TCP/IP Fundamentals

OSI Seven Layer Model & Seminar Outline

This seminar will present TCP/IP communications starting from Layer 2 up to Layer 4 (TCP/IP applications cover Layers 5-7)

• IP Addresses
• Data Link Layer
  • Network Frames
  • Address Resolution Protocol
• Network Layer
  • Internet Protocol
  • IP Routing
  • ICMP Error Reporting
• Transport Layer
  • User Datagram Protocol
  • Transmission Control Protocol
• Session through Application Layers
  • Domain Name System
• Final example tracing DNS transaction through a router

Definitions

• Physical network - a collection of computers, communications devices, wiring, etc. that communicate directly with one another (e.g., Ethernet, Token Ring)
• Host - A computer, connected to a physical network, that exchanges information with another computer via TCP/IP
• Gateway - A computer that interconnects two or more physical networks and that routes TCP/IP information among those networks (accurately referred to as a router)

IP Addresses

IP addresses

• are unique, 32-bit addresses
• correspond to connections, not hosts (generally, move connection ==> change IP address)
• are referenced by humans via dotted decimal (or dotted quad) notation, one number per 8 bits (1 octet or byte), e.g., 128.192.6.7
• consist of three primary classes A, B, and C (class D is for multicast) of the form [netid,hostid]

Class formats

Subnet Mask (netmask)

• 32-bit value
• Generally used to subdivide (subnet) a given IP class network into smaller (sub)networks
• Netmask determines which portion of an IP address is the network address and which is the host address
  • An IP address bit is a network address bit if the corresponding netmask bit is 1
  • An IP address bit is a host address bit if the corresponding netmask bit is 0
• "Natural netmask" has all netid bit locations = 1 and all hostid bit locations = 0
  (e.g., 255.0.0.0, 255.255.0.0, and 255.255.255.0 for class A, B, and C networks, respectively)
• Netmask example:
  
  
  

Netid and hostid conventions:

• Network addresses have hostid with all bits = 0 (e.g., 128.192.0.0 with netmask=255.255.0.0 and 128.192.6.0 with netmask=255.255.255.0)
• Directed broadcast addresses have hostid with all bits = 1 (e.g., 128.192.255.255 with netmask=255.255.0.0 and 128.192.54.255 with netmask=255.255.255.0)
• "Limited" broadcast has all bits = 1 (e.g. 255.255.255.255)
• Loopback address 127.xxx.yyy.zzz used for internal testing, no traffic generated (typically 127.0.0.1)

IP network ranges by class:

• Class A ==> 1.0.0.0 - 126.0.0.0
• Class B ==> 128.xxx.0.0 - 191.xxx.0.0
• Class C ==> 192.xxx.yyy.0 - 223.xxx.yyy.0
• Class D ==> 224.xxx.yyy.zzz - 239.xxx.yyy.zzz (multicast IP)

Data Link Layer

Network Frames

• The basic unit of a physical network is a frame
• General form of a network frame
  
  
  
• Network frame formats
  • Ethernet frames
    • Version 2 format
      
      
      
      
    • IEEE 802 format
      
      
  • Token Ring frames
    • IEEE 802 format
      
      
• Every physical network has a maximum frame size called the maximum transfer unit (MTU)
  • Ethernet MTU - 1500 bytes
  • Token Ring MTU - 4192 bytes
• Some physical networks have a minimum frame size and must be padded (typically with bytes of "zeroes") to that size when the actual data size is smaller (Ethernet has a minimum frame size of 60 bytes)

Address Resolution Protocol (ARP)

• The address resolution protocol (ARP) is used to associate physical network card addresses (MAC addresses) with IP addresses.
• Encapsulation of ARP message in a physical frame
  
  
  
• ARP message format
  
  
  
  
• ARP process
  1. ARP requestor sends a broadcast frame with the destination IP address, its source IP address and MAC address, asking for the destination MAC address.
  2. Host with destination IP address sends a directed frame back to ARP requestor filling in its MAC address and storing the MAC address of the sender in an ARP table (or cache).
  3. Optionally, all other hosts within the same broadcast domain add the sender's MAC and IP addresses to its ARP cache.
  
