Why the TCP segment only contains the port numbers but no IP addresses? How does the packet know which host it is going to?
Because the TCP segment is encapsulated into an Internet Protocol (IP) datagram, and the IP datagram contains the source and destination IP.
Related
I was studying about packets and networking and i think that the packet have a header which contain source address and destination ...
but since the destination is the IP of the router so after the packet reach the router how does the router know which device it should forward the packet like 192.168.1.2? or 192.168.1.3?
or does the packet contain the internal IP too
thanks for any answers .
I have to design a program that reads all the TCP segments incoming of the same connection. How can I distinguish which connection a packet belongs to, among many packets that I receive? Is it sufficient to discriminate on the basis of the DESTINATION PORT field in the header?
No. Using just the destination port isn't enough. A TCP connection is defined by a combination of the following 4 values:
Source port
Source ip address
Destination port
Destination ip address
I'm just curious about how the server knows if the received segment is a UDP or a TCP segment, especially when the listening port can listen on both UDP and TCP.
I know the client can use SOCK_DGRAM to generate UDP segments and SOCK_STREAM for TCP segments, but the segment transmitted is still a bunch of bits. How can the server know whether it should interpret these bits as a UDP segment or as a TCP segment? What if these bits are a UDP segment, but accidentally do not mean "too weird" if they are interpreted as a TCP segment?
It's firstly an IP packet, which contains the protocol in the IP header. Inside the IP packet is a payload, which contains either a TCP segment or a UDP datagram.
By searching on internet I got information that Address Resolution Protocol (ARP) is Link Layer (L2) protocol. As per ARP functionality it broadcasts to entire network to check to whom this specific IP belongs to get its MAC address.. but as ARP is L2 protocol, how does it knows destination IP address as IP's are encapsulated in L3 and L2 protocol can't read it
Layer 3 and above are located in the "Payload" part of an ethernet header.
As you can see here the ARP packet also contains IP addresses from its sender and receiver:
ARP packet contain source HW address and src IP address as well as destination HW address and destination IP also .
when ARP resolution happens, means when ARP send request and get response from same destination,ARP update the destination IP in arp_entry .
I would like to elaborate on the previous questions.
first, here it is the case where you can't really apply the model. ARP is sometimes layer 2 and sometimes layer 3 (the similar functionality in IPv6 is done with neighbor discovery protocol, which is carried in ICMP packets)
ARP packets do not carry IP payload. They only carry ARP packets. See other answers for the format
ARP is executed by two end-hosts, which both have to implement both layer 2 and layer 3
ARP is initiated by layer 3, when layer 3 tries to send packet to an IP address on the local network.
ARP is processed by a host, which implements both layer 2 and layer 3. A host without layer 3 cannot have an IP address.
Intermediate layer 2 systems generally cannot process ARP requests, past forwarding ethernet packets with broadcast destination MAC
Why a layer-4 firewall (a device that can look at all protocol headers up to the transport layer) cannot block all ICMP traffic?
ICMP is a IP layer protocol.Why can't we block all ICMP traffic using layer-4 firewall.Can it not be done by blocking IP adresses and port number?
For blocking it , block the ip protocol 01 which number is for ICMP http://en.wikipedia.org/wiki/List_of_IP_protocol_numbers
Port number is a 4-layer conception, ICMP is at 3-layer.