Glossary

147 terms from TCP/IP in Depth, Part 1, in plain words, each with the chapter that teaches it.

Search the glossary

#

/31: A prefix that leaves a subnet of just two addresses. A subnet normally loses two addresses to the network and broadcast addresses, but on a link with exactly two routers at its ends, both addresses of a /31 can be used.
2001:db8::/32: A range of IPv6 addresses set aside for documentation and examples, so it never clashes with real networks. Example networks such as Kettle & Crane's IPv6 office LAN, 2001:db8:10::/64, are taken from it.

A

administratively prohibited: An ICMP destination unreachable error (type 3, code 13) that means a firewall refused the packet and said so. When the shop wouldn't load, ping showed it as "Packet filtered" and traceroute marked it !X, and both pointed at the office router.
AND: Comparing two numbers bit by bit, where a result bit is 1 only if both input bits are 1. ANDing an address with its subnet mask gives the network address, so 192.168.10.77 AND 255.255.255.192 gives 192.168.10.64.
ARP (Address Resolution Protocol): The protocol that finds the MAC address that goes with an IPv4 address on the local LAN. The laptop broadcasts "who has 192.168.10.30?", and only the printer answers, by unicast, with its MAC.
ARP cache: The table where a machine keeps the MAC addresses it has learned through ARP, so it doesn't have to ask before every packet. `ip neigh` shows it, with a state such as REACHABLE, STALE or FAILED for each entry.
ARP cache states: The state `ip neigh` shows for each entry: REACHABLE (confirmed in about the last 30 seconds), STALE (not confirmed lately and checked on the next send), DELAY or PROBE (being checked now), INCOMPLETE (a request is out with no reply yet) and FAILED (nobody answered).
ARP inspection: A switch feature that checks ARP messages and stops false ones, which defends against ARP spoofing.
ARP spoofing: Falsely announcing another machine's IP address, such as "192.168.10.1 is at my MAC", so that its traffic comes to you instead. It works because ARP has no proof built in and neighbors believe any announcement.
arping: A command that sends ARP messages by hand. `-D` checks whether an address is already taken (duplicate address detection), and `-U` sends an announcement nobody asked for (gratuitous ARP).

B

binary: A way of writing numbers with only the digits 0 and 1, one digit per bit. Writing a byte in binary shows its single bits, such as header flags or the special bits of a MAC address, and Python's `bin()` converts a number to binary.
block size: The number of addresses in a subnet: 2 to the power (32 − prefix). A /26 holds 64 addresses, and subnets always start on a multiple of their block size.
bridge: A virtual switch inside Linux. In the lab, the bridge `br0` plays the office switch that joins the laptop, the printer and the router into one LAN.
bridge fdb: The command that shows or edits a Linux bridge's forwarding database, the table of which MAC address sits behind which port. Alex used `bridge fdb show` to find that the label printer is on port p2.
broadcast: Sent to every machine on the LAN, using the MAC address ff:ff:ff:ff:ff:ff, as ARP requests do. In subnetting, the broadcast address is a subnet's last address, such as 192.168.10.127 for 192.168.10.64/26.

C

capture filter: An expression that tells tcpdump which packets to keep, such as `icmp and host 203.0.113.10`. You build it from words like host, net and port, joined with and, or and not.
curl: A command-line tool that fetches a web page or other resource from a URL. It is handy for making one page load on demand, for example from shop.kettleandcrane.com, so that the packets can be captured, and `-w` can print details such as the HTTP status code.

