Networks including the internet

Networks, LANs and WANs

Two or more devices connected so that they can share data and hardware form a network. The point of a network is sharing: one printer, one central store of files and one internet connection can serve many users, and any user can reach data held on another machine without walking to it.

A local area network (LAN) covers a small geographical area - a single building, or the buildings on one site, such as a school, an office or a home. The hardware is normally owned and managed by the organisation itself, so it chooses its own cabling, its own switches and its own security. Because the distances are short, a LAN runs at high data rates - switched Ethernet at 1 Gbps to the desktop is ordinary - and the latency is very low.

A wide area network (WAN) covers a large geographical area, from a city to the whole world, and its purpose is to connect LANs that are far apart. The links between the sites generally belong to a telecommunications company and are leased by the organisation, because laying your own cable across a country is not realistic.

Bandwidth costs more, latency is higher and the design is more complex, with routers at each site deciding how traffic passes between them. The internet is the largest WAN in existence.

The distinction between the two is scale and ownership rather than technology. Both move packets between hosts, both use IP addresses and both are built from switches, routers and links; what changes is the distance, who owns the links, and how much bandwidth you get for the money.

• Share hardware: one printer or one large storage array can serve the whole site.
• Share data: files are held centrally, so everyone works from the same version and one backup covers them all.
• Communicate: email, messaging and video calls run over the same connection.
• Central management: user accounts, security settings and software updates are applied once, at the server.
• Cheaper per user: fewer devices and fewer internet connections are needed than for standalone machines.
• Remote access: staff can reach the network from home over a WAN link.

The hardware that supports a LAN

There are seven devices to know for a LAN, plus the cable that joins them, and every question about them is really asking the same two things: what does the device do to the data, and what does it base its decisions on?

A network interface card (NIC) is the hardware inside a device that connects it to the network. It holds the device's MAC address, which is fixed when the card is made, and it converts data from the parallel form used inside the computer into the serial signals the medium carries.

A wired NIC has an RJ45 socket for a twisted-pair cable. A wireless NIC (WNIC) has a radio transceiver and an aerial instead, and connects to a wireless access point.

A switch sits at the centre of a star topology. It learns the MAC address on each port by reading the source address of every frame that arrives, then forwards each frame out of the one port where the destination is known to be. That is a large improvement on a shared segment, where every frame reaches every host: each switch port is its own collision domain, full duplex becomes possible, and local traffic stays off the rest of the network.

A server is a computer whose job is to provide a service to the other machines - files, printing, email, web pages, DHCP addresses or DNS lookups. It is built with more memory, faster storage and often duplicate disks and power supplies, because many users depend on it. Its weakness is that it is a single point of failure, so important servers are duplicated or clustered.

A wireless access point (WAP) joins wireless devices to the wired LAN. It contains a radio transceiver and an aerial, and it bridges frames between the radio network and the cable, handling authentication and encryption with WPA2 or WPA3 as it does so. Access points are placed so that their coverage overlaps slightly, which lets a device move through the building without losing the connection.

A bridge joins two segments of the same LAN. It reads the MAC address of each frame, learns which addresses lie on which side, and forwards a frame across only when the destination is on the other side; frames for devices on the same side are filtered out.

That filtering cuts traffic and turns one large collision domain into two smaller ones. A switch does the same job with many ports, so a bridge now usually links two switches, or joins two buildings over a wireless link.

A repeater regenerates a digital signal so that a cable can run further than the medium allows. It does not simply amplify, which would amplify the noise as well: it reads the incoming bits and transmits clean copies of them. It makes no decision about addresses, so every bit that arrives is sent out again.

The cable itself is the medium: unshielded twisted pair (UTP) to the desk, and fibre-optic cable for the backbone between switches or between buildings.

Routers, Ethernet and collisions

A router connects networks to one another, and its job is to get a packet to a network it is not directly attached to. Each of its interfaces has its own IP address.

When a packet arrives, the router reads the destination IP address, looks it up in its routing table, and forwards the packet out of the interface that leads to the best next hop. The table can be configured by hand or learned automatically from other routers.

