How it networks

Since my last post was way more popular than I wanted it to be, and because literally one guy said he'd be interested in another, here you go: a detailed description of how computers network. Buckle up, this stuff has been built on and developed since the 1940s and this is likely going to take longer than one of grandpa's stories that don't really go anywhere, like that time when . . . oh, right

Edit: Other posts I've done
How it internets - https://imgur.com/gallery/9Lj7bwM
How it boots - https://imgur.com/gallery/8E2rdDp
How it stores - https://imgur.com/gallery/SR50IS3

Let's start with where you're at. Most of you are reading this from a phone or a computer. We'll start with the phone since cell and wifi are kinda similar.

So, if you haven't checked your wifi, you're connecting through the cellular network. Your phone is sending a radio signal to one of those hideous-looking cell towers, and getting a radio signal back.

It's not all that different from the radio in your car, but that works between 80mhz-110mhz. Cell towers, for data, are at the 700mhz range. What the crap does that even mean, though?

Time to bring up painful memories of math classes gone by. Sines and cosines, they're a wave, right? Well, that's what this frequency refers to, a sine wave and how many times per second it goes up and down.

The way that moves data to your phone is pretty cool, actually. We can add two waves together to make a unique wave, but since we already agreed on the frequency (the Carrier wave pictured above) we can just subtract that out (and, ok, we play with the wave a little bit more than that to give cleaner signals, but that's the idea) and we're left with the signal we care about.

The actual frequency you connect at will depend on where you live and who your cell provider is. Your cell phone sends out signals on that frequency, and the cell tower subtracts out the carrier wave, and then translates what's left into binary the computer can understand.

Well, that's the ideal case. In reality, a lot of what arrives gets translated into something the computer can't understand. This happens because people turn on a microwave, or some weird crap happens from the sun, or even something as stupid as a pigeon is flying somewhere nearby. . .carrying a magnet. The point is, a lot of data gets lost and garbled along the way, and the cell tower and your cell phone have to throw it away. When we lose enough of the data you see your signal strength drop a few bars, or just perceive a bad connection. Your cell is constantly sending a signal to the cell tower saying "yeah, I'm still here" and getting one back to determine what the signal strength is.

So, now we've gone from radio to binary. The process is the same for your Wi-Fi, it just uses a different frequency and less total power is required than the cell tower. There's also some differences in the specifics of how it says "yeah, I'm still here" between the cell tower and your router, but principal is the same.

And if you're an elitist like me, you wire in with an Ethernet cable. For Ethernet, it's not that complicated. Your device has a physical media access controller (MAC) which throws some of its own information to mark the start and end of a message and then ships the binary off to wherever you're connected.

But shipping a few bits of binary around is hardly adequate to facilitate the next imgur GIF war, and...wait, if we're literally sending our bank information out through radio waves that ANYONE (with a certain level of understanding) can receive, then we need a way to protect that information and ensure only the intended cell-tower or router can actually understand it.

Enter encryption. Cryptography is a huge subject and terribly complex, so I'm going to abbreviate and simplify it with two analogies.

tl;dr version: Encryption happens and it's a bit weird, but it works (and if that's good enough for you, skip to the next picture).

First case, you and your friend both have a copy of a key. Whenever you use this key, only that same key can be used to unlock whatever box it locked. As long as no one else gets a copy of your key, or breaks the box, whatever you use it on is safe. This is how cell towers and wifi work, and the more technical term for it is symmetric encryption.

Your key is in your SIM card for cell towers and kinda covered by your wifi password for your wireless router. The wifi password actually just says that this device is cool enough to get in the club and the router makes a key for both of them after putting it in, then shares that. It will change what key it uses from time to time to limit the risk of someone catching that key and making a copy of it while it's in flight.

These secret club-house keys are how a lot of encryption works, but the "grab in flight" is still an issue and you have to implicitly trust who you're talking to for it to work.

