Network Administrator Network Security

Introduction to the TCP/IP application layer

When the TCP/IP model was designed, the session and presentation layers from the OSI model were bundled into the application layer of the TCP model. This means that issues of representation, encoding, and dialog control are handled in the application layer rather than in separate lower layers as in the OSI model. This design assures that the TCP/IP model provides maximum flexibility at the application layer for developers of software. The TCP/IP protocols that support file transfer, e-mail, and remote login are probably the most familiar to users of the Internet. These protocols include the following applications: Domain Name System (DNS) File Transfer Protocol (FTP) Hypertext Transfer Protocol (HTTP) Simple Mail Transfer Protocol (SMTP) Simple Network Management Protocol (SNMP) Telnet

DNS

The Internet is built on a hierarchical addressing scheme. This scheme allows for routing to be based on classes of addresses rather than based on individual addresses. The problem this creates for the user is associating the correct address with the Internet site. It is very easy to forget an IP address to a particular site because there is nothing to associate the contents of the site with the address. Imagine the difficulty of remembering the IP addresses of tens, hundreds, or even thousands of Internet sites.

A domain naming system was developed in order to associate the contents of the site with the address of that site. The Domain Name System (DNS) is a system used on the Internet for translating names of domains and their publicly advertised network nodes into IP addresses. A domain is a group of computers that are associated by their geographical location or their business type. A domain name is a string of characters, number, or both. Usually a name or abbreviation that represents the numeric address of an Internet site will make up the domain name. There are more than 200 top-level domains on the Internet, examples of which include the following:

.us – United States
.uk – United Kingdom

There are also generic names, which examples include the following:

.edu – educational sites
.com – commercial sites
.gov – government sites
.org – non-profit sites
.net – network service

See Figure for a detailed explanation of these domains.

FTP and TFTP

FTP is a reliable, connection-oriented service that uses TCP to transfer files between systems that support FTP. The main purpose of FTP is to transfer files from one computer to another by copying and moving files from servers to clients, and from clients to servers. When files are copied from a server, FTP first establishes a control connection between the client and the server. Then a second connection is established, which is a link between the computers through which the data is transferred. Data transfer can occur in ASCII mode or in binary mode. These modes determine the encoding used for data file, which in the OSI model is a presentation layer task. After the file transfer has ended, the data connection terminates automatically. When the entire session of copying and moving files is complete, the command link is closed when the user logs off and ends the session. TFTP is a connectionless service that uses User Datagram Protocol (UDP). TFTP is used on the router to transfer configuration files and Cisco IOS images and to transfer files between systems that support TFTP. TFTP is designed to be small and easy to implement. Therefore, it lacks most of the features of FTP. TFTP can read, write, or mail files to or from a remote server but it cannot list directories and currently has no provisions for user authentication. It is useful in some LANs because it operates faster than FTP and in a stable environment it works reliably.

HTTP

Hypertext Transfer Protocol (HTTP) works with the World Wide Web, which is the fastest growing and most used part of the Internet. One of the main reasons for the extraordinary growth of the Web is the ease with which it allows access to information. A Web browser is a client-server application, which means that it requires both a client and a server component in order to function. A Web browser presents data in multimedia formats on Web pages that use text, graphics, sound, and video. The Web pages are created with a format language called Hypertext Markup Language (HTML). HTML directs a Web browser on a particular Web page to produce the appearance of the page in a specific manner. In addition, HTML specifies locations for the placement of text, files, and objects that are to be transferred from the Web server to the Web browser.

Hyperlinks make the World Wide Web easy to navigate. A hyperlink is an object, word, phrase, or picture, on a Web page. When that hyperlink is clicked, it directs the browser to a new Web page. The Web page contains, often hidden within its HTML description, an address location known as a Uniform Resource Locator (URL).

In the URL http://www.cisco.com/edu/, the "http://" tells the browser which protocol to use. The second part, "www", is the hostname or name of a specific machine with a specific IP address. The last part, /education identifies the specific folder location on the server that contains the default web page.

