← Field Notes

Follow the Beat: A Rhythmic Approach to Networking

November 27, 2024

Last week, I took a class at the Amazon Skills Center: "Becoming a Cloud Practitioner -- Part 2 -- Compute, Networking, and Account Strategies."

The class covered the topics of IP addressing, subnet masking, access control lists, and routing tables, which, according to the instructor, makes it the most difficult class in the "Becoming a Cloud Practitioner" series.

I've come across networking concepts before, but only in passing, such as when following step-by-step instructions for installation of new equipment or software. In my career, I've always worked at much higher levels of abstraction, whether with databases and low-code platforms or executive-level case studies about core banking solutions.

But now, for the very first time, I'm learning the basics of networking.

With that in mind, and as a way for me to internalize the concept by writing about it, here's how I'd explain IP addresses to someone without a technical background.

Knock, Knock

Suppose you're an attendant standing behind a door. There's no peephole. You may only open the door when you hear the secret knock.

You have a rulebook, with rules that go from more to less restrictive.

Rule #1: Open when you hear a precise four-bar rhythm.

Example:

X---X--- / X---X--- / XXXX---- / XXXX---- (Staying Alive)

Rule #2: Open the door when you hear the first three-and-a-half bars. The last half-bar can be any pattern that fits.

Example:

X---X--- / X---X--- / XXXX---- / XXXX____

...ending with

-XXX or -X-X or XX--

Rule #3: Open when you hear the first three bars. The last bar of the song can be any pattern that fits into the final bar.

Example:

X---X--- / X---X--- / XXXX---- / ---XX-X- (rim shot)

Rule #4: Open when you hear the first two bars of the song. The last two bars can be any pattern that fits.

Example:

X---X--- / X---X---

followed by

X-XXX-X- (shave and a haircut) --X-X--- (two bits)

Or

X-X-X--- / X-X-X--- (We Will Rock You)

Understanding IP Addresses

Got it?

If you can figure out those rules, you can learn the notation for Classless Inter-Domain Routing, or CIDR.

A digital signal, just like a simple rhythmic pattern with knocks (X) and rests (-), consists entirely of a series of 1s and 0s.

A single bit is either 1 or 0.

A byte is an octet of 8 bits in a row. That's 2^8 combinations, or 256, represented numerically in the range from 0 to 255. Go from bytes to integers by converting from base-2 to base-10.

An Internet Protocol v4 (IPv4) address consists of 4 bytes, shown as 0.0.0.0 through 255.255.255.255. This has 4.3m possible combinations, or 2^32 to be precise.

When you create a Virtual Private Cloud, or VPC, you decide which IP addresses to use. It's a blank canvas. You can place a resource at 11.27.24.100 or 100.24.27.11, that's entirely up to you. But what you cannot do is place one resource at 11.27.24.100 and another at 100.24.27.11. Those addresses are too far apart.

Think of the attendant behind the door, primed to recognize a specific pattern of knocks. You can teach the attendant to recognize either "Staying Alive" or "Billie Jean" (X--X---- / X--X----), but not both. Pick a song, pick a beat.

Here's what those four-bar patterns look like as IP addresses.

Staying Alive: 136.136.240.240

Billie Jean: 144.144.144.144

Let's stick with Staying Alive. That's the theme song for our VPC. We can get directly to our VPC using that IP address. That's like the attendant listening for the full four-bar rhythm, as in Rule #1. But that only brings you to the VPC itself, not to anything contained within it.

If you want to access the resources inside the VPC, you need to do something funky with the rhythm near the end of the pattern, as in Rules #2 through #4.

CIDR Notation

How many IP addresses do you need in a VPC?

You'll need a separate IP address for every compute resource, storage container, gateway, endpoint, database, and so on. Each instance will have its own address with its own attendant listening for a specific rhythm.

With Rule #2, there are 16, or 2^4, possible rhythms for the last half-bar.

With Rule #3, there are 256, or 2^8, possible rhythms for the last bar.

With Rule #4, there are 65,536, or 2^16, possible rhythms for the last two bars.

Most of the time, you'll go with Rule #3. That's 256 possibilities, enough room to expand without too many unallocated addresses.

A range of IP addresses is called a CIDR block, which consists of the Base IP address (136.136.240.240) combined with a prefix length.

The prefix is that part which will be the same for everything inside the VPC.

If we pick Rule #3, we have 136.136.240.[...], with three octets fixed and the last octet open.

Every address in the VPC will have the first 24 bits in common. We call that the prefix length.

In CIDR notation, we add the prefix length to the IP address, separated by a slash. In AWS, you can select any prefix length from /16 (65,536 IP addresses) to /28 (16 IP addresses), which corresponds to Rules #4 and #2, respectively.

136.136.240.240/24   Rule #3 for Staying Alive.

144.144.144.144/16 Rule #4 for Billie Jean

Make your own CIDR block at https://cidr.xyz/.

And there you have it. That's IP addressing and CIDR notation.

Subnetting

You can subdivide your VPC using subnets.

Let's say we have a VPC with a CIDR block of 136.136.240.240/24, containing 256 IP addresses.

Every IP address in this range starts with 136.136.240 (followed by any a number from 0 to 255).

If we want to divide those into two equal-sized groups of IP addresses, add +1 to the prefix length.

Examples:

136.136.240.240/25 covers the range from 128 to 255.

136.136.240.240/26 covers the range from 192 to 255.

136.136.240.240/27 covers the range from 224 to 255.

136.136.240.240/28 covers the range from 240 to 255.

Access Control and Routing

Think of your VPC as a building. At the front door, an attendant follows Rule #4 and will open the door if you know the code.

But that's not enough.

Now you have to go through the "virtual firewall." Either your name must be on an Access Control List (ACL) or you must prove that you are a member of a designated Security Group.

On each floor, you may find an attendant following Rule #3 (for a large building) or Rule #2 (for a smaller building), also checking that your name is on the list.

To grant access to a specific room, an attendant follows Rule #1 (IP address).

And what happens when you reach the resources with your message? Here's where it gets fun.

You pass through the door and deliver your message.

This is answered by an entirely new message, a new pattern, a new rhythm, a new song.

This new message may have any destination -- an IP address within the subnet, an IP address within the CIDR block for VPC, or something completely different -- any of the 4.3 million possible combinations.

You may have shown up with Staying Alive, but you're leaving with Eye of the Tiger.

Everything outbound goes through a Route Table, either for the VPC, the subnet, or both.

If the Route Table has an entry for the first three bars of Eye of the Tiger, you may be directed to a specific target.

But if there's no other matching route on the Route Table, you'll fall back to the default entry, 0.0.0.0/0, pointing to your Internet gateway, out into the wide world, knocking on doors, and so it goes.

I hope that helps you understand the wide world of networking!

And now that you know how it works, what song rhythm are you going to assign to your virtual private cloud?

← Field Notes