In the second analogy, imagine that you own a key that splits into two parts. One half of the key can unlock, the other half can lock. The half that can lock, you give copies of that to your friends, and the half that can unlock is a secret. Your friends all give a copy of their public-half to you, and you can lock up anything you want with their key and only they will be able to unlock it so long as they keep their unlock-half a secret. Since these are magic keys (i.e. math), the keys actually can work kinda in reverse too! What I mean is that one half can always unlock what the other half locked and vice verse. So, if your friends want you to verify it was actually them who sent the box, they can use their secret-private key to lock the first box in another box, and then the copy of their not-so-secret public key can unlock the outer box, then your secret key can unlock the inside box.

The second analogy is how SSL/HTTPS works (and is called asymmetric encryption), and that's what your computer means when it shows you that little green "locked" icon by the URL of the site you're visiting. When it shows a yellow locked icon, that really only means that your browser isn't sure they trust the other guy's keys for whatever reason, but it's still encrypted. The whole chain of trust is a fun area to explore, and feel free to talk with me about it at our next key-signing party.

At the end of it all, we end up with binary data that looks like complete nonsense until it is mathematically unlocked with a key. After that, we have real network data that we can work with.

So, now that our connection is secure and we've gotten the usable data from it, what happens next? We have data sitting on a cell tower anxiously waiting to request a new cat video, and we need our cat videos dagnabit!

As with most things on computers, the "data" we have is conceptually split into two parts--the information and the instruction. Both of these together is called a packet (and I'm gonna limit things to the IP stack, and just IPv4 here for you network guys, but know I lament the lack of adoption of IPX with you, and IPv6's slow adoption). The instruction comes first, and it's called the packet header. This header contains all the information needed to get the information (called the payload) to the next-closest place to its destination, called a hop.

The way this data moves around is through a network routing device. In ye olde times, they were called hubs, and hubs just took whatever information was put in on one port and then spat it out on every port and left it up to the computers connected to it to decided whether they wanted it or not. Well, that wasn't efficient, or secure, or even very functional, so we decided to make hubs intelligent and actually read/write to each individual port as needed.

We call these network switches, or just switches for short. Anything with a port that you can plug into nowadays is a switch, but the hub concept still kinda applies for wireless--we just use encryption and hardware IDs to limit the network traffic to the intended device.

That's nice and all, but what do switches actually do? Routing, in a nutshell. The concept isn't all that different from those old-timey telephone operators. When they received a call, they asked how they could direct it, and the person told the operator. Using addresses and numbers and a bit of specialized training, the operator would move some cables around a switch board and then the two phone lines would connect so people could talk.

In a computer network, there's a whole lot less people-skills involved. Everything is a number, and the specialized training for a computer is how they interpret those numbers into an action.

Switches are actually very specialized computers, but are capable of processing quite a bit of information (anyone ran DOOM on a Cisco switch yet?). The main difference between a switch and your computer is specialization. Switches are designed to process very simple, almost identical, bits of data in almost no perceivable time.
What they process isn't that much of a mystery. The keep a record of everything they're actively connected to, called the routing table, and how long it takes for them to talk to what they're connected to. What gets stored in the routing table depends on who made the Switch, or programmed the computer.

Your computer has one too! If you're on windows, run a command prompt (cmd or win+r cmd) and type "route print." (or don't, I'm not your boss) Linux guys, it's "ip r" and Mac, who cares, you paid extra money so you didn't ever have to worry about this stuff, right? (j/k it's "netstat -nr" in an iTerm and that will work for some Linux guys too)

Here's an example of Window's output:

This part gets complicated. tl;dr is that computers have an address book in them and IP addresses have a prefix which lets them route traffic.

There are some specialty addresses that were created by the wisdom of the ancients. 127.0.0.1 is the most common and it's a way for the computer to talk to itself so it can test the network hardware without having to worry about the cabling, switch, and all that stuff. In fact, all but the top 4 lines are specialty addresses. They can be used with the same versatility as any other address.

And when I say "lines" I mean just the lines that are all numbers. The first line says, in rough English, "If you have no idea where this traffic is supposed to go, send it to 10.20.32.1 (your router), and tell it that you're located at 10.20.36.4)"
The Metric at the end is a "priority" for that route, and each switch and OS interprets that a bit differently. Here, it looks like the higher numbers are checked first.