A Web browser usually opens to a starting or "home" page. The URL of the home page has already been stored in the configuration area of the Web browser and can be changed at any time. From the starting page, click on one of the Web page hyperlinks, or type a URL in the address bar of the browser. The Web browser examines the protocol to determine if it needs to open another program, and then determines the IP address of the Web server using DNS. Then the transport layer, network layer, data link layer, and physical layer work together to initiate a session with the Web server. The data that is transferred to the HTTP server contains the folder name of the Web page location. The data can also contain a specific file name for an HTML page. If no name is given, then the default name as specified in the configuration on the server is used.

The server responds to the request by sending to the Web client all of the text, audio, video, and graphic files specified in the HTML instructions. The client browser reassembles all the files to create a view of the Web page, and then terminates the session. If another page that is located on the same or a different server is clicked, the whole process begins again.

SMTP

Email servers communicate with each other using the Simple Mail Transfer Protocol (SMTP) to send and receive mail. The SMTP protocol transports email messages in ASCII format using TCP. When a mail server receives a message destined for a local client, it stores that message and waits for the client to collect the mail. There are several ways for mail clients to collect their mail. They can use programs that access the mail server files directly or collect their mail using one of many network protocols. The most popular mail client protocols are POP3 and IMAP4, which both use TCP to transport data. Even though mail clients use these special protocols to collect mail, they almost always use SMTP to send mail. Since two different protocols, and possibly two different servers, are used to send and receive mail, it is possible that mail clients can perform one task and not the other. Therefore, it is usually a good idea to troubleshoot e-mail sending problems separately from e-mail receiving problems. When checking the configuration of a mail client, verify that the SMTP and POP or IMAP settings are correctly configured. A good way to test if a mail server is reachable is to Telnet to the SMTP port (25) or to the POP3 port (110). The following command format is used at the Windows command line to test the ability to reach the SMTP service on the mail server at IP address 192.168.10.5: C:\>telnet 192.168.10.5 25 The SMTP protocol does not offer much in the way of security and does not require any authentication. Administrators often do not allow hosts that are not part of their network to use their SMTP server to send or relay mail. This is to prevent unauthorized users from using their servers as mail relays.

SNMP.

The Simple Network Management Protocol (SNMP) is an application layer protocol that facilitates the exchange of management information between network devices. SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth. SNMP uses UDP as its transport layer protocol. An SNMP managed network consists of the following three key components: Network management system (NMS) – NMS executes applications that monitor and control managed devices. The bulk of the processing and memory resources required for network management are provided by NMS. One or more NMSs must exist on any managed network. Managed devices – Managed devices are network nodes that contain an SNMP agent and that reside on a managed network. Managed devices collect and store management information and make this information available to NMSs using SNMP. Managed devices, sometimes called network elements, can be routers, access servers, switches, and bridges, hubs, computer hosts, or printers. Agents – Agents are network-management software modules that reside in managed devices. An agent has local knowledge of management information and translates that information into a form compatible with SNMP.

Telnet

Telnet client software provides the ability to login to a remote Internet host that is running a Telnet server application and then to execute commands from the command line. A Telnet client is referred to as a local host. Telnet server, which uses special software called a daemon, is referred to as a remote host. To make a connection from a Telnet client, the connection option must be selected. A dialog box typically prompts for a host name and terminal type. The host name is the IP address or DNS name of the remote computer. The terminal type describes the type of terminal emulation that the Telnet client should perform. The Telnet operation uses none of the processing power from the transmitting computer. Instead, it transmits the keystrokes to the remote host and sends the resulting screen output back to the local monitor. All processing and storage take place on the remote computer. Telnet works at the application layer of the TCP/IP model. Therefore, Telnet works at the top three layers of the OSI model. The application layer deals with commands. The presentation layer handles formatting, usually ASCII. The session layer transmits. In the TCP/IP model, all of these functions are considered to be part of the application layer.\ Cisco Systems, Inc.

