• The 32-bit IPv4 address space provides

approximately 4,294,967,296 unique

addresses.

• IPv6 address space provides

340,282,366,920,938,463,463,374,607,431,76
8,211,456, or 340 undecillion addresses.
• This is roughly equivalent to every grain of
sand on Earth.
The hexadecimal numbering system is used in
networking to represent IP Version 6
addresses and Ethernet MAC addresses.

IPv6 addresses are 128 bits in length and every 4

bits is represented by a single hexadecimal
digit; for a total of 32 hexadecimal values. IPv6
addresses are not case-sensitive and can be
written in either lowercase or uppercase.
When referring to 8 bits of an IPv4 address we
use the term octet.

In IPv6, a hextet is the unofficial term used to

refer to a segment of 16 bits or four
hexadecimal values.

Each “x” is a single hextet, 16 bits, or four

hexadecimal digits.
Quiz - Number Systems
Purpose of the Data Link Layer
 IEEE 802 LAN/MAN Data Link Sublayers

• IEEE 802 LAN/MAN standards are specific to

Ethernet LANs, wireless LANs (WLAN), wireless
personal area networks (WPAN) and other
types of local and metropolitan area networks.
• The IEEE 802 LAN/MAN data link layer consists
of the following two sublayers:
• Logical Link Control (LLC) - This IEEE 802.2 sublayer
communicates between the networking software at the
upper layers and the device hardware at the lower
layers. It places information in the frame that identifies
which network layer protocol is being used for the
frame. This information allows multiple Layer 3
protocols, such as IPv4 and IPv6, to use the same
network interface and media.

• Media Access Control (MAC) – Implements this

sublayer (IEEE 802.3, 802.11, or 802.15) in hardware. It
is responsible for data encapsulation and media access
control. It provides data link layer addressing and it is
integrated with various physical layer technologies.
 Topologies
Physical and Logical Topologies

• Physical topology – Identifies the physical connections

and how end devices and intermediary devices (i.e,
routers, switches, and wireless access points) are
interconnected.

• Logical topology - Refers to the way a network transfers

frames from one node to the next. This topology
identifies virtual connections using device interfaces and
Layer 3 IP addressing schemes.
Ethernet Frames
 MAC Sublayer
The MAC sublayer is responsible for data encapsulation and
accessing the media.
Data Encapsulation
IEEE 802.3 data encapsulation includes the following:

• Ethernet frame - This is the internal structure of the

Ethernet frame.
• Ethernet Addressing - The Ethernet frame includes both a
source and destination MAC address to deliver the
Ethernet frame from Ethernet NIC to Ethernet NIC on the
same LAN.
• Ethernet Error detection - The Ethernet frame includes a
frame check sequence (FCS) trailer used for error detection.
 Ethernet Frame Fields

The minimum Ethernet frame size is 64 bytes

and the expected maximum is 1518 bytes.

This includes all bytes from the destination MAC

address field through the frame check
sequence (FCS) field.

The preamble field is not included when

describing the size of the frame.
• Any frame less than 64 bytes in length is
considered a “collision fragment” or “runt
frame” and is automatically discarded by
receiving stations.

• Frames with more than 1500 bytes of data are

considered “jumbo” or “baby giant frames”.

• Jumbo frames are usually supported by most

Fast Ethernet and Gigabit Ethernet switches
and NICs.
The MAC Address Table
 How a Host Routes
Another role of the network layer is to direct packets between hosts.
A host can send a packet to the following:

• Itself - A host can ping itself by sending a packet to a special IPv4

address of 127.0.0.1 or an IPv6 address ::1, which is referred to as
the loopback interface. Pinging the loopback interface tests the
TCP/IP protocol stack on the host.

• Local host - This is a destination host that is on the same local

network as the sending host. The source and destination hosts
share the same network address.

• Remote host - This is a destination host on a remote network. The

source and destination hosts do not share the same network
address.
 Default Gateway
On a network, a default gateway is usually a
router with these features:

• It has a local IP address in the same address

range as other hosts on the local network.

