Geode Cities

Rooms

Settings

Table of Contents

< Chapter 11

Chapter 12 - ARP and DNS

More immediately important to talk about is two related technologies, called ARP and DNS.

The first of these is Address Resolution Protocol (ARP), which is a technology used on Ethernet networks to convert IP Addresses into MAC addresses. By using ARP, your computer can automatically discover that (for example) IP Address 15.23.44.0 corresponds to MAC 11:22:33:44:55:66 on your local network. This is important to make Internet Protocol work effortlessly on Ethernet networks.

Referring back to the network diagram I shared earlier, ARP allows "Alisa's Personal Computer" to configure its IP settings without even thinking about Ethernet MACs. In this network, Alisa's PC would have its IP settings configured so that the "default gateway" was 15.23.44.0. As the default gateway, Alisa's computer would know that any messages not addressed to devices inside the Ethernet network should be sent to that Gateway instead. Alisa's PC's IP settings mark 15.23.44.0 as the default gateway, not 11:22:33:44:55:66. So the MAC must be discovered before traffic can be sent to the gateway, because the Ethernet Switch only works in terms of MAC addresses not IP addresses. (Much later, "layer 3" switches were introduced to have switches that are actually aware of IP addresses, but even now these are expensive and only provide value in niche situations).

This discovery, powered by ARP, works like this roughly:

Alisa's computer wants to reach address 15.23.44.0 but it doesn't know what MAC that corresponds to

Alisa's computer sends an ARP packet in an Ethernet frame addressed to the special MAC FF:FF:FF:FF:FF:FF (called the broadcast MAC)

The Ethernet Switch forwards this packet to all ports on the switch. If your network is set up with a hub instead of a switch, this is the normal behavior.

Whatever device is using IP address 15.23.44.0 will send an ARP response packet back to whatever Ethernet MAC address broadcasted the request. In this case, the ISP gateway attached to the switch by a modem is the one that is using the IP address 15.23.44.0. The response says "I'm MAC 11:22:33:44:55:66 and I'm the one using IP address 15.23.44.0 :)"

Alisa's computer receives the response and caches the pair 15.23.44.0 -> 11:22:33:44:55:66 in a list it keeps (called the ARP table). Next time, it just checks this table to find the MAC instead of sending a broadcast across the whole Ethernet network.

So let's say we have Alisa's house with these equipment inside. Alisa wants to print a document to her printer using Internet Printing Protocol. So she points her document program to print to IPP device 15.23.44.2. Alisa hasn't printed to this device before, so her computer will send an Ethernet broadcast with an ARP request asking "what Ethernet device here has IP Address 15.23.44.2?" and then the printer replies "I'm 12:34:56:AB:CD:EF and I have that IP Address!" Then Alisa's Computer sends the IPP packets as serial-style data across the Ethernet cable, packaging them in Ethernet frames addressed to MAC 12:34:56:AB:CD:EF. The switch takes those serial messages, checks the frames' destination MACs, and then switches the messages to go out of the port that the printer is attached to. Then the printer receives the messages and tries to print the document they contain.

Alright so like, ARP and DNS do not work anything like each other. But they serve a similar purpose. ARP translates IP addresses into MAC addresses. DNS translates human readable addresses into IP addresses.

Ever see The Lion King?

DNS stands for "Domain Name System". The word "Domain" is used in the same sense as that scene in the Lion King, where Simba's dad Mufasa tells him "everywhere the light touches is our kingdom". That kingdom is Simba's Domain.

The Domain Name System allows organizations to assign names to all the devices within their domain, and for those names to be unique globally.

If you set up some records in the domain name system, you'd likely consider the contents of your house as your "domain".

For many practical reasons, the DNS system can't work like ARP where the computer trying to look up an address just broadcasts to the whole network. ARP broadcasts on an Ethernet network, which has like a few hundred members at most. DNS contains hundreds of millions of members.

