Bob opens a laptop and asks for one Web page, and six protocols across all five layers have to run before a single byte of that page comes back.
Words you will meet
Nothing new. That is the point of this page: every protocol here has already had its own section, and the work now is seeing them run together.
-
DHCP (Dynamic Host Configuration Protocol) Dynamic Host Configuration Protocol Gives a host its IP address and the address of its local DNS server when it joins a network. Built properly in §4.3.2. introduced in ch. 2 (§4.3.2) · DNS (Domain Name System) Domain Name System Translates a human-friendly name such as www.ietf.org into a network address. introduced in ch. 1 (§2.4.1) · ARP (Address Resolution Protocol) Address Resolution Protocol Translates an IP address into the MAC address of an interface on the same subnet. It works only within one subnet, which is the whole point. introduced in ch. 6 (§6.4.1)
-
TCP (Transmission Control Protocol) Transmission Control Protocol The Internet transport protocol that delivers data reliably and in order, with flow control and congestion control. introduced in ch. 1 (§3.5) · HTTP (HyperText Transfer Protocol) HyperText Transfer Protocol The application-layer protocol that requests and transfers Web documents. introduced in ch. 1 (§2.2) · Ethernet (§6.4.2)
Why this matters
Section 1.1 said that much of this book is about protocols, and you may reasonably have wondered what a protocol actually was.
This page is the answer, and it is not a definition of a protocol protocol Simple An agreed set of rules for what messages to send, in what order, and what to do with them. Precise A protocol defines the format and the order of messages exchanged between two or more communicating entities, as well as the actions taken on the transmission and/or receipt of a message or other event. introduced in ch. 1 — open in glossary . It is one ordinary action — opening a laptop and loading a page — taken apart into the twenty-four things that have to happen, in order, for it to work.
Everything on this page has appeared before. Nothing here is new. If you can follow it, you have understood the first six chapters.
The setting
Drag any device to rearrange the picture. Hover a link to see its rate, delay and length.
Three journeys, and they get longer. Everything Bob’s laptop needs before it can even ask its question happens in the first two.
Read this diagram as text
- Bob’s laptop · 00:16:D3:23:68:8A · 68.85.2.101 — wired link — Ethernet switch
- Ethernet switch — wired link — gateway + DHCP server · 00:22:6B:45:1F:1B · 68.85.2.1
- gateway + DHCP server · 00:22:6B:45:1F:1B · 68.85.2.1 — wired link — Comcast
- Comcast — wired link — DNS server · 68.87.71.226
- Comcast — wired link — Google
- Google — wired link — www.google.com · 64.233.169.105
Bob’s laptop is on a school network inside Comcast’s address block. The gateway router gateway router Simple A router on the edge of one organisation's network. Precise A router at the edge of an autonomous system that connects directly to one or more routers in other autonomous systems. Contrast an internal router, which connects only to hosts and routers inside its own AS. introduced in ch. 5 — open in glossary also runs the DHCP (Dynamic Host Configuration Protocol) Dynamic Host Configuration Protocol Gives a host its IP address and the address of its local DNS server when it joins a network. Built properly in §4.3.2. introduced in ch. 2 server. The DNS (Domain Name System) Domain Name System Translates a human-friendly name such as www.ietf.org into a network address. introduced in ch. 1 server is in Comcast’s network, and www.google.com is somewhere else entirely.
| Book steps | What happens | What the laptop now knows that it did not before |
|---|---|---|
Cells marked ⓘ have an explanation — click to read it.
Twenty-four steps, but only six moments where the laptop learns something it did not know. Every other step uses one of these. Step through, and watch the "known" column fill up.
The twenty-four steps
No address, no gateway, no DNS server. It builds a DHCP request, puts it in a UDP segment to port 67, puts that in an IP datagram from 0.0.0.0 to 255.255.255.255, and puts that in an Ethernet frame to FF:FF:FF:FF:FF:FF. Four headers, and only one real address in any of them: its own MAC.
Nine screens for twenty-four steps. The two worth lingering on are step 13, where a frame and a datagram disagree about where they are going, and step 5, where one message answers four questions at once.
Read all steps as text
- Step 1 — the laptop has nothing — No address, no gateway, no DNS server. It builds a DHCP request, puts it in a UDP segment to port 67, puts that in an IP datagram from 0.0.0.0 to 255.255.255.255, and puts that in an Ethernet frame to FF:FF:FF:FF:FF:FF. Four headers, and only one real address in any of them: its own MAC.
- Steps 3–4 — the switch floods it, the router answers — The switch has never seen this MAC address as a destination, and the frame is a broadcast anyway, so it goes out on every port — including the one to the router. Inside the router, the datagram is demultiplexed up to UDP and the DHCP server reads the request.