Introduction to transport layer

The primary duties of the transport layer, Layer 4 of the OSI model, are to transport and regulate the flow of information from the source to the destination, reliably and accurately. End-to-end control and reliability are provided by sliding windows, sequencing numbers, and acknowledgments. To understand reliability and flow control, think of someone who studies a foreign language for one year and then they visit the country where that language is used. In conversation, words must be repeated for reliability and to speak slowly so that the meaning of the conversation is not lost, this is flow control. The transport layer provides transport services from the source host to the destination host. It establishes a logical connection between the endpoints of the network. Transport services segment and reassemble several upper-layer applications onto the same transport layer data stream. This transport layer data stream provides end-to-end transport services. The transport layer data stream is a logical connection between the endpoints of a network. Its primary duties are to transport and regulate the flow of information from source to destination reliably and accurately. The primary duty of Layer 4 is to provide end-to-end control using sliding windows and to provide reliability in sequencing numbers and acknowledgments. The transport layer defines end-to-end connectivity between host applications. Transport services include the following basic services: Segmentation of upper-layer application data Establishment of end-to-end operations Transport of segments from one end host to another end host Flow control provided by sliding windows Reliability provided by sequence numbers and acknowledgments TCP/IP is a combination of two individual protocols. IP operates at Layer 3, and is a connectionless protocol that provides best-effort delivery across a network. TCP operates at Layer 4, and is a connection-oriented service that provides flow control as well as reliability. By pairing these protocols, a wider range of services is provided. Together, they are the basis for an entire suite of protocols called the TCP/IP protocol suite. The Internet is built upon this TCP/IP protocol suite.

Flow control

As the transport layer sends data segments, it tries to ensure that data is not lost. A receiving host that is unable to process data as quickly as it arrives could be a cause of data loss. The receiving host is then forced to discard it. Flow control avoids the problem of a transmitting host overflowing the buffers in the receiving host. TCP provides the mechanism for flow control by allowing the sending and receiving host to communicate. The two hosts then establish a data-transfer rate that is agreeable to both

Session establishment, maintenance, and termination overview

Multiple applications can share the same transport connection in the OSI reference model. Transport functionality is accomplished on a segment-by-segment basis. In other words, different applications can send data segments on a first-come, first-served basis. The segments that arrive first will be taken care of first. These segments can be routed to the same or different destinations. This is referred to as the multiplexing of upper-layer conversations.

One function of the transport layer is to establish a connection-oriented session between similar devices at the application layer. For data transfer to begin, both the sending and receiving applications inform the respective operating systems that a connection will be initiated. One node initiates a connection that must be accepted by the other. Protocol software modules in the two operating systems communicate with each other by sending messages across the network to verify that the transfer is authorized and that both sides are ready.

The connection is established and the transfer of data begins after all synchronization has occurred. During transfer, the two machines continue to communicate with their protocol software to verify that data is received correctly.

Figure shows a typical connection between the sending and receiving systems. The first handshake requests synchronization. The second and third handshakes acknowledge the initial synchronization request, as well as synchronizing connection parameters in the opposite direction. The final handshake segment is an acknowledgment used to inform the destination that both sides agree that a connection has been established. After the connection has been established, data transfer begins.

Congestion can occur during data transfer for two reasons. First, a high-speed computer might be capable of generating traffic faster than a network can transfer it. Second, if many computers simultaneously need to send datagrams to a single destination, that destination can experience congestion, although no single source caused the problem.

When datagrams arrive too quickly for a host or gateway to process, they are temporarily stored in memory. If the traffic continues, the host or gateway eventually exhausts its memory and must discard additional datagrams that arrive.

Instead of allowing data to be lost, the transport function can issue a “not ready” indicator to the sender. Acting like a stop sign, this indicator signals the sender to stop sending data. When the receiver can handle additional data, the receiver sends a “ready” transport indicator. When this indicator is received, the sender can resume the segment transmission.

At the end of data transfer, the sending host sends a signal that indicates the end of the transmission. The receiving host at the end of the data sequence acknowledges the end of transmission and the connection is terminated.

