Level H - Networked Embedded Systems Development

ENIC4023 - Networked Embedded Systems Development

Network Utilities Lab

Note: the examples in this lab require to be run on a networked system with an IP address. Standalone PC's and some laptop systems without a permanent IP address are not suitable.

Every PC on the lab network has two addresses. These are the physical address (the lab uses Ethernet) and the internet (IP) address. These together with the Domain Name System (DNS) and Address Resolution Protocol (ARP) are the basis for communication on an IP network.

Physical (Ethernet) Address

The Ethernet address (also known as a Media Access Control (MAC) address) is a 48-bit address that identifies the Ethernet adapter. Adapter manufacturers are assigned Ethernet address blocks to use so that they are all unique and never reassigned, depending on the adapter design it may not even be possible to change the Ethernet address on it. More generally the Ethernet address is the "physical address" of the PC, other technologies are possible for the physical layer networking (eg FDDI, frame relay) but Ethernet is by far the most used in an office/lab environment.

Ethernet addresses are usually shown as bytes separated by a hyphen or a colon, eg:

00-40-95-44-27-20(all numbers are HEX)

Check out the Ethernet address of the PC you are working on by entering ipconfig /all at a command prompt. This will give you quite a lot of information about the network settings of your PC. Record the Ethernet (physical) address here:

- - - - -

Compare this Ethernet address with that found by the other students in the lab and confirm its uniqueness (if it isn't unique tell a technician fast).

Internet Address

Note that IP addresses may be changed from 32-bit (IPv4) to 128-bit (IPv6) soon (or may not be), this should not have any effect on the Java networking programs we write here!!!

The Internet Address is also called an IP address (IP stands for Internet Protocol) or host address. It is a logical address assigned to a network interface (eg the one on your PC). An IP address is how one computer finds another on a large network. Each node must know its own IP address and that of any other computer with which it will communicate.

An IP address is a unique 32-bit number, this takes up exactly 4 bytes in memory. An IP address is normally written as 4 unsigned bytes, each ranging from 0 to 255, with the most significant byte first. Bytes are separated by periods for the convenience of the human reader (dotted decimal format), eg:

146.191.100.247

Check out the IP address on your PC by again using ipconfig /all Record your IP address and subnet mask here:

IP Address: . . .

Subnet Mask: . . .

IP addresses aren't allocated randomly but rather in blocks allocated to organisations such as a University. Since the size of organisations varies so will the number of IP addresses needed vary too. Three classes of network are defined by the range of addresses allocated to them:

* Note that class D is used only for multicast addressing and that class E is reserved for experimentation.

Each class of network has a different number of bits of the address allocated to the network ID (the bit that defines the block of addresses), and the host ID (the bit that distinguishes between addresses within a block):

The class A format provides a small number of possible network IDs and a huge number of possible host IDs for each network. However a class C format can support only a small number of hosts (256 - 2 = 254) but there are many more of them available. Note that certain IP address ranges are not assigned to networks because they are reserved for special uses (see below).

Check out the IP address of your PC, is it class A, B, or C? My office PC is 146.191.100.247 ie class B.

A class B network can have approximately 216 = 65536 hosts. This is much too many to be easily managed on a single network segment. It is therefore usual to split this into a number of subnets interconnected by routers. The subnet to which a host belongs is determined by the IP address in conjunction with the subnet mask. The subnet mask is a 32-bit number which has 1's at the left end and 0's at the right end. The bit position at which the 1's change to 0's is what is significant. This defines a split in the host ID field defined by the network class, those bits of the host ID fields which have 1's in the corresponding bit of the subnet mask are "stolen" to act as a subnet ID. As an example consider my office PC again:

IP address:146.191.100.247 = 1001 0010 1011 1111 0110 0100 1111 0111

subnet mask255.255.240.0 = 1111 1111 1111 1111 1111 0000 0000 0000

= nnnn nnnn nnnn nnnn ssss hhhh hhhh hhhh

(where n = network ID, s = subnet ID, h = host ID)

The IP address starts with 10 therefore it is class B.

As a class B network the left most 16-bits are the network ID, ie 1001 0010 1011 1111

The remaining bits where the corresponding bits of the subnet mask are 1's are the subnet ID, ie 0110

The bits where the corresponding bits of the subnet mask are 0's are the host ID, ie 0100 1111 0111

(There are "IP Address Calculators" available from many internet sites that purport to make understanding and manipulating IP addresses easier. Put "IP Address Calculator" into altavista.co.uk or other good internet search engine to find one)

As well as the class D and E addresses there are other addresses that are not available for assigning to host systems:

(1)All addresses where the host ID is all zeros is used to identify the subnet. Such an address is called the "subnet number". The subnet number for my office PC would thus be: 146.191.96.0Work out the subnet number of your PC and record it here:

Subnet Number: . . .