D

default gateway: The router a machine sends traffic to when the destination is outside its own subnet; for Kettle & Crane's office laptops that is the office router, 192.168.10.1. If the default route points at a wrong address, such as 192.168.10.254, local devices still work but every off-subnet destination fails, which is why Priya's laptop couldn't load the shop.
destination unreachable: ICMP type 3: a packet could not be delivered, and the code gives the reason (net, host, port, fragmentation needed or administratively prohibited). "Destination Host Unreachable" from your own address means ARP got no answer and the packet never left.
DF (don't fragment): An IPv4 flag that forbids routers from cutting a packet into fragments. If the packet is too big for the next link, the router drops it and sends back "fragmentation needed", and path MTU discovery is built on this.
DHCP (Dynamic Host Configuration Protocol): A protocol that hands out addresses and settings, such as the default gateway, to machines automatically. dnsmasq can act as a DHCP server, and on a real laptop the gateway usually comes from DHCP.
DHCPv6: The IPv6 version of DHCP. If a router advertisement has the `managed` flag set, hosts get their address from a DHCPv6 server instead of using SLAAC.
DNS (Domain Name System): The system that turns names like shop.kettleandcrane.com into IP addresses, usually over UDP port 53. The office router is the laptop's DNS cache, and it asks the shop's DNS server at 203.0.113.53.
dnsmasq: A small, free DNS and DHCP server. The lab installs the dnsmasq-base package because it comes without a system service that would get in the way.
Dot1Q: Scapy's name for the VLAN tag, after the IEEE 802.1Q standard that defines it. `Dot1Q(vlan=20)` adds a tag that puts a frame in VLAN 20.
DSCP (Differentiated Services Code Point): The left 6 bits of the IPv4 tos byte, which mark a packet's priority class so routers know which packets to serve first. Voice packets get DSCP 46, which makes the tos byte 0xb8.
DSCP classes: Named DSCP values: 46, expedited forwarding, for voice packets that routers should send first (tos 0xb8), and 48, network control, which Linux puts on its own ICMP errors (tos 0xc0).
duplicate address detection: Checking that nobody already uses an address before taking it. In IPv4, `arping -D` asks from 0.0.0.0. In IPv6, a host sends a neighbor solicitation from the unspecified address ::, and any answer means the address is taken.

E

echo request: The ICMP messages ping uses: an echo request (type 8) asks, and an echo reply (type 0) answers. The identifier and sequence number tie each reply to its request.
ECN (Explicit Congestion Notification): The right 2 bits of the IPv4 tos byte. A busy router can set them to warn of congestion instead of dropping the packet.
Ethernet: The technology that carries frames on the office LAN. Each frame starts with a 14-byte header that holds the destination MAC, the source MAC and the EtherType.
EtherType: The 2-byte Ethernet field that names the protocol inside the frame: 0x0800 for IPv4, 0x0806 for ARP, 0x86dd for IPv6, or 0x8100 when a VLAN tag follows.
EUI-64: A way to build a 64-bit IPv6 interface ID from a MAC address: split the MAC, put ff:fe in the middle, and flip the 2 bit of the first byte. With the prefix 2001:db8:10::/64, the laptop's MAC 02:00:00:00:10:20 gives the address 2001:db8:10::ff:fe00:1020.
extension headers: Optional IPv6 headers that sit between the IPv6 header and the data, such as the fragment header. Each one has its own next header field, so together they form a chain.

F

FCS (frame check sequence): A 4-byte check value at the end of every Ethernet frame. The receiving card recomputes it to drop damaged frames, then removes it, so tcpdump never shows it.
firewall: A device or set of rules that blocks or rejects some traffic. A polite firewall answers with administratively prohibited, while one that drops all ICMP can cause a PMTU black hole.
flooding: A switch sending a frame out of every port except the one it came in on, because the destination is broadcast or not yet in its table. That's why the printer saw a ping meant for the router after the router's entry was deleted.
flow label: A 20-bit IPv6 header field that tags the packets of one flow, so routers can keep them on one path.
fragment header: An IPv6 extension header (next header 44) that is used when a packet is fragmented. In IPv6, only the sender may fragment, never a router.
fragment offset: A 13-bit IPv4 field that says where a fragment's data belongs in the original packet. It is counted in 8-byte units on the wire, so 185 means byte 1,480, though tcpdump shows the offset in bytes.
fragment6: A Scapy function that cuts an IPv6 packet carrying a fragment header into pieces no bigger than a given size, such as 1,280 bytes.
fragmentation needed: An ICMP error (type 3, code 4) from a router that had to drop a DF packet because it was too big for the next link. The error includes that link's MTU, such as 1,400, so the sender can send smaller packets.
fragments: The pieces of an IP packet that was cut to fit a link with a smaller MTU. Each piece is a full IP packet with its own header, all pieces share one ID, and losing any piece loses the whole packet.
frame: One Ethernet message: a 14-byte header, a payload of 46 to 1,500 bytes, and a 4-byte FCS. A router builds a new frame on every link it forwards a packet to.

