Routing and Subnets

If every computer on the Internet had to know the location of every other computer on the Internet and how to get from here to there, the entire Internet would have come to a grinding halt long ago. Early on, it became apparent that a method was needed to filter and route packets so you can easily not only print to your network printer, but also reach any other computer on the Internet without having to know a whole lot about how to get there. Enter subnets, routers, and gateways.

What Is a Subnet?

A subnet is simply a portion of the network that operates as a separate network, without regard to what happens outside and without affecting the rest of the network. A subnet is usually a separate physical "wire" that has only a single point of contact with other areas of the network, through a router or bridge.

Setting up a subnet involves using what is known as a subnet mask to allow computers in a subnet to see and directly communicate only with other computers in the same subnet. A subnet mask is an address, again in w.x.y.z form, that masks or blocks areas outside the subnet from sight. The mask works by letting you see only those portions of the IP address space that aren't masked by a 1. (Remember that each octet is actually an 8-bit binary value. To "mask by 1" means to ensure that the appropriate bit has been set to a value of 1.) For example, if you have a class C address of 192.168.222.17, and your subnet mask is 255.255.255.0 (a typical class C subnet), as shown in Figure 13-1, you can see only addresses in the last octet of the address (the z portion).

Figure 13-1. Subnet masking.

If your IP address is 192.168.222.17, the address at 192.168.223.25 is hidden from you by your subnet mask of 255.255.255.0. You can send a packet to that address only by first passing that packet to a gateway or router that knows both where you are and either where the other network is or how to find it. If, on the other hand, you send a packet to a printer with the IP address 192.168.222.129 or to a computer at 192.168.222.50, you have no problem. The system can see that address, and the packet goes directly to its destination.

If you can assign an entire class of addresses to a subnet, it's easy to figure out what your mask is; however, if you can assign only a portion of a class, you need to sit down with your binary-to-decimal conversion tables and determine exactly what the correct subnet mask should be. (Remember that this is all done in binary.) If you understand how it works, you can customize your subnet mask or figure out what the one you have is actually doing.

We recommend using the default subnet mask for your network class, unless you have a specific reason not to. For a class A network, this is 255.0.0.0; for a class B network, it's 255.255.0.0; and for a class C network, use 255.255.255.0. For in-depth information about subnet masks, see the Microsoft Windows 2000 Server TCP/IP Core Networking Guide (Microsoft Press).

All the subnet masks on a single portion of your network must be the same. If they aren't, this causes all sorts of problems. One machine might be able to send a packet to another, but the other might not be able to send the packet back.

Gateways and Routers

A gateway can have different functions on a network, but for the moment we're going to focus on the subnet and routing functions. As we mentioned, if you have a subnet mask of 255.255.255.0 and the y octet of your IP address is 222, you can't see an IP address on the network with a y octet of 223.

How, then, do you get to an IP address on another subnet? The answer is a gateway or router. This is a physical device—usually a router device, or sometimes a computer with more than one network card—that's physically connected to both portions of the network. It takes your packets from the 222 subnet and sends them over to the 223 subnet for delivery to the address on that subnet. Thus, it acts as a gatekeeper between the two separate portions of the network, keeping the traffic with 222 addresses in the 222 subnet and letting only traffic with 223 addresses cross over to the 223 segment.

Although the terms gateway and router are often used interchangeably, strictly speaking a gateway is a device or computer that translates between networks of different architectures, such as NetWare and Windows. A router is a device or computer that sends packets between two or more network segments as necessary using logical network addresses (typically IP addresses).

Routers

A router is a device that connects to more than one physical segment of the network and sends packets between those segments as required. If a router doesn't know where to direct a packet, the router knows which entity to ask for directions—another router. It constantly updates its routing tables with information from other routers about the best way to get to various parts of the network.

In addition to gateways and routers, there are also bridges. Bridges are devices or computers that direct traffic between two network segments based on physical (media access control) addresses and are generally used to isolate two sections of a network to improve performance. Bridges are cheaper and less capable than routers.

Routing Protocols

Detailed information about how routing protocols work and the algorithms involved in routing and address resolution are beyond the scope of this book, but it's useful to know what some of the protocols are, if only to recognize acronyms when they're thrown about. In that spirit, the following list consists of the most common TCP/IP address resolution and routing protocols:

• Address Resolution Protocol (ARP) Maps the IP address to the physical hardware address (the media access control [MAC] address) of that IP address, permitting you to send something to an IP address without having to know what physical device it is.
• Routing Information Protocol (RIP) A vector-based routing protocol that is mostly provided for backward compatibility with existing RIP-based networks. As with most vector-based routing protocols (which make extensive use of broadcasts to discover what other devices and routers are nearby), RIP is being replaced by newer routing protocols that scale better and have lower network traffic overhead.
• Open Shortest Path First (OSPF) A link-state routing protocol that is suitable for use in large and very large networks, such as those common in large enterprises. Link-state routing protocols maintain a map of the network topology that they share with other routers. As the topology changes, routers update their link-state database and then inform neighboring routers of the topology change, reducing the amount of network bandwidth consumed when compared to vector-based routing protocols.

Real World

Routing Flaps

The Internet has grown exponentially in the last few years, stretching the technology for resolving addresses to the limit, and sometimes past the limit. When a major router on the Internet goes down—even momentarily—all the other routers on the Internet have to tell one another about it and recalculate new routes that bypass that router. This adjustment results in large numbers of packets passing back and forth, causing traffic to become so heavy that the routing updates can't occur properly because the information doesn't make it through the traffic. Such a situation is called a routing flap, and it can cause a large portion of the Internet to come to a virtual halt.

Routing flaps don't happen very often, but they are becoming more and more of a problem. In addition, current router technology is reaching the limit of its ability to calculate the best route from all the possible routes when major changes are caused by the failure of a key router. The next generation of TCP/IP (known as IP version 6, discussed later in this chapter) will help, as will new algorithms for performing the routing calculations.