Chapter 7 — Networks and protocols | Bachelor's Network and communications security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 07 published. Map, example, EX019.

flowchart TD
  N0["Learning outcomes"]
  N1["7.1 IP addresses and prefixes"]
  N2["7.2 Planning subnets for groups"]
  N3["Lab — Device placement"]
  N4["7.3 Reading the result"]
  N5["7.4 Protocols and ports"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6
  N6 --> EX["Worked example"]
  EX --> Q["Exercise EX019"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["7.1 IP addresses and prefixes"]
  N2["7.2 Planning subnets for groups"]
  N3["Lab — Device placement"]
  N4["7.3 Reading the result"]
  N5["7.4 Protocols and ports"]
  N6["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> Q["EX019"]

[Learning outcomes]
    |
    v
[7.1 IP addresses and prefixes]
    |
    v
[7.2 Planning subnets for groups]
    |
    v
[Lab — Device placement]
    |
    v
[7.3 Reading the result]
    |
    v
[7.4 Protocols and ports]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX019]

Learning outcomes

You will (1) explain IP addressing and subnets; (2) use CIDR notation; (3) check device placement with a script.

7.1 IP addresses and prefixes

An IPv4 address has 32 bits, usually written as four decimal numbers. CIDR notation, such as 10.20.1.0/25, gives a network address and the number of bits fixed as the network prefix; the remaining bits identify hosts. A /24 leaves eight host bits, 256 addresses; a /25 leaves seven, 128 addresses. Two addresses in each block are traditionally reserved, for the network itself and broadcast, so a /25 has 126 usable hosts. Private ranges such as 10.0.0.0/8 are used inside organisations and are not routed on the internet.

So the block 10.20.1.0/25 runs from 10.20.1.0 to 10.20.1.127: hosts take .1 to .126, and .127 is the broadcast address.

7.2 Planning subnets for groups

Priya proposes one subnet per group for a clinic: staff, clinical devices, guest wireless and network management. Each is sized for current devices plus growth, rounded up to a power of two. Management gets a small /28 because only switches and access points live there. Separate subnets do not by themselves stop traffic, since routers forward between them, but they give each group a distinct address range that firewall rules can refer to, which is the foundation for any segmentation design.

Lab — Device placement

"""Check which synthetic clinic devices fall inside which planned subnet (stdlib only)."""
import ipaddress
nets = {"staff": "10.20.0.0/24", "clinical": "10.20.1.0/25", "guest": "10.20.2.0/24", "mgmt": "10.20.3.0/28"}
nets = {k: ipaddress.ip_network(v) for k, v in nets.items()}
devices = {"reception-pc": "10.20.0.15", "ecg-cart": "10.20.1.40", "visitor-phone": "10.20.2.77",
           "switch-1": "10.20.3.2", "old-printer": "10.20.1.200", "nurse-tablet": "10.20.0.130"}
for name, a in devices.items():
    ip = ipaddress.ip_address(a); zone = next((z for z, n in nets.items() if ip in n), "UNPLANNED")
    print(f"{name:14}{a:13}{zone}")
for z, n in nets.items(): print(f"{z:9}{str(n):15}usable hosts {n.num_addresses - 2}")

Run with python3 lab_cidr.py. Verified output:

reception-pc  10.20.0.15   staff
ecg-cart      10.20.1.40   clinical
visitor-phone 10.20.2.77   guest
switch-1      10.20.3.2    mgmt
old-printer   10.20.1.200  UNPLANNED
nurse-tablet  10.20.0.130  staff
staff    10.20.0.0/24   usable hosts 254
clinical 10.20.1.0/25   usable hosts 126
guest    10.20.2.0/24   usable hosts 254
mgmt     10.20.3.0/28   usable hosts 14

7.3 Reading the result

The script places five of six synthetic devices in their expected groups. The old printer at 10.20.1.200 falls outside every planned subnet, because the clinical /25 ends at 10.20.1.127. This is exactly the kind of counterexample from chapter 1: a single device breaks the claim that every device has a planned home. In a real clinic, such devices are common, often with fixed addresses set years ago. Priya lists it for readdressing rather than widening the clinical subnet to include it, which would quietly enlarge the group.

7.4 Protocols and ports

Above IP, TCP provides reliable connections and UDP sends independent datagrams. Services listen on ports: 443 for HTTPS, 53 for DNS, 22 for SSH. Rules refer to protocol and port as well as addresses, so knowing which services each group uses is essential. Priya starts a list of the services the clinics need between groups. This list of needed flows becomes the basis of later policy, and anything not on it is a candidate to block. She records the protocol, port and direction for each entry, with the group that starts the connection.

Worked example

The lab reports the clinical /25 has 126 usable hosts and finds one unplanned device, the old printer.

Synthetic case. Addresses and devices are synthetic.

Errors and limits

Widening a subnet to fit a stray device enlarges a group without anyone deciding it should.

Exercises

EX019 — Unplanned printer. Why is the old printer at 10.20.1.200 unplanned?
Show marking criteria
Rubric: 3 = clinical /25 ends at .127, outside all subnets;; 2 = outside range;; 1 = wrong subnet without reason;; 0 = none.
EX020 — Usable hosts. How many usable hosts does a /28 provide?
Show marking criteria
Rubric: 3 = 14, sixteen minus network and broadcast;; 2 = 14;; 1 = 16;; 0 = none.
EX021 — Stray device fix. Should the clinical subnet be widened to include the printer?
Show marking criteria
Rubric: 3 = no, readdress the device to avoid enlarging the group;; 2 = no;; 1 = yes;; 0 = none.

Synthesis

CIDR subnets give each group an address range that later controls can rely on.

Continue studying — chapter 07 of 40

← Chapter 06 (draft) · Course chapter index · Chapter 08 (draft) →