its immediate local network, but cannot reach any external subnets, websites, or the Internet.

---

Public vs. Private IPv4 Address Spaces (RFC 1918)

As the Internet expanded exponentially in the 1990s, the ~4.3 billion available IPv4 addresses rapidly depleted. To forestall address exhaustion, the Internet Engineering Task Force (IETF) published RFC 1918, which reserved three specific address blocks for private internal networks. These private addresses are non-routable across the public Internet; public Internet backbone routers immediately discard any packets carrying RFC 1918 source or destination addresses.

Private vs. Public Address Boundary:
[Client PC: 192.168.1.45] --(Private LAN)--> [Router: 192.168.1.1 / Public: 203.0.113.88] ===(Internet)===> [Web Server: 93.184.216.34]
                                                      ^
                                                (NAT / PAT Translation)

RFC 1918 Private IPv4 Address Blocks

1. Class A Private Range: 10.0.0.0 to 10.255.255.255
   • CIDR Block: 10.0.0.0/8 (Default mask: 255.0.0.0)
   • Capacity: 1 contiguous network with 16,777,216 addresses. Widely deployed in large multinational corporations, enterprise data centers, and cloud VPCs.
2. Class B Private Range: 172.16.0.0 to 172.31.255.255
   • CIDR Block: 172.16.0.0/12 (Default mask: 255.240.0.0)
   • Capacity: 16 contiguous /16 networks containing 1,048,576 total addresses. Common in mid-sized commercial and educational networks.
3. Class C Private Range: 192.168.0.0 to 192.168.255.255
   • CIDR Block: 192.168.0.0/16 (Default mask: 255.255.0.0, typically deployed as /24 subnets like 192.168.1.0/24)
   • Capacity: 256 contiguous /24 networks containing 65,536 total addresses. The universal default addressing scheme in residential broadband routers and small business gateways.

Network Address Translation (NAT)

Because private RFC 1918 addresses cannot be routed across the Internet, internal networks employ Network Address Translation (NAT)—specifically Port Address Translation (PAT). The border router replaces the private source IP address of an outbound client packet with the router's single public, ISP-assigned IP address and maps the session to a unique Layer 4 source port. When external servers reply, the router consults its active translation table and forwards the response back to the originating private internal host.

Special Reserved IPv4 Addresses

• Loopback Address: 127.0.0.0/8 (most notably 127.0.0.1 / localhost). Used to verify that a computer's local TCP/IP protocol software stack, operating system kernel network driver, and physical NIC controller are functioning properly. Executing ping 127.0.0.1 tests the internal network stack without transmitting any electrical signals onto the physical cable.
• Automatic Private IP Addressing (APIPA):
  • Address Range: 169.254.0.1 to 169.254.255.254 (Prefix: 169.254.0.0/16, Subnet Mask: 255.255.0.0).
  • Operational Behavior: When a client operating system (such as Microsoft Windows or macOS) is configured to receive an IP address automatically from a DHCP server, but fails to receive a response after broadcasting discovery requests, the operating system's APIPA service automatically self-assigns an IP address from the 169.254.0.0/16 block.
  • Critical Diagnostic Symptom: A workstation bearing a 169.254.x.x address can communicate with other APIPA-assigned computers on the exact same physical wire segment, but it cannot communicate with the default gateway, local subnet resources, or the Internet. In troubleshooting scenarios, an APIPA address is an immediate diagnostic indicator of a DHCP failure (caused by an unplugged Ethernet cable, disconnected Wi-Fi, a crashed DHCP server, an exhausted DHCP address scope, or an incorrect VLAN assignment).

---

IPv6 Addressing Architecture

While NAT and RFC 1918 delayed IPv4 depletion, the ultimate solution is IPv6 (Internet Protocol Version 6).

• Address Length & Notation: IPv6 expands the address space from 32 bits to 128 bits in length. To keep representations manageable, IPv6 addresses are written as eight groups of four hexadecimal digits (called hextets or quads), separated by colons: $\text{Example: } \mathtt{2001:0db8:85a3:0000:0000:8a2e:0370:7334}$
• Vast Address Pool: An address space of $2^{128} \approx 3.4 \times 10^{38}$ unique addresses (340 undecillion), providing enough addresses to assign billions of unique IPs to every human and IoT sensor on Earth without needing NAT.
• IPv6 Compression Rules (Essential Technical Skill):
  1. Leading Zero Suppression: Leading zeros within any individual 16-bit hextet may be omitted. (E.g., :0042: becomes :42:, :0000: becomes :0:, and :0db8: becomes :db8:). Trailing zeros cannot be omitted.
  2. Zero Compression (Double Colon ::): Any single contiguous sequence of one or more consecutive all-zero hextets can be replaced with a single double colon (::).
     • The Strict Single Use Rule: The double colon can be used only once within an IPv6 address string. If used multiple times, the address becomes mathematically ambiguous because a computer cannot determine how many zeros each double colon represents.
• Step-by-Step Compression Example:
  • Uncompressed: 2001:0db8:0000:0000:0000:0000:0000:0001
  • Suppress leading zeros: 2001:db8:0:0:0:0:0:1
  • Apply double colon compression: 2001:db8::1
• IPv6 Loopback Address: The IPv6 equivalent of 127.0.0.1 is ::1 (seven all-zero hextets followed by a 1).

