Internet protocol fundamentals

How addressing works: IPv4 and IPv6 addresses, what a subnet mask actually does, the private ranges, and the protocols and well-known ports a candidate is expected to recognise on sight.

Lesson 1 of 4 in objective 109. Networking fundamentals, part of LPIC-1 Exam 102-500.

An address and its prefix. /24 is 255.255.255.0. 192.168.1.10/24 — part 1, 192.168.1: the network part: the 24 bits the mask sets; part 2, 10: the host part: 8 bits, so 256 addresses, 254 usable; part 3, /24: how many bits are network. /16 and /8 are the other two to know. 1 192.168.1 . 2 10 3 /24 1 the network part: the 24 bits the mask sets 2 the host part: 8 bits, so 256 addresses, 254 usable 3 how many bits are network. /16 and /8 are the other two to know
An address and its prefix. /24 is 255.255.255.0.

Addresses and masks

An IPv4 address is 32 bits written as four decimal octets. A subnet mask splits it into a network part and a host part: the bits set in the mask are the network. /24 means 255.255.255.0 — 24 network bits, 8 host bits, so 256 addresses of which 254 are usable, because the all-zeros address is the network itself and the all-ones is the broadcast. /16 is 255.255.0.0 and /8 is 255.0.0.0. Being able to move between the two notations quickly is worth more marks than any single fact on this objective.

The private ranges, which are never routed on the public internet, are 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16. 127.0.0.0/8 is loopback, and 169.254.0.0/16 is the link-local range a host gives itself when DHCP fails — which is why an address starting 169.254 means "no DHCP server answered" rather than a working network.

IPv6 is 128 bits written as eight groups of four hexadecimal digits, with a doubled colon standing in for one run of zero groups. ::1 is loopback, fe80::/10 is link-local and every interface has one, and there is no broadcast at all — multicast does that job. IPv6 has no need for NAT, and public addresses on hosts are the normal case rather than the exception.

Protocols above the address

TCP is connection-oriented: a three-way handshake, ordered delivery, retransmission of what was lost, and flow control. UDP has none of that — it sends a datagram and does not care whether it arrives — which makes it the right choice for DNS queries, streaming and anything where a late packet is worse than a missing one. ICMP is neither; it carries control and error messages, which is what ping and traceroute are built on.

Ports identify the service on a host. The ones worth memorising: 20 and 21 FTP, 22 SSH, 23 telnet, 25 SMTP, 53 DNS, 67 and 68 DHCP, 80 HTTP, 110 POP3, 123 NTP, 139 and 445 SMB, 143 IMAP, 161 SNMP, 389 LDAP, 443 HTTPS, 465 and 587 mail submission, 514 syslog, 636 LDAPS, 993 IMAPS, 995 POP3S. /etc/services is the local list of them, and ports below 1024 are privileged — only root may bind them.

The ports to memorise, grouped by the job each one does. Ports below 1024 — only root may bind contains Remote login and file sharing, 22 SSH, 23 telnet, 20 and 21 FTP, 139 and 445 SMB, Mail, 25 SMTP, 465 and 587 submission, 110 POP3, 995 POP3S, 143 IMAP, 993 IMAPS, Web and directory, 80 HTTP, 443 HTTPS, 389 LDAP, 636 LDAPS, Infrastructure services, 53 DNS, 123 NTP (DNS queries go over UDP), 67 and 68 DHCP (No answer and the host takes 169.254), 161 SNMP, 514 syslog. Ports below 1024 — only root may bind Remote login and file sharing 22 SSH, 23 telnet 20 and 21 FTP, 139 and 445 SMB Mail 25 SMTP, 465 and 587 submission 110 POP3, 995 POP3S 143 IMAP, 993 IMAPS Web and directory 80 HTTP, 443 HTTPS 389 LDAP, 636 LDAPS Infrastructure services 53 DNS, 123 NTP DNS queries go over UDP 67 and 68 DHCP No answer and the host takes 169.254 161 SNMP, 514 syslog
The ports to memorise, grouped by the job each one does.

Reading what this machine has been given

The theory above is asked about a real machine, so the commands that print its addressing belong with it. ip addr show lists every interface with its addresses and prefix lengths, ip route prints the routing table with the default gateway on the line beginning default, and ip neigh shows the ARP or neighbour cache — which addresses have been resolved to which hardware addresses, and how fresh each entry is. The older ifconfig, route and arp from net-tools print the same three things and are still on plenty of machines.

On a desktop or laptop the addressing usually comes from NetworkManager rather than from a file, and nmcli is its command line. nmcli connection show lists the configured profiles — a profile is the saved settings, not the live state — and nmcli device status lists the interfaces and which profile each is currently running. The profiles themselves live under /etc/NetworkManager/system-connections/. It is worth being able to tell the two apart: a profile can exist for a network you are not on, and an interface can be up with no profile at all.

The new command and the old one print the same three things. Left column, The command you type; right column, What it prints. ip addr show and ifconfig both point at Every interface and its addresses (The prefix length comes with each address). ip route and route both point at The routing table (The default gateway is the line beginning default). ip neigh and arp both point at The ARP or neighbour cache (Which address resolved to which hardware address, and how fresh). The command you type What it prints ip addr show ifconfig Every interface and its addresses The prefix length comes with each address ip route route The routing table The default gateway is the line beginning default ip neigh arp The ARP or neighbour cache Which address resolved to which hardware address, and how fresh
The new command and the old one print the same three things.
ip addr show eth02: eth0: <BROADCAST,MULTICAST,UP> mtu 1500 state UP    inet 192.168.1.10/24 brd 192.168.1.255 scope global eth0ip routedefault via 192.168.1.1 dev eth0 proto dhcp metric 100192.168.1.0/24 dev eth0 proto kernel scope link src 192.168.1.10nmcli connection showNAME       UUID                                  TYPE      DEVICEWired 1    b2f1...                               ethernet  eth0
The address, the gateway, and the profile that supplied them.

Worth carrying in

/24 = 255.255.255.0
24 network bits; 256 addresses, 254 usable.
10/8, 172.16/12, 192.168/16
The private IPv4 ranges.
169.254.0.0/16
Link-local: what a host assigns itself when DHCP fails.
127.0.0.1 / ::1
Loopback in IPv4 and IPv6.
fe80::/10
IPv6 link-local. Every interface has one.
TCP vs UDP
Handshake, ordering and retransmission versus none of it.
22 / 25 / 53 / 80 / 443
SSH, SMTP, DNS, HTTP, HTTPS.
/etc/services
Port-to-service-name mapping.
ports < 1024
Privileged: only root may bind them.
ip addr show
Interfaces and their addresses. ip route for the gateway, ip neigh for the ARP cache.
nmcli connection show
NetworkManager profiles. nmcli device status is the live view instead.

What the exam does with this

Objective
109. Networking fundamentals
Share of the exam
23.33% (the whole objective)
Questions in this lesson
20
Signed for by a person
0

Partly checked. None of the 20 questions here has been read against the cited source by a person. 20 questions have been checked against their cited clause by an automated pass — which is not the same thing, and is not a signature.

Only questions a person has signed for are used in mock exams here. That is the whole difference between the two kinds of checking above.

How these questions are written — where each question comes from, what the verification ledger records, and what happens when one is found wrong.

Drill this lesson

A lesson is one sitting: the trainer draws a short run from these questions alone and spaces the ones you get wrong.

Practise Internet protocol fundamentals

Questions in this lesson

Practise Internet protocol fundamentals

The rest of objective 109