networking-concepts-howto.txt

这是我对防火墙技术的一些见解

  Linux Networking-concepts HOWTO
  Rusty Russell
  $Revision: 1.13 $ $Date: 2001/07/29 04:45:11 $

  This document describes what a network (such as the Internet) is, and
  the very basics of how it works.
  ______________________________________________________________________

  Table of Contents


  1. Introduction
  2. What is a `computer network'?
  3. What is the `Internet'?
     3.1 How Does The Internet Work?

  4. This IP Thing
     4.1 Groups of IP Addresses: Network Masks

  5. Machine Names and IP Addresses
  6. Different Services: Email, Web, FTP, Name Serving
  7. Dialup Interfaces: PPP
  8. What Packets Look Like
  9. Summary
  10. Thanks
  11. Index


  ______________________________________________________________________

  1.  Introduction

  Welcome, gentle reader.


  I have written a number of networking HOWTOs in the past, and it
  occurred to me that there's a hell of pile of jargon in each one.  I
  had three choices: my other two were ignoring the problem and
  explaining the terms everywhere.  Neither was attractive.


  The point of Free software is that you should have the freedom to
  explore and play with the software systems you use.  I believe that
  enabling people to experience this freedom is a noble goal; not only
  do people feel empowered by the pursuit (such as rebuilding a car
  engine) but the nature of the modern Internet and Free software allows
  you to share the experience with millions.


  But you have to start somewhere, so here we are.


  (C) 2000 Paul `Rusty' Russell.  Licenced under the GNU GPL.


  2.  What is a `computer network'?


  A computer network is just a set of stuff for nodes to talk to each
  other (by `nodes' I mean computers, printers, Coke machines and
  whatever else you want).  It doesn't really matter how they are
  connected: they could use fiber-optic cables or carrier pigeons.
  Obviously, some choices are better than others (especially if you have
  a cat).


  Usually if you just connect two computers together, it's not called a
  network; you really need three or more to become a network.  This is a
  bit like the word `group': two people is just a couple of guys, but
  three can be an `group'.  Also, networks are often hooked together, to
  make bigger networks; each little network (usually called a `sub-
  network') can be part of a larger network.


  The actual connection between two computers is often called a `network
  link'.  If there's a bit of cable running out of the back of your
  machine to the other machines, that's your network link.


  There are four things which we usually care about when we talk about a
  computer network:


     Size

        If you simply connect your four computers at home together, you
        have what is called a LAN (Local Area Network).  If everything
        is within walking distance, it's usually called a LAN, however
        many machines are connected to it, and whatever you've built the
        network out of.


        The other end of the spectrum is a WAN (Wide Area Network).  If
        you have one computer in Lahore, Pakistan, one in Birmingham, UK
        and one in Santiago, Chile, and you manage to connect them, it's
        a WAN.


     Topology: The Shape

        Draw a map of the network: lines are the

        ``network links'', and each node is a dot.  Maybe each line
        leads into a central node like a big star, meaning that everyone
        talks through one point (a  `star topology'):


              o   o   o
               \_ | _/
                 \|/
            o-----o-----o
                _/|\_
               /  |  \
              o   o   o



     Maybe everyone talks in a line, like so:


              o------o------o-------o--------o
              |                              |
              |                              |
              |                              o
              |                              |
              o                              |
                                             o



     Or maybe you have three subnetworks connected through one node:


                          o
              o           |  o--o--o
              |           |  |
              o--o--o--o--o  o
                     \       |
                      o------o
                     /       |
              o--o--o--o--o  o
              |           |  |
              o           |  o--o
                          o



     You'll see many topologies like these in real life, and many far
     more complicated.


     Physical: What It's Made Of
        The second thing to care about is what you've built the network
        out of.  The cheapest is `sneakernet', where badly-dressed
        people carry floppy disks from one machine to the others.
        Sneakernet is almost always a ``LAN''.  Floppies cost less than
        $1, and a solid pair of sneakers can be got for around $20.


