Router vs Firewall

Router vs Firewall

Lets check whats difference between a router and a firewall operations

In simple words Router do a job of Post Man and Firewall works as a Police Officer.

When router receive a packet, it checks the destination IP and forwards it as a Post Man deliver the letter to the "To" Address. The Post Man don't check who send the letter or whats the content, same way the Router don't check any details on the source or the content of received packet. It just do the forwarding based on the destination IP.

When a firewall receives a Packet it checks the destination address, the source address, the interface through which it came, the data type/protocol ( like is it HTTP/FTP/ICMP etc) , the actual data ( if enabled) , the time when it came and logs all these details to a Session Entry/Table, which it can use to track the packet/transaction. Just like a Police Man creating FIR.

Below pictures shows the difference on what a router and firewall see/check on ICMP packet it receives

                                                             Router

 

                                                         Firewall

Please leave your suggestions and questions as comments.

Where is ARP used

Where is ARP used?

We checked whats ARP on  my previous blog ARP, now lets check where do we use ARP.

First of all we need to understand, where do we use MAC/Layer 2 address and where do we use IP/Layer 3 address.

MAC address is used for communication with in a broadcast domain and IP address is used when communication happens between different broadcast domains

In below topology we have 3 broadcast domains 192.168.1.0/24 ,10.10.10.0/30 and 192.168.2.0/24

Lets consider below examples

A1 wants to ping A2 (Communication within a broadcast domains)

By looking at A2s IP address A1 can identify that A2 falls on same broadcast domain and to learn the MAC address it sends an ARP. This ARP will be broadcasted by Switch A and A2 can reply with its MAC address.

Same is the case when B1 wants to ping B2 or Router A wants to Ping Router B

Lets check how the ARP packet will looks like in these 2 cases.

ARP Request

Ethernet Header:
Source MAC : A1:A1:A1:A1:A1:A1
Destination MAC : FF: FF: FF: FF: FF: FF
ARP Packet:
Sender MAC Address: A1:A1:A1:A1:A1:A1
Sender IP Address: 192.168.1.1
Target MAC Address: 00:00:00:00:00:00
Target IP Address: 192.168.1.2

 ARP Reply

Ethernet Header:
Source MAC : A2:A2:A2:A2:A2:A2
Destination MAC : A1:A1:A1:A1:A1:A1
ARP Packet:
Sender MAC Address: A2:A2:A2:A2:A2:A2
Sender IP Address: 192.168.1.2
Target MAC Address: A1:A1:A1:A1:A1:A1
Target IP Address: 192.168.1.1

A1 wants to ping B1 (Communication between different broadcast domains)

By looking at B1s IP address A1 can identify that B1 falls on a different broadcast domain and to reach B1 it has to go via its default gateway. In this case A1 will not do an ARP for B1 but ARP for the default gateways -Router A MAC . This ARP will be broadcasted by Switch A and Router A can reply with its MAC address.

ARP Request

Ethernet Header:
Source MAC : A1:A1:A1:A1:A1:A1
Destination MAC : FF: FF: FF: FF: FF: FF
ARP Packet:
Sender MAC Address: A1:A1:A1:A1:A1:A1
Sender IP Address: 192.168.1.1
Target MAC Address: 00:00:00:00:00:00
Target IP Address: 192.168.1.254

 ARP Reply

Ethernet Header:
Source MAC : R1:R1:R1:R1:R1:R1
Destination MAC : A1:A1:A1:A1:A1:A1
ARP Packet:
Sender MAC Address: R1:R1:R1:R1:R1:R1
Sender IP Address: 192.168.1.254
Target MAC Address: A1:A1:A1:A1:A1:A1
Target IP Address: 192.168.1.1


Now you may check how the ARP Packets for communication from Router A to B1

Hint: There will 2 ARP request/reply 

Please leave your suggestions and questions as comments.

Address Resolution Protocol (ARP)

Address Resolution Protocol (ARP)

Address Resolution Protocol (ARP) is used to find the MAC (Layer 2) address associated with an IP (Layer 3) Address or in other words Identify the Hardware Address associated with the Protocol Address (IP).

Is it a Layer 2 or Layer 3 Protocol? If you check the ARP packet we dont have a Layer 3/IP header, which means its a Layer 2 protocol. But if you check the ARP Data, we could see IP address.

Sample Captures:

ARP Request from 10.222.0.10 requesting the MAC address of 10.222.0.7

ARP Reply from 10.222.0.7 with its MAC address

 

Please leave your suggestions and questions as comments.