For a LAN, the router is the default gateway: any packet whose destination is not on the local subnet is sent to it. The router also performs network address translation (NAT), which lets many devices with private addresses share one public address, and a home router adds a switch, a wireless access point, a DHCP server and a firewall in the same box.

Ethernet is the family of standards (IEEE 802.3) that defines how a wired LAN sends data: the frame format, the addressing, the cabling and the speeds, which run from 10 Mbps to 100 Gbps and beyond. A frame carries the destination MAC address, the source MAC address, a type field, the data (usually 46 to 1500 bytes) and a frame check sequence, a checksum used to detect corruption in transit.

A MAC address is 48 bits long, written as six pairs of hexadecimal digits such as 00:1A:2B:3C:4D:5E. The first three pairs identify the manufacturer and the last three are unique to the card, so no two NICs should share one. It is a physical address: it stays the same wherever the device goes.

A collision happens when two hosts on a shared segment transmit at the same time. The two signals add together on the cable, both frames are corrupted, and both transmissions are wasted. The rules that recover from this are carrier sense multiple access with collision detection (CSMA/CD): a host listens before it sends, keeps listening while it sends, and backs off for a random time if it hears a collision.

On a modern switched network each device has its own pair of wires to the switch and can transmit and receive at the same time, so collisions cannot occur and CSMA/CD is not needed. Wireless networks cannot detect a collision while they are transmitting, so they use CSMA/CA, carrier sense multiple access with collision avoidance: a station waits a random time after the medium becomes free, and expects an acknowledgement, which avoids most collisions instead of detecting them.

Client-server, peer-to-peer, thin and thick clients

In the client-server model one or more computers are dedicated servers and the rest are clients. The server holds the data and provides the service; the client sends a request and presents the result. The roles are fixed and they are different: the server runs the service and enforces the rules, and the client runs the interface and asks for things.

Servers usually have a fixed, well-known IP address, sit in a locked room with backup power, and are run by a specialist. Clients are the ordinary desktops, laptops and phones, and they can be configured to find their services automatically, taking their own address from DHCP and the server's name from DNS.

In a peer-to-peer (P2P) network every computer can act as both client and server: each one can share its own files and printers and can use anything shared by any other. There is no central store and no central administrator, which makes a small network cheap and quick to set up and means nobody has to buy a server. The price is that there is no central control, no central backup and no consistent security policy, and a machine can only be used while it is switched on.

A large network is usually split into subnetworks (subnets), each a smaller network with its own range of addresses, joined to the rest by routers. The roles are repeated inside each subnet: a file server for the admin staff, a different server for students, a switch in each room and a router between them. Splitting the network keeps broadcast traffic inside one subnet, lets each subnet have its own security rules, and stops a fault in one part from flooding the rest.

A thin client is a low-power terminal with little processing power, memory or storage. It does almost nothing itself: the application runs on a server and only screen, keyboard and mouse traffic crosses the network. A thick client is an ordinary PC that runs the application and stores its files locally, using the network mainly for shared storage and services.

The difference that earns marks is where the processing and the data sit. A thin client is cheap to buy, quiet, low on power and easy to replace, and because the data never leaves the server it is easier to secure and to back up; but it is useless without a working network and a powerful server, and it is a poor choice for video editing or computer-aided design. A thick client keeps working when the network fails, handles graphics well and spreads the processing load, but it costs more per seat, its software must be updated machine by machine, and its data is spread across many devices.

Topologies, and how a packet travels across each one

A topology is the arrangement of the devices and the links between them. There are four in this syllabus, and each one changes both how a packet reaches its destination and what happens when something fails.

In a bus, every device taps into one shared backbone cable, terminated at both ends so the signal does not reflect back. When a host transmits, the frame travels along the whole cable and every device receives it; each NIC compares the destination MAC address with its own, and only the matching one accepts the frame.

The cable is shared, so only one host can transmit at a time and CSMA/CD is needed. A bus uses very little cable and no central device, but a break in the backbone or a missing terminator stops the whole network, every device competes for the same bandwidth, and a fault is hard to find because there is no centre to test from.

In a star, every device has its own cable to a central switch. The switch reads the destination MAC address and sends the frame out of that one port only, so a star is fast and a single faulty cable affects a single device.

