Categories: Networks

Introduction to Networks

I’m taking an online introductory course on networks. I have been surprised by how much ground this course is covering. I didn’t expect to cover wireless (mobile) networks, for example. I looked for videos on some of the topics to learn more, e.g. 4g network architecture – YouTube. Networking is turning out to be much cooler and more interesting than I thought possible. This post is a compilation of all the key topics introduced in the course (in the general order they were introduced, but not particularly organized into a coherent story).

My main takeaway from this first video is that 4G networks are entirely packet switched (basic, but new to me).

4G LTE Network Architecture Simplified

The next video on how messages are transmitted to the cell phone tower is insightful as well. I appreciated the high-level discussion of antennas.

How WiFi and Cell Phones Work | Wireless Communication Explained

The concept of control plane and data plane came up as well. One advantage of this separation as per the overview below are independent evolution and development of each (e.g. control software can be upgraded without changing the hardware).

M2.1: Overview of Control and Data Plane Separation

There are so many concepts in this space, most of them new to me, e.g. OAM, NMS, and EMS. Some places they are discussed include LTE Architecture Concepts, Differences Between an NMS and an EMS, and this video on Management Plane vs. Control Plane vs. Data Plane. We briefly got into the differences between 4G and 5G, one being the service-based architecture. Here’s a video I found introducing it:

5G Service Based Architecture | Telecoms Bytes – Mpirical

Then of course there are the fundamental concepts of throughput, delay, and packet loss error. Jim Kurose’s book (and video below) covers these topics but it’s been a while since I read that book.

The professor also clarified the difference between bandwidth and throughput. The next video briefly touches on this distinction:

The course has also introduced me to the concept of spectral efficiency as part of understanding the difference between bandwidth and throughput. There is no shortage of concepts to learn about, from the different types of lines like T1 and T3 to bit robbing to the existence of network interface devices. The video below is good intro to T1.

DS1 (T1) Fundamentals

There was also a discussion about cable networks, with an onslaught of concepts like Hybrid fiber-coaxial. This Cable 101 video is a helpful resource.

The HFC Cable Systems Introduction video below starts out with a comparison of coax and fiber then explains the flow of signals from the core network to the home.

HFC Cable Systems Introduction

I still need to learn more information about the Cable modem termination system (CMTS) and the next resource is perfect. It mentions CMTS vendors like Arris, Cisco, and Motorola, which inspires me to look up the Cisco CMTS.

Cable Modem Termination System Tutorial (CMTS)

I have never researched how most of these systems work so I am greatly appreciating this introduction to networks course! Here’s a video on how cable modems work, including their interactions with the CMTS.

How Cable Modems Work

The communication between the CMTS and the CMs is done via DOCSIS. Here is the reference I found with insight into DOCSIS.

DOCSIS® 3.1 – An Overview

Something I picked up is that CableLabs does a lot of the research for these systems. Other concepts to know include wavelength-division multiplexing (WDM), which was used in the traditional coax networks. The following explanation is an example of WDM in fiber.

What is WDM (Wavelength Division Multiplexer)?

The next technology described is DSL (Digital subscriber line). With DSL, the last mile is not shared (unlike cable networks). It evolved into ADSL and VDSL to support higher throughput. It’s interesting that it uses Asynchronous Transfer Mode (ATM) from back in the day. We also briefly introduce passive optical networks.

PON, What is a PON? All you need to know!

Next, we get into the 7-layer OSI model. The example given for the physical layer is SONET technology. Another foray into T1 technology reveals the fact that bipolar transmission is used for T1 since it is more power efficient.

Multiplexing is the next interesting topic introduced. I have included some videos below on the different types of multiplexing employed in communications.

  1. FDM involves modulating message signals over carrier frequencies then using bandpass filters to extract the individual signals.
  2. Time-division multiplexing: one variant is statistical TDM, which was a first step toward IP.
  3. Wavelength-division multiplexing (WDM)
Frequency Division Multiplexing (FDM) Explained
Time Division Multiplexing (TDM) | Synchronous, Asynchronous, Statistical TDM | Computer Networks

The course also addresses transmission fundamentals like the difference between bit rate and baud rate, the Shannon–Hartley theorem, the Nyquist–Shannon sampling theorem, modulation, modems, and codecs. I have compiled a few videos covering these topics below.

Here is an explanation of the Shannon–Hartley theorem:

Channel Capacity by Shannon-Hartley | Basics, Proof & Maximum Bandwidth Condition

The intuitition behind the Nyquist–Shannon sampling theorem is explained in the next video:

The intuition behind the Nyquist-Shannon Sampling Theorem

The concept of modulation comes next:

What is Modulation ? Why Modulation is Required ? Types of Modulation Explained.

