Chapter 6: TCP/IP Basics

Classless Inter-Domain Routing; a flexible IP addressing method that replaces classful networking.

Allows subnetting by varying the subnet mask length (e.g., /24, /25).

Enables variable-length subnet masking (VLSM), letting ISPs allocate exact-sized blocks (e.g., /25 for 126 hosts, /26 for 62 hosts).

Splits one network into two subnets, each with half the hosts (e.g., 208.25.160.0/24 → 208.25.160.0/25 and 208.25.160.128/25).

65–126 (64 total addresses, minus network ID 64 and broadcast 127).

Subnet masks must be contiguous 1s followed by 0s (e.g., 11111111.11111111.11111111.10000000 for /25).

More subnets = fewer hosts per subnet (e.g., /24 = 254 hosts, /26 = 62 hosts).

ISPs, to allocate customized address blocks to customers.

/24 → 255.255.255.0

/25 → 255.255.255.128

255.255.255.192

62 (2⁶ - 2)

One is the network address, and the other is the broadcast address.

To resolve a known IP address to its corresponding MAC address on the same local network.

The sender broadcasts an ARP request: "Who has [IP]? Tell [My IP]."

Only the device with the matching IP replies with its MAC address.

arp -a (displays dynamic and static IP-to-MAC mappings).

Because the sender doesn’t know the target’s MAC, so it asks all devices on the network.

Dynamic: Learned via ARP, expire after a timeout.

Static: Manually configured, permanent (rarely used).

For remote networks (ARP is only for local communication; routers handle cross-network traffic).

Address Resolution Protocol.

Ethernet requires the destination’s MAC address to form a complete Ethernet frame.

It stores known IP-to-MAC mappings in the ARP cache.

It was learned automatically and will expire after a short period.

You may need to ping or connect to other devices to populate it.

It's a fundamental part of how local devices communicate on Ethernet networks, and arp -a is a common command-line tool to verify it.

Whether an IP address is local (same subnet) or remote (different subnet).

Compares destination IP to its own network ID (using subnet mask).

Match: ARP for local MAC.

No match: Forward to default gateway.

11111111.11111111.11111111.00000000 (or /24).

VLSM assigns smaller subnets to small networks (e.g., /28 for 8 hosts), avoiding IP waste.

Hosts may incorrectly classify remote IPs as local (or vice versa), causing communication failures.

To route traffic outside the local subnet (e.g., to the internet).

To separate the network ID from the host ID in an IP address.

24 bits are used for the network portion; equivalent to 255.255.255.0.

It compares its own IP and the target IP using the subnet mask.

It ARPs for the default gateway (router) and sends the packet there.

An IP address, a subnet mask, and a default gateway.

Every subnet has the same subnet mask, regardless of size.

Subnets use different masks to better fit the number of required hosts.

/24 or 255.255.255.0

It wastes IP addresses — VLSM helps avoid this.

Globally manages IP allocation, delegates blocks to RIRs (e.g., ARIN, RIPE).

First octet 128–191, subnet mask /16 (e.g., 160.25.0.0/16).

Forced rigid sizes (/8, /16, /24), wasting addresses for small networks.

Borrows 8 host bits → creates 256 /24 subnets (e.g., 160.25.1.0/24).

CIDR/VLSM, allowing custom subnet masks (e.g., /26, /28).

Classful: Fixed to /8, /16, /24.

CIDR: Any mask length (e.g., /22, /27).

Distribute IP address blocks in different geographic regions.

Contact their ISP, not IANA or RIRs directly.

1.0.0.0 to 126.255.255.255

254 usable hosts

Small networks got more IPs than they needed, wasting address space.

Dividing a larger network into smaller subnetworks.

IP address followed by a slash and number of network bits, e.g., 192.168.1.0/26

Classful addressing waste by allowing custom subnet sizes (e.g., /26, /28).

2 subnets, each with 126 hosts (128 total, minus networkroadcast).

11111111.11111111.11111111.11000000 (or 255.255.255.192).

62 hosts (64 total, minus 2).

