Chapter 6-2 TCP/IP Layers PDF

Chapter 6-2 the TCP/IP Layers  the TCP/IP Layers The four layers of the TCP/IP model are listed in Table 6-1. The layers are Application Internet Transport Network Interface  the TCP/IP Layers The TCP/IP protocol was established in...

Chapter 6-2 the TCP/IP Layers  the TCP/IP Layers The four layers of the TCP/IP model are listed in Table 6-1. The layers are Application Internet Transport Network Interface  the TCP/IP Layers The TCP/IP protocol was established in 1978, prior to the final release of the OSI model (see Chapter 4) however, the four layers of the TCP/IP model do correlate to the seven layers of the OSI model as shown in the next slide (Fig. 6-1). The Application layer of the TCP/IP stack is responsible for making sure a connection is made to an appropriate network port. These ports are reserved by ICANN (Internet Corporation for Assigned Names and Numbers).  Transport Layer The transport layer protocols in TCP/IP are very important in establishing a network connection, managing the delivery of data between a source and destination host, and terminating the data connection. There are two transport protocols within the TCP/IP transport layer. These are TCP and UDP. The first protocol examined is TCP. TCP, the Transport Control Protocol is a connection oriented protocol. A connection oriented protocol establishes the network connection, manages the data transfer, and terminates the connection. The TCP protocol establishes a set of rules or guidelines for establishing the connection. TCP verifies the delivery of the data packets through the network and includes support for error checking and recovering lost data. TCP then specifies a procedure for terminating the network connection. There is a unique sequence of three data packets exchanged at the beginning of a TCP connection between two hosts. A connection between two hosts is shown. This is a virtual connection that is made over the network. The first three packets always exchanged between two hosts when establishing a TCP connection are: the SYN (Synchronizing) packet the SYN + ACK (Synchronizing + Acknowledgement) packet the ACK (Acknowledgement) packet The three-packet initial TCP handshake The following is a example of a TCP packet transmission captured using a protocol analyzer. The network is set-up as shown. Host A (the client) is establishing an FTP connection with Host B. The captured file is 5-a.cap and is provided on the CD-ROM in the capture folder. Portions of the captured data packets are next shown.  the three packets exchanged in the initial TCP handshake. Packet 1 (ID 000001) is called the “SYN” or synchronizing packet. This packet is sent from the host computer on the network that wants to establish a TCP network connection. In this example, host A is making a TCP connection for an FTP file transfer. The summary information for packet 1 specifies that this is a TCP packet, the source port is 1054 (SP=1054), and the destination port is 21 (DP=21).  the three packets exchanged in the initial TCP handshake. Packet 1 (ID 000001) is called the “SYN” or synchronizing packet. This packet is sent from the host computer on the network that wants to establish a TCP network connection. In this example, host A is making a TCP connection for an FTP file transfer. The summary information for packet 1 specifies that this is a TCP packet, the source port is 1054 (SP=1054), and the destination port is 21 (DP=21).  the three packets exchanged in the initial TCP handshake. Packet 1 (ID 000001) is called the “SYN” or synchronizing packet. This packet is sent from the host computer on the network that wants to establish a TCP network connection. In this example, host A is making a TCP connection for an FTP file transfer. The summary information for packet 1 specifies that this is a TCP packet, the source port is 1054 (SP=1054), and the destination port is 21 (DP=21).  the three packets exchanged in the initial TCP handshake. Packet 1 (ID 000001) is called the “SYN” or synchronizing packet. This packet is sent from the host computer on the network that wants to establish a TCP network connection. In this example, host A is making a TCP connection for an FTP file transfer. The summary information for packet 1 specifies that this is a TCP packet, the source port is 1054 (SP=1054), and the destination port is 21 (DP=21).  the three packets exchanged in the initial TCP handshake. Packet 1 (ID 000001) is called the “SYN” or synchronizing packet. This packet is sent from the host computer on the network that wants to establish a TCP network connection. In this example, host A is making a TCP connection for an FTP file transfer. The summary information for packet 1 specifies that this is a TCP packet, the source port is 1054 (SP=1054), and the destination port is 21 (DP=21).  