---

Core Network Infrastructure Services: DHCP & DNS

1. Dynamic Host Configuration Protocol (DHCP)

DHCP automates the network configuration of client devices. Without DHCP, administrators would have to manually assign static IP addresses, subnet masks, gateways, and DNS servers to every smartphone, laptop, and IoT device on a network—a slow and error-prone process.

• Assigned Network Parameters: A DHCP server dynamically leases: an IP address, Subnet Mask, Default Gateway, Primary and Secondary DNS Server IP addresses, and the Lease Duration.
• Transport Ports: Operates over UDP using Port 67 (DHCP Server listening) and Port 68 (DHCP Client listening).
• The Four-Step DORA Process:

DHCP Four-Step DORA Handshake:
Client                                           DHCP Server
  |                                                   |
  |  1. DHCPDISCOVER (Broadcast: 255.255.255.255)     |
  |-------------------------------------------------->|
  |                                                   |
  |  2. DHCPOFFER (Unicast / Broadcast with IP Offer) |
  |<--------------------------------------------------|
  |                                                   |
  |  3. DHCPREQUEST (Broadcast accepting specific IP) |
  |-------------------------------------------------->|
  |                                                   |
  |  4. DHCPACK (Unicast confirming lease duration)   |
  |<--------------------------------------------------|

1. D — Discover: When a client joins a network, it does not yet have an IP address. It broadcasts a DHCPDISCOVER packet across the local subnet to destination 255.255.255.255 seeking an active DHCP server.
2. O — Offer: A DHCP server receives the discovery frame, reserves an available IP address from its configured pool (scope), and transmits a DHCPOFFER containing the proposed IP configuration back to the client.
3. R — Request: The client broadcasts a DHCPREQUEST packet notifying the network that it formally accepts the parameters offered by that specific server (and declining any offers from competing servers).
4. A — Acknowledge: The DHCP server sends a final DHCPACK (Acknowledgment) packet finalizing the binding, committing the lease duration, and enabling the client to begin using the network parameters.

2. Domain Name System (DNS)

DNS functions as the distributed global directory of the Internet, translating human-friendly Fully Qualified Domain Names (FQDNs) like www.example.com into computer-routable numerical IP addresses like 93.184.216.34 or 2606:2800:220:1:248:1893:25c8:1946.

• Transport Port: Operates on Port 53 (predominantly using UDP for fast client lookup queries, and TCP for zone transfers between servers or queries returning payloads exceeding 512 bytes).
• Hierarchical Tree Architecture:
  • Root Domain (.): The apex of the DNS hierarchy, maintained by 13 global root server authority clusters.
  • Top-Level Domains (TLD): Generic TLDs (.com, .org, .net, .edu, .gov) and country-code TLDs (.uk, .jp, .de).
  • Second-Level Domains: The unique name registered by an organization (e.g., example in example.com).
  • Subdomains / Hostnames: Specific host identifiers created by the domain owner (e.g., www, mail, portal, api).
• Diagnostic Clue: If a computer can successfully ping external IP addresses (e.g., ping 8.8.8.8), but entering www.google.com into a web browser results in a "Server Not Found" error, the computer's network connectivity and default gateway are functional, but its DNS server configuration is missing, unreachable, or failing to resolve queries.