• It can accept data into the local network and

forward data out of the local network.

• It routes traffic to other networks.

Host Routing Tables
 Introduction to Routing

• The router examines the destination IP

address of the packet and searches its routing
table to determine where to forward the
packet.
• The routing table contains a list of all known
network addresses (prefixes) and where to
forward the packet.
• These entries are known as route entries or
routes. The router will forward the packet
using the best (longest) matching route entry.
 IP Router Routing Table
The routing table of the router contains network route entries listing all
the possible known network destinations.

The routing table stores three types of route entries:

Directly-connected networks - These network route entries

are active router interfaces.

Remote networks - These network route entries are

connected to other routers.

Default route – Like a host, most routers also include a

default route entry, a gateway of last resort.
Static routing has the following characteristics:

• A static route must be configured manually.

• The administrator needs to reconfigure a static route

if there is a change in the topology and the static
route is no longer viable.

• A static route is appropriate for a small network and

when there are few or no redundant links.

• A static route is commonly used with a dynamic

routing protocol for configuring a default route.
 Dynamic Routing

A dynamic routing protocol allows the routers to

automatically learn about remote networks, including
a default route, from other routers.

Routers that use dynamic routing protocols automatically

share routing information with other routers and
compensate for any topology changes without
involving the network administrator.

If there is a change in the network topology, routers

share this information using the dynamic routing
protocol and automatically update their routing tables.
Dynamic routing protocols include

• OSPF and
• Enhanced Interior Gateway Routing Protocol
(EIGRP).
Basic configuration only requires the network
administrator to enable the directly connected
networks within the dynamic routing protocol. The
dynamic routing protocol will automatically do as
follows:

• Discover remote networks

• Maintain up-to-date routing information
• Choose the best path to destination networks
• Attempt to find a new best path if the current path is no
longer available

Note: It is common for some routers to use a combination

of both static routes and a dynamic routing protocol.
Introduction to an IPv4 Routing Table
The show ip route privileged EXEC mode command is used to
view the IPv4 routing table on a Cisco IOS router. The
example shows the IPv4 routing table of router R1.

At the beginning of each routing table entry is a code that is

used to identify the type of route or how the route was
learned.
Common route sources (codes) include these:

• L - Directly connected local interface IP address

• C – Directly connected network
• S – Static route was manually configured by an administrator
• O - OSPF
• D - EIGRP
• A directly connected route is automatically
created when a router interface is configured
with IP address information and is activated.
• The router adds two route entries with the
codes C (i.e., the connected network)
and L (i.e., the local interface IP address of the
connected network).
• The route entries also identify the exit
interface to use to reach the network.
• The two directly connected networks in this
example are 192.168.10.0/24 and
209.165.200.224/30.
• A default route has a network address of all
zeroes. For example, the IPv4 network address
is 0.0.0.0.
• A static route entry in the routing table begins
with a code of S*, as highlighted in the
example.
 MAC and IP
Destination on Same Network

• There are two primary addresses assigned to a device

on an Ethernet LAN:

• Physical address (the MAC address) – Used for NIC to

NIC communications on the same Ethernet network.

• Logical address (the IP address) – Used to send the

packet from the source device to the destination device.
The destination IP address may be on the same IP
network as the source or it may be on a remote
network.
Destination on Remote Network
Check Your Understanding - MAC and IP
 ARP

• If your network is using the IPv4 communications protocol, the

Address Resolution Protocol, or ARP, is what you need to map IPv4
addresses to MAC addresses.

• A device uses Address Resolution Protocol (ARP) to determine the

destination MAC address of a local device when it knows its IPv4
address.

ARP provides two basic functions:

• Resolving IPv4 addresses to MAC addresses

• Maintaining a table of IPv4 to MAC address mappings
 Removing Entries from an ARP Table

• For each device, an ARP cache timer removes

ARP entries that have not been used for a
specified period of time.
• The times differ depending on the operating
system of the device.