G

gratuitous ARP: An ARP message nobody asked for, in which a machine announces its own IP and MAC to everyone. The new label printer can send one so the laptops update their caches at once.

H

haslayer: A Scapy method that checks whether a packet contains a given header, such as ARP or IP, before you try to read it.
header: A block of fixed fields at the start of a packet, such as the 14-byte Ethernet header or the 20-byte IPv4 header. Headers sit inside each other like envelopes, and each one names the next.
header checksum: A 16-bit IPv4 field that catches damage to the header. With the field set to zero, you add the header's 16-bit words, fold the carry back in and flip the bits, and every router must recompute it because it changes the TTL.
header diagram: A drawing of a header in rows of 32 bits, as RFCs use. A field's width in bit columns is its size in bits.
hex dump: A listing of every byte of a packet in hexadecimal, 16 bytes per row, with each row's offset on the left. tcpdump prints one with `-XX`.
hexadecimal: Base 16, with the digits 0 to 9 and then a to f. One hex digit is 4 bits, so two digits make a byte: `c0` is 12 × 16 + 0 = 192.
hop: One step of a packet's path, from one router (or host) to the next. traceroute and tracepath list the path one hop at a time.
hop limit: IPv6's name for the TTL: an 8-bit field that each router lowers by 1. Neighbor Discovery messages are sent with 255.
Host addresses (127.0.0.1, 0.0.0.0): Two special IPv4 addresses: 127.0.0.1 is the loopback address a machine uses to reach itself on its `lo` interface, and 0.0.0.0 means "no address", which `arping -D` uses as its sender address so that it changes no one's cache.
host bits: The bits of an address after the prefix, which number the hosts inside a subnet; a /26 has 32 − 26 = 6. Python's `ip_network` refuses a subnet whose host bits aren't all zero.
HTTP status codes: The three-digit number a web server sends back with each response to say how the request went; 200 means OK. curl's `-w "%{http_code}"` prints it.

I

ICMP (Internet Control Message Protocol): IP's messenger protocol (IP protocol 1), which carries answers such as echo replies and errors such as time exceeded. Every message starts with type, code and checksum, and every error quotes the start of the packet that caused it.
ICMPv6: The IPv6 version of ICMP (next header 58). Besides errors such as Packet Too Big, it carries Neighbor Discovery, so IPv6 can't work if it is blocked.
ID (identification): A 16-bit IPv4 header field that labels a packet, so that all fragments of one packet share the same value. Because a router doesn't change it, the ID can also be used to match the same packet in captures taken on both sides of a router.
IEEE (Institute of Electrical and Electronics Engineers): The standards body that gives each network maker its OUI and publishes standards such as 802.1Q for VLAN tags.
IHL (Internet header length): The IPv4 field that gives the header length in 4-byte words: 5 means 20 bytes, and anything above 5 means options follow.
interface: A machine's connection to a network, with its own name and addresses. Each lab machine names its interfaces eth0 and eth1, and the router has one on each network.
interface ID: The last 64 bits of an IPv6 address, which the host makes itself. It can come from EUI-64 or be random.
ip: Linux's command for network settings. `ip -br addr` lists addresses, `ip link` shows interfaces and their MTU, and `ip link set` changes them.
ip neigh: The command that shows the ARP cache (neighbor table), with each entry's MAC and state. `ip neigh flush all` empties it, so the machine has to ask again.
ip netns: The command that creates network namespaces and runs commands inside them. The lab's `on` helper is short for `sudo ip netns exec`.
IP options: Optional extra fields, up to 40 bytes, that follow the 20-byte IPv4 header and are signalled by an IHL above 5. They are rare today, and many routers drop packets that carry them.
ip route: The command that shows and changes the routing table. `ip route get ADDR` shows the route and any cached MTU for one address, and `ip route replace default via 192.168.10.1` fixed Priya's wrong gateway.
ipaddress: A Python standard-library module for working with IPv4 and IPv6 addresses and subnets. It can check subnet calculations, find overlaps in an address plan, summarize routes and build addresses such as EUI-64 ones.
IPv4 (Internet Protocol version 4): The version of IP the office mostly uses, with 32-bit addresses such as 192.168.10.20. Its header has twelve fields in 20 bytes, plus any options.
IPv6 (Internet Protocol version 6): The newer version of IP, with 128-bit addresses and a fixed 40-byte header. It has no header checksum, no fragmentation by routers and no broadcast.
IPv6 multicast groups (ff02::1, ff02::2): Two fixed IPv6 multicast groups on the local link: ff02::1 reaches all nodes, and router advertisements go there, while ff02::2 reaches all routers, and router solicitations go there.