(2)All addresses where the host ID is all ones is as the "directed broadcast address" for the subnet. This address can be used to send a packet to every host on the subnet. The subnet broadcast address for my office PC would thus be: 146.191.111.255Work out the subnet broadcast address of your PC and record it here:

Broadcast Address:. . .

(3)All addresses where the subnet ID is all zeros are called zero subnets, their use is discouraged.

(4)All addresses where the subnet ID is all ones are called broadcast subnets, their use is discouraged.

(5)The first and last networks in each class are reserved (the last class A network address: 127.0.0.0 is used as the loopback address).

(6)Some addresses are reserved for use by "private internets", these are networks that will never be connected to the internet so do not need unique addresses. These are:

Exercise

Fill in the blanks in the following table (check your answers with an IP address calculator):

Domain Name System

IP addresses are difficult for humans to remember. However the Domain Name System (DNS) associates hostnames that humans can remember (like my office PC: ICT-EEP-051.msroot.staff.paisley.ac.uk) with IP addresses that computers can remember (146.191.100.247).

The DNS is a bit like a telephone directory, however storing the IP address - hostname mapping for all the computers in the world requires a lot of storage! The DNS is instead a distributed system; which also makes it more reliable. The task of keeping track of the address mapping is delegated to DNS servers. To get the IP address from the hostname (or vice-versa) a computer sends a query to its local DNS server which will supply the information. The local DNS server keeps a record of the mappings for all the local computers, so if the request concerns another local computer, it can reply straight away. If the request concerns a computer that is not local it sends a request to another DNS server and so on. Strictly speaking DNS servers work with fully qualified domain names, for example my office PC:

ICT-EEP-051.msroot.staff.paisley.ac.uk

These names are hierarchical, and DNS servers are arranged similarly so a request can be passed up the hierachy then back down again to get to the required DNS server.

The DNS server can be accessed manually in Windows 2000 with NSLookup. To find out the hostname of your PC enter NSLookup at a command prompt. You will now get a "" prompt. At this enter the IP address of your PC (as found above) and it should respond with your hostname. Try entering the hostname (just the bit before the first dot will do) you have just got and it should respond with your IP address back again. Enter exit to get back to the command prompt. The following shows what happened when I done this on my office PC:

Note that the DNS server (in this case cis13.msroot.staff.paisley.ac.uk) responded with a different hostname from what ipconfig did when I ran it on my PC. This just means that my office PC has more than one hostname. When I entered the hostname that ipconfig gave me into NSLookup I got my correct IP address back. Make a note of the hostname (fully qualified domain name) of your PC below:

You can also use the network utility tracert to check the hostname - IP address mapping. This utility is used for tracing the route a packet takes in getting to a specified destination. Try it out with your favourite website (one nearby preferable), eg for Glasgow University:

From the above you can see that the IP address of is: 130.209.34.12 type this IP address into an internet browser and check.

You can also use the network utility ping to get an IP address from a hostname (but not the other way round). This utility is used to check that a server is responding. Again try it out with one of your favourite websites, eg for the University of Central Lancashire:

Note: University of Paisley network security policy may not allow tracert or ping to be used with external hosts. These policies are applied in an arbitrary way and change from time to time without notice or explanation. You may not be able to replicate the examples in this labsheet if the policies have been changed since the time of writing. If pinging external hosts is not allowed, try pinging other PC's in the same lab.

Address Resolution Protocol (ARP)

When two IP-enabled devices on the same network segment (in practice the same subnet) want to communicate, they do so using the low-level protocols and addressing mechanisms defined for the medium in use, in the lab this is Ethernet so Ethernet addresses and protocols are used. In order for IP systems to communicate with each other, they must first be able to identify the physical addresses of the other devices on the same network segment. This service is provided by the Address Resolution Protocol (ARP).

The Java networking classes work at the IP level and so effectively hide the lower level protocols associated with the medium in use. Although we will not explicitly use ARP in our programs, it is still worth understanding it as it works in the background.

Each host on a network segment maintains a table in memory called the ARP cache. This associates the IP addresses of other hosts on the same network segment with physical addresses (on the lab network this is Ethernet addresses). When a host needs to send data to another host on the segment, the host checks the ARP cache to determine the physical address of the recipient. You can check the contents of the ARP cache on your PC by entering arp -a at a command prompt. You should get something like this:

At first sight this might seem to be a rather short list. The reason for this though is that the ARP cache is assembled dynamically and typically the entries expire after a pre-determined time and are removed. If the IP address that is to receive the data is not listed in the ARP cache, the host will send a broadcast (ie uses a special address to which all hosts will listen to) called an ARP request frame. This contains the unresolved IP address and also the IP and physical address of the requester. The host that owns the unresolved IP address responds by sending its physical address to the host that sent the request. The target host may also add the requester to its own ARP cache.