  
• Ethernet example:
  
  Source IP address = 128.192.6.7 (80 C0 06 07)
  Source MAC address = 00 00 C0 8D 9C FB
  Destination IP address = 128.192.6.193 (80 C0 06 C1)
  Destination MAC address = 00 00 1D E5 A3 B9
  
  
  1. ARP Request
     
     
     
  2. ARP Response
     
     

ARP Table (or Cache)

• To minimize broadcasts due to ARP requests, IP hosts and gateways store tables of MAC and IP addresses (called ARP tables or cashes)
• Each entry in the cache contains (IP address, MAC address, Time to Live)
• Sample ARP cache:
  
  

  IP address	MAC address	TTL
  128.192.6.111	00:00:C0:B8:A5:E3	155s
  128.192.10.141	08:00:20:7C:7F:7E	246s
  128.192.106.159	00:05:02:E6:48:41	626s
  128.192.153.21	00:00:1B:16:F7:FF	332s
  128.192.237.52	00:00:0C:4E:60:8F	185s
  128.192.26.126	00:00:94:21:66:14	439s

  
  
• The Time to Live (TTL) field has either a fixed or adjustable maximum (usually a workstation or router, respectively)
• TTL is set to maximum when ARP request received, not set when communicating with another host
• Tools to display ARP info (TTL usually not displayed):
  • arp (Windows 9x/NT/2000)
  • arp (Unix)

Proxy ARP

• Some devices (such as routers) respond to ARP requests for IP addresses connected to other networks by providing their MAC address in an ARP reply
• This behavior is called proxy (or promiscuous) ARP
• Proxy ARP example:
  
  
  
  

Network Layer

Internet Protocol

• The Internet Protocol (IP) is an:
  • unreliable (delivery not guaranteed)
  • connectionless (packets independent of one another)
  • best-effort (attempt to deliver packets)
  packet delivery mechanism
• Basic unit is the datagram (up to 65,535 bytes)
• Encapsulation of IP datagram in a physical frame
  
  
  
• IP datagram format
  
  
  
• Network MTU and fragmentation
  • IP hosts send datagrams up to the MTU size of the physical network
  • Routers *may* have to fragment datagrams if outbound MTU smaller than inbound frame size
    • Each fragment has the format of an IP datagram
    • Fragments reassembled at receiving host (may be inefficient)
    • Higher probability of retransmission --> losing one fragment loses entire datagram
• IP Options
  • Loose and strict source routing - used to route a datagram along a specific path
  • Record route - used to trace a route
  • Internet timestamp - used to record timestamps along the route

IP Routing

• Both hosts and routers participate in routing
• Direct routing - transmitting a datagram from one computer directly to another on same physical network
• Indirect routing - destination host not on same network --> datagram sent to a router for delivery
• Routing based on IP routing table of the form (netmask, net-address, next-hop)
• Routing algorithm
  1. Extract destination IP address ipdest from datagram
  2. Starting at the beginning of the routing table (and for each entry)
     1. Calculate network portion of ipdest --> ipnet = AND(netmask, ipdest)
     2. If ipnet equals net-address, send datagram to next-hop
     3. If ipnet does not equal net-address, repeat steps a. and b. for next entry
     4. If no table entry matches, declare a routing error
• Routing table order:
  1. Directly connected networks (DCN)
  2. Host-specific routes (HSR)
  3. Net-specific routes (NSR)
  4. Default route (DR)
• Hosts have minimal routing tables (usually two entries - directly connected network and default route)
• Network for host routing examples
  
  
  
• Routing table for host H1
  
  

  entry	netmask	net-address	next-hop	hop-count	(comments)
  1	255.255.0.0	128.192.0.0	128.192.6.7	0	DCN
  2	0.0.0.0	0.0.0.0	128.192.1.1	1	DR

  
  
• Host routing example 1:
  