Three-way handshake

TCP is a connection-oriented protocol. TCP requires connection establishment before data transfer begins. For a connection to be established or initialized, the two hosts must synchronize their Initial Sequence Numbers (ISNs). Synchronization is done through an exchange of connection establishing segments that carry a control bit called SYN, for synchronize, and the ISNs. Segments that carry the SYN bit are also called “SYNs". This solution requires a suitable mechanism for picking an initial sequence number and a slightly involved handshake to exchange the ISNs. The synchronization requires each side to send its own initial sequence number and to receive a confirmation of exchange in an acknowledgment (ACK) from the other side. Each side must also receive the INS from the other side and send a confirming ACK. The sequence is as follows: A→B SYN—(A) initial sequence number is X, ACK number is 0, SYN bit is set, but ACK bit is not set. B→A ACK—(A) sequence number is X + 1, (B) initial sequence number is Y, and SYN and ACK bit are set. A→B ACK—(B) sequence number is Y + 1, (A) sequence number is X + 1, the ACK bit is set, but the SYN bit is not set. This exchange is called the three-way handshake. A three-way handshake is necessary because sequence numbers are not tied to a global clock in the network and TCP protocols may have different mechanisms for picking the ISN. The receiver of the first SYN has no way of knowing whether the segment was an old delayed one, unless it remembers the last sequence number used on the connection. Recalling that number is not always possible Therefore, the receiver must ask the sender to verify this SYN.

Windowing

Data packets must be delivered to the recipient in the same order in which they were transmitted to have a reliable, connection-oriented data transfer. The protocol fails if any data packets are lost, damaged, duplicated, or received in a different order. An easy solution is to have a recipient acknowledge the receipt of each packet before the next packet is sent.

If the sender must wait for an acknowledgment after sending each packet, throughput would be low. Therefore, most connection-oriented, reliable protocols allow more than one packet to be outstanding on the network at one time. Because time is available after the sender finishes transmitting the data packet and before the sender finishes processing any received acknowledgment, this interval is used for transmitting more data. The number of data packets the sender is allowed to have outstanding without having received an acknowledgment is known as the window size, or window.

TCP uses expectational acknowledgments. Expectational acknowledgements mean that the acknowledgment number refers to the packet that is next expected. Windowing refers to the fact that the window size is negotiated dynamically during the TCP session. Windowing is a flow-control mechanism. Windowing requires that the source device receive an acknowledgment from the destination after transmitting a certain amount of data. The receiving TCP process reports a “window” to the sending TCP. This window specifies the number of packets, starting with the acknowledgment number, that the receiving TCP process is currently prepared to receive.

With a window size of three, the source device can send three packets to the destination. The source device must then wait for an acknowledgment. If the destination receives the three packets, it sends an acknowledgment to the source device, which can now transmit three more packets. If the destination does not receive the three packets, because of overflowing buffers, it does not send an acknowledgment. Because the source does not receive an acknowledgment, it knows that the packets should be retransmitted, and that the transmission rate should be slowed.

TCP window sizes are variable during the lifetime of a connection. Each acknowledgement contains a window advertisement that indicates the number of bytes the receiver can accept. TCP also maintains a congestion-control window. This window is normally the same size as the window of the receiver. However, this window is cut in half when a packet is lost, perhaps as a result of network congestion. This approach permits the window to be expanded or contracted as necessary to manage buffer space and processing. A larger window size allows more data to be processed.

As shown in Figure , the sender sends three packets before expecting an ACK. If the receiver can handle a window size of only two packets, the window drops packet three, specifies three as the next packet, and specifies a new window size of two. The sender sends the next two packets, but still specifies a window size of three. This means that the sender will still expect a three packet acknowledgement from the receiver. The receiver replies by requesting packet five and again specifying a window size of two.