Other concepts introduced include the constellation diagram and Quadrature amplitude modulation (QAM). The following videos introduce these 2 concepts:

What is a Constellation Diagram?

We then start getting into network addressing. One of the important concepts here is how the exhaustion of IPv4 addresses is handled: private IP addresses, DHCP, subnetting, and IPv6. One particularly interesting point was the difference between IPv4 and IPv6 headers:

IPv4 Header vs IPv6 Header Explained

The history of telecom is also worth knowing. More recent key events are the 1984 Modified Final Judgement and the Telecommunications Act of 1996. Verify that this playlist covers the 1984 Modified Final Judgement.

In a discussion of the impact of TCP on throughput, the professor called out TCP global synchronization as an issue that networks need to avoid. Here’s one video about it.

Avoiding packet reordering is another important aspect of TCP. The contrast with UDP is especially interesting when other protocols like Google’s QUIC are designed. The RTP protocol (a relative of UDP, informally speaking) is used for VoIP. This is a good description of RTP:

Real-Time Transport Protocol (RTP) in VoIP

The Session Initiation Protocol (SIP) may be used to set up the RTP bearer streams. Here is a high level overview of SIP.

What is SIP?

RTP Control Protocol is a related protocol used to provide feedback on the quality of service (QoS).


Categories: Networks

Building tcpdump on Windows

One of the security podcasts I listened to mentioned using tcpdump to analyze traffic. It looks like a tool you need to build for yourself since is no download page. Build instructions are well documented at tcpdump/doc/README.windows.md. This post is a summary of all the instructions required, including for installation of the Npcap: Windows Packet Capture Library & Driver. First get the Npcap SDK:

mkdir -p /c/software/npcap
cd /c/software/npcap
curl -Lo npcap-sdk-1.13.zip https://npcap.com/dist/npcap-sdk-1.13.zip
unzip npcap-sdk-1.13.zip

Clone the repo and create a build directory:

cd /c/repos
git clone https://github.com/the-tcpdump-group/tcpdump
cd tcpdump
mkdir build

Run these commands from the Developer command prompt:

cd \repos\tcpdump\build
cmake "-DPCAP_ROOT=C:\software\npcap" -G "Visual Studio 16 2019" -A x64 C:\repos\tcpdump
msbuild /m /nologo /p:Configuration=Debug tcpdump.sln

This takes only 40 seconds on my desktop. Next, run the Npcap 1.79 installer to ensure that launching tcpdump does not fail with this error: “The code execution cannot proceed because wpcap.dll was not found. Reinstalling the program may fix this problem.” We can now run tcpdump:

cd Debug
tcpdump.exe

When tcpdump starts up, it indicates that it is listening on a given device.

C:\repos\tcpdump\build\Debug> tcpdump.exe
tcpdump.exe: verbose output suppressed, use -v[v]... for full protocol decode
listening on \Device\NPF_{SOME-GUID}, link-type EN10MB (Ethernet), snapshot length 262144 bytes

Interestingly, the repo does not have much (any?) documentation on how to use tcpdump. However, there are links to tutorials and numerous other resources at Home | TCPDUMP & LIBPCAP. As per the repo:

Richard Stevens gives an excellent treatment of the Internet protocols in his book “TCP/IP Illustrated, Volume 1”. If you want to learn more about tcpdump and how to interpret its output, pick up this book.

GitHub – the-tcpdump-group/tcpdump: the TCPdump network dissector

The 2nd edition is dated November 2011: TCP/IP Illustrated: The Protocols, Volume 1 (Addison-Wesley Professional Computing Series): Fall, Kevin, Stevens, W.: 0785342336313: Amazon.com: Books. I have added it to the reading list.

The earlier test tcpdump did not display any traffic on my desktop. Following an introduction to using tcpdump at the Linux command line | Opensource.com, list the available devices using tcpdump -D then select one of them and pass it as the --interface argument. This allows me to find the device that with network traffic.

tcpdump -D
tcpdump --interface \Device\NPF_{SOME-GUID}

How does tcpdump -D generate the list of network devices? The main function of the application detects the -D option then calls the show_devices_and_exit function, which in turn retrieves the devices by calling the pcap_findalldevs function. Stepping into this call reveals that it is in C:\Windows\System32\wpcap.dll. As shown in the properties of wpcap.dll below, it is part of the libpcap product. This explains why tcpdump fails to start if the Npcap installer is not executed (when “wpcap.dll was not found”). I’m interested in the actual enumeration of network devices but that appears to be part of libpcap, specifically pcap.c. I’ll save that exploration for another day.

wpcap.dll Properties
wpcap.dll Properties