Subnet masks must be contiguous 1s followed by 0s (no "gaps").

65–126 (Network ID: 64, Broadcast: 127).

The more bits you borrow from the host part of the address (i.e., increasing the prefix length), the more subnets you create.

You divide the network into 2 subnets, each with 126 usable hosts.

It divides the network into 4 subnets, each with 62 usable hosts.

A /26 subnet allows 62 usable hosts (64 - 2 for network and broadcast addresses).

CIDR allows ISPs to efficiently allocate smaller blocks of IP addresses to customers, avoiding waste.

A /28 subnet allows 14 usable hosts (16 - 2).

Dynamic IPs change over time (common in home networks).

Static IPs remain fixed (required for servers).

To ensure consistent accessibility for web, email, or game servers.

Usable hosts = 2ⁿ - 2, where *n* = number of host bits.

14 usable hosts (2⁴ - 2 = 16 - 2 = 14).

The first or last IP (for the ISP’s routerateway).

Static: Manually configured.

Dynamic (DHCP): Automatically assigned.

Dynamic Host Configuration Protocol – Automatically assigns IP addresses, subnet masks, gateways, and DNS.

DORA: Discover, Offer, Request, Acknowledgment.

DHCP relies on broadcasts, which don’t cross subnets. Use a DHCP relay/IP helper to forward requests.

Assigns a fixed IP to a MAC address (e.g., printers, servers).

How long a device keeps an IP before renewal (e.g., 24 hours).

DHCPv6: Stateful (server assigns IPs).

SLAAC: Stateless (devices self-configure via EUI-64).

They may assign conflicting IPs (e.g., two devices getting the same IP).

Forwards DHCP requests across subnets to a central DHCP server.

Sends a DHCP Discover broadcast (MAC FF:FF:FF:FF:FF:FF).

IP address, subnet mask, and default gateway.

Static IP configuration.

A broadcast message.

A unicast message.

The defined range of IP addresses available to assign to clients.

An IP within the scope that will not be assigned dynamically.

Stateless Address Auto Configuration.

Devices auto-generate addresses using their MAC and the EUI-64 method.

DHCPv6 provides full address assignment with more configuration, similar to DHCPv4.

Cause: Static conflict or rogue DHCP.

Windows: Auto-switches to DHCP; shows error.

Cause: VM cloning without MAC regeneration.

Impact: Switches may flood traffic (hub mode).

Local access works, no internet.

DHCP failure (server down/expired lease).

Device A sees B in the same subnet; B sees A in a different subnet.

Unauthorized DHCP server; can assign wrong gateway/IPs (MITM risk).

Windows: ipconfig

Linux: ifconfig or ip a

8 days (renews at 4 days).

Tracks all manual IP assignments to avoid overlaps.

tracert (Windows) or traceroute (Linux) to test routing paths.

Used for local/internal networks; not routable on the public internet.

Translates private IP addresses to a public IP for internet access.

127.0.0.1 (localhost)

::1

Used to test a system’s network stack internally.

169.254.0.1 – 169.254.255.254

When DHCP fails and the OS self-assigns an IP.

No; only allows local communication within the same subnet.

DHCP server is unreachable or down.

ipconfig elease

ipconfig enew

IP conflict – one or both may lose connectivity.

The system disables the NIC or reverts to DHCP.

Silent failure or connectivity issues.

Change one device’s IP or verify DHCP settings.

Two devices have the same hardware address.

In virtual machines that were cloned.

Switch confusion, traffic drops, or reverting to hub-like behavior.

Routes traffic to outside networks (e.g., the internet).

It can't access external networks or the internet.

An unauthorized router offering incorrect gateway settings, possibly used in MITM attacks.

Defines the network and host portions of an IP address.

Devices may not communicate properly within the network.

Devices on the same IP range can’t ping each other or show asymmetric connectivity.

ipconfig /all – shows lease info, DHCP server, etc.

Same subnet mask and same default gateway (usually the router).

Can ping local devices but not websites or external IPs.

tracert (Windows) or traceroute (Linux/macOS)

Test connectivity to another host or IP.