So the organization ICANN keeps a list of so-called "top level domains". Each entry on this list specifies the IP address of a server which can help you look up the IP for addresses under that level. The list originally had just a handful of entries:

Later this list was expanded to include a bunch more entries. Notably, they added a bunch of two-letter country codes. E.g. us and ru.

The servers for each of those country codes are owned by the governments of each country. Typically, the government delegates management of that server to a dedicated organization.

This was a huge deal for some countries, like Tuvalu who got tv and makes a significant portion of their countrywide revenue from it. It is similar with the British Indian Ocean Territory that got io.

DNS is a hierarchical naming system, so the "top level domains" (TLDs) each can have any number of names "below" them in the hierarchy. For example, "com" has "discord" under it. Bizarrely, the group who came up with the standards for DNS decided that instead of going from left to right like a directory path, DNS names should go from right to left. So instead of having com.discord we get names like discord.com. This "fully qualified" name has TLD name com and second-level domain name discord. Fully qualified meaning it shows the entire name up to the top-level.

Although domain names are now mostly used for websites, the domain name system pre-dates the invention of websites by like 6 years. For the longest time, it was standard to have the third-level domain "www" to identify the web server separately from the rest of the domain. E.g. www.discord.com would identify the primary web server on the discord second-level domain under the com commercial TLD.

So here's the scenario: "back in the day" documents were sent around by Fax machine. But now you have this fancy Internet printer. I want to send you a document, for example some pages of a sensitive document. I ask you for the address of your Internet printer, and you tell me it's 15.23.44.2. I forget that immediately. To help with the forgetting problem, you register a domain name system entry.

Let's say you want to name your domain cheesebags. You might approach an Internet company that contracts with the Russian government (or the government's delegated management organization). You pay that Internet company $10 a year to keep that entry valid. Some of that money goes to the Internet company in exchange for hosting your entry. Some of that money goes to the government in exchange for hosting the ru TLD. And some of that money goes to ICANN for hosting the list of TLDs.

As the proud owner of domain name cheesebags.ru, you now set up the third-level domain printer.cheesebags.ru. You pay that Internet company to keep the record that printer.cheesebags.ru is associated with IP address 15.23.44.2.

So, now, when I ask you what the address of your Internet Printer is, you can tell me the address is printer.cheesebags.ru. Now that's a name to remember.

When I put that address into my computer, it checks my computer's network settings for the IP address of a "DNS Server" to use. This used to have to be entered manually according to guidelines from the ISP, though these days the server is usually picked automatically. So, because this is the 1990s, my PC will go to the server my ISP told me to use and ask it "what is the IP address for printer.cheesebags.ru"? Then my ISP's server will check the ICANN list of TLDs and see that ru is managed by Russia and it will go ask Russia "what is the IP address for printer.cheesebags.ru?". Russia will say that this domain is managed by the Internet Company that Alisa is a customer of. So my ISP's server will check with that Internet Company to ask "what is the IP address for printer.cheesebags.ru?" and that Internet Company will check its records and reply that "printer.cheesebags.ru is associated with 15.23.44.2". Then the ISP-owned DNS server will forward that reply back to my computer.

Very notably, a lot of government-mandated website blocks work at this level. The government forces all the ISPs in the country to reject requests for DNS addresses that the government says should be blocked.

Once my PC has discovered the IP address of your internet printer, me printing on your printer is as simple as sending some IP packets with source address 18.43.64.1 and destination 15.23.44.1:

My computer does not know the MAC addresses you use on your Ethernet network, but it also does not need to. When the IP packet arrives at your ISP's customer-facing gateway router, that router (which is attached to your Ethernet network by your Ethernet Modem) will itself use ARP to discover the appropriate MAC to use. Then the router will encapsulate the IP packet in an Ethernet frame with the appropriate source and destination MACs. That IP packet inside an ethernet frame is what gets passed the rest of the way of the journey.

Chapter 13 >