  
  1. Datagram ipdest=128.192.254.100
  2. Calculate network portion of ipdest using 1st routing table entry netmask:

            ipdest = 10000000 11000000 11111110 01100100 (128.192.254.100)
           netmask = 11111111 11111111 00000000 00000000 (255.255.0.0)
     AND operation   -----------------------------------
            ipnet  = 10000000 11000000 00000000 00000000 (128.192.0.0)
          

  3. Compare ipnet and 1st routing table entry net-address

               128.192.0.0 equals 128.192.0.0
          

  4. Since they match, send it to next-hop=128.192.6.7, i.e., communicate directly with destination host
  
  
• Host routing example 2:
  
  
  1. Datagram ipdest=131.144.4.10
  2. Calculate network portion of ipdest using 1st routing table entry netmask:

            ipdest = 10000011 10010000 00000100 00001010 (131.144.4.10)
           netmask = 11111111 11111111 00000000 00000000 (255.255.0.0)
     AND operation   -----------------------------------
            ipnet  = 10000011 10010000 00000000 00000000 (131.144.0.0)
          

  3. Compare ipnet with 1st routing table entry net-address

               128.192.0.0 does *not* equal 131.144.0.0
          

  4. Since they don't match, calculate network portion of ipdest using 2nd routing table entry netmask:

            ipdest = 10000011 10010000 00000100 00001010 (131.144.4.10)
           netmask = 00000000 00000000 00000000 00000000 (0.0.0.0)
     AND operation   -----------------------------------
            ipnet  = 00000000 00000000 00000000 00000000 (0.0.0.0)
          

  5. Compare ipnet with 2nd routing table entry net-address

               0.0.0.0 does equal 0.0.0.0
          

  6. Since they match, send it to next-hop=128.192.1.1, i.e., the default gateway
• Network for gateway routing examples
  
  
  
• Routing table for gateway G1
  
  

  entry	netmask	net-address	next-hop	hop-count	(comments)
  1	255.255.255.0	128.192.6.0	128.192.6.250	0	DCN
  2	255.255.255.0	128.192.7.0	128.192.7.250	0	DCN
  3	255.255.255.0	128.192.150.0	128.192.150.250	0	DCN
  4	255.255.255.0	128.192.232.0	128.192.232.250	0	DCN
  5	255.255.255.255	131.144.4.10	128.192.232.2	1	HSR
  6	255.255.0.0	168.15.0.0	128.192.232.2	2	NSR
  7	0.0.0.0	0.0.0.0	128.192.232.2	1	DR

  
  
• Gateway routing example 1:
  
  
  1. Datagram ipdest=128.192.150.24
  2. Find routing entry in table in which network portion of ipdest matches net-address and send datagram to corresponding next-hop

                          (netmask)
  entry    netmask  AND(128.192.150.24)  net-address    result
  -----    -------      --------------   -----------    ------
    1    255.255.255.0  128.192.150.0    128.192.6.0    no match
    2    255.255.255.0  128.192.150.0    128.192.7.0    no match
    3    255.255.255.0  128.192.150.0    128.192.150.0  send directly
  

• Gateway routing example 2:
  
  
  1. Datagram ipdest=168.15.44.39
  2. Find routing entry in table in which network portion of ipdest matches net-address and send datagram to corresponding next-hop

                           (netmask)
  entry    netmask    AND(168.15.44.39)   net-address   result
  -----    -------        ------------    -----------   ------  
    1    255.255.255.0    168.15.44.0    128.192.6.0    no match
    2    255.255.255.0    168.15.44.0    128.192.7.0    no match
    3    255.255.255.0    168.15.44.0    128.192.150.0  no match
    4    255.255.255.0    168.15.44.0    128.192.232.0  no match
    5    255.255.255.255  168.15.44.39   131.144.4.10   no match
    6    255.255.0.0      168.15.0.0     168.15.0.0     send to 128.192.232.2
  

• Gateway routing example 3:
  
  
  1. Datagram ipdest=193.24.56.149
  2. Find routing entry in table in which network portion of ipdest matches net-address and send datagram to corresponding next-hop