---

Transport Layer Protocols: TCP vs. UDP

At the Transport Layer (Layer 4), data transmissions rely on two contrasting protocols that dictate connection mechanics, reliability, and transmission overhead:

TCP 3-Way Handshake vs. UDP Best-Effort Transmission:

[TCP: Connection-Oriented & Reliable]               [UDP: Connectionless & Best-Effort]
Client                     Server                   Client                     Server
  |                          |                        |                          |
  |--- 1. SYN -------------->| (Synchronize)          |=== Datagram 1 ==========>| (No setup)
  |<-- 2. SYN-ACK -----------| (Syn-Acknowledge)      |=== Datagram 2 ==========>| (No ACKs)
  |--- 3. ACK -------------->| (Acknowledge)          |=== Datagram 3 ==========>| (No retry)
  |                          |                        |                          |
  |[Data Transfer with ACKs] |                        |[Fast, Streamed Delivery] |

1. Transmission Control Protocol (TCP)

• Connection Model: Connection-Oriented. Before any application payload data can be exchanged, TCP establishes a verified two-way virtual circuit between client and server via the Three-Way Handshake:
  1. SYN (Synchronize): Client transmits an initial sequence number ($X$) to the server requesting session establishment.
  2. SYN-ACK (Synchronize-Acknowledge): Server acknowledges receipt with an acknowledgment number ($X + 1$) and supplies its own sequence number ($Y$).
  3. ACK (Acknowledge): Client acknowledges the server's sequence number ($Y + 1$). The connection is now formally established.
• Reliable, Ordered Stream: TCP detects loss and corruption, retransmits as needed, and delivers bytes to the application in order; if recovery cannot succeed, the connection fails rather than silently guaranteeing delivery. Every segment carries a sequence number. The receiver acknowledges received packets; if an acknowledgment fails to return within an expected retransmission timeout window, the sender automatically retransmits the lost packet.
• Sequencing & Flow Control: Packets arriving out of order are reassembled into correct sequential order based on sequence numbers before passing to the application. Sliding window algorithms dynamically manage flow control to prevent buffer overruns.
• Overhead: Higher protocol header overhead (20 to 60 bytes per packet) and slight operational latency.
• Typical Use Cases: World Wide Web (HTTP/HTTPS), file transfers (FTP/SFTP), email transmission (SMTP/IMAP/POP3), remote shell sessions (SSH), remote desktop administration (RDP).

2. User Datagram Protocol (UDP)

• Connection Model: Connectionless. UDP transmits data packets (called datagrams) immediately without establishing a preliminary handshake, exchanging sequence numbers, or closing sessions.
• Reliability & Delivery Guarantees: Unreliable ("Best-Effort"). UDP provides zero delivery guarantees. Packets are transmitted into the network stream; if a router drops a packet, UDP does not detect the loss and makes no attempt to request a retransmission.
• Overhead & Speed: Exceptional transmission speed and ultra-low latency. A UDP header requires only 8 fixed bytes of overhead, and there is zero handshake delay.
• Typical Use Cases: Real-time communications where latency is far more damaging than occasional dropped packets: Voice over IP (VoIP), live video streaming, competitive multiplayer gaming, DNS lookup queries, and DHCP leasing.

---

Essential Network Protocols & Standard Port Numbers

Network applications direct incoming and outgoing traffic using standardized 16-bit port numbers (ranging from 0 to 65,535). Well-Known Ports (0 to 1,023) are assigned by the Internet Assigned Numbers Authority (IANA).

Essential Port Master Reference Table

---

Real-World Scenarios & Common Exam Traps

• Trap 1: The 169.254.x.x APIPA Address Clue. Whenever an exam scenario displays an IP address starting with 169.254, do not look for DNS or default gateway issues! The workstation has self-assigned an APIPA address because it failed to communicate with a DHCP server. The root cause is a physical link disconnect, downed DHCP service, or exhausted IP scope.
• Trap 2: Double Colons in IPv6. Remember that the double colon (::) shorthand in IPv6 can appear only once in any address. An address formatted as 2001::db8::1 is mathematically invalid and will be rejected by network operating systems.
• Trap 3: POP3 vs. IMAP Synchronization Behavior. Both retrieve email, but their synchronization models differ completely:
  • POP3 (Port 110): Downloads messages to a single local device and deletes them from the server by default. Reading an email on your laptop leaves your smartphone unaware.
  • IMAP (Port 143): Keeps all email synchronized on the mail server. Actions (reading, deleting, moving to folders) reflect instantly across your laptop, smartphone, and webmail interface.
• Trap 4: Telnet vs. SSH Security. Both protocols provide a remote command-line terminal shell to network switches, routers, and Linux servers. However, Telnet (Port 23) transmits all passwords and commands in clear, readable plaintext. An attacker running a packet sniffer can easily read credentials. SSH (Port 22) encrypts all session traffic, rendering it the mandatory modern replacement.
• Trap 5: Ping IP Address vs. Ping Domain Name. When troubleshooting internet connectivity:
  • If ping 8.8.8.8 succeeds, your physical connection, IP configuration, and default gateway are operating correctly.
  • If ping google.com immediately fails afterward, the problem is isolated specifically to DNS resolution (Port 53).