Chapter 3 CONE

Addressing Overview

This module focuses on the methods used to address and locate software, files, computers, and other devices on a network. It takes a bottom-up approach to the OSI model, starting at the data link layer and moving up to the application layer. The physical layer is excluded because it doesn't require a network address.

Addressing methods operate at the data link, network, transport, and application layers.

Addressing Methods

• Data Link Layer: MAC (Media Access Control) address. A MAC address is embedded on every NIC (Network Interface Card) and is assumed to be unique. It is 48 bits long and written as six hexadecimal numbers separated by colons (e.g., 00:60:8C:00:54:99). Nodes on a LAN (Local Area Network) use MAC addresses to find each other. Switches, functioning at layer 2, use MAC addresses to determine where to send messages.
• Network Layer: IP (Internet Protocol) address. An IP address is assigned to nearly every network interface of a node. It can be used to find any computer in the world if the IP address is public on the Internet. Browsers can store and retrieve IP addresses, but IP addresses are primarily used at the network layer for routing. Routers, functioning primarily at layer 3, use IP addresses to determine the destination network of a message.
  • IPv4: 32 bits, written as four decimal numbers called octets (e.g., 92.106.50.200). Each octet is 8 bits when written in binary.
    $92 = 0101 \space 1100$
  • IPv6: 128 bits, written as eight blocks of hex numbers (e.g., 2001:0DB8:0B80:0000:0000:00D3:9C5A:00CC). Each block contains 16 bits when written in binary.
• Transport Layer: Ports. A port is a number used by the transport layer to find an application. It identifies one application among several running on a host. Web servers usually listen for requests at port 80 or port 443.
• Application Layer: Domain names, computer names, and host names. Every host on a network is assigned a unique character-based name called the FQDN (fully qualified domain name) e.g., susan.mycompany.com. The last two parts of a host’s name (e.g., mycompany.com) are the domain name, matching the organization’s network. The first part (e.g., susan) is the host name, identifying the computer on the network.

IANA (Internet Assigned Numbers Authority), a department of ICANN (Internet Corporation for Assigned Names and Numbers), tracks the assignments of IP addresses, port numbers, and domain names.

MAC Addresses

A MAC address is stamped directly onto the NIC's circuit board or on a sticker attached to the NIC. MAC addresses contain two parts, are 48 bits long, and are written as hexadecimal numbers separated by colons. The first 24 bits are the OUI (Organizationally Unique Identifier), identifying the NIC’s manufacturer. The IEEE (Institute of Electrical and Electronics Engineers) assigns the OUI and maintains a database that is accessible via the web.

The last 24 bits of the MAC address make up the extension identifier or device ID, identifying the device itself. Manufacturers assign each NIC a unique extension identifier based on the NIC’s model and manufacture date.

Switches use MAC addresses to identify devices on the LAN. As each device communicates on the network, the switch identifies the sending device’s MAC address from its transmitted message. The MAC address is stored in a MAC address table that maps each MAC address to a physical port on the switch.

The information in a MAC address table expires after a short period, and the switch is constantly relearning device locations on the network.

IP Addresses

IP addresses identify nodes at the network layer. MAC addresses are used by switches for communication inside a local network, whereas an IP address is required for a device to communicate outside its local network through a gateway device such as a router. Routers rely on IP addresses to locate devices across networks.

IP addresses can be assigned persistently (static IP address) or dynamically leased from a DHCP (Dynamic Host Configuration Protocol) server each time a device connects to the network.

A DHCP server manages the dynamic distribution of IP addresses to devices on a network.

A subnet mask, also called a netmask, is a 32-bit number that helps one computer find another. The 32 bits are used to indicate what part of an IP address’s bits are the network portion, called the network ID or network address, and which bits consist of the host portion, called the host ID or node ID. Using this information, a computer can determine if another computer with a given IP address is on its own or a different network.