        The most common system used to connect home networks to far
        bigger networks is called a `modem' (for MODulator/DEModulator),
        which turns a normal phone connection into a network link.  It
        turns the stuff the computer sends into sounds, and listens to
        sounds coming from the other end to turn them back into stuff
        for the computer.  As you can imagine, this isn't very
        efficient, and phone lines weren't designed for this use, but
        it's popular because phone lines are so common and cheap: modems
        sell for less than $50, and phone lines usually cost a couple of
        hundred dollars a year.



        The most common way to connect machines into a LAN is to use
        Ethernet.  Ethernet comes in these main flavors (listed from
        oldest to newest): Thinwire/Coax/10base2, UTP (Unshielded
        Twisted Pair)/10baseT and UTP/100baseT.  Gigabit ethernet (the
        name 1000baseT is starting to get silly) is starting to be
        deployed, too.  10base2 wire is usually black coaxial cable,
        with twist-on T-pieces to connect them to things: everyone gets
        connected in a big line, with special `terminator' pieces on the
        two ends.  UTP is usually blue wire, with clear `click-in'
        phone-style connectors which plug into sockets to connect: each
        wire connects one node to a central `hub'.  The cable is a
        couple of dollars a meter, and the 10baseT/10base2 cards (many
        cards have plugs for both) are hard to get brand new.  100baseT
        cards, which can also speak 10baseT as well, are ten times
        faster, and about $30.


        On the other end of the spectrum is Fiber; a continuous tiny
        glass filament wrapped in protective coating which can be used
        to run between continents.  Generally, fiber costs thousands.


        We usually call each connection to a node a `network interface',
        or `interface' for short.  Linux gives these names like `eth0'
        for the first ethernet interface, and `fddi0' for the first
        fiber interface.  The `/sbin/ifconfig' command lists them.


     Protocol: What It's Speaking

        The final thing to care about is the language the two are
        speaking.  When two ``modems'' are talking to each other down a
        phone line, they need to agree what the different sounds mean,
        otherwise it simply won't work.  This convention is called a
        `protocol'.  As people discovered new ways of encoding what the
        computer says into smaller sounds, new protocols were invented;
        there are at least a dozen different modem protocols, and most
        modems will try a number of them until they find one the other
        end understands.


        Another example is the ``100baseT'' network mentioned above: it
        uses the same physical ``network links'' (``UTP'') as
        ``10baseT'' above, but talks ten times as fast.



        These two protocols are what are called `link-level' protocols;
        how stuff is handed over the individual network links, or `one
        hop'.  The word `protocol' also refers to other conventions
        which are followed, as we will see next.


  3.  What is the `Internet'?

  The Internet is a ``WAN'' which spans the entire globe: it is the
  largest computer network in existence.  The phrase `internetworking'
  refers to connecting separate networks to build a larger one, hence
  `The Internet' is the connection of a whole pile of subnetworks.


  So now we look at the list above and ask ourselves: what is the
  Internet's size, physical details and protocols?


  The size is already established above: it's global.


  The physical details are varied however: each little sub-network is
  connected differently, with a different layout and physical nature.
  Attempts to map it in a useful way have generally met with abject
  failure.


  The protocols spoken by each link are also often different: all of the
  ``link-level protocols'' listed above are used, and many more.



  3.1.  How Does The Internet Work?

  The question then arises: how come every node on the Internet can talk
  to the others, if they all use different link-level protocols to talk
  to each other?


  The answer is fairly simple: we need another protocol which controls
  how stuff flows through the network.  The link-level protocol
  describes how to get from one node to another if they're connected
  directly: the `network protocol' tells us how to get from one point in
  the network to any other, going through other links if necessary.



  For the Internet, the network protocol is the Internet Protocol
  (version 4), or `IP'.  It's not the only protocol out there (Apple's
  AppleTalk, Novell's IPX, Digital's DECNet and Microsoft's NetBEUI
  being others) but it's the most widely adopted.  There's a newer
  version of IP called IPv6, but it's still not common.


