Week 7

An IP address is like a postal address. The Maxwell Dworkin building on campus has an address of 33 Oxford Street, Cambridge, Massachusetts, 02138, USA. This is a unique address in the world, and likewise computers have unique addresses.

Each number, then, uses 8 bits, and in total the address is 32 bits, making for a total number of roughly 4 billion possible addresses.

Specific ranges are also reserved for particular organizations or providers. For example, many of the computers at Harvard will be assigned an IP address that starts with 140.247.#.# or 128.103.#.#, with MIT down the street having its own range as well. Providers like Comcast also has a particular prefix that they own.

Notice that the laptop connects wirelessly to an AP, access point, which typically comes with antennas. The access point allows devices to talk to the rest of the network wirelessly. At home, this might be called a home router, made by D-Link or Linksys or the like.

The access point is connected to a switch, which is connected to a router, and there is other equipment in between the router and the cloud on the right, representing the rest of the world.

We also have at least two other servers, one being a DHCP server and the other a DNS server.

At home, the switch and router and DHCP and DNS servers are replaced by a cable modem that connects to the equipment that the Internet provider, like Verizon or Comcast, is running somewhere else for all its customers.

To draw an analogy, lots of companies buy 1-800 numbers with words at the end, like 1-800-COLLECT, so people don’t need to remember those numbers but just one word.

Hostnames, or fully qualified domain names, allow us to do something similar, addressing servers by names rather than numbers.

The first part, lines 2-3, is the address of Harvard’s DNS servers, and the last line, line 7, is its response to the question of what Facebook’s IP address really is. And if we copied that number, and went to http://173.252.120.6, we’ll indeed end up at facebook.com.

Sometimes companies tell the world they have one IP address, which ends up being resolved, or mapped, to a whole bunch of servers after, or, like Google, they tell the world that there are a number of addresses, any of which you can contact.

On the Internet, servers might lose, or drop, packets, and we want to avoid this.

But before we send that, let’s remember that there are lots of services on the Internet beside regular web browsing. Email, chat, and file storage are all examples, and servers can do any of those things. So we need to somehow tell Dan about the type of message that we’re sending him in the envelope, so he can open it with the right program.

ports
21 FTP
25 SMTP
53 DNS
80 HTTP
443 HTTPS

For example, FTP, file transfer protocol, was assigned a unique identifier of 21 some years ago.

SMTP, for outbound email, is 25.

DNS uses 53 for its queries, or questions of what the address of a website might be.

And you may have seen that HTTP, web traffic, and HTTPS, secure web traffic, use 80 and 443.

But what if one router is broken or is powered off, and a packet doesn’t make it to Dan? TCP tells computers to send a packet back - a message from Dan to David - telling him which packets in the original message were missing, since they were all numbered.

Each of these rows is like a student in the audience between David and Dan, who passed the message along.

On line 2 we see the domain name typed in, and 23.10.80.128 is apparently the IP address of www.mit.edu that the computer figured out using DNS. We’re also going to limit ourselves to 30 hops, or by going through no more than 30 servers between us and MIT.

Then each row is a router, with the first two routers having no name, just some private (because they start with 10.#.#.#) IP address.

They only take a few milliseconds to reach, and when we get to the third router at (3), we see that it has some cryptic name.Having been told how by Harvard’s network administrators, we can break the name down as identifying this particular router as one in the core of the network, located in sc, the Science Center, and acts as a gw, gateway, which is a synonym for router.

That server is connected to another one at (4), nicknamed bdrgw1, border gateway.

The next one at (5) is nicknamed "northern crossroads", which is just where lots of cables from lots of entities are connected.

The next one is unnamed and not very interesting, but router (7) has a part that says ny - implying New York, where this router is probably located (conventionally we name routers by the city or airport they’re located near), and the fact that it took about 6 milliseconds (as opposed to one or two) makes sense.

Finally, the actual domain name for www.mit.edu, (8), seems to indicate a server that’s part of a company called Akamai that they’ve outsourced server hosting to.