A gateway is a computer, router, firewall, or other device that a host uses to access another network. The default gateway is the routing device that nodes on the network turn to for access to the outside world. A missing default route will prevent network nodes from reaching DNS servers outside the local network. The default gateway provides a connection to all resources outside the local network when static routes aren’t available.

Networks may use IPv4 addresses (32 bits) and IPv6 addresses (128 bits).

IPv4 Addresses

A 32-bit IP address is organized into four groups of 8 bits each, called octets, presented as four decimal numbers separated by periods (e.g., 72.56.105.12). The largest possible 8-bit number is 11111111, which is equal to 255 in decimal. So, the largest possible IP address in decimal is 255.255.255.255. In binary, this number is written $11111111.11111111.11111111.11111111$. Each of the four octets can be any number from 0 to 255, making a total of nearly 4.3 billion IPv4 addresses ($256 \times 256 \times 256 \times 256$). Some IP addresses are reserved, so these numbers are approximations.

The first part of an IP address identifies the network, and the last part identifies the host. The dividing line between the network and host bits varies according to several factors. With classful addressing, the dividing line is determined by the numerical range the IP address falls in. Classful IPv4 addresses are categorized into five classes: class A, class B, class C, class D, and class E. Classes A, B, and C addresses, for the most part, can be used to connect to and access Internet resources. Class D and class E IPv4 addresses are not available for general use.

• Class D addresses begin with octets 224 through 239 and are used for multicast transmissions, in which one host sends messages to multiple hosts.
• Class E addresses, which begin with 240 through 254, are reserved for research.

A value of 255 in the corresponding octet of the subnet mask indicates that octet of the IP address identifies the network. A value of 0 in the corresponding octet of the subnet mask indicates that octet of the IP address identifies the host.

Class A, B, and C licensed IP addresses are available for use on the Internet and are, therefore, called public IP addresses. To conserve its public IP addresses, a company can instead use private IP addresses for devices on its private networks—that is, devices that do not directly connect to the Internet but instead communicate through a representative device such as a router. IANA allocated the following IP addresses for private networks:

• Class A: 10.0.0.0 through 10.255.255.255
• Class B: 172.16.0.0 through 172.31.255.255
• Class C: 192.168.0.0 through 192.168.255.255

Private IP addresses are not routable on the Internet. IANA also reserves some IP addresses for special use:

• 255.255.255.255: Used for broadcast messages by TCP/IP background processes. A broadcast message is read by every node on the network. A LAN is defined as a group of computers and other devices that can directly address each other without going through a router. The LAN can be referred to as a broadcast domain.
• 0.0.0.0: Currently unassigned.
• 127.0.0.1 through 127.255.255.254: Used for research or can indicate your own computer, in which case it is called the loopback address. The loopback address to verify that TCP/IP is configured correctly on a computer when it can talk to and hear itself on the loopback interface.
• 169.254.0.1 through 169.254.255.254: Used to create an APIPA (Automatic Private IP Addressing) address when a computer configured for DHCP first connects to the network and is unable to lease an IPv4 address from the DHCP server.

In contrast to classful addressing, classless addressing allows the dividing line between network and host portions to fall anywhere along the string of binary bits in an IP address. Shifting this dividing line allows for segmenting networks within networks in a process called subnetting.

With classless addressing, rely on a variety of subnet mask values to communicate any number of bits used for the network or host portions. Another option is to use CIDR (Classless Interdomain Routing) notation, also known as slash notation. CIDR notation takes the network ID or a host’s IP address and follows it with a forward slash (/), which is then followed by the number of bits that are used for the network ID. For example, a private IP address could be written as 192.168.89.127/24, where 24 represents the number of bits in the network ID. In CIDR terminology, the forward slash with the number of bits used for the network ID—for example, /24—is known as a CIDR block.

DHCP (Dynamic Host Configuration Protocol)

Static IP addresses are manually assigned by the network administrator, whereas dynamic IP addresses are automatically assigned by a DHCP server each time a computer connects to the network. Most network administrators choose to use dynamic IP addressing by running a DHCP server.

DHCP servers offer many options in common. Generally, define a range of IP addresses, called a DHCP scope or DHCP pool, to be assigned to clients when they request an address. The scope includes the following additional information, called scope options:

• A time limit, called a lease time, which restricts the amount of time a network host can keep the IP address before it must request a renewal. When the lease time expires without renewal, the DHCP server returns the IP address to the available address pool.
• The default gateway’s IP address, which each client must know to send messages to hosts on other networks. The default gateway is typically a router or firewall.
• The primary and secondary DNS server addresses, which clients use to match computer names with IP addresses. DNS servers might be internal to the local network or external and accessed through the default gateway.

When other nodes on the network frequently need to know the IP address of a particular client, DHCP can offer that client the same IP address every time it requests one. The DHCP server recognizes this client based on its MAC address, so this reserved IP address is called a variety of names: MAC reservation, IP reservation, or DHCP reservation. A network printer should consistently use the same IP address so that computers on the network can always find it.

A reserved IP address is not quite the same thing as a static IP address. A reserved IP address is offered to the client by DHCP when the client requests an IP address. A static IP address is configured on the client itself so that the client never requests an IP address from DHCP in the first place.

If you have one or more clients on the network with static IP addresses, configure an IP exclusion range on the DHCP server. This excludes one or more IP addresses from the IP address pool so the server doesn’t offer those IP addresses to other clients.

Address Translation

Most devices on a network are assigned a private IP address, while only a few, representative devices (such as a router) receive a public IP address for communicating directly on the Internet. When private devices need access to other networks or the Internet, a public-facing gateway (such as a router or firewall) substitutes the private IP addresses used by computers on the private network with its own public IP address. This process is called NAT (Network Address Translation). Besides requiring only a single public IP address for the entire private network, another advantage of NAT is security; the gateway hides the private network’s hosts behind this one address.

PAT (Port Address Translation) assigns a separate TCP port to each session between a local host and an Internet host. When the Internet host responds to the local host, the gateway uses PAT to determine which local host is the intended recipient.

Two variations of NAT you need to be aware of include the following:

• SNAT (Source Network Address Translation): The gateway assigns the same public IP address to a host each time it makes a request to access the Internet. Small home networks with only a single public IP address provided by its ISP use SNAT.
• DNAT (Destination Network Address Translation): Hosts outside the network address a computer inside the network (such as a web server or an email server) by a predefined public IP address. When a message sent to the public IP address reaches the router managing DNAT, the destination IP address is changed to the private IP address of the host inside the network. The router must maintain a translation table of public IP addresses mapped to various hosts inside the network.

SNAT changes the source IP addresses of outgoing messages and is used to reduce the number of public IP addresses needed by a network. DNAT changes the destination IP address of incoming messages and is often used by organizations that provide services to the Internet servers to use private IP addresses for security and also to allow network administrators more freedom.

IPv6 Addresses

IPv6 standards were developed to allow for more public IP addresses on the Internet. IPv6 designers also worked to improve routing capabilities and speed of communication over the established IPv4 standards.

Recall that an IPv6 address has 128 bits that are written as eight blocks (also called quartets) of hexadecimal numbers separated by colons, like this:

$2001:0000:0B80:0000:0000:00D3:9C5A:00CC$

Each block is 16 bits long.

Shorthand notation makes these addresses easier to read and write. For example, leading zeroes in a four-character hex block can be eliminated. Thus, the IP address can be written as: $2001:0000:B80:0000:0000:D3:9C5A:CC$.

If blocks contain all zeroes, they can be eliminated and replaced by double colons (::). Only one set of double colons is used in an IPv6 address. Thus, the sample IP address can be written two ways:

$2001::B80:0000:0000:D3:9C5A:CC$

$2001:0000:B80::D3:9C5A:CC$

Here are a few terms used in the IPv6 standards:

• A link, sometimes called the local link, is any LAN bounded by routers. Neighbors are two or more nodes on the same link.
• When a network is configured to use both IPv4 and IPv6 protocols, the network is said to be dual stacked. If packets on this network must traverse other networks where dual stacking is not used, tunneling is used, which is a method of transporting IPv6 packets over an IPv4 network.
• The last 64 bits, or four blocks, of an IPv6 address identify the interface and are called the interface ID or interface identifier. These 64 bits uniquely identify an interface on the local link.

IPv6 supports these three types of IP addresses:

• Unicast address: Specifies a single node on a network.
  • Global address: Can be routed on the Internet and is similar to public IPv4 addresses. Most begin with the prefix 2000::/3, although other prefixes are being released. The /3 indicates that the first three bits are fixed and are always 001. Notice the 16 bits reserved for the subnet ID, which can be used to identify a segment of a large corporate network.
  • Link local address: Can be used for communicating with nodes in the same link and is similar to an autoconfigured APIPA address in IPv4. It begins with FE80::/10. The first 10 bits (indicated by /10) of the reserved prefix are fixed (1111 1110 10), and the remaining 54 bits in the 64-bit prefix are all zeroes. Therefore, a link local address prefix is sometimes written as FE80::/64. Link local addresses are not allowed past the local link or on the Internet.
  • Loopback address: Similar to the IPv4 loopback address, can be used to test that an interface and supporting protocol stack are functioning properly. Consists of 127 zeros followed by a 1 and is written ::1/128.
• Multicast address: Delivers packets to all nodes in a targeted, multicast group.
• Anycast address: Identifies multiple destinations, with packets delivered to the closest destination. For example, a DNS server might send a DNS request to a group of DNS servers that have all been assigned the same anycast address. A router handling the request examines routes to all the DNS servers in the group and routes the request to the closest server.

IPv6 broadcasting is eliminated in order to reduce network traffic.

Due to the way switches learn MAC addresses of connected devices, multicasting can cause traffic congestion problems called multicast flooding. The multicast group is assigned a single IP address, which means no particular MAC address can be associated with that IP address. Instead, when the switch receives a multicast message, it must flood all its interfaces with the transmission, which defeats the purpose of multicasting. To fix this problem, a switch that must handle multicast traffic should have IGMP snooping enabled on it. IGMP (Internet Group Management Protocol) is a network-layer protocol used to manage multicast group memberships and direct multicast traffic to the correct devices. However, because switches are layer 2 devices, they miss out on the IGMP information that identifies group members. IGMP snooping, then, gives switches the ability to detect IGMP messages on the network and gather information from those messages to add accurate entries in their MAC address tables.

Unique local unicast addresses which similar to IPv4 private IP addresses work on local links.

IPv6 Autoconfiguration

IPv6 addressing is designed so that a computer can autoconfigure its own link local IP address without the help of a DHCPv6 server. This process is called SLAAC (stateless address autoconfiguration) and is similar to how IPv4 uses an APIPA address but results in an address the computer can continue to use on the network.

The SLAAC process describes how a computer using IPv6 makes a network connection:

1. The computer creates its IPv6 address. It uses FE80::/64 as the first 64 bits, called the prefix. The last 64 bits (called the interface ID) can be generated in one of two ways:
   • The 64 bits are randomly generated—In this case, the IP address is called a temporary address and is never registered in DNS or used to generate global addresses for use on the Internet. The IP address changes often to help prevent hackers from discovering the computer. This is the default method used by Windows 10.
   • The 64 bits are generated from the network adapter’s MAC address—MAC addresses consist of 48 bits (formally called EUI-48) and must be converted to the 64-bit standard, called the EUI-64 (Extended Unique Identifier-64) standard. To generate the interface ID, the OS takes the 48 bits of the device’s MAC address, inserts a fixed 16-bit value in the middle of the 48 bits, and inverts the value of the seventh bit.
2. The computer checks to make sure its IP address is unique on the network. It does this by sending a message to the IP address and, if there’s a reply, then the address is a duplicate and the computer tries again with a different address.
3. The computer asks if a router on the network can provide configuration information. This message is called an RS (router solicitation) message. If a router responds with DHCP information in what’s called an RA (router advertisement) message, the computer uses whatever information this might be, such as the IP addresses of DNS servers or the network prefix. The process is called prefix discovery; the computer then uses the prefix to generate its own link local or global IPv6 address by appending its interface ID to the prefix.

Because a computer can generate its own link local or global IP address, a DHCPv6 server usually serves up only global IPv6 addresses to hosts that require static address assignments.

An IPAM (IP address management) system, whether as a standalone product or embedded in another product such as Windows Server, provides a way to plan, deploy, and monitor a network’s IP address space. IPAM tools can automatically detect IP address ranges, assignments, reservations, and exclusions, integrate this information with data from DNS records, and provide constant monitoring for growth, security, and troubleshooting purposes.

Ports and Sockets

A port is a number assigned to a process, such as an application or a service, that can receive data. An IP address is used to find a computer, a port is used to find a process running on that computer. TCP and UDP ports ensure that data is transmitted to the correct process among multiple processes running on a single device.

A socket consists of both a host’s IP address and a process’s TCP or UDP port, with a colon separating the two values. For example, the standard port for the Telnet service is TCP 23. If a host has an IP address of 10.43.3.87, the socket for Telnet running on that host is 10.43.3.87:23.

When the host receives a request to communicate on TCP port 23, it establishes or opens a session, which is an ongoing conversation, with the Telnet service. At that point, the socket is said to be open. When the TCP session is complete, the socket is closed or dissolved.

Port numbers range from 0 to 65535 and are categorized by IANA into three types:

• Well-known ports: Range from 0 to 1023 and are assigned by IANA to widely used and well-known utilities and applications, such as Telnet, FTP, and HTTP.
• Registered ports: Range from 1024 to 49151 and can be used temporarily by processes for nonstandard assignments to increase security. Default assignments of these registered ports must be registered with IANA.
• Dynamic and private ports: Range from 49152 to 65535 and are open for use without restriction.
  • Dynamic port: Number assigned by a client or server as the need arises.
  • Private port: Number assigned by a network administrator that is different from the well-known port number for that service.

Here's several common well-known and registered TCP and UDP ports:

• 20 FTP-DATA TCP File transfer—data
• 21 FTP TCP File transfer—control
• 22 SSH TCP Secure communications
• 22 SFTP TCP Encrypted file transfer using SSH
• 23 TELNET TCP Unencrypted control of remote computers
• 25 SMTP TCP Outgoing email messages
• 53 DNS TCP or UDP Name resolution.
• 67 DHCP UDP client to server messages
• 68 DHCP UDP server to client messages
• 69 TFTP UDP Simple file transfer
• 80 HTTP TCP or UDP Requests between web servers
• 110 POP3 TCP Incoming email messages (downloaded messages)
• 123 NTP UDP time synchronization
• 143 IMAP4 TCP Incoming email messages (messages stored on server)
• 161 SNMP TCP or UDP Messages sent to managed network devices from SNMP manager
• 162 SNMP Typically UDP Responses or unsolicited information sent from network devices to manager
• 389 LDAP TCP or UDP Access to network-based directories
• 443 HTTPS TCP Secure implementation of HTTP over SSL or TLS
• 445 SMB TCP Network file sharing
• 514 Syslog UDP and stores information about system events
• 587 SMTP TLS TCP SMTP encrypted by TLS
• 636 LDAPS TCP or UDP Secure access to network-based directories
• 993 IMAP4 over SSL TCP or UDP IMAP4 encrypted by SSL or TLS
• 995 POP3 over SSL TCP or UDP POP3 encrypted by SSL or TLS
• 1433 SQL Server TCP Connections to installation of Microsoft SQL Server from other databases or applications
• 1521 SQLnet, also called Oracle Net Services TCP Connections to installation of Oracle Database from other databases or applications
• 3306 MySQL Connections to installation of MySQL Server from other databases or applications
• 3389 RDP TCP Encrypted control of remote Windows computers
• 5060 SIP UDP Creation of unencrypted connections for multimedia session
• 5061 SIP UDP Creation of encrypted connections for multimedia session

TFTP (Trivial File Transfer Protocol) is used by computers (without user intervention) as they are booting up to request configuration files from another computer on the local network. TFTP uses UDP, whereas normal FTP uses TCP.

NTP (Network Time Protocol) is used to synchronize clocks on computers throughout a network. NTP through a hierarchy of time servers where stratum-1 servers communicate directly with a primary time source, such as GPS (Global Positioning System) or Galileo (Europe’s version of GPS). These servers track UTC (Coordinated Universal Time) and provide this information to lower strata servers. Each hop between NTP servers increases the stratum number by 1 up to 16.

LDAP (Lightweight Directory Access Protocol) is a standard protocol for accessing network-based directories. LDAPS (Lightweight Directory Access Protocol over SSL) uses SSL to encrypt its communications.

SMB (Server Message Block) is first used by earlier Windows OSs for file sharing on a network. UNIX uses a version of SMB in its Samba software, which can share files with other operating systems, including Windows systems.

Syslog (system log) is a Linux or UNIX standard for generating, storing, and processing messages about events on a system. The syslog utility does not alert a user to problems—it only keeps a history of messages issued by the system.

SQLnet, also known as Oracle Net Services is used by Oracle Database to communicate with other Oracle Databases or with database clients. This interconnection allows applications and databases to be distributed across different machines and still communicate as if they were on the same machine.

All firewalls are porous to some degree in that they always let some traffic through; some of this filtering is accomplished by opening or closing ports.

Domain Names and DNS

Instead of entering a website’s IP address into a browser’s address bar, a website address, such as cengage.com can be typed. The browser might add some more information, such as https://www.cengage.com, which is called a URL. A URL (uniform resource locator) is an application layer addressing scheme that identifies where to find a particular resource on a network or across networks. Application layer addressing was created because character-based names are easier for humans to remember than numeric IP addresses.

The first part of the URL, https, identifies the protocol to be used. The next part is the FQDN.

An FQDN combines the host name with a domain name.

The host name is determined by the website developer or administrator.

Domain names must be registered with an Internet naming authority that works on behalf of ICANN.

The last part of an FQDN is called the TLD (top-level domain). No restrictions exist on the use of the .com, .org, and .net TLDs, and ICANN restricts what type of hosts can be associated with the .arpa, .mil, .edu, and .gov TLDs. Other TLDs are dedicated to hosts in specific countries, such as .us, .eu (for countries in the European Union), .ca (Canada), and .au (Australia).

While FQDNs are convenient for humans, a computer must convert the FQDN to an IP address before it can find the referenced computer. Name resolution is an application layer process of discovering the IP address of a host when its FQDN is known.

In the mid-1980s, DNS (Domain Name System) was designed to associate computer names with IP addresses. DNS is an application layer client-server system of computers and databases:

• Namespace: The entire collection of computer names and their associated IP addresses stored in databases on DNS name servers around the globe
• Name servers: Computers that hold these databases, organized in a hierarchical structure
• Resolvers: A DNS client that requests information from DNS name servers

Namespace databases are stored on thousands of servers around the world, rather than being centralized on a single server or group of servers. In other words, DNS doesn’t follow a centralized database model, but rather a distributed database model. Because data is distributed over thousands of servers, DNS will not fail catastrophically if one or a handful of servers experiences errors.

Each organization that provides host services (for example, websites or email) on the public Internet is responsible for providing and maintaining its own DNS authoritative servers for public access, or they can use a third-party or cloud-hosted DNS server. An authoritative name server is the authority on computer names and their IP addresses for computers in their domains. The domains the organization is responsible for managing are collectively called a DNS zone.

An organization might have these four common types of DNS servers:

• Primary DNS server: The authoritative name server for the organization, which holds the authoritative DNS database for the organization’s zones. This server is contacted by clients, both local and over the Internet, to resolve DNS queries for the organization’s domains.
• Secondary DNS server: The backup authoritative name server for the organization. When a secondary DNS server needs to update its database, it makes the request to the primary server for the update; this update process is called a zone transfer.
• Caching DNS server: A server that accesses public DNS data and caches the DNS information it collects. This server receives DNS queries from local network clients and works to resolve them by contacting other DNS servers for information. Caching DNS servers do not store zone files and, therefore, do not participate in zone transfers.
• Forwarding DNS server: An optional server that receives queries from local clients but doesn’t work to resolve the queries. Typically, a forwarding server will maintain its own DNS cache from previous queries, and so it might already have the information the client needs. If not, the forwarding server forwards the query to another server to resolve Several forwarding servers might be strategically placed throughout the organization’s network.

A registry, also known as a domain name registry operator, is an organization or country that is responsible for one or more TLDs and that maintains a database or registry of TLD information. A domain name registrar is an organization accredited by registries and ICANN to lease domain names to companies or individuals, following the guidelines of the TLD registry operators.

DNS name servers are organized in a global hierarchical structure. At the root level, 13 clusters of root DNS servers hold information used to locate the TLD servers. These TLD servers hold information about the authoritative name servers owned by various organizations and how to find them.

Following are the steps to resolve the name and are also illustrated in Figure 3-22:

1. The resolver on the client computer first searches its DNS cache, a database stored on the local computer, for the match. If it can’t find the information there, the resolver sends a DNS message or query to its local DNS server
2. The local name server queries a root server with the request. The root server responds to the local name server with a list of IP addresses of TLD name servers responsible for the .edu suffix.
3. The local name server makes the same request to one of the TLD name servers responsible for the .edu suffix. The TLD name server responds with the IP address of the mdc.edu authoritative server.
4. The local name server makes the request to the authoritative name server at Miami Dade Community College, which responds to the Cengage name server with the IP address of the www.mdc.edu host.
5. The local name server responds to the client resolver with the requested IP address. Both the Cengage name server and the Cengage client computer store the information in their DNS caches and, therefore, don’t need to ask again until that information expires.

There are two types of DNS requests:

• Recursive lookup: A query that demands a resolution or the answer “It can’t be found.”
• Iterative lookup: A query that does not demand resolution. The other servers only provide information if they have it.

Resource Records in a DNS Database

Namespace databases are stored in DNS zone files, which are simple text files consisting of resource records that each store specific kinds of information about the zone. These records consist of fields specific to the kind of information that record type should hold, such as the zone name, class (these days, that’s always Internet class), and record type. Other fields in each record vary according to the purpose of that record.

Here are the common DNS record types found in a zone file:

• SOA (start of authority) record: Listed at the beginning of the zone file and gives information about the zone, such as a contact email address, when the zone was last updated, how long the zone information is valid until it should be refreshed for a zone transfer.
• A (address) record: Stores the name-to-address mapping for a host. This resource record matches a given FQDN to its IPv4 address in response to a forward lookup request.
• AAAA (address) record: Holds the name-to-address mapping for IPv6 addresses.
• CNAME (canonical name) record: Holds alternative names for a host. Also, these names can be used in place of the canonical name, which is the complete and properly formatted name.
• PTR (pointer) record: Used for a reverse lookup, also called rDNS (reverse DNS), which provides a host name when you know its IP address. PTR records are usually created by ISPs and stored in a specially formatted reverse lookup zone file, or reverse zone.
• NS (name server) record: Indicates the authoritative name server for a domain. It’s mostly used for delegating subdomains to other name servers.
• MX (mail exchanger) record: Identifies an email server and is used for email traffic.
• SRV (service) record: Identifies the hostname and port of a computer that hosts a specific network service besides email, such as FTP or SIP.
• TXT (text) record: Holds any type of free-form text.
  • **SPF (Sender