  So to send a message from one side of the globe to another, your
  computer writes a bit of Internet Protocol, sends it to your modem,
  which uses some modem link-level protocol to send it to the modem it's
  dialed up to, which is probably plugged into a terminal server
  (basically a big box of modems), which sends it to a node inside the
  ISP's network, which sends it out usually to a bigger node, which
  sends it to the next node... and so on.  A node which connects two or
  more networks is called a `router': it will have one ``interface'' for
  each network.


  We call this array of protocols a `protocol stack', usually drawn like
  so:



        [ Application: Handles Porn ]           [ Application Layer: Serves Porn ]
                     |                                          ^
                     v                                          |
       [ TCP: Handles Retransmission ]          [ TCP: Handles Retransmission ]
                     |                                          ^
                     v                                          |
           [ IP: Handles Routing ]                   [ IP: Handles Routing ]
                     |                                          ^
                     v                                          |
       [ Link: Handles A Single Hop ]           [ Link: Handles A Single Hop ]
                     |                                          |
                     +------------------------------------------+



  So in the diagram, we see Netscape (the Application on top left)
  retrieving a web page from a web server (the Application on top
  right).  To do this it will use `Transmission Control Protocol' or
  `TCP': over 90% of the Internet traffic today is TCP, as it is used
  for Web and EMail.



  So Netscape makes the request for a TCP connection to the remote web
  server: this is handed to the TCP layer, which hands it to the IP
  layer, which figures out which direction it has to go in, hands it
  onto the appropriate link layer, which transmits it to the other end
  of the link.


  At the other end, the link layer hands it up to the IP layer, which
  sees it is destined for this host (if not, it might hand it down to a
  different link layer to go out to the next node), hands it up to the
  TCP layer, which hands it to the server.


  So we have the following breakdown:


  1. The application (Netscape, or the web server at the other end)
     decides who it wants to talk to, and what it wants to send).


  2. The TCP layer sends special packets to start the conversation with
     the other end, and then packs the data into a TCP `packet': a
     packet is just a term for a chunk of data which passes through a
     network.  The TCP layer hands this packet to

     the IP layer: it then keeps sending it to the IP layer until the
     TCP layer at the other end replies to say that it has received it.
     This is called `retransmission', and has a whole heap of complex
     rules which control when to retransmit, how long to wait, etc.  It
     also gives each packet a set of numbers, which mean that the other
     end can sort them into the right order.


  3. The IP layer looks at the destination of the packet, and figures
     out the next node to send the packet to.  This simple act is called
     `routing', and ranges from really simple (if you only have one
     modem, and no other network interfaces, all packets should go out
     that interface) to extremely complex (if you have 15 major networks
     connected directly to you).


  4.  This IP Thing

  So the role of the IP layer is to figure out how to `route' packets to
  their final destination.  To make this possible, every interface on
  the network needs an `IP address'.  An IP address consists of four
  numbers separated by periods, like `167.216.245.249'.  Each number is
  between zero and 255.


  Interfaces in the same network tend to have neighboring IP addresses.
  For example, `167.216.245.250' sits right next to the machine with the
  IP address `167.216.245.249'.  Remember also that a router is a node
  with interfaces on more than one network, so the router will have one
  IP address for each interface.


  So the Linux Kernel's IP layer keeps a table of different `routes',
  describing how to get to various groups of IP addresses.  The simplest
  of these is called a `default route': if the IP layer doesn't know
  better, this is where it will send a packet onwards to.  You can see a
  list of routes using `/sbin/route'.


  Routes can either point to a link, or a particular node which is
  connected to another network.  For example, when you dial up to the
  ISP, your default route will point to the modem link, because that's
  where the entire world is.



         Rusty's              ISP's  ~~~~~~~~~~~~
          Modem               Modem {            }
              o------------------o { The Internet }
                                    {            }
                                     ~~~~~~~~~~~~



  But if you have a permanent machine on your network which connects to
  the outside world, it's a bit more complicated.  In the diagram below,
  my machine can talk directly to Tridge and Paul's machines, and to the
  firewall, but it needs to know that packets heading the rest of the
  world need to go to the firewall, which will pass them on.  This means
  that you have two routes: one which says `if it's on my network, just
  send it straight there' and then a default route which says
  `otherwise, send it to the firewall'.