IP Services

When we talk about IP services, we refer to the applications, protocols, and services that not only use IP themselves, but also provide data to be used by other IP protocols. These IP services typically allow for IP communications between hosts by performing functions such as physical address resolution, automatic address assignment, name resolution, and time synchronization.

Address Resolution Protocol (ARP) is an IP service that was developed to map physical addresses to logical addresses. This resolution is required because hosts need to be able to physically address the data frames at Layer 2 to the appropriate destination. In most cases, the hosts only know each other by IP address. Consequently, ARP functions by broadcasting on the local subnet for the host that has the IP address that needs to be resolved. Because it is a broadcast, all hosts will process the packet, but only the host that actually has that IP address will respond with its MAC address, thereby allowing the original source to properly address the packet both logically by IP address and physically by MAC address.

DHCP exists to provide unconfigured hosts on a network with the appropriate IP addressing information necessary to enable them to communicate on the network. Because a host that is a DHCP client does not have an IP address to use, DHCP uses broadcasts between the DHCP client and the DHCP server. When a DHCP client is turned on, it issues a broadcast known as a DHCP Discover packet. The objective of this broadcast is to discover whether there is a DHCP server on the network. If there is, the DHCP server responds with a broadcast known as a DHCP Offer packet, because the client still has no IP address. Because the packet is a broadcast, the client still processes it even though the client has no configured IP address. If the network has multiple DHCP servers, they all respond with a DHCP Offer, and the client accepts the first offer it receives. The client then broadcasts a packet known as a DHCP Request packet. This serves two purposes. First, it notifies the selected DHCP server that the client has elected to accept the DHCP Offer. Second, it notifies all other DHCP servers that the client selected another DHCP server, allowing them to place that offered IP address back in the pool of IP addresses they can offer to clients. Finally, the DHCP server responds with a final broadcast known a DHCP Acknowledgement packet, which notifies the client that it can use the IP address that it was offered and provides additional configuration information such as subnet mask, default gateway, name servers, and so on. At this point, the client configures itself accordingly and can begin engaging in full TCP/IP communications.

DNS provides for the resolution of host names and fully qualified domain names to IP addresses. The reason for this is simple. Most humans do not know the IP address of the remote hosts that they are trying to communicate with. They know the name, such as www.cisco.com. Unfortunately, the network hosts require the IP address of the remote host to communicate with that host. When an IP host receives a request to communicate with a remote host by name, the host automatically and transparently contacts a DNS server to resolve the name to an IP address, which if successful allows the two hosts to communicate with each other. A detailed discussion of DNS is beyond the scope of this book, but an excellent resource for understanding DNS is DNS and BIND, Fourth Edition, by Paul Albitz and Cricket Liu.

Network Time Protocol (NTP) is used to synchronize the time across hosts over the network. Time synchronization is critical for applications such as Windows authentication, Kerberos, IPsec, as well as event logging. NTP functions over UDP port 123 and allows clients to synchronize their time with a master time server, known as a stratum 1 or stratum 2 server.