• For example, newer Windows operating

systems store ARP table entries between 15
and 45 seconds, as illustrated in the figure.
ARP Tables on Networking Devices
ARP Issues - ARP Broadcasts and ARP Spoofing
• As a broadcast frame, an ARP request is received and
processed by every device on the local network. On a
typical business network, these broadcasts would
probably have minimal impact on network performance.

• However, if a large number of devices were to be

powered up and all start accessing network services at the
same time, there could be some reduction in performance
for a short period of time, as shown in the figure.

• After the devices send out the initial ARP broadcasts and
have learned the necessary MAC addresses, any impact
on the network will be minimized.
• In some cases, the use of ARP can lead to a potential security risk.

• A threat actor can use ARP spoofing to perform an ARP poisoning

attack.

• This is a technique used by a threat actor to reply to an ARP

request for an IPv4 address that belongs to another device, such
as the default gateway, as shown in the figure.

• The threat actor sends an ARP reply with its own MAC address.
The receiver of the ARP reply will add the wrong MAC address to
its ARP table and send these packets to the threat actor.

•
Enterprise level switches include mitigation techniques known as
dynamic ARP inspection (DAI).
 IPv6 Neighbor Discovery
IPv6 Neighbor Discovery protocol is sometimes referred to as
ND or NDP.

ND provides address resolution, router discovery, and

redirection services for IPv6 using ICMPv6. ICMPv6 ND
uses five ICMPv6 messages to perform these services:

• Neighbor Solicitation messages

• Neighbor Advertisement messages
• Router Solicitation messages
• Router Advertisement messages
• Redirect Message
Neighbor Solicitation and Neighbor
Advertisement messages are used for device-
to-device messaging such as address
resolution (similar to ARP for IPv4).

Devices include both host computers and

routers.
 IPv6 Neighbor Discovery - Address Resolution

• Much like ARP for IPv4, IPv6 devices use IPv6 ND to determine
the MAC address of a device that has a a known IPv6 address.

• ICMPv6 Neighbor Solicitation and Neighbor Advertisement

messages are used for MAC address resolution.

• This is similar to ARP Requests and ARP Replies used by ARP for
IPv4. For example, assume PC1 wants to ping PC2 at IPv6
address 2001:db8:acad::11.

• To determine the MAC address for the known IPv6 address, PC1
sends an ICMPv6 Neighbor Solicitation message as illustrated in
the figure.
Configure Initial Router Settings
 Configure Initial Router Settings
quiz
• Configure the device name.
• Secure the privileged EXEC mode.
• Secure and enable remote SSH and Telnet
access.
• Secure all plaintext passwords.
• Provide legal notification.
 Configure Interfaces

• The task to configure a router interface is very

similar to a management SVI on a switch.
Specifically, it includes issuing the following
commands:
• In this example, the directly connected
interfaces of R1 in the topology diagram will
be enabled.
Configuration Verification Commands
 Quiz
• Describe the link as 'Link to LAN'.
• Configure the IPv4 address as 192.168.10.1
with the subnet mask 255.255.255.0.
• Configure the IPv6 address as
2001:db8:acad:10::1 with the /64 prefix
length.
• Activate the interface.
 Configure the Default Gateway
Default Gateway on a Host

• If your local network has only one router, it

will be the gateway router and all hosts and
switches on your network must be configured
with this information.
• If your local network has multiple routers, you
must select one of them to be the default
gateway router.
• For an end device to communicate over the network,
it must be configured with the correct IP address
information, including the default gateway address.

• The default gateway is only used when the host wants

to send a packet to a device on another network.

• The default gateway address is generally the router

interface address attached to the local network of the
host.

• The IP address of the host device and the router

interface address must be in the same network.
 Default Gateway on a Switch

• A switch that interconnects client computers is

typically a Layer 2 device. As such, a Layer 2
switch does not require an IP address to
function properly.

• However, an IP configuration can be

configured on a switch to give an
administrator remote access to the switch.
• To connect to and manage a switch over a local IP
network, it must have a switch virtual interface (SVI)
configured.

• The SVI is configured with an IPv4 address and subnet

mask on the local LAN.

• The default gateway address is typically configured on

all devices that will communicate beyond their local
network.

• The switch must also have a default gateway address

configured to remotely manage the switch from another
network.
• To configure an IPv4 default gateway on a
switch, use the ip default-gateway ip-
address global configuration command.

• The ip-address that is configured is the IPv4

address of the local router interface
connected to the switch.
Quiz - Basic Router Configuration
IPv4 Address Structure
• Note: A default gateway IPv4 address is
required to reach remote networks and DNS
server IPv4 addresses are required to translate
domain names to IPv4 addresses.
The Prefix Length
Types of IPv4 Addresses
Public and Private IPv4 Addresses
• Public IPv4 addresses are addresses which are
globally routed between internet service
provider (ISP) routers.

• However, not all available IPv4 addresses can

be used on the internet.

• There are blocks of addresses called private

addresses that are used by most organizations
to assign IPv4 addresses to internal hosts.
 Special Use IPv4 Addresses

• There are certain addresses, such as the

network address and broadcast address, that
cannot be assigned to hosts.

• There are also special addresses that can be

assigned to hosts, but with restrictions on how
those hosts can interact within the network.
• Loopback addresses (127.0.0.0 /8 or 127.0.0.1 to
127.255.255.254) are more commonly identified as only
127.0.0.1, these are special addresses used by a host to
direct traffic to itself.

• For example, it can be used on a host to test if the TCP/IP

configuration is operational, as shown in the figure.

• Notice how the 127.0.0.1 loopback address replies to

the ping command.

• Also note how any address within this block will loop back
to the local host, which is shown with the second ping in
the figure.
• Link-local addresses (169.254.0.0 /16 or
169.254.0.1 to 169.254.255.254) are more
commonly known as the Automatic Private IP
Addressing (APIPA) addresses or self-assigned
addresses.
• They are used by a Windows DHCP client to self-
configure in the event that there are no DHCP
servers available.
• Link-local addresses can be used in a peer-to-
peer connection
Activity - Public or Private IPv4 Address
Network Segmentation
• Routers do not propagate broadcasts. When a
router receives a broadcast, it does not
forward it out other interfaces.

• or instance, when R1 receives a broadcast on

its Gigabit Ethernet 0/0 interface, it does not
forward out another interface.

• Therefore, each router interface connects to a

broadcast domain and broadcasts are only
propagated within that specific broadcast
domain.
 Problems with Large Broadcast Domains
• A large broadcast domain is a network that connects many
hosts.

• A problem with a large broadcast domain is that these hosts

can generate excessive broadcasts and negatively affect the
network.

• In the figure, LAN 1 connects 400 users that could generate an

excess amount of broadcast traffic.

• This results in slow network operations due to the significant

amount of traffic it can cause, and slow device operations
because a device must accept and process each broadcast
packet.
• Notice how the prefix length has changed
from a single /16 network to two /24
networks.

• This is the basis of subnetting: using host bits

to create additional subnets.

• Note: The terms subnet and network are often

used interchangeably. Most networks are a
subnet of some larger address block.
 Reasons for Segmenting Networks
• Subnetting reduces overall network traffic and
improves network performance.

• It also enables an administrator to implement

security policies such as which subnets are
allowed or not allowed to communicate together.

• Another reason is that it reduces the number of

devices affected by abnormal broadcast traffic
due to misconfigurations, hardware/software
problems, or malicious intent.
• Understanding how to subnet networks is a
fundamental skill that all network
administrators must develop.

• Various methods have been created to help

understand this process.

• Although a little overwhelming at first, pay

close attention to the detail and, with practice,
subnetting will become easier.
Subnet an IPv4 Network