Everything else is just clever matching, and many of you are likely familiar with an IP address. What might be a little less familiar is the Netmask. The netmask is part of the IP address, in a way.

The IP address alone isn't enough. We also need to know the neighborhood where that address lives. By analogy, remember that computers are really very stupid and only know how to speak some types of numbers. Giving a computer an address that included a city, and a country would be really messy to work with, so instead all our addresses are just numbers and we use the class to specify whether it's city, state, country, ect.. To make the programming simpler, we don't use cities at all, but rather just give an address to each piece of networking equipment.
The switch is specified as a gateway in most cases, meaning that for anything outside our current class of address, we'll forward traffic to the switch.
The address is categorized by the bit-mask associated with your IP address. So, when you see something like 192.168.1.3/24, the /24 is the subnet mask (it also looks like 255.255.255.0 because well, binary. That translates to 11111111.11111111.11111111.00000000, which is 24 ones and who in there right mind wants to type that out?) and that tells us which parts are used to find the entire network we're looking for, and which parts are used to find a machine on the network. Your switch/router will usually be 192.168.1.1 and will pickup any traffic intended for a different neighborhood.
If you've been to a website before and made a connection, there's a good chance that the full internet-ip-address path to that website is stored close by. It creates that road-map by bouncing to switches on higher-class addresses looking for one that is "closer" to the final destination IP address.

0.0.0.0/0 as a network address means "any and every, I don't really know." So, for this example routing table, the top entry means "send anything that doesn't match below to my gateway". Your router in your house has a gateway to your ISP which then has a gateway to the general internet, which I'll cover in another post.

The only way computers really have to map out these roads is known as ARP (Address Resolution Protocol). They basically scream out "anyone home?" and hope someone responds. If someone does respond, then the switch and routing table can be updated with that information.

(image stolen from https://www.ampercent.com/how-to-connect-two-computers-without-a-router-or-wireless-connection/6587/)

Now we have enough to get two computers to talk to each other, but we haven't talked about any social graces or norms between the computers to get them to talk. You may have heard/seen the letters TCP/IP, and we've, so far, only covered a portion of the IP on that (Internet protocol, for those who are curious).

TCP covers a lot of what gets said, but it's only one of a dozen ways computers can talk to each other inside of the IP stack. I'll go over the top 3: ICMP, UDP, and TCP.

ICMP (Internet Control Message Protocol) is better known as "ping." It just asks basic questions like, "you there?" or "I sent you my ping, how long is it gonna take for you to respond?" ICMP is meant to be super lightweight and is very analogous to smoke signals. No real data gets passed here, it's just there to indicate status. I'm sure the Beacons of Gondor work just as well, but are probably a tad slower.

UDP is User Datagram Protocol, but no one ever remembers that. It's better to think of this as a "fire and forget" way of talking. UDP is used heavily for games and gaming because it's super light on network traffic, and if a few bytes go missing and never actually arrive, then it doesn't matter. When playing, oh, let's stick with the classics and say Quake, your current position on the map is sent via UDP because your most current position is the only one that's important. If you lag and packets stop arriving, you'll "rubber band" back to where the server thinks you are.

TCP (Transmission Control Protocol) is a 500lb gorilla in comparison. TCP does a very intricate back-and-forth with the intended receiver. It's kinda like that pesky kid during your awkward adolescence that constantly badgered you saying, "hey, you there? can you hear me? You listening?"

If you wanted to send me a Paul Revere style message of "2" then UDP would give you a single 2 and hope you saw it. TCP would make sure you're watching and then once it had your attention would send several thousand "2"s until you shouted at it to shut-up.
TCP guarantees that your data will arrive. It doesn't guarantee that it will arrive in any particular order (but each packet gets a number so it can piece it together afterwards), and it will only ever give up after you tell it to (by timeout or completion).

Web pages work via TCP, and basically everything on the internet. Some games even use it, but that's a mistake for most of them. It is, by far, the most popular way for computers to communicate.

That's the basics of networking. If this is popular enough, I'll do the second part on how the general internet works.

As always, if I'm wrong or missing something important, correct me and I'll update the post and if it's something major (i.e. we DM and you explain it to me) I'll give you credit.