If the central switch fails, the whole network fails, and more cable is needed because every device needs its own run back to the centre. Nearly every office and school LAN is a star, often a star of stars with switches chained together.

In a mesh, each node is connected to several others, or in a full mesh to every other node; a full mesh of n nodes needs n(n-1)/2 links. With several routes between any two points there is no single point of failure, because traffic can go another way when a link or a node fails.

The cost is the number of links and ports, which rises very quickly with the number of nodes, plus the complexity of configuring the routing. Mesh and partial mesh are used for WAN backbones, for joining a few critical sites, and for wireless mesh networks.

A hybrid combines the others, and it is what most real networks are. A school might have a star in each block, the stars joined by a fibre backbone in a ring or mesh, with a wireless network on top for laptops and phones. The internet itself is a mesh of networks with many different shapes inside.

To say how a packet reaches another host, follow it device by device. The sending host builds the packet, and its NIC puts it into a frame addressed to the next device on the path.

On a star, that next device is the switch, which looks up the destination MAC address and forwards the frame out of the right port; on a bus the frame is broadcast along the backbone and only the destination accepts it. If the destination is on another network, the frame goes to the default gateway, and from there each router forwards the packet by its IP address until the packet reaches the destination network, where the final router delivers it to the host.

Wired and wireless media

The medium is what carries the signal, and every medium trades one advantage for another. Learn each one with a strength and a limitation, because compare and justify questions always want both.

Copper cable carries data as electrical pulses. Twisted pair, the ordinary network cable with an RJ45 plug, is cheap, flexible and easy to terminate, and it can carry power as well as data, which is how an access point in a ceiling is fed.

The weaknesses of twisted pair are distance, since a standard Ethernet run is limited to about 100 metres, and interference: electrical noise from motors, power cables and fluorescent lights induces a current in the wire, and signals in neighbouring pairs interfere with each other as crosstalk. Coaxial cable has a single core inside a shield, so it resists interference better and is used for cable broadband.

Fibre-optic cable carries data as pulses of light along a glass core. It has enormous bandwidth, runs for kilometres rather than metres, is completely immune to electrical interference, is hard to tap without disturbing the light, and carries no electrical hazard.

Fibre costs more, the cable is fragile, joining two fibres needs a skilled technician with a fusion splicer, and every device on the end needs an optical transceiver. It is the standard choice for backbones, between buildings and for long WAN links.

Radio waves, including WiFi, carry data through the air. WiFi uses the 2.4 GHz and 5 GHz bands, and 6 GHz on newer equipment, under the IEEE 802.11 standards; those bands are unlicensed, so a network can be installed without buying a licence. Radio gives mobility, needs no cable to each device and is quick to extend, but the signal weakens with distance and with walls and metal, the air is shared so every device on an access point competes for the same bandwidth, it suffers interference from other networks, microwave ovens and Bluetooth, and anyone in range can try to listen, so WPA2 or WPA3 encryption is essential.

Microwaves are used for point-to-point terrestrial links, with a dish at each end aimed at the other. The link must be line of sight: the dishes sit on masts or roofs, and anything in the path, including a new building or a mature tree, breaks it.

A microwave link carries high bandwidth over tens of kilometres and is far cheaper and quicker to install than digging a trench for fibre, which is why it is used between two sites of one organisation, or across a river or a valley. Heavy rain degrades it.

Satellites use a dish pointed at a satellite in orbit. A geostationary satellite sits about 36 000 km above the equator and stays over the same point, so the dish does not have to track it, and one satellite covers a large area including places no cable reaches.

The penalty for a satellite link is latency: the signal travels up and back, giving a round trip of roughly half a second, which is painful for video calls and impossible for fast online games. Low Earth orbit constellations such as Starlink fly a few hundred kilometres up and give much lower latency, but they need hundreds of satellites and a dish that tracks them.

The implications of wired against wireless come down to five things: mobility, since only wireless lets a device move; installation, since wireless avoids the cost and disruption of cabling while a cable is faster and more reliable; bandwidth, since a cable gives each device a dedicated connection while wireless shares the air; interference and security, since radio can be blocked, overheard and attacked from outside the building; and latency, which is more variable over radio.

