Hi

Something I have been wondering about, but am not able to find an answer to, is what goes on at the PC end of a local network. What exactly happens when a packet comes into the network card of a PC? What part decides where the information goes and how does the network card filter out un-wanted packets? I have tried searching the 'net, but all I seem to turn up is a lot of information about how 'networks' work. The only specific information I find about the PC end is that 'it' decides what happens to the information ('it' as in the PC - most helpful...). I'm after a relatively detailed answer here if possible.

Thanks

http://en.wikipedia.org/wiki/Internet_protocol_suite

google

Thanks, but that isn't really what I am looking for. I found plenty of information like that also using Google, but I am more interested in the very basic level of one end of the connection that deals with incoming data and gives it to the appropriate processes, not the connection itself. I'm guessing that this is well below OS level but I'm not 100% sure.

the processes themselves are controlled in user space by the operating system. the os itself will handle routing packets internally and can be controlled by user processes on behalf of the os through the use of shared libraries. a process can attach or subscribe to a particular socket and/or port and the os will forward data it receives on that port to that process. the way it identifies incoming traffic with destined processes is probably through a mix of protocol and port.

EDIT: this is still pretty basic i guess, i'm not sure how detailed you want to get.

This post has been edited by Dark_Nexus: 12 Dec, 2007 - 08:34 PM

That's more what I was looking for. Would you know what happens when a packet turns up addressed to that computer, but is completely un-expected? I'm guessing that the OS will simply ignore it, or, if it is on a port assigned to a process, that process will deal with it it's own way.

EDIT: If you know more about exactly how the network card knows what to do with the information (ie what sort commands are issued from where in the system, is the packet simply dumped into a location in memory for something else to deal with) then some info on that would be great.

This post has been edited by scalt: 12 Dec, 2007 - 08:45 PM

not all packets are to be expected, so if the port is open and being listened to by a process, the os would probably forward it to that process. of course there are things like ip tables and firewall rules that can give the os a better idea of what to do. in most cases, if the computer received something it wasn't expecting and the port it was destined to wasn't open, it would either silently drop the packet or respond with an error of some sort.

EDIT: i don't really know how it gets handled on a really low hardware level. i don't think the network card actually knows what's going on at data or application level, all it really cares about is transporting packets too and from the computer. the os and network card can speak to each other via the network card driver which offers a library to the os to configure the card to be in certain states as well as retrieve information from the card like incoming connections. anything past this level you'd probably have to look up.

This post has been edited by Dark_Nexus: 12 Dec, 2007 - 08:48 PM

Ok, thanks for your help, you've given me a better idea of what actually goes on in there. I'll keep poking around and see what I can find out.

I used to use a Packet Sniffer to understand how it all worked.

From the protocol perspective (TCP/IP) there are several points of discrimination.

At the data link level, when a NIC receives a frame from the network, it checks the CRC to see if the frame was corrupted. Often if there is corruption the frame is discarded rather than trying to flip bits. If not corruption is detected then the data link layer checks the MAC address. This will be different for differing technologies (Ethernet, FDDI, etc). If it is addressed to this node, it gets passed up to the next layer (Typically Network layer), otherwise discarded.


At the Network layer, in this case IP, the destination network address (IP address) is checked. If it matches this node, the packet is kept. Otherwise it's routed elsewhere. The IP packet header contains a protocol field that is used as a demux key that routes the packet to the proper protocol at the next layer (TCP, UDP, etc).

The Transport layer uses source and dest port numbers to demux the message to the proper application. The port number combined with the address is what is known as a socket and is the API typically used for network programming. I'm guessing you already know that part though.

Is this detailed enough, or do you want more detail?

EDIT I forgot to mention that some of the other layers do their own error checking as well. The higher layers usually do a checksum rather than CRC though.

This post has been edited by Programmist: 13 Dec, 2007 - 12:35 PM

Thanks Programmist. I already had some knowledge of how that side of it worked, but it was pretty basic. One of my lecturers had tried to explain what you talked about but I never really got it 'til now.

I think that what I originally was after sort of lies more in the network card driver field if you know any more about that.

NIC drivers - not my area. They probably vary from card to card and manufacturer to manufacturer as well.

Yep I would imagine they do. When I get home tonight I'll have a look around the web for a few examples