OSI and TCP/IP Application Layer

• The application layer in the OSI and TCP/IP models is closest to the end user, providing the interface between applications and the underlying network.
• Application layer protocols are used for data exchange between programs running on source and destination hosts.
• The top three layers of the OSI model (application, presentation, session) define the functions of the TCP/IP application layer.
• Common application layer protocols include HTTP, FTP, TFTP, IMAP, and DNS.

Presentation Layer

• The presentation layer's functions include formatting data for compatibility, compressing data, and encrypting/decrypting data.
• The presentation layer formats data for the application layer and sets standards for file formats, including video (MKV, MPG, MOV) and graphic image (GIF, JPG, PNG) formats.

Session Layer

• The session layer creates and maintains dialogs between source and destination applications.
• It handles information exchange to initiate, maintain, and restart sessions.

TCP/IP Application Layer Protocols: Name System

• DNS (Domain Name System or Service) translates domain names (like cisco.com) into IP addresses using TCP/UDP port 53.

TCP/IP Application Layer Protocols: Host Configuration

• BOOTP (Bootstrap Protocol) uses UDP client 68 and server 67 to enable diskless workstations to discover their IP address, BOOTP server, and a boot file, but is being superseded by DHCP.
• DHCP (Dynamic Host Configuration Protocol) dynamically assigns IP addresses, using UDP client 68 and server 67 and re-using them when no longer needed

TCP/IP Application Layer Protocols: Email

• SMTP (Simple Mail Transfer Protocol) uses TCP 25 to enable email sending for clients and servers.
• POP3 (Post Office Protocol) utilizes TCP 110, allowing clients to retrieve email from a mail server, downloading it to the client.
• IMAP (Internet Message Access Protocol) uses TCP 143, enabling clients to access email stored on a mail server, maintaining email on the server.

TCP/IP Application Layer Protocols: File Transfer

• FTP (File Transfer Protocol) employs TCP ports 20-21 to set rules that enable users to access and transfer files between hosts over a network, providing reliable, connection-oriented, and acknowledged file delivery.
• TFTP (Trivial File Transfer Protocol) uses UDP client 69 as a simple, connectionless protocol that offers best-effort, unacknowledged file delivery with less overhead than FTP.

TCP/IP Application Layer Protocols: Web

• HTTP (Hypertext Transfer Protocol) uses TCP ports 80 and 8080 for exchanging text, graphic images, sound, video, and other multimedia files on the World Wide Web.
• HTTPS (HTTP Secure) uses TCP/UDP 443 and browser encryption to secure HTTP communications and authenticate the website.

Client/Server Model

• Application layer protocols must be compatible on both source and destination devices in TCP/IP networks.
• The client requests data, and the server responds, following specific protocols and potentially requiring authentication or identification.
• Email communication is a common example: clients request unread messages, and the server sends the emails. Uploading sends data, while downloading retrieves data.

Peer-to-Peer (P2P) Networks

• In P2P networks, devices communicate directly without a dedicated server, acting as both client and server.
• P2P networks enable users to share files, printers, and internet connections, ensuring equal communication between devices.
• P2P applications allow each device to function as a client and a server simultaneously, needing a user interface and background service.
• Hybrid P2P models use a centralized index server to help locate resources.
• Popular P2P networks include BitTorrent, Direct Connect, eDonkey, and Freenet. Some applications use the Gnutella protocol (µTorrent, BitComet) to share entire files with others.

P2P File Sharing and BitTorrent:

• P2P applications allow sharing pieces of multiple files simultaneously using a torrent file to locate users with needed file pieces, managed by a tracker computer.
• BitTorrent technology: Downloading or distributing copyrighted files without permission may lead to criminal charges.

Web and Email Protocols:

• Application layer protocols are designed for web browsing and email.
• Typing a URL into a web browser establishes a connection to the web service using HTTP.

URL Components:

• The browser interprets the protocol, server name, and specific filename requested in the URL.
• The browser checks with a name server to convert the server name into an IP address, then initiates an HTTP request to the server for the file.
• The server sends the HTML code for the web page to the browser, which formats the page.

