AppleTalk Addressing and the Network Layer

The AppleTalk Network layer includes protocols concerned with network addressing and routing. An AppleTalk network address is a 32-bit address and consists of three main parts – a network number, a node number, and a socket number. These are described below.

Network number. A 16-bit number that uniquely identifies an extended or nonextended AppleTalk network.

Node number. An 8-bit number that uniquely identifies a network node (host). A given network number is limited to supporting a maximum of 253 nodes.

Socket number. An 8-bit number that uniquely identifies an upper-layer protocol interface for sending or receiving packets. Similar in function to a port number in TCP/IP.

AppleTalk addresses are usually displayed in dotted decimal notation. As such, node 100 on network 8 using socket 99 could be displayed as 8.100.99, or even 8.100, socket 99.

To reduce administrative effort, AppleTalk network addresses are dynamically assigned. When a node starts up, it gives itself a temporary address for the purpose of network communication. It then uses the Zone Information Protocol (ZIP) to query a local router to find out the network numbers (cable range) available for its physical segment. After doing so, it assigns itself a node number, and broadcasts a message onto the network to see whether that node number is in use. If it isn’t, the system will use that number. If it is, it will choose a different node number and try again.

The two main protocols found at this layer include the Datagram Delivery Protocol (DDR) and the AppleTalk Address Resolution Protocol (AARP). Network layer routing protocols used by AppleTalk will be discussed in Chapter 8.

Datagram Delivery Protocol (DDP)

The Datagram Delivery Protocol is the connectionless network layer protocol of the AppleTalk suite. It might be compared to IP or IPX, in that it makes reliable delivery the responsibility of upper-layer protocols. Two types of DDP packets exist, a long (extended) version and a short (nonextended) version. The short version is only used on nonextended networks, and does not include any network information (since only a single network can exist). The fields found in an extended DDP packet are outlined below:

Null. The first two bits of a DDP packet are not used.
Hop Count. Similar to a TTL value. For each router that a DDP packet crosses, this field is decreased by one. The maximum number of hops for a DDP packet is 15.
Length. The total length of the DDP packet in bytes.
Checksum. A computed value that verifies the integrity of the DDP header, similar to a CRC.
Destination Network. The network number of the receiving system.
Source Network. The network number of the sending system.
Destination Node. The node number of the receiving system.
Source Node. The node number of the sending system
Destination Socket. The socket number of the receiving system
Source Socket. The socket number of the sending system
Type. This field specifies the upper-layer protocol to which the data in this packet should be passed.

AppleTalk Address Resolution Protocol (AARP)

Much like the ARP protocol found in the TCP/IP suite, the job of the AppleTalk Address Resolution Protocol (AARP) is to map network addresses to physical (MAC) addresses. Similar to ARP, AARP also does this via broadcasts and temporarily caches entries that it has recently resolved. These are stored on each node in its Address Mapping Table (AMT).

Author: Dan DiNicolo

Dan DiNicolo is a freelance author, consultant, trainer, and the managing editor of He is the author of the CCNA Study Guide found on this site, as well as many books including the PC Magazine titles Windows XP Security Solutions and Windows Vista Security Solutions. Click here to contact Dan.