the three packets exchanged in the initial TCP handshake. Packet 1 (ID 000001) is called the “SYN” or synchronizing packet. This packet is sent from the host computer on the network that wants to establish a TCP network connection. In this example, host A is making a TCP connection for an FTP file transfer. The summary information for packet 1 specifies that this is a TCP packet, the source port is 1054 (SP=1054), and the destination port is 21 (DP=21).  the three packets exchanged in the initial TCP handshake. Port 1054 is an arbitrary port number that the FTP client picks or is assigned by the operating system. The destination port 21 is the well-known FTP (see. Table 6-3). The packet has a starting sequence number SEQ=997462768, and there is no acknowledgement (ACK=0). The length of the data packet is 0 (LEN=0). This indicates that the packet does not contain any data. The window size = 16384 (WS=16384). The window size indicates how many data packets can be transferred without an acknowledgement.  the three packets exchanged in the initial TCP handshake. Port 1054 is an arbitrary port number that the FTP client picks or is assigned by the operating system. The destination port 21 is the well-known FTP (see. Table 6-3). The packet has a starting sequence number SEQ=997462768, and there is no acknowledgement (ACK=0). The length of the data packet is 0 (LEN=0). This indicates that the packet does not contain any data. The window size = 16384 (WS=16384). The window size indicates how many data packets can be transferred without an acknowledgement.  the three packets exchanged in the initial TCP handshake. Port 1054 is an arbitrary port number that the FTP client picks or is assigned by the operating system. The destination port 21 is the well-known FTP (see. Table 6-3). The packet has a starting sequence number SEQ=997462768, and there is no acknowledgement (ACK=0). The length of the data packet is 0 (LEN=0). This indicates that the packet does not contain any data. The window size = 16384 (WS=16384). The window size indicates how many data packets can be transferred without an acknowledgement.  the three packets exchanged in the initial TCP handshake. Port 1054 is an arbitrary port number that the FTP client picks or is assigned by the operating system. The destination port 21 is the well-known FTP (see. Table 6-3). The packet has a starting sequence number SEQ=997462768, and there is no acknowledgement (ACK=0). The length of the data packet is 0 (LEN=0). This indicates that the packet does not contain any data. The window size = 16384 (WS=16384). The window size indicates how many data packets can be transferred without an acknowledgement.  the three packets exchanged in the initial TCP handshake. Port 1054 is an arbitrary port number that the FTP client picks or is assigned by the operating system. The destination port 21 is the well-known FTP (see. Table 6-3). The packet has a starting sequence number SEQ=997462768, and there is no acknowledgement (ACK=0). The length of the data packet is 0 (LEN=0). This indicates that the packet does not contain any data. The window size = 16384 (WS=16384). The window size indicates how many data packets can be transferred without an acknowledgement.  the three packets exchanged in the initial TCP handshake. Packet 2 is the “SYN-ACK” packet from the FTP server. The sequence number SEQ = 3909625466 is the start of a new sequence number for the data packet transfers from host B. The source port is 21 (SP=21) and the destination port for packet 2 is 1054 (DP=1054). ACK=997462769 is an acknowledge by host B (the FTP server) that the first TCP transmission was received. Note that this acknowledgement shows an increment of one from the starting sequence number provided by host A in packet 1.  the three packets exchanged in the initial TCP handshake. Packet 2 is the “SYN-ACK” packet from the FTP server. The sequence number SEQ = 3909625466 is the start of a new sequence number for the data packet transfers from host B. The source port is 21 (SP=21) and the destination port for packet 2 is 1054 (DP=1054). ACK=997462769 is an acknowledge by host B (the FTP server) that the first TCP transmission was received. Note that this acknowledgement shows an increment of one from the starting sequence number provided by host A in packet 1.  the three packets exchanged in the initial TCP handshake. Packet 2 is the “SYN-ACK” packet from the FTP server. The sequence number SEQ = 3909625466 is the start of a new sequence number for the data packet transfers from host B. The source port is 21 (SP=21) and the destination port for packet 2 is 1054 (DP=1054). ACK=997462769 is an acknowledge by host B (the FTP server) that the first TCP transmission was received. Note that this acknowledgement shows an increment of one from the starting sequence number provided by host A in packet 1.  the three packets exchanged in the initial TCP handshake. Packet 2 is the “SYN-ACK” packet from the FTP server. The sequence number SEQ = 3909625466 is the start of a new sequence number for the data packet transfers from host B. The source port is 21 (SP=21) and the destination port for packet 2 is 1054 (DP=1054). ACK=997462769 is an acknowledge by host B (the FTP server) that the first TCP transmission was received. Note that this acknowledgement shows an increment of one from the starting sequence number provided by host A in packet 1.  