When a host wants to communicate with another host that is not on the same subnet, it simply sends the data to whatever is listed as its default gateway which will be an IP router that forwards it on in a direction based on the IP address.

Packet Sniffing

A Packet Sniffer (Network Protocol Analyser) is a tool used to monitor the traffic on a network segment. In its simplest form it can be a software application run on a PC with a network connection. The packet sniffer captures the packets seen by the PC's network card (whether addressed to the PC or not). The captured packets can then be displayed and analysed.

Hall's book shows screen captures from a packet sniffer called Shomiti Surveyor; a cut-down version of which is on the CD-ROM included with the book. Unfortunately the capture function is disabled in the cut-down version and the full version costs money; hence we will not be using it. However there is a good open-source packet sniffer available called Ethereal and this is installed on the lab PCs (see for information and downloads).

The next page shows what packets were captured when I pinged host 146.191.100.246 from my office PC (146.191.100.247).

The first is a broadcast ARP packet sent by my office PC. It knows that 146.191.100.246 is on the same network as itself so it needs to find out 146.191.100.246's physical address. 146.191.100.246 sees the ARP broadcast, recognises its IP address, and replies with a unicast packet back to my office PC with the information that its physical address is 00:60:b0:ed:3b:84. This exchange of ARP packets is only needed because 146.191.100.246 is not in the ARP cache of my office PC. If I pinged 146.191.100.246 a second time shortly after the first there would be no ARP packets sent as the information needed would already be in the ARP cache.

The remaining 8 packets consist of 4 pairs of ICMP (Internet Control Message Protocol) echo request and echo reply packets. Whenever a host running the TCP/IP protocol suite receives a ICMP echo request packet it replies with an ICMP echo reply packet. The various messages that are supported by ICMP will be explained in the lecture program.

To get a similar capture yourself, start up Ethereal, pull down the Capture menu and select Start. In the dialog that appears type: host your_PCs_IP_address into the Capture Filter field, and click OK. Ethereal will now capture all packets that your PC sees. Ping a neighbouring lab PC (make sure it is switched on first), click the Stop button in the Ethereal dialog and the captured packets should be displayed. You may find extra packets have been captured which are not caused by the ping, ignore these.

Example - Internet Addresses

The InetAddress class is Java's encapsulation of an IP address; it is used by most of the other networking classes including those associated with sockets (which we will be looking at in subsequent labs). You can check out the documentation for this class in the usual way. The class has two private attributes: a String representing the host name (eg media.paisley.ac.uk), and a byte array representing the IP address. Since these attributes are not public they cannot be accessed directly but instead various methods of the class can be used. A simple program that uses the InetAddress class to look up the Domain Name System (DNS) server to get the IP address of an internet host is shown:-

import java.net.*;

public class HostByName {

public static void main(String[] arg) {

String hostname = "localhost";

if (arg.length > 0) hostname = arg[0];

try {

InetAddress host = InetAddress.getByName(hostname);

System.out.println("host name: " + host.getCanonicalHostName());

System.out.println("host address: " + host.getHostAddress());

} catch (UnknownHostException e) {

System.out.println("Could not find " + hostname);

}

}

}

The InetAddress class does not have any public constructors, however calling the getByName method returns a suitably initialised InetAddress object. The getByName method throws an UnknownHostException so needs to be called within a try clause.

Similarly to above, the following shows a program to get the name and IP address of the local host. In this case the getLocalHost method is used to return the suitably initialised InetAddress object:-

import java.net.*;

public class LocalHost {

public static void main(String[] arg) {

try {

InetAddress host = InetAddress.getLocalHost();

System.out.println("local host name: " + host.getCanonicalHostName());

System.out.println("local host address: " + host.getHostAddress());

} catch (UnknownHostException e) {

System.out.println("Could not find local host");

}

}

}

Exercise

Write a simple Java application that takes a hostname or IP address as a command line argument and outputs the next ten consecutive IP addresses together with their host names if allocated.

Hint: the getAddress method of the InetAddress class returns a byte array representing the IP address. Byte [3] is the least significant and byte [0] the most significant.

Uniform Resource Locator (URL)

An IP address just specifies the address of a host on a network; a URL also specifies the location of a resource (file) on that host and the scheme(protocol) to be used to access it. An example of a URL is:

This can be broken into its component parts as follows:

scheme (or protocol)

media.paisley.ac.ukthe server name

/~johnstone/em_sys/path that leads to the file

index.htmlfile name

This specifies the file index.html, access via the path /~johnstone/em_sys/ from the server root, the host being media.paisley.ac.uk, and the application protocol to be used to access the resource is