Cloud computing and bit streaming

Cloud computing means using computing resources - storage, processing power and software - provided by a third party over the internet, on demand and paid for as they are used. The organisation does not own the hardware; it rents capacity, and the provider is responsible for the building, the power, the cooling and the maintenance.

A public cloud is owned by a provider and its resources are shared between many customers, each kept logically separate. Because the provider buys at huge scale, the cost per hour is low, capacity can be added in minutes, and there is nothing to maintain on site. The trade-offs are that the data is held by someone else, under their security and in their jurisdiction, that performance depends on the internet link, and that the bill continues for as long as the service is used.

A private cloud is dedicated to one organisation, either in its own data centre or hosted for it alone. It gives control over where the data sits, how it is secured and how the hardware is configured, which matters for regulated records such as medical or financial data.

A private cloud costs more, because the hardware and the staff are paid for whether the system is busy or idle, and it scales only as fast as new equipment can be bought. Many organisations run a hybrid of the two: sensitive records in a private cloud, and public cloud capacity for a website that must survive a sudden surge in demand.

Bit streaming is playing media while it is still being downloaded, instead of waiting for the whole file. The player keeps a few seconds of the stream in a buffer ahead of playback, so that a short slowdown on the network does not interrupt the sound or the picture.

Real-time streaming is live: the data is generated as it is sent, as in a live match, a video call or a radio broadcast. There is nothing to buffer ahead, because the next second of the event has not happened yet, so the stream needs a steady bit rate and low, consistent latency; if the connection falls below the bit rate the picture stalls and then jumps forward.

On-demand streaming plays media that is already stored, such as a catch-up programme or a film. The viewer can start at any point, pause and skip, and because the rest of the file already exists the player can buffer much further ahead, which hides short drops in speed.

The bit rate is the number of bits per second the stream needs, and the broadband speed must be comfortably above it. A 5 Mbps stream cannot run on a 4 Mbps connection at all, and on a connection that only just exceeds it any competing traffic causes buffering. When the available speed falls, adaptive streaming drops to a lower bit rate and quality instead of stopping, which is why a weak connection gives a soft, blocky picture.

The internet, the World Wide Web and the hardware behind them

The internet is the global network of interconnected networks. It is infrastructure: submarine cables, fibre in the ground, routers in exchanges and the internet exchange points where networks meet, all running the same suite of protocols, chiefly TCP/IP. It exists whether or not anybody is browsing.

The World Wide Web is one service that runs on the internet: the collection of web pages and other resources, identified by URLs, requested with HTTP or HTTPS and displayed by a browser. Email, file transfer, voice calls and streaming are other services on the same internet. So the internet is the road network and the web is one kind of traffic on it: you can be connected to the internet without opening a web page, but you cannot open a web page without the internet.

A modem (modulator-demodulator) converts between the digital data of the computer and the signal the line can carry. On an ordinary telephone line it turns the data into sound frequencies the line will pass; on a cable television network it does the equivalent job for the cable; on fibre, an optical network terminal converts between light and electrical signals. Without it the digital data would not survive the journey to the exchange.

The public switched telephone network (PSTN) is the world's telephone system, a circuit-switched network built to carry voices. Dial-up internet used it directly: the modem called a number, the connection held the line open, and the speed was very low. ADSL reuses the same copper pair for data at higher speeds while leaving the voice service usable, by carrying the data on frequencies the voice does not occupy.

A dedicated line (leased line) is a permanent point-to-point connection rented from a provider. It is private to the customer, always on, and normally offers the same speed in both directions - symmetric bandwidth - with a guaranteed service level. It is the most expensive option, and it is used by businesses, schools and hospitals that cannot tolerate a shared or variable link.

A cell phone network carries data over radio links between a mobile device and the nearest base station, handing the connection from one cell to the next as the user moves. It provides internet access where there is no cable at all, which makes it the connection for phones and tablets and a useful backup link for a business, but coverage, speed and latency vary with position and with the load on the cell.