Acknowledgment

Reliable delivery guarantees that a stream of data sent from one device is delivered through a data link to another device without duplication or data loss. Positive acknowledgment with retransmission is one technique that guarantees reliable delivery of data. Positive acknowledgment requires a recipient to communicate with the source and send back an acknowledgment message when the data is received. The sender keeps a record of each data packet (TCP segment), that it sends and expects an acknowledgment. The sender also starts a timer when it sends a segment and will retransmit a segment if the timer expires before an acknowledgment arrives. Figure shows the sender transmitting data packets 1, 2, and 3. The receiver acknowledges receipt of the packets by requesting packet 4. Upon receiving the acknowledgment, the sender sends packets 4, 5, and 6. If packet 5 does not arrive at the destination, the receiver acknowledges with a request to resend packet 5. The sender resends packet 5 and then receives an acknowledgment to continue with the transmission of packet 7. TCP provides sequencing of segments with a forward reference acknowledgment. Each datagram is numbered before transmission. At the receiving station, TCP reassembles the segments into a complete message. If a sequence number is missing in the series, that segment is retransmitted. Segments that are not acknowledged within a given time period will result in a retransmission.

Transmission Control Protocol (TCP)

Transmission Control Protocol (TCP) is a connection-oriented Layer 4 protocol that provides reliable full-duplex data transmission. TCP is part of the TCP/IP protocol stack. In a connection-oriented environment, a connection is established between both ends before the transfer of information can begin. TCP is responsible for breaking messages into segments, reassembling them at the destination station, resending anything that is not received, and reassembling messages from the segments. TCP supplies a virtual circuit between end-user applications. The protocols that use TCP include: FTP (File Transfer Protocol) HTTP (Hypertext Transfer Protocol) SMTP (Simple Mail Transfer Protocol) Telnet The following are the definitions of the fields in the TCP segment: Source port – Number of the calling port Destination port – Number of the called port Sequence number – Number used to ensure correct sequencing of the arriving data Acknowledgment number – Next expected TCP octet HLEN – Number of 32-bit words in the header Reserved – Set to zero Code bits – Control functions, such as setup and termination of a session Window – Number of octets that the sender is willing to accept Checksum – Calculated checksum of the header and data fields Urgent pointer – Indicates the end of the urgent data Option – One option currently defined, maximum TCP segment size Data – Upper-layer protocol data

User Datagram Protocol (UDP)

User Datagram Protocol (UDP) is the connectionless transport protocol in the TCP/IP protocol stack. UDP is a simple protocol that exchanges datagrams, without acknowledgments or guaranteed delivery. Error processing and retransmission must be handled by higher layer protocols.

UDP uses no windowing or acknowledgments so reliability, if needed, is provided by application layer protocols. UDP is designed for applications that do not need to put sequences of segments together.

The protocols that use UDP include:

• TFTP (Trivial File Transfer Protocol)
• SNMP (Simple Network Management Protocol)
• DHCP (Dynamic Host Control Protocol)
• DNS (Domain Name System)

The following are the definitions of the fields in the UDP segment:

• Source port – Number of the calling port
• Destination port – Number of the called port
• Length – Number of bytes including header and data
• Checksum – Calculated checksum of the header and data fields
• Data – Upper-layer protocol data

TCP and UDP port numbers

Both TCP and UDP use port (socket) numbers to pass information to the upper layers. Port numbers are used to keep track of different conversations crossing the network at the same time. Application software developers agree to use well-known port numbers that are issued by the Internet Assigned Numbers Authority (IANA). Any conversation bound for the FTP application uses the standard port numbers 20 and 21. Port 20 is used for the data portion and port 21 is used for control. Conversations that do not involve an application with a well-known port number are assigned port numbers randomly from within a specific range above 1023. Some ports are reserved in both TCP and UDP, but applications might not be written to support them. Port numbers have the following assigned ranges: Numbers below 1024 are considered well-known ports numbers. Numbers above 1024 are dynamically assigned ports numbers. Registered port numbers are those registered for vendor-specific applications. Most of these are above 1024. End systems use port numbers to select the proper application. The source host dynamically assigns originating source port numbers. These numbers are always greater than 1023 Cisco Systems, Inc.

Classes of network IP addresses

Classes of IP addresses offer a range from 256 to 16.8 million hosts, as discussed previously in this module. To efficiently manage a limited supply of IP addresses, all classes can be subdivided into smaller subnetworks. Figure provides an overview of the division between networks and hosts
Introduction to and reason for subnetting

To create the subnetwork structure, host bits must be reassigned as network bits. This is often referred to as ‘borrowing’ bits. However, a more accurate term would be ‘lending’ bits. The starting point for this process is always the leftmost host bit, the one closest to the last network octet.

Subnet addresses include the Class A, Class B, and Class C network portion, plus a subnet field and a host field. The subnet field and the host field are created from the original host portion of the major IP address. This is done by assigning bits from the host portion to the original network portion of the address. The ability to divide the original host portion of the address into the new subnet and host fields provides addressing flexibility for the network administrator.

In addition to the need for manageability, subnetting enables the network administrator to provide broadcast containment and low-level security on the LAN. Subnetting provides some security since access to other subnets is only available through the services of a router. Further, access security may be provided through the use of access lists. These lists can permit or deny access to a subnet, based on a variety of criteria, thereby providing more security. Access lists will be studied later in the curriculum. Some owners of Class A and B networks have also discovered that subnetting creates a revenue source for the organization through the leasing or sale of previously unused IP addresses.

A LAN is seen as a single network with no knowledge of the internal network structure. This view of the network keeps the routing tables small and efficient. Given a local node address of 192.168.10.14, the world outside the LAN sees only the advertised major network number of 192.168.10.0. The reason for this is that the local address of 192.168.10.14 is only valid within the LAN 192.168.10.0 and cannot function anywhere else.

Establishing the subnet mask address

Selecting the number of bits to use in the subnet process will depend on the maximum number of hosts required per subnet. An understanding of basic binary math and the position value of the bits in each octet is necessary when calculating the number of subnetworks and hosts created when bits were borrowed. The last two bits in the last octet, regardless of the IP address class, may never be assigned to the subnetwork. These bits are referred to as the last two significant bits. Use of all the available bits to create subnets, except these last two, will result in subnets with only two usable hosts. This is a practical address conservation method for addressing serial router links. However, for a working LAN this would result in prohibitive equipment costs. The subnet mask gives the router the information required to determine in which network and subnet a particular host resides. The subnet mask is created by using binary ones in the host octet or octets. The subnet octet or octets are determined by adding the position value of the bits that were borrowed. If three bits were borrowed, the mask for a Class C address would be 255.255.255.224. This mask may also be represented, in the slash format, as /27. The number following the slash is the total number of bits that were used for the network and subnetwork portion. To determine the number of bits to be used, the network designer needs to calculate how many hosts the largest subnetwork requires and the number of subnetworks needed. As an example, the network requires 30 hosts and five subnetworks. A shortcut to determine how many bits to reassign is by using the subnetting chart. By consulting the row titled ”Usable hosts”, the chart indicates that for 30 usable hosts three bits are required. The chart also shows that this creates six usable subnetworks, which will satisfy the requirements of this scheme. The difference between usable hosts and total hosts is a result of using the first available address as the ID and the last available address as the broadcast for each subnetwork. The ability to use these subnetworks is not provided with classful routing. However, classless routing, which will be covered later in the course can recover many of these lost addresses. The method that was used to create the subnet chart can be used to solve all subnetting problems. This method uses the following formula: Number of usable subnets= two to the power of the assigned subnet bits or borrowed bits, minus two (reserved addresses for subnetwork id and subnetwork broadcast) (2 power of borrowed bits) – 2 = usable subnets (23) – 2 = 6 Number of usable hosts= two to the power of the bits remaining, minus two (reserved addresses for subnet id and subnet broadcast) (2 power of remaining host bits) – 2 = usable hosts (25) – 2 = 30

Applying the subnet mask.
Once the subnet mask has been established it then can be used to create the subnet scheme. The chart in the Figure is an example of the subnets and addresses created by assigning three bits to the subnet field. This will create eight subnets with 32 hosts per subnet. Start with zero (0) when numbering subnets. The first subnet is always referenced as the zero subnet.

When filling in the subnet chart three of the fields are automatic, others require some calculation. The subnetwork ID of subnet zero is the same as the major network number, in this case 192.168.10.0. The broadcast ID for the whole network is the largest number possible, in this case 192.168.10.255. The third number that is given is the subnetwork ID for subnet number seven. This number is the three network octets with the subnet mask number inserted in the fourth octet position. Three bits were assigned to the subnet field with a cumulative value of 224. The ID for subnet seven is 192.168.10.224. By inserting these numbers, checkpoints have been established that will verify the accuracy when the chart is completed.

When consulting the subnetting chart or using the formula, the three bits assigned to the subnet field will result in 32 total hosts assigned to each subnet. This information provides the step count for each subnetwork ID. Adding 32 to each preceding number, starting with subnet zero, the ID for each subnet is established. Notice that the subnet ID has all binary 0s in the host portion.

The broadcast field is the last number in each subnetwork, and has all binary ones in the host portion. This address has the ability to broadcast only to the members of a single subnet. Since the subnetwork ID for subnet zero is 192.168.10.0 and there are 32 total hosts the broadcast ID would be 192.168.10.31. Starting at zero the 32nd sequential number is 31. It is important to remember that zero (0) is a real number in the world of networking.

The balance of the broadcast ID column can be filled in using the same process that was used in the subnetwork ID column. Simply add 32 to the preceding broadcast ID of the subnet. Another option is to start at the bottom of this column and work up to the top by subtracting one from the preceding subnetwork ID.

Subnetting Class A and B networks

The Class A and B subnetting procedure is identical to the process for Class C, except there may be significantly more bits involved. The available bits for assignment to the subnet field in a Class A address is 22 bits while a Class B address has 14 bits.

Assigning 12 bits of a Class B address to the subnet field creates a subnet mask of 255.255.255.240 or /28. All eight bits were assigned in the third octet resulting in 255, the total value of all eight bits. Four bits were assigned in the fourth octet resulting in 240. Recall that the slash mask is the sum total of all bits assigned to the subnet field plus the fixed network bits.

Assigning 20 bits of a Class A address to the subnet field creates a subnet mask of 255.255.255.240 or /28. All eight bits of the second and third octets were assigned to the subnet field and four bits from the fourth octet.

In this situation, it is apparent that the subnet mask for the Class A and Class B addresses appear identical. Unless the mask is related to a network address it is not possible to decipher how many bits were assigned to the subnet field.

Whichever class of address needs to be subnetted, the following rules are the same:

Total subnets = 2 ^{to the power of the bits borrowed}
Total hosts= 2 ^{to the power of the bits remaining}
Usable subnets = 2 ^{to the power of the bits borrowed} minus 2
Usable hosts= 2 ^{to the power of the bits remaining} minus 2

Calculating the resident subnetwork through ANDing.

Routers use subnet masks to determine the home subnetwork for individual nodes. This process is referred to as logical ANDing. ANDing is a binary process by which the router calculates the subnetwork ID for an incoming packet. ANDing is similar to multiplication. This process is handled at the binary level. Therefore, it is necessary to view the IP address and mask in binary. The IP address and the subnetwork address are ANDed with the result being the subnetwork ID. The router then uses that information to forward the packet across the correct interface. Subnetting is a learned skill. It will take many hours performing practice exercises to gain a development of flexible and workable schemes. A variety of subnet calculators are available on the web. However, a network administrator must know how to manually calculate subnets in order to effectively design the network scheme and assure the validity of the results from a subnet calculator. The subnet calculator will not provide the initial scheme, only the final addressing. Also, no calculators, of any kind, are permitted during the certification exam.

Cisco Systems, Inc.