the three packets exchanged in the initial TCP handshake. Packet 2 is the “SYN-ACK” packet from the FTP server. The sequence number SEQ = 3909625466 is the start of a new sequence number for the data packet transfers from host B. The source port is 21 (SP=21) and the destination port for packet 2 is 1054 (DP=1054). ACK=997462769 is an acknowledge by host B (the FTP server) that the first TCP transmission was received. Note that this acknowledgement shows an increment of one from the starting sequence number provided by host A in packet 1.  the three packets exchanged in the initial TCP handshake. Packet 2 is the “SYN-ACK” packet from the FTP server. The sequence number SEQ = 3909625466 is the start of a new sequence number for the data packet transfers from host B. The source port is 21 (SP=21) and the destination port for packet 2 is 1054 (DP=1054). ACK=997462769 is an acknowledge by host B (the FTP server) that the first TCP transmission was received. Note that this acknowledgement shows an increment of one from the starting sequence number provided by host A in packet 1.  the three packets exchanged in the initial TCP handshake. Packet 2 is the “SYN-ACK” packet from the FTP server. The sequence number SEQ = 3909625466 is the start of a new sequence number for the data packet transfers from host B. The source port is 21 (SP=21) and the destination port for packet 2 is 1054 (DP=1054). ACK=997462769 is an acknowledge by host B (the FTP server) that the first TCP transmission was received. Note that this acknowledgement shows an increment of one from the starting sequence number provided by host A in packet 1.  the three packets exchanged in the initial TCP handshake. Packet 3 is an acknowledgement from the client (host A) back to the FTP server (host B) that packet 2 was received. Note the acknowledgement is ACK= 3909625467 which is an increment of one from the SEQ number transmitted is packet 2. This completes the initial handshake establishing the TCP connection. The next part is the data packet transfer. At this point, the two hosts can begin transferring data packets.  the three packets exchanged in the initial TCP handshake. Packet 3 is an acknowledgement from the client (host A) back to the FTP server (host B) that packet 2 was received. Note the acknowledgement is ACK= 3909625467 which is an increment of one from the SEQ number transmitted is packet 2. This completes the initial handshake establishing the TCP connection. The next part is the data packet transfer. At this point, the two hosts can begin transferring data packets.  the three packets exchanged in the initial TCP handshake. Packet 3 is an acknowledgement from the client (host A) back to the FTP server (host B) that packet 2 was received. Note the acknowledgement is ACK= 3909625467 which is an increment of one from the SEQ number transmitted is packet 2. This completes the initial handshake establishing the TCP connection. The next part is the data packet transfer. At this point, the two hosts can begin transferring data packets.  the three packets exchanged in the initial TCP handshake. Packet 3 is an acknowledgement from the client (host A) back to the FTP server (host B) that packet 2 was received. Note the acknowledgement is ACK= 3909625467 which is an increment of one from the SEQ number transmitted is packet 2. This completes the initial handshake establishing the TCP connection. The next part is the data packet transfer. At this point, the two hosts can begin transferring data packets.  the three packets exchanged in the initial TCP handshake. Packet 3 is an acknowledgement from the client (host A) back to the FTP server (host B) that packet 2 was received. Note the acknowledgement is ACK= 3909625467 which is an increment of one from the SEQ number transmitted is packet 2. This completes the initial handshake establishing the TCP connection. The next part is the data packet transfer. At this point, the two hosts can begin transferring data packets.  Terminating the TCP Session The last part of the TCP connection is terminating the session for each host. The first thing that happens is a host sends a FIN (finish) packet to the other connected host. Host B sends a FIN packet to Host A indicating the data transmission is complete. Host A responds with an ACK packet acknowledging the reception of the FIN packet. Host A then sends Host B a FIN packet indicating that the connection is being terminated. Host B replies with an ACK packet.  An example of the four-packet TCP connection termination. Packet 48 is a TCP packet with a source port of 21 (SP=21) and a destination port of 1054 (DP= 1054). The FIN statement is shown followed by a SEQ# and an ACK#. Remember, the SEQ and ACK numbers are used to keep track of the number of packets transmitted and an acknowledgement of the number received. The LEN of packet 48 is 0 which means the packet does not contain any data.  