- Steps 5–7 — one message, four answers — The DHCP ACK carries the laptop’s address 68.85.2.101, the subnet mask, the default gateway 68.85.2.1, and the DNS server 68.87.71.226. The laptop records all four and installs the gateway in its forwarding table. Everything else in this story depends on this one frame.
- Steps 8–9 — Bob types the URL, and hits a wall — The browser wants a TCP socket to www.google.com, so the laptop needs that name resolved. It builds a DNS query to 68.87.71.226 — which is off its own subnet, so the frame must go to the gateway router. It knows the router’s IP address. It does not know the router’s MAC address.
- Steps 10–12 — ARP, for the router and only the router — A broadcast query for 68.85.2.1, and a unicast reply from the gateway giving 00:22:6B:45:1F:1B. Note what is NOT asked for: nobody ever ARPs for the DNS server or for Google. ARP resolves addresses on your own subnet, and neither of those is on it.
- Step 13 — two destinations in one frame — Now the DNS query can go. Read its two destination fields side by side: the IP datagram is addressed to 68.87.71.226, and the frame around it is addressed to 00:22:6B:45:1F:1B. §6.4.1 said a datagram is addressed end to end and a frame hop by hop. Here they are, in one packet.
- Steps 14–17 — off through Comcast, and back — The gateway router forwards on its forwarding table, filled in by an intra-domain protocol such as OSPF and by BGP between domains. The DNS server finds a cached record for www.google.com and replies with 64.233.169.105. None of these hops are visible from Bob’s laptop — except in the time to live, which comes back decremented.
- Steps 18–21 — a TCP handshake, at last — SYN to port 80, SYNACK back, then ACK. The datagrams are addressed to 64.233.169.105 — the address the DNS reply taught — and the frames are still addressed to the gateway router. Only now is there a socket Bob’s browser can write into.
- Steps 22–24 — the thing Bob actually wanted — The GET goes into the socket, becomes the payload of a TCP segment, and crosses three networks. The server reads it, builds a response with the page in its body, and sends it back. The browser reads the HTML out of the socket and displays it.
Every frame, on the wire
Here is the whole thing, captured on Bob’s laptop. Eleven frames.
| No. | Time | Source | Destination | Protocol | Length | Info |
|---|---|---|---|---|---|---|
| 1 | 0.000000 | 0.0.0.0 | 255.255.255.255 | DHCP | 292 | DHCP Request — Transaction ID 0x3d1e |
| 2 | 0.002100 | 68.85.2.1 | 255.255.255.255 | DHCP | 304 | DHCP ACK — yiaddr 68.85.2.101 |
| 3 | 0.010400 | 00:16:d3:23:68:8a | Broadcast | ARP | 60 | Who has 68.85.2.1? Tell 68.85.2.101 |
| 4 | 0.011100 | 00:22:6b:45:1f:1b | 00:16:d3:23:68:8a | ARP | 60 | 68.85.2.1 is at 00:22:6b:45:1f:1b |
| 5 | 0.011800 | 68.85.2.101 | 68.87.71.226 | DNS | 74 | Standard query A www.google.com |
| 6 | 0.039200 | 68.87.71.226 | 68.85.2.101 | DNS | 90 | Standard query response A 64.233.169.105 |
| 7 | 0.040100 | 68.85.2.101 | 64.233.169.105 | TCP | 54 | 49153 → 80 [SYN] Seq=0x51a20000 |
| 8 | 0.068400 | 64.233.169.105 | 68.85.2.101 | TCP | 54 | 80 → 49153 [SYN, ACK] Seq=0x9c4f0000 Ack=0x51a20001 |
| 9 | 0.068500 | 68.85.2.101 | 64.233.169.105 | TCP | 54 | 49153 → 80 [ACK] Ack=0x9c4f0001 |
| 10 | 0.068700 | 68.85.2.101 | 64.233.169.105 | HTTP | 162 | GET / HTTP/1.1 Host: www.google.com |
| 11 | 0.097100 | 64.233.169.105 | 68.85.2.101 | HTTP | 179 | HTTP/1.1 200 OK (text/html) |
Packet 1 — Steps 1 to 3. Bob’s laptop has no address yet, so the source IP is 0.0.0.0 and the destination is the broadcast 255.255.255.255. The frame goes to FF:FF:FF:FF:FF:FF, and the switch broadcasts it on every port — including the one leading to the router. Everything the laptop will do for the rest of this capture depends on the answer.