So now we’re going through a longer list of routers and cities, with router number (8) probably located in Chicago, (9) in Salt Lake City, (10) in Los Angeles, and (12) LAX. Finally, it goes from Southern California to Northern California to where Stanford is.

It would take about 82 milliseconds to send a message to California, but let’s go further to www.cnn.co.jp, CNN in Japan:

$ traceroute -q 1 www.cnn.co.jp
traceroute to www.cnn.co.jp (14.0.42.95), 30 hops max, 40 byte packets
 1  10.243.16.161 (10.243.16.161)  0.926 ms
 2  10.240.144.33 (10.240.144.33)  227.831 ms
 3  core-sc-1-gw-vl415.fas.harvard.edu (140.247.2.61)  1.460 ms
 4  bdrgw2-te-4-2-core.net.harvard.edu (128.103.0.2)  1.460 ms
 5  xe-11-2-0.bar2.Boston1.Level3.net (4.53.56.9)  0.879 ms
 6  * (6)
 7  124.215.192.77 (124.215.192.77)  79.800 ms (7)
 8  * (8)
 9  otejbb205.int-gw.kddi.ne.jp (203.181.100.137)  180.785 ms
10  sjkBBAC07.bb.kddi.ne.jp (106.162.175.154)  188.651 ms
11  obpBBAC03.bb.kddi.ne.jp (111.87.242.70)  192.322 ms
12  111.86.159.66 (111.86.159.66)  185.208 ms
13  14.0.40.86 (14.0.40.86)  187.124 ms
14  lajbb001.int-gw.kddi.ne.jp (59.128.2.209)  75.087 ms
15  otejbb206.int-gw.kddi.ne.jp (203.181.100.25)  185.154 ms
16  sjkBBAC07.bb.kddi.ne.jp (118.152.210.246)  172.626 ms
17  14.0.42.95 (14.0.42.95)  184.472 ms (17)

Looks like servers (6) and (8) aren’t responding, if they’re being private, but we can see that between routers (7) and (17) that there’s a huge jump in time that it takes for the message to send, so between 7 and 9 there’s probably a body of water, with transatlantic or transpacific cables connecting these servers.

But here, despite the number of hours it would take to fly to Japan, our message took under than 200 milliseconds to send.

And you can click Show original which will show you lots of information like timestamps, IP addresses, and domain names. More importantly it will show you the headers that have been hidden in every email that you’ve ever sent or received, from which we can infer where and whom the email came from.

The client is your machine that asks for information, and the server is the machine that responds with information.

This simple message would be opened by the server on the other side, which then responds accordingly.

The / right after GET is just asking for the root directory, or the highest directory. To properly visit a website, we should really be typing http://www.facebook.com/ with that final / meaning we want the root of the hard drive, or the default page.

The next part, HTTP/1.1, means that we’re using version 1.1 of HTTP to talk to the server.

The first line is confirming that we’re using version 1.1 of HTTP to communicate, and 200 is a status code that means OK: the server has the page we’re looking for.

The second line is telling the web browser that you’re getting back a webpage of the type text/html (as opposed to an image or video, for example).

And then the …​ is the actual message that the server responds with.

You’ll see lots of cryptic text, and the response is in the language called HTML, Hypertext Markup Language. It’s not a programming language because it doesn’t have functions or loops, but a markup language in that it has tags and attributes that tell a browser what to display on the screen and how to display it, like centering or bolding text, or changing its color.

The output would get 0 out of 5 for style, but in this case since they’re serving billions of pages, removing the unnecessary spaces and tabs saves time and bandwidth and ultimately money.

Notice that we are using a GET request that gave us a status code of 200, meaning we found the page. And if we click on that row, we can actually see the full request:

Someone somewhere will know who’s registered to which IP address, and eventually the logs can be traced back to you, making for very little privacy.

200 OK
301 Moved Permanently
302 Found
401 Unauthorized
403 Forbidden
404 Not Found
500 Internal Server Error

You’ve probably seen at least the 404, which means the file doesn’t exist.