L

link-local address: An IPv6 address in fe80::/64 that every interface gives itself first, usable only on its own link. Routers send their Neighbor Discovery messages from theirs, such as fe80::1.
little-endian: Writing a number with its smallest byte first. Ping stores its send time this way, while network headers put the biggest byte first.
locally administered: A MAC address set by software instead of built in by a maker, marked by the 2 bit of the first byte. All the lab's MACs start with 02, so they are locally administered.
loopback interface: The `lo` interface every machine has, with the address 127.0.0.1, which the machine uses to talk to itself.

M

MAC address: A 6-byte hardware address written as six hex pairs, such as the laptop's 02:00:00:00:10:20. It only works on the local link and never crosses a router.
mdev: The last number on ping's `rtt` summary line, which shows how much the round-trip times vary.
MF (more fragments): An IPv4 flag set on every fragment except the last, meaning that another piece follows. tcpdump shows it as `flags [+]`.
MTU (maximum transmission unit): The largest IP packet a link can carry in one frame. On Ethernet it is 1,500 bytes, counting the IP header but not the Ethernet header.
multicast: Sent to a group of machines rather than to one or to all; in a MAC address, the 1 bit of the first byte marks it. IPv6 multicast goes to MACs that start with 33:33.
multicast snooping: A switch feature that controls where multicast frames go. If it is set up wrong, it can block Neighbor Discovery messages.

N

neighbor advertisement: Neighbor Discovery's answer (ICMPv6 type 136), sent by unicast with the MAC address for the address that was asked about. Its solicited flag means it answers a question, and its override flag means "replace any cached MAC".
Neighbor Discovery: IPv6's replacement for ARP. It finds neighbors' MACs, routers and prefixes with ICMPv6 messages sent to multicast groups instead of broadcasts.
neighbor solicitation: Neighbor Discovery's question (ICMPv6 type 135), such as "who has 2001:db8:10::30?", sent to the solicited-node address. Sent from ::, it also does duplicate address detection.
network address: The first address of a subnet, which names the subnet itself and can't be given to a host. For 192.168.10.77/26 it is 192.168.10.64.
network namespace: A separate copy of Linux's network system, with its own interfaces, addresses and routes. Each lab machine, such as `laptop` or `router`, is one namespace and looks to its programs like a separate computer.
next header: The IPv6 field that names what follows the header: 44 for a fragment header, 58 for ICMPv6, 6 for TCP or 17 for UDP. Each extension header has one too, which makes a chain.

O

octet: One of the four 8-bit numbers in an IPv4 address or mask, such as the 77 in 192.168.10.77.
offset: How many bytes come before a byte or a row, usually written in hex. The IPv4 header starts at offset 14 of the frame, right after Ethernet.
on: The lab's tiny helper script: `on laptop COMMAND` runs a command as root inside the laptop namespace.
OUI (organizationally unique identifier): The first three bytes of a maker's MAC address: a number the IEEE gives each maker.
overlaps: An ipaddress method that asks whether two networks share any address. In plan.py, it caught the typo in Alex's servers subnet.