An example of the four-packet TCP connection termination. Packet 48 is a TCP packet with a source port of 21 (SP=21) and a destination port of 1054 (DP= 1054). The FIN statement is shown followed by a SEQ# and an ACK#. Remember, the SEQ and ACK numbers are used to keep track of the number of packets transmitted and an acknowledgement of the number received. The LEN of packet 48 is 0 which means the packet does not contain any data.  An example of the four-packet TCP connection termination. Packet 48 (Fig. 6-7) is a TCP packet with a source port of 21 (SP=21) and a destination port of 1054 (DP= 1054). The FIN statement is shown followed by a SEQ# and an ACK#. Remember, the SEQ and ACK numbers are used to keep track of the number of packets transmitted and an acknowledgement of the number received. The LEN of packet 48 is 0 which means the packet does not contain any data.  An example of the four-packet TCP connection termination. Packet 48 (Fig. 6-7) is a TCP packet with a source port of 21 (SP=21) and a destination port of 1054 (DP= 1054). The FIN statement is shown followed by a SEQ# and an ACK#. Remember, the SEQ and ACK numbers are used to keep track of the number of packets transmitted and an acknowledgement of the number received. The LEN of packet 48 is 0 which means the packet does not contain any data.  An example of the four-packet TCP connection termination. Packet 48 (Fig. 6-7) is a TCP packet with a source port of 21 (SP=21) and a destination port of 1054 (DP= 1054). The FIN statement is shown followed by a SEQ# and an ACK#. Remember, the SEQ and ACK numbers are used to keep track of the number of packets transmitted and an acknowledgement of the number received. The LEN of packet 48 is 0 which means the packet does not contain any data.  An example of the four-packet TCP connection termination. Packet 48 (Fig. 6-7) is a TCP packet with a source port of 21 (SP=21) and a destination port of 1054 (DP= 1054). The FIN statement is shown followed by a SEQ# and an ACK#. Remember, the SEQ and ACK numbers are used to keep track of the number of packets transmitted and an acknowledgement of the number received. The LEN of packet 48 is 0 which means the packet does not contain any data.  An example of the four-packet TCP connection termination. Packet 49 is an acknowledgement from the host, at port 1054, of the FIN packet. Remember the FIN packet was sent by the Host at the source port 21. In packet 50 the Host at port 1054 sends a FIN packet to the host at the destination port of 21. In packet 51, the host at port 21 acknowledges the reception of the FIN packet and the four packet sequence closes the TCP connection.  An example of the four-packet TCP connection termination. Packet 49 is an acknowledgement from the host, at port 1054, of the FIN packet. Remember the FIN packet was sent by the Host at the source port 21. In packet 50 the Host at port 1054 sends a FIN packet to the host at the destination port of 21. In packet 51, the host at port 21 acknowledges the reception of the FIN packet and the four packet sequence closes the TCP connection.  An example of the four-packet TCP connection termination. Packet 49 is an acknowledgement from the host, at port 1054, of the FIN packet. Remember the FIN packet was sent by the Host at the source port 21. In packet 50 the Host at port 1054 sends a FIN packet to the host at the destination port of 21. In packet 51, the host at port 21 acknowledges the reception of the FIN packet and the four packet sequence closes the TCP connection.  An example of the four-packet TCP connection termination. Packet 49 is an acknowledgement from the host, at port 1054, of the FIN packet. Remember the FIN packet was sent by the Host at the source port 21. In packet 50 the Host at port 1054 sends a FIN packet to the host at the destination port of 21. In packet 51, the host at port 21 acknowledges the reception of the FIN packet and the four packet sequence closes the TCP connection.  An example of the four-packet TCP connection termination. Packet 49 is an acknowledgement from the host, at port 1054, of the FIN packet. Remember the FIN packet was sent by the Host at the source port 21. In packet 50 the Host at port 1054 sends a FIN packet to the host at the destination port of 21. In packet 51, the host at port 21 acknowledges the reception of the FIN packet and the four packet sequence closes the TCP connection.  An example of the four-packet TCP connection termination. Packet 49 is an acknowledgement from the host, at port 1054, of the FIN packet. Remember the FIN packet was sent by the Host at the source port 21. In packet 50 the Host at port 1054 sends a FIN packet to the host at the destination port of 21. In packet 51, the host at port 21 acknowledges the reception of the FIN packet and the four packet sequence closes the TCP connection.  UDP UDP, the User Datagram Protocol is a connectionless protocol. This means that UDP packets are transported over the network without a connection being established and without any acknowledgement that the data packets arrived at the destination. UDP is useful in applications such as videoconferencing and audio feeds where acknowledgements that the data packet arrived are not necessary.  A UDP packet transfer Packet 136 is the start of a UDP packet transfer of an Internet audio feed. A TCP connection to the Internet was first made and then the music feed was started. At that time, the UDP connectionless packets started.  A UDP packet transfer Packet 136 is the start of a UDP packet transfer of an Internet audio feed. A TCP connection to the Internet was first made and then the music feed was started. At that time, the UDP connectionless packets started.  A UDP packet transfer Packets 138, 139, and 140 are the same type of packets with a length of 789. There are no acknowledgements sent back from the client. All of the packets are coming from the Internet source. UDP does not have a procedure for terminating the data transfer, the source either stops delivery of the data packets or the client terminates the connection.  A UDP packet transfer Packets 138, 139, and 140 are the same type of packets with a length of 789. There are no acknowledgements sent back from the client. All of the packets are coming from the Internet source. UDP does not have a procedure for terminating the data transfer, the source either stops delivery of the data packets or the client terminates the connection.  A UDP packet transfer Packets 138, 139, and 140 are the same type of packets with a length of 789. There are no acknowledgements sent back from the client. All of the packets are coming from the Internet source. UDP does not have a procedure for terminating the data transfer, the source either stops delivery of the data packets or the client terminates the connection.  The Internet Layer The TCP/IP Internet Layer defines the protocols used for address and routing the data packets. Protocols that are part of the TCP/IP Internet layer include IP, ARP, ICMP, and IGMP.  IP (Internet Protocol) IP, the Internet Protocol, defines the addressing used for identifying the source and destination addresses of data packets being delivered over an IP network. The IP address is a logical address that consists of a network and a host address portion. The network portion is used to direct the data to the proper network. The host address identifies the address locally assigned to the host. The network portion of the address is similar to the area code for a telephone number. The host address in similar to the local exchange number. The network and host portions of the IP address are then used to route the data packets to the destination.  ARP (Address Resolution Protocol) ARP, the Address Resolution Protocol, is used to resolve an IP address to a hardware address for final delivery of data packets to the destination. ARP issues a query in a network called an ARP request, asking which network interface has this IP address. The host assigned the IP address replies with an ARP reply that contains the hardware address for the destination host. As shown highlighted in blue, an ARP request is issued on the LAN. The source MAC address of the packet is 00-10-A4-13-99-2E. The destination address on the local area network shown is BROADCAST which means that this message is being sent to all computers in the local area network. A query (Q) is being asked who has the IP address 10.10.10.1 (PA= ). PA is an abbreviation for Protocol Address. As shown highlighted in blue, an ARP request is issued on the LAN. The source MAC address of the packet is 00-10-A4-13-99-2E. The destination address on the local area network shown is BROADCAST which means that this message is being sent to all computers in the local area network. A query (Q) is being asked who has the IP address 10.10.10.1 (PA= ). PA is an abbreviation for Protocol Address. As shown highlighted in blue, an ARP request is issued on the LAN. The source MAC address of the packet is 00-10-A4-13-99-2E. The destination address on the local area network shown is BROADCAST which means that this message is being sent to all computers in the local area network. A query (Q) is being asked who has the IP address 10.10.10.1 (PA= ). PA is an abbreviation for Protocol Address. As shown highlighted in blue, an ARP request is issued on the LAN. The source MAC address of the packet is 00-10-A4-13-99-2E. The destination address on the local area network shown is BROADCAST which means that this message is being sent to all computers in the local area network. A query (Q) is being asked who has the IP address 10.10.10.1 (PA= ). PA is an abbreviation for Protocol Address. The highlighted blue area now shows the destination computer replying with its MAC address back to the source that issued the ARP request. This is called an ARP reply which is a protocol where the MAC address is returned. The R after the ARP indicates this is an ARP reply. The source of the ARP reply is from 00-10-A4-13-6C-6E which is replying that the MAC address for 10.10.10.1 is 00-10-A4-13-6C-6E (HA=). In this case, the owner of the IP address replied to the message but this is not always the case. In some cases another networking device such as a router can provide the MAC address information. In that case, the MAC address being returned is for the next networking device in the route to the destination. The highlighted blue area now shows the destination computer replying with its MAC address back to the source that issued the ARP request. This is called an ARP reply which is a protocol where the MAC address is returned. The R after the ARP indicates this is an ARP reply. The source of the ARP reply is from 00-10-A4-13-6C-6E which is replying that the MAC address for 10.10.10.1 is 00-10-A4-13-6C-6E (HA=). In this case, the owner of the IP address replied to the message but this is not always the case. In some cases another networking device such as a router can provide the MAC address information. In that case, the MAC address being returned is for the next networking device in the route to the destination. The highlighted blue area now shows the destination computer replying with its MAC address back to the source that issued the ARP request. This is called an ARP reply which is a protocol where the MAC address is returned. The R after the ARP indicates this is an ARP reply. The source of the ARP reply is from 00-10-A4-13-6C-6E which is replying that the MAC address for 10.10.10.1 is 00-10-A4-13-6C-6E (HA=). In this case, the owner of the IP address replied to the message but this is not always the case. In some cases another networking device such as a router can provide the MAC address information. In that case, the MAC address being returned is for the next networking device in the route to the destination. The highlighted blue area now shows the destination computer replying with its MAC address back to the source that issued the ARP request. This is called an ARP reply which is a protocol where the MAC address is returned. The R after the ARP indicates this is an ARP reply. The source of the ARP reply is from 00-10-A4-13-6C-6E which is replying that the MAC address for 10.10.10.1 is 00-10-A4-13-6C-6E (HA=). In this case, the owner of the IP address replied to the message but this is not always the case. In some cases another networking device such as a router can provide the MAC address information. In that case, the MAC address being returned is for the next networking device in the route to the destination. the packet details of the ARP request  ICMP Protocol ICMP, the Internet Control Message Protocol is used to control the flow of data in the network , reporting errors, and for performing diagnostics. A networking device, such as a router, sends an ICMP source-quench packet to a host that requests a slowdown in the data transfer. A very important troubleshooting tool within the ICMP protocol is PING, the Packet InterNet Groper. The ping command is used to verify connectivity with another host in the network. The destination host could be in a LAN, a campus LAN, or on the Internet.  IGMP Protocol IGMP is the Internet Group Message Protocol. IGMP is used when one host needs to send data to many destination hosts. This is called multicasting. The addresses used to send a multicast data packet are called multicast addresses. These are reserved addresses that are not assigned to hosts in a network. An example of an application that uses IGMP packets is when a router uses multicasting to share routing tables. This is explained in Chapter 7 when routing protocols are examined.  IGMP Protocol Another application to use IGMP packets is when a hosts wants to stream data to multiple hosts. Streaming means the data are sent without waiting for any acknowledgement that the data packets were delivered. In fact, in the IGMP protocol, the source doesn’t care if the destination receives a packet. Streaming is an important application in the transfer of audio and video files over the Internet. Another feature of IGMP is the data is handed off to the application layer as it arrives. This enables to begin processing the data for playback. The Network Interface Layer The Network Interface Layer of the TCP/IP model defines how the host connects to the network. The host could be a computer connected to an Ethernet or Token-Ring network or a router connected to a frame-relay wide area network. TCP/IP is not dependent on a specific networking technology therefore, TCP/IP can be adapted to run on newer networking technologies such as ATM (Asynchronous Transfer Mode).  Section 6-2 Key Terms Well-known ports ICANN Transport Layer Protocols TCP Connection Oriented Protocol SYN SYN + ACK ACK  Section 6-2 Key Terms UDP Internet Layer IP (internet protocol) ARP IGMP Multicasting Multicast Address Network Interface