HTTP Message Types:

• HTTP is a request/response protocol. Message types include:
  • GET: Client request for data.
  • POST: Uploads data files.
  • PUT: Uploads resources or content.
• HTTP is insecure while HTTPS encrypts data using TLS or SSL for secure communication.

Email Protocols

• Email requires several applications and services, utilizing a store-and-forward method.
• Email clients communicate with mail servers using SMTP, POP, and IMAP protocols.

SMTP:

• SMTP message formats require a message header (recipient and sender email addresses) and a message body.
• The client SMTP process connects with a server SMTP process on port 25 to send email, which the server either places in a local account or forwards.
• Destination email servers spool undelivered messages and check the queue, returning them as undeliverable after expiration.

POP:

• POP retrieves mail from a mail server, downloading it to the client and then deleting it from the server.
• The server listens on TCP port 110 for client connection requests, and POP3 is the most commonly used version.
• Since POP does not store messages, it is not recommended for businesses needing a centralized backup solution.

IMAP:

• IMAP retrieves email messages, copying them to the client application while keeping the originals on the server until manually deleted.
• Users can organize and store mail in a file hierarchy on the server, which is duplicated on the email client. Deleting a message synchronizes the action and deletes it from the server.

IP Addressing Services: DNS and DHCP

• DNS translates domain names (e.g., www.cisco.com) into IP addresses (e.g., 198.133.219.25).
• DNS queries and responses follow a standardized message format for retrieving IP address information.
• DNS and DHCP automate address assignment and name resolution to make network communication efficient.
• To translate an FQDN to an IP address: User enters FQDN, A DNS query is sent to the designated DNS server, DNS server matches the FQDN with its IP address, The DNS query response is sent back to the client with the IP address for the FQDN and the client computer uses the IP address to make requests of the server.

DNS Message Format:

• A DNS server stores resource records to resolve domain names, including:
  • A: IPv4 address
  • AAAA: IPv6 address (quad-A)
  • NS: Authoritative name server
  • MX: Mail exchange record
• Clients may contact other servers or cache resolved IP addresses.
• DNS messages include a question, answer, authority, and additional information.

DNS Hierarchy:

• The DNS system organizes domain names into manageable zones, with each DNS server maintaining a portion of the database.
• If a query is outside its zone, the request is forwarded to the appropriate DNS server.
• Top-level domains (TLDs) categorize domains by organization type or country (e.g., .com, .org, .au, .co).

nslookup Command:

• The nslookup command allows users to manually query DNS servers to resolve hostnames into IP addresses.

Dynamic Host Configuration Protocol (DHCP):

• DHCP automates the assignment of IPv4 addresses, subnet masks, gateways, and other network settings.
• Upon connecting, a device requests an IP address from a DHCP server, assigning it for a specific lease period.
• DHCP is essential for large or frequently changing networks.

DHCP Operation:

• When devices boot up or connect to a network, DHCP-configured devices broadcast a DHCP discover (DHCPDISCOVER) message to identify any available DHCP servers
• A DHCP server replies with a DHCP offer (DHCPOFFER) message, which offers a lease to the client
• When multiple DHCP servers exist on a network, a client may receive multiple DHCPOFFER messages and must select one by sending a DHCPREQUEST.
• DHCP ensures unique IP allocation (ISPs), DHCPv6 has a similar process.

File Sharing Services:

• In the client/server model, a client can upload and download data using a file transfer protocol (FTP).

FTP:

• FTP allows data transfers between a client and a server.
• An FTP client pushes and pulls data from an FTP server.
• Client opens first connection to the server for control traffic using TCP port 21.
• Client opens second connection for data traffic using TCP port 20.

SMB:

• SMB (Server Message Block) is a client/server file-sharing protocol for accessing shared network resources.
• SMB operates as a request-response protocol with standardized message format and widely used in MS networking since Windows 2000
• Clients maintain long-term connections to servers
• LINUX and UNIX use SAMBA for MS networks, MAC OSs support SMB to share resources.