Networking Introduction

A network is two or more devices that can send each other messages. That's the whole definition. Two laptops joined by one cable are a network. So are your phone, TV and printer sharing the Wi-Fi at home. The Internet is a network too, just a very large one.

Networks come in sizes, and you'll see three words for them everywhere:

• LAN (local area network) means the devices in one place: your house, an office floor, a classroom. They're usually joined by one box, or a few boxes in the same building.
• WAN (wide area network) means a network that spans distance, joining LANs in different buildings or cities. The line from your house to your Internet provider is your WAN connection.
• The Internet is a network of networks: millions of LANs and WANs, run by different people, that have agreed to pass each other's messages along. Nobody owns it. It works because every piece follows the same rules.

Those shared rules are called protocols. A protocol is an agreement about how to talk, just as English grammar is an agreement that lets two strangers understand each other. You'll meet a handful by name on this page: IP, TCP, DNS, DHCP. Each one solves one problem, and they stack together to deliver a web page.

When you load a photo, it doesn't travel as one big lump. Your device chops it into small pieces called packets, usually about 1,500 bytes each. A single photo can be a thousand of them. Each packet is sent separately, and the receiving device puts them back together in the right order.

Every packet is built like a letter in an envelope:

• The header is the outside of the envelope: who it's from, who it's to, and enough bookkeeping to reassemble the pieces. Network equipment reads only the header.
• The payload is the letter inside, the actual data. Routers and switches never need to look at it.

Why go to the trouble? There are two reasons, and both matter for everything that follows:

• Sharing. If your photo went as one lump, nobody else on your Wi-Fi could send anything until it finished. With packets, everyone's pieces take turns, so a video call and a download can share the same connection.
• Resending. Packets do get lost: a burst of Wi-Fi interference, or a busy router that drops some. When that happens, only the missing pieces are sent again, not the whole photo.

See it: ping

ping sends one tiny packet to an address and times how long the reply takes. It's the simplest network test there is, and it works the same on every operating system. Open PowerShell (Windows: right-click Start → Terminal) or Terminal (Mac or Linux) and type:

ping 1.1.1.1

Each line is one packet that went out and came back. time=14ms is the round trip: 14 thousandths of a second to reach a server and return. Lost = 0 means none went missing. (Mac and Linux keep pinging until you press Ctrl+C.) 1.1.1.1 is a public server run by Cloudflare that always answers, which is why guides use it.

This is the idea that confuses beginners most, so it gets its own step. Every network connection has two different addresses, and they do different jobs.

An IP address is four numbers from 0 to 255 separated by dots. Think of it as a street and a house number. In 192.168.1.23, the first three numbers (192.168.1) are the street, meaning the network, and the last one (23) is the house, meaning your device. Devices on the same street can talk directly. Reaching another street needs a router, which is Step 04.

The subnet mask says where the street part ends. 255.255.255.0 means “the first three numbers are the street.” It is also written /24, and it's by far the most common mask on home and small office networks.

The default gateway is the address of your router, the house at the end of the street that knows the way to everywhere else.

See yours

ipconfig /all

ifconfig en0 | grep -E "ether|inet "
route -n get default | grep gateway

ip addr
ip route | grep default

Write down four things: your IP address, subnet mask, default gateway and MAC address. Your numbers will be different from the example; 192.168.0.x, 192.168.1.x and 10.0.0.x are all common. You'll use them again in Steps 07 and 08.

Networking equipment looks alike (grey or black boxes covered in ports), but each kind does one specific job. The easiest place to see all of them is the box your Internet provider gave you, opened up:

• Network interface (NIC) is the part of each device that connects to the network: the Ethernet port on a desktop, or the Wi-Fi chip in a phone. The MAC address belongs to the NIC.
• Switch connects many devices on the same network. It learns which MAC address is on which port and sends each packet out of only the port it needs. It never looks at IP addresses. A switch makes one street longer; it doesn't connect you to other streets.
• Router connects different networks. It has a foot on each street and reads the IP address in every packet to decide which way to send it. Your home router has one foot on your home network and one on your provider's. The Internet is routers passing packets to each other.
• Access point is a switch port without the cable. It lets Wi-Fi devices join the same network as the wired ones.
• Modem translates between Ethernet and whatever the provider's line is (cable, fibre, DSL, cellular). It doesn't make any decisions; it's a translator.
• Firewall decides which packets are allowed through at all, by rules. On a home network it's a feature of the router, not a separate box.

A switch connects devices. A router connects networks. Almost every networking question starts with which of the two you're dealing with.

Delivering a web page means solving several separate problems: getting a signal onto the wire, finding the right network, reaching the right program, and agreeing on what the message means. Networking splits them into layers, and each layer solves one problem and relies on the layer below. That's why you can change from Wi-Fi to Ethernet without your browser noticing. Only the bottom layer changed.