P

Packet Too Big: The ICMPv6 error (type 2) a router sends when an IPv6 packet is too big for the next link. It carries that link's MTU, because IPv6 routers never fragment.
padding: Zeros added on a real cable to an Ethernet payload shorter than 46 bytes, so that every frame is at least 64 bytes. ARP's 28-byte message always gets padding.
PATH: The list of folders where the shell looks for commands. Copying the `on` helper to /usr/local/bin puts it on your PATH, so you can run it from anywhere.
path MTU: The smallest MTU among the links on a path, and so the largest packet that can cross the whole path without fragmenting. With the 1,400-byte outside link, the path from the laptop to the shop has a path MTU of 1,400.
path MTU discovery: Finding the path MTU by sending packets with DF set and listening for "fragmentation needed" errors (Packet Too Big in IPv6) that carry the smaller MTU. It is optional in IPv4 but required in IPv6.
payload: Whatever a header carries inside it; an Ethernet frame's payload is the IP packet. In Scapy, `.payload` gives the next header in.
pcap file: A file of captured packets. tcpdump writes one with `-w` and reads it with `-r`, and Wireshark and Scapy can open it too.
ping: A command that sends ICMP echo requests and measures how long the replies take to come back. `-s` sets the data size, `-M do` sets DF, and `-Q` sets the tos byte.
PMTU black hole: What happens when a firewall drops the ICMP "fragmentation needed" messages that path MTU discovery depends on. Small packets pass but big ones vanish, so pages half-load and big transfers hang.
port: A number that names a service on a machine, such as 53 for DNS or 80 for the web server. tcpdump writes it after the last dot of an address, as in 192.168.10.1.53.
port unreachable: An ICMP error (type 3, code 3) meaning no program is listening on that UDP port. For traceroute, it means the probe has reached its destination.
preamble: An 8-byte fixed pattern sent before each frame on a real cable to wake up the receiver. The card removes it, so tcpdump never shows it.
prefix: The /n after an address, which says how many leading bits name the network; the rest are host bits, so /26 leaves 6. In IPv6, a router advertises the LAN's 64-bit prefix.
promiscuous mode: A mode where a network card keeps every frame, not only frames addressed to it. tcpdump turns it on, so it can show frames meant for other machines.
protocol field: The IPv4 header field that names what's inside: 1 for ICMP, 6 for TCP, 17 for UDP.

R

rate limiting: Limiting how many ICMP errors a machine sends. After a short burst, Linux sends about one per second to each destination, which can make traceroute show * for a hop.
raw: A Scapy function that turns a packet into its bytes, filling in lengths and checksums as it goes.
rdpcap: A Scapy function that reads a pcap file into a list of packets.
RFCs (Requests for Comments): The documents that define internet standards, such as RFC 791 for IPv4 and RFC 792 for ICMP. They draw headers as header diagrams.
round-trip time: The time a message takes to get there plus the time its answer takes to come back. Ping measures it by writing the send time into its data and subtracting that time when the reply returns.
route cache: Where Linux keeps what it has learned about a destination, such as a path MTU of 1,400, for about 10 minutes. `ip route get` shows it.
router advertisement: A router's announcement of itself and the LAN's prefix (ICMPv6 type 134), sent to ff02::1. Its `auto` flag invites hosts to build their own address with SLAAC.
router solicitation: A message a new host sends to ff02::2 (ICMPv6 type 133) to ask routers to announce themselves, so it doesn't have to wait for the next router advertisement.
routing table: A machine's list of where to send packets for each destination, including its default route. Scapy uses it to pick a source address, and `ip route` shows it.