Data crosses all of these links by packet switching. A message is split into packets, each with a header holding the source and destination IP addresses, a sequence number and a time to live.

Each packet is routed independently, so two packets from the same file may take different routes and arrive out of order, and the destination reassembles them by sequence number. That is what makes the internet resilient: if a router or a link fails, packets go another way, whereas a circuit-switched network such as the PSTN must set up and reserve a path before any data moves.

IP addresses, URLs and DNS

An IP address is the logical address of a device on a network. Routers use it to decide where a packet goes: the MAC address only matters inside one LAN segment, while the IP address is what carries a packet across the internet.

An IPv4 address is 32 bits long, written as four decimal numbers separated by dots, each from 0 to 255, for example 192.168.10.25. The four groups are called octets because each one is a byte. Thirty-two bits give about 4.3 billion possible addresses, and they have effectively run out, which is why IPv6 exists.

An IPv6 address is 128 bits long, written as eight groups of four hexadecimal digits separated by colons, for example 2001:0db8:85a3:0000:0000:8a2e:0370:7334. Leading zeros in a group may be dropped, and one run of zero groups may be replaced by a double colon, so that address can be shortened to 2001:db8:85a3::8a2e:370:7334. The address space is so large that exhaustion is not a practical concern, and every device can have a globally unique address.

Subnetting means splitting one network into smaller subnetworks. A subnet mask marks which bits of the address identify the network and which identify the host: with 255.255.255.0 the first 24 bits are the network and the last 8 are the host, giving 254 usable addresses once the network and broadcast addresses are excluded. Subnetting keeps broadcast traffic inside a subnet, lets each subnet have its own security rules, makes addressing easier to manage and uses the available addresses more efficiently.

An IP address is associated with a device in one of two ways. It can be set by hand, which gives a static address, or it can be issued automatically by a DHCP server, which gives a dynamic address leased for a period and then returned to the pool. Inside the LAN, ARP finds the MAC address that belongs to an IP address, so that the frame can be addressed to the right NIC.

Servers, printers and routers are usually given static addresses, because other devices must find them at a known address and a changing address would break a DNS record or a firewall rule. Ordinary client machines are usually dynamic, because that needs no configuration, stops two devices being given the same address by mistake, and reuses the address of a machine that has been switched off.

A public IP address is globally unique and routable on the internet; it is the address the rest of the world uses to reach a network. A private IP address comes from a reserved range - 10.0.0.0 to 10.255.255.255, 172.16.0.0 to 172.31.255.255 and 192.168.0.0 to 192.168.255.255 - and is not routed on the internet, so the same addresses can be reused in every home and office. NAT on the router rewrites the private source address into the public one on the way out and matches the replies back to the right device.

The security implication is that a device with only a private address cannot be contacted directly from the internet, because no route to it exists: an attacker has to get past the router first, and NAT incidentally hides the internal layout of the network. That is a genuine reduction in exposure, but it is not protection. NAT is not a firewall, and it does nothing about malware that opens the connection outwards, or about a port that has been deliberately forwarded to an internal server.

A uniform resource locator (URL) is the address of a resource on the web. It gives the scheme, which is the protocol to use (https), the domain name of the server (www.example.com), an optional port, and the path and file name of the resource (/revision/networks.html), followed by an optional query string. The browser must have the domain name turned into an IP address before it can send the request.

The domain name service (DNS) does that translation, using a distributed hierarchical database. A resolver asks a root server, which points it to the name server for the top-level domain such as .com or .uk; that server points to the authoritative name server for the domain, which returns the record - an A record for an IPv4 address or an AAAA record for an IPv6 address. The answer is cached for a time to live, so the next request for the same name is answered without repeating the whole lookup.

• IPv4: 32 bits, four decimal octets, dots, for example 10.0.0.7.
• IPv6: 128 bits, eight hexadecimal groups, colons, for example 2001:db8::1.
• Private ranges: 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/16, which are never routed on the internet.
• Static address: configured by hand, used for servers, printers and routers.
• Dynamic address: leased by DHCP, used for ordinary client devices.
• DNS records: A for IPv4, AAAA for IPv6, MX for mail servers, CNAME for an alias.