This four-layer version is the TCP/IP model, which is how the Internet is actually built. You'll also hear about the OSI model, which splits the same job into seven layers. Its numbers are the ones people say out loud: a switch is a Layer 2 device, a router is Layer 3, and TCP and UDP are Layer 4. OSI Layers 1 and 2 are the Link row above (1 is the physical cable or radio signal), 3 is Internet, 4 is Transport, and 5–7 are all folded into Application.

Ports: which program gets the packet

An IP address gets a packet to the right device. But a computer runs many network programs at once, such as a browser, an email client and a chat app. The port number says which one the packet is for, like an apartment number after the street address. Some ports are standard, so everyone knows where to knock:

The transport layer comes in two main kinds. TCP numbers every piece, confirms each arrived, and resends anything lost. Web pages, email and file downloads use it because every byte must arrive. UDP just sends and doesn't check. Video calls, games and DNS use it, because a late packet is useless and it's better to move on than wait for it to be resent.

Packets need IP addresses, but people remember names. DNS (the Domain Name System) is the Internet's phone book: you ask it for a name and it answers with the address. Every time you type a website, your device asks a DNS server first, before it sends a single packet to the site. Try it:

nslookup bozcode.com

The first two lines are who you asked. That's the DNS server from your ipconfig /all in Step 03, usually your own router, which forwards the question to your provider's DNS servers. The last lines are the answer. Non-authoritative just means the answer came from a server that had it saved, not from the server that owns the name, which is normal and fast.

Everything so far comes together here. When you type bozcode.com and press Enter, this happens in well under a second:

1. You already have an address. When your laptop joined the Wi-Fi, DHCP gave it an IP address, a mask, a default gateway and a DNS server (Step 03).
2. DNS. The browser asks the DNS server for bozcode.com and gets back an IP address (Step 06).
3. Same street or not? Your laptop compares that address with its own using the subnet mask. It's on a different street, so the packet has to go to the default gateway, your router.
4. ARP: finding the router's MAC. To hand the packet to the router over Wi-Fi, the laptop needs the router's MAC address. It asks the whole network, “who is 192.168.1.1?”, and the router answers. That protocol is ARP, and the answer is kept in a table you can see below.
5. The router takes over. It swaps your private return address for its own public one (that's NAT, in Step 08) and sends the packet to your provider.
6. Router to router. Each router along the way reads the destination IP and passes the packet one hop closer. There are usually 8 to 20 hops.
7. TCP, then encryption, then the page. Your laptop and the server shake hands on port 443, agree an encryption key (the padlock in your browser), and then the browser asks for the page. The page comes back as packets over the same path in reverse, and the router passes each one back to your laptop.

See step 4: the ARP table

arp -a

This is your laptop's list of neighbours on the same street: each IP address and the MAC address it matched. Your default gateway will be in the list, because your laptop talks to it constantly. (Linux: ip neigh.)

See step 6: every hop

tracert -d bozcode.com

Each line is one router that handled your packet, with three timings to reach it. Hop 1 is always your default gateway, the address you wrote down in Step 03. Hop 2 is usually your provider. The timings grow as the packet travels further. A line of * means that router didn't answer this test, which many don't. The packet still went through. -d (or -n) skips looking up a name for every hop, which makes it much faster.

Here's a puzzle. Your laptop's IP address from Step 03 is something like 192.168.1.23. So is your neighbour's. So are millions of other laptops. How can they all have the same address?

Because those are private addresses. Three ranges are reserved for use inside homes and offices and are never used on the public Internet:

Anyone can use them, and they only need to be unique within one network. To reach the Internet, your router does NAT (Network Address Translation): on the way out, it replaces your private return address with its one public address, the address your provider gave it. It keeps a note of which conversation belongs to which device, and swaps the address back when replies arrive. Every device in your house shares that one public address.

See both of your addresses

You already have your private address from ipconfig. Now open the site's IP Lookup page, which shows the address this web server saw your request come from:

The two are different, and that difference is NAT. Every phone and laptop in your house would show the same public address on that page.

Every term from this page, for when you meet it again in another guide.

Check yourself

• You can find your IP address, subnet mask, default gateway and MAC address
• You can say which of those changes when you move to another network
• You know which box connects devices and which connects networks
• ping 1.1.1.1 works, and you know what time= and Lost mean
• You found your default gateway as hop 1 of tracert and in arp -a
• You've seen your private address and your public address, and can say why they differ

You now know what a network is made of and how a packet crosses the Internet. The next step is to stop just watching the network and start building one. That means a real router you configure yourself, where you set every address, mask, gateway, DHCP pool and NAT rule from this page by hand.