Protocol tree — click a field
The actual bytes
0000 ff ff ff ff ff ff 00 16 d3 23 68 8a 08 00 45 00 .........#h...E.0010 01 16 10 00 00 00 40 11 69 d8 00 00 00 00 ff ff ......@.i.......0020 ff ff 00 44 00 43 01 02 89 5a 01 01 06 00 00 00 ...D.C...Z......0030 3d 1e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 =...............0040 00 00 00 00 00 00 00 16 d3 23 68 8a 00 00 00 00 .........#h.....0050 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................0060 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................0070 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................0080 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................0090 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................00a0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................00b0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................00c0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................00d0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................00e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................00f0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................0100 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................0110 00 00 00 00 00 00 63 82 53 63 35 01 03 37 03 01 ......c.Sc5..7..0120 03 06 ff 00 ....
Eleven frames, six protocols, and one chain: every address after frame 2 was learned from an earlier frame in this capture. Nothing here was typed in twice.
In plain words — read this capture as a chain
Nothing in this capture after frame 2 was decided in advance. Every address in it was learned from an earlier frame.
- Frame 3 asks about 68.85.2.1 — because frame 2’s DHCP option 3 said so.
- Frame 5 is sent to 68.87.71.226 — because frame 2’s option 6 said so.
- Frame 5’s Ethernet destination is 00:22:6B:45:1F:1B — because frame 4 said so.
- Frames 7, 9 and 10 are sent to 64.233.169.105 — because frame 6’s answer record said so.
- Every one of them has source 68.85.2.101 — because frame 2’s yiaddr said so.
Pull out any one frame and the ones after it have nowhere to go. That is what it means to say these are not twenty-four facts but one chain.
The two frames worth opening side by side
Open frame 5 and look at its two destination fields.
The IP (Internet Protocol) Internet Protocol The network-layer protocol that defines the datagram format and addressing every Internet device must use. introduced in ch. 1 destination is 68.87.71.226, the DNS server, several networks away. The Ethernet destination is 00:22:6B:45:1F:1B, the router two metres down the corridor.
Both are correct, and they are correct about different questions. The datagram is addressed to where it is going; the frame is addressed to the next machine that will handle it. Section 6.4.1 made that argument with two figures. Here it is in one packet, in the middle of a real request.
Then look at the time to live in frames 6, 8 and 11. It is not 64. Those datagrams crossed routers this capture cannot see — the whole of steps 14 to 16 and 19 — and each router left a mark.
What is still missing
The book is careful to say this scenario, detailed as it looks, leaves things out. In a real school network you would also meet:
- NAT (Network Address Translation) Network Address Translation Letting a whole private network share one public IP address by rewriting addresses and ports. introduced in ch. 4 running in the gateway router (§4.3.3)
- Wireless access to the school network (chapter 7)
- Security protocols for getting onto the network, and for encrypting the segments and datagrams (chapter 8)
- Network management protocols (§5.7)
- Web caching and the full DNS hierarchy (§2.2.5, §2.4.2)
Everyday picture
You arrive in a country where you have no phone, no address and no map, and you want to send one letter to a company you know only by name.
First you must be given an address of your own, and told where the post office is and which road leads out of town.
Then you need the company’s street address, which means asking a directory. But to reach the directory you must first learn which van at the end of your road goes there. Only then can you write the letter.
Where the picture stops. A person doing all this would notice how long it took. Bob’s laptop did the equivalent in 97 milliseconds, and Bob noticed nothing at all except a page appearing.
Check yourself
Check yourself
0 of 7 answered1.Bob's laptop sends its DHCP request with a source IP address of 0.0.0.0. Why?
2.How many separate things does the DHCP ACK teach Bob's laptop?
3.predictIn this whole request, how many ARP exchanges does Bob's laptop perform, and what for?
4.predictOpen frame 5, the DNS query. What are its IP destination and its Ethernet destination?
5.predictFrames 6, 8 and 11 arrive with a time to live of 57 or 53 rather than 64. What does that tell you?
6.Bob typed the URL before step 8. Why does the HTTP GET not appear until frame 10 of 11?
7.The book says this scenario, detailed as it is, still leaves things out. Which of these is NOT in it?
What to remember
- DHCP first, always. With no address, no gateway and no DNS server, nothing else can start, and one DHCP ACK (acknowledgement) acknowledgement A message, or a header field, saying that data was received correctly. Written ACK in diagrams and code, "acknowledgement" in prose. introduced in ch. 3 answers all four questions at once.
- ARP is asked exactly once, and only about the gateway router. Nothing off your subnet is ever ARPed for, because a frame carrying a datagram to a far host is addressed to the next router.
- Twenty-four steps, eleven frames on Bob’s link, six protocols, five layers — and 97 milliseconds. The whole thing is one chain: every address is something an earlier message taught.