                            (netmask)
  entry    netmask    AND(193.24.56.149)  net-address    result
  -----    -------        --------------  -----------    ------ 
    1    255.255.255.0    193.24.56.0     128.192.6.0    no match
    2    255.255.255.0    193.24.56.0     128.192.7.0    no match
    3    255.255.255.0    193.24.56.0     128.192.150.0  no match
    4    255.255.255.0    193.24.56.0     128.192.232.0  no match
    5    255.255.255.255  193.24.56.149   131.144.4.10   no match
    6    255.255.0.0      193.24.0.0      168.15.0.0     no match
    7    0.0.0.0          0.0.0.0         0.0.0.0        send to 128.192.232.2
                                                         (default gateway)
  

  
  

Routing Update Protocols

• Routing update protocols are used to modify the routing tables in gateways
• Autonomous system - a collection of networks and gateways controlled by a single authority
  
  
  
• Two general types of update protocols
  • Interior gateway protocols - Used among gateways within an autonomous system
    • Routing Information Protocol (RIP, RIP2)
    • Open Shortest Path First (OSPF)
  • Exterior gateway protocols - Used by gateways connecting autonomous systems
    • Exterior Gateway Protocol (EGP)
    • Border Gateway Protocol (BGP)
• OSPF & RIP used at UGA
  • Only Foundry core routers communicate via OSPF
  • Foundry routers broadcast RIP sometimes (don't listen)
  • RIP turned off all other routers
  • Hosts can listen to RIP but must *NOT* broadcast RIP

ICMP Error Reporting

• Since IP networks are inherently unreliable, need a mechanism for reporting IP datagram delivery problems
• Internet Control Message Protocol (ICMP) used to report errors
  • ICMP *required* implementation of any TCP/IP software
  • Usually initiated by gateways, but can also be initiated by hosts
  • ICMP messages are sent back to source IP host, not gateways
  • ICMP messages delivered just like IP datagrams
  • Problems delivering ICMP messages do *not* generate additional ICMP messages
  • ICMP does not specify how to handle errors
• ICMP Message Encapsulation
  
  
  
• ICMP Message Format
  
  
  
• ICMP Echo Request/Reply - Used to test whether a destination is reachable and responding (e.g., used by packet internet groper or ping)
  
  
  
• ICMP Destination Unreachable - Used by a gateway to indicate that it cannot route or deliver an IP datagram
  
  
  
• ICMP Source Quench - Used by a gateway to indicate that it is congested, source slows down rate it sends datagrams
  
  
  
• ICMP Redirect - Used by a gateway to tell a directly connected host that a more efficient gateway should be used for a specific IP address
  
  
  
• ICMP Time Exceeded - Used by a gateway to indicate that a routing loop has occurred (sent when the IP TTL value reaches 0 or when segment reassembly time exceeded)
  
  
  

Transport Layer

• TCP/IP applications utilize client/server technology to exchange information
  • Some hosts can offer a number of TCP/IP services concurrently
  • Some hosts can execute multiple client TCP/IP applications concurrently
  • Some can execute both client and server applications
• When TCP/IP client and server applications want to send data to one another, they need a method of transporting that data to the correct application
• Protocol ports are used to determine which application receives the data
  • positive 16-bit integers
  • well-known ports assigned by central authority (range 1-2047)
  • User-defined ports (range 2048 or greater)
  • destination port - used to specify the application on the destination host to receive the data (usually one of the well-known port assignments)
  • source port - used to specify where replies on the source host are to be sent (generated by the source host)
• Two methods of transporting data
  • Connectionless, unreliable delivery (User Datagram Protocol)
  • Connection-oriented, reliable delivery (Transmission Control Protocol)

User Datagram Protocol (UDP)

• UDP provides an unreliable, connectionless delivery
• Application programs using UDP are responsible for message loss, duplication, delay, out-of-order delivery, and loss of connectivity
• Examples of applications that use UDP transport include Network Time Protocol (NTP), Sun's Network File System (NFS), and the Simple Network Management Protocol (SNMP)
• Each UDP message is called a user datagram
• UDP Message Encapsulation
  
  
  
• UDP Message Format
  
  
  
• UDP messages are stored in queues on destination host, one queue per destination port
  
  
  

Transmission Control Protocol (TCP)

• TCP provides reliable, end-to-end data transmission with flow control
• Examples of TCP applications include Telnet, FTP, WWW, POP, IMAP, etc.
• Basic features of TCP transmission:
  • Streamed Data - Data from sender to receiver organized as a stream of bits divided into 8-bit bytes (data streams have no TCP imposed structure)
    
    
    
  • Connection Oriented
    • Client host "calls" server host at a specific destination port
    • If receiver accepts call, a connection is established between the corresponding client and server applications
    • Information is transferred bi-directionally
    • Connection is closed ("call terminated") when client or server application finished or when certain communications errors detected
  • Buffered Transfer - Applications send bytes to TCP software that delivers the stream of bytes in exactly the order sent (not necessarily grouped the same way)
  • Full-duplex Transmission - Both hosts can send and receive data and control information independently
    
    
    
• The unit of transfer in TCP is called a segment
• TCP Segment Encapsulation
  
  
  
• TCP Segment Format
  
  
  
• Connection defined by the pair of numbers (source IP, source port) and (dest IP, dest port)
• Different connections can use the same destination port on server host as long as the source ports or source IPs are different
  
  
  
• TCP breaks data stream into segments
  
  
  
• Sequence numbers used to place received segment data in the correct order
  • Initial sequence number (ISN) marks the beginning of data stream
  • ISN is random and negotiated when connection is established
• Acknowledgement numbers tell sender that receiver expects *next* segment
  
  
  
• When a segment is sent, a timer is started; if an ACK has not been received when the timer expires, the segment is resent
  
  
  
• Sliding windows are used to transmit data stream efficiently and for flow control
  
  
  
• All segments within the window are sent without waiting for acknowledgement (efficient transmission)
  
  
  
• Window slides as acknowledgements received
  
  
  
• Receiver sends acceptable window size to sender during each segment transmission (flow control)
  • if too much data being sent, acceptable window size is reduced
  • if more data can be handled, acceptable window size is increased
• Actually four windows used, i.e., send and receive windows in both directions (full-duplex)
  
  
  
• A TCP connection is established using a "three-way handshake"
  
  
  
• A TCP connection is closed using a "modified three-way handshake"
  
  
  
• A TCP connection is aborted via a connection reset (RST bit set in the CODE field)

Session through Application Layers

Domain Name System (DNS)

• For human beings wanting to access Internet resources, names are much easier to remember than IP addresses
• The Domain Name System (DNS) was created to provide a mapping between names for Internet resources and their associated IP addresses
• Characteristics of DNS:
  • Hierarchical naming scheme
    
    
    
  • Delegation of authority for names
  • Distributed databases of name to IP address (and IP to name) mappings
• Each name authority must operate at least two DNS database servers (name servers) for their authorized domain
  
  
  
• Every TCP/IP implementation has a software routine called the name resolver (NR) to request a DNS lookup from a name server (NS)
• Two types of name resolution:
  • Recursive resolution - NR asks NS to resolve names for which it does not have an authoritative answer by querying other name servers (predominant method)
  • Iterative resolution - NR asks NS to provide the IP address of a NS that can provide an authoritative answer
• Typical name resolution process:
  1. NR receives a domain name from client TCP/IP application, formulates a DNS query and sends it to the first NS in its list
  2. NS determines if it is the authority for the domain name
  3. If so, it looks up the answer and sends an authoritative response back to client's NR
  4. If not, it (typically) queries other name servers for an authoritative response, sends a non-authoritative response to the client's NR and caches the response in case it receives a NR request for the same name
  5. The NR passes the response back to the application program and caches it for a period of time
  6. If the NR does not received a response from the NS in a specified period of time, it sends the query to the next NS in its list

DNS message format: