An Overview of IEEE 802.3, TCPIP

An Overview of IEEE 802.3, TCP/IP

To understand how the networking on your Linux system works, you first need to understand the components of your network. Linux uses the OSI model, which consists of seven layers of network functionality (see Figure 7-1).

Figure 7-1. ISO/OSI Network Layer Functions

Layer Number	Layer Name	Data Form	Comments
7	Application		User applications here.
6	Presentation		Applications prepared.
5	Session		Applications prepared.
4	Transport	Packet	Port-to-port transportation handled by TCP.
3	Network	Datagram	Internet Protocol (IP) handles routing by going directly to either the destination or default router.
2	Link	Frame	Data encapsulated in Ethernet or IEEE 802.3 with source and destination addresses.
1	Physical		Physical connection between systems. Usually thinnet or twisted pair.

In what follows, I cover the bottom four layers at a cursory level so that you can see how each layer plays a part in the operation of your network. This will help you to understand, configure, and troubleshoot networking on your Linux system.

The top layers are the ones that most Linux system administrators spend time working with because those layers are the ones you work with most often. The bottom layers are, however, also important to understand, so that you can perform any configuration necessary to improve network performance on your system. Improving network performance can have a major impact on the overall performance of your system.

This is the International Standards Organization Open Systems Inter-connection (ISO/OSI) model. It is helpful to visualize the way in which networking layers interact. We'll start with the bottom layer (Layer 1 Physical) and work our way up.

Physical Layer (Layer 1)

At the bottom of the model is the physical interconnection between the systems on your network. Without the physical layer, you can't communicate between systems, and all the great functionality you would like to implement is not possible. The physical layer converts the data you would like to transmit to the analog signals that travel along the wire. The information traveling into a network interface is taken off the wire and prepared for use by the next layer. For the purposes of this discussion, I'll assume for now that whatever physical layer you have in place uses wires. If your network is all or partially wireless, the wireless bandwidth is also part of the physical layer.

Link Layer (Layer 2)

To connect to other systems local to your system, you use the link layer. The link layer establishes a connection to all the other systems on your local segment (assuming they all use the same protocol). In this layer, data packets are encoded and decoded into bits. The link layer furnishes transmission protocol knowledge and management and handles errors in the physical layer, flow control, and frame synchronization.

The data link layer is divided into two sublayers: the Media Access Control (MAC) layer and the Logical Link Control (LLC) layer. The MAC sublayer controls how a computer on the network gains access to the data and permission to transmit it. The LLC layer controls frame synchronization, flow control, and error checking.

The link layer supports either IEEE 802.3 or Ethernet frames. Your Linux system may support both of these "encapsulation" methods. This is called encapsulation because your data is put in one of these two forms (either IEEE 802.3 or Ethernet). Data is transferred at the link layer into frames (just another name for data), with the source and destination addresses and some other information attached. You might think that because two different encapsulation methods exist, they must be different. This assumption, however, is not the case. IEEE 802.3 and Ethernet are nearly identical. For this reason, many Linux systems can handle both types of encapsulation.

Figure 7-2 lists the components of an Ethernet encapsulation and makes comments about IEEE802.3 encapsulation where appropriate.

Figure 7-2. Ethernet Encapsulation

Destination address	6 bytes	Address data is sent to.
Source address	6 bytes	Address data is sent from.
Type	2 bytes	This is the "length count" in 802.3.
Data	46MTU bytes	38-1492 bytes for 802.3; the difference in these two data sizes (MTU) can be seen with the ifconfig command.
Crc	4 bytes	Checksum to detect errors called cycle redundancy check.

One interesting item to note is the difference in the maximum data size between IEEE 802.3 and Ethernet of 1492 and 1500 bytes, respectively. This is the Maximum Transfer Unit (MTU). The ifconfig command (covered in the next chapter) displays the MTU for your network interface. The data in Ethernet is called a frame (the re-encapsulation of data at the next layer up is called a datagram in IP, and encapsulation at two levels up is called a packet for TCP).

Keep in mind that Ethernet and IEEE 802.3 will run on the same physical connection, but there are indeed differences between the two encapsulation methods. With your Linux systems, you don't have to spend much, if any, time setting up your network interface for encapsulation.

Note that MAC address is short for Media Access Control address, a hardware address that uniquely identifies each node of a network. The MAC layer interfaces directly with the network media. Consequently, each different type of network media requires a different MAC layer. On a Local Area Network (LAN) or other network, the MAC address is your computer's unique hardware number. (On an Ethernet LAN, it's the same as your Ethernet address.) When you're connected to the Internet from your computer (or host as the Internet protocol thinks of it), a correspondence table relates your IP address to your computer's physical (MAC) address on the LAN.

Network Layer (Layer 3)

The network layer on Linux systems is synonymous with the Internet Protocol (IP). Data at this layer is transported as datagrams. This is the layer that handles the routing of data around the network. Data that gets routed with IP sometimes encounters an error of some type, which is reported back to the source system with an Internet Control Message Protocol (ICMP) message. You will see some ICMP messages in the next chapter. ifconfig and netstat are two Linux commands that are commonly used to configure this routing.

Unfortunately, the information that IP uses does not conveniently fit inside an Ethernet frame, so you end up with fragmented data. This is really re-encapsulation of the data, so you end up with a lot of inefficiency as you work your way up the layers.

IP handles routing in a simple fashion. If data is sent to a destination connected directly to your system, the data is sent directly to that system. If, on the other hand, the destination is not connected directly to your system, the data is sent to the default router. The default router then has the responsibility of getting the data to its destination. This routing can be a little tricky to understand, so I'll cover it in detail shortly (see the upcoming "Subnet Mask section").

Transport Layer (Layer 4)

The transport layer is the next level up from the network layer. It communicates with ports. TCP is the most common protocol found at this level, and it forms packets that are sent from port to port. The port used by a program is usually defined in /etc/services, along with the protocol (such as TCP). These ports are used by network programs, such as telnet, rlogin, ftp, http, and so on. You can see that these programs, associated with ports, are the highest level we have covered while analyzing the layer diagram. Ports are covered later in this chapter.