S

Scapy: A Python library that builds, sends and takes apart packets. You stack headers with `/`, as in `IP(dst="203.0.113.10") / ICMP()`.
SLAAC (stateless address autoconfiguration): How an IPv6 host builds its own address without a server: it takes the 64-bit prefix from a router advertisement and adds its own interface ID.
solicited-node address: The IPv6 multicast group made of ff02::1:ff followed by the last 24 bits of an address, where neighbor solicitations for that address are sent. For 2001:db8:10::30 it is ff02::1:ff00:30.
sr1: Scapy's "send, receive one" function. It sends an IP packet and returns the first reply, or None if nothing arrives before the timeout.
srp1: Like sr1, but for whole Ethernet frames: it sends on the interface you name and waits for one reply, as whohas.py does for ARP.
subnet mask: The dotted form of a prefix, such as 255.255.255.192 for /26, which marks the bits that name the network. With a wrong mask, a laptop ARPs for machines it should reach through the router.
subnet_of: An ipaddress method that asks whether one network lies inside another, such as whether each roastery subnet is inside 10.20.0.0/22.
sudo: A command that runs another command as root, the all-powerful user. Building the lab, capturing packets and sending raw packets all need it.
summary route: One route that covers several neighboring subnets that together fill one block, such as 10.20.0.0/22 for the whole roastery. Python's `collapse_addresses` merges subnets into summaries.
switch: A device that joins machines into one LAN, learning which MAC address sits behind each port from the source MACs of incoming frames, and forwarding each frame only out of its destination's port. In the lab, the bridge br0 plays the office switch.

T

TCP (Transmission Control Protocol): The protocol that carries web pages and most other reliable connections, marked as protocol 6 in the IP header. Packets that load a web page, such as the shop's home page, are TCP packets inside IP.
tcpdump: The command-line tool that captures packets on an interface and prints one line per packet. Its options pick the interface (-i), show MACs (-e), decode every field (-v), print hex (-XX), and save or read pcap files (-w, -r).
time exceeded: An ICMP error (type 11) that a router sends when it lowers a packet's TTL to 0 and drops it. traceroute uses these errors to learn each router's address.
tos (type of service): tcpdump's name for the second byte of the IPv4 header, which holds DSCP and ECN; the name comes from the field's old name. `ping -Q 0xb8` sets it to mark DSCP 46.
total length: The IPv4 field that gives the whole packet's size, header plus data, such as 44 bytes for the small ping.
tracepath: A tool that lists the routers on a path hop by hop and finds the path MTU, such as pmtu 1400 on the narrowed link.
traceroute: A tool that finds each router on a path by sending probes with TTL 1, 2, 3 and so on, collecting time exceeded from each router until port unreachable (or an echo reply) says the probe has arrived. `-I` probes with echo requests and `-T` with TCP to port 80.
traffic class: The 8-bit IPv6 header field that holds DSCP and ECN, as the tos byte does in IPv4.
TTL (time to live): An 8-bit IPv4 field that says how many more routers may forward a packet; each router lowers it by 1 and drops the packet at 0. A reply that arrives with 63 from a Linux server that started at 64 crossed one router.
tunnel: A link that wraps every packet in an extra header, which lowers the MTU left for the packet. Kettle & Crane's new internet line uses one, which leaves an MTU of 1,400.

U

UDP (User Datagram Protocol): A simple way to send a message to a numbered port (IP protocol 17). DNS lookups and Linux traceroute probes use it.
unicast: Sent to one machine. An ARP reply is unicast, sent straight back to the laptop that asked.
unspecified address: The IPv6 address ::, which a host uses as its source while it doesn't have an address yet, for example during duplicate address detection.
usable hosts: The addresses in a subnet that can be given to machines: the block size minus two, for the network and broadcast addresses, so a /26 has 62. /31 links and /32 hosts are the exceptions.

V

veth pair: A virtual cable with two ends that can sit in different network namespaces. In the lab, one connects the laptop's eth0 to port p1 on the switch.
VLAN (virtual LAN): A way to split one switch into several separate LANs. Kettle & Crane puts guest Wi-Fi on VLAN 20, so guests never share a LAN with the label printer.
VLAN tag: Four bytes in a frame that name its VLAN: 0x8100 sits where the EtherType normally goes, followed by 2 bytes whose top bits hold a priority and whose lowest 12 bits are the VLAN number. The real EtherType comes after the tag.
VLSM (variable length subnet masks): Splitting one block into subnets of different sizes, giving each group the smallest block that fits and handing out the largest first. Alex used it to divide the roastery's 10.20.0.0/22.

W

Wireshark: A graphical packet capture tool that opens the same pcap files tcpdump writes.
wrpcap: A Scapy function that writes a list of packets to a pcap file, so tcpdump can read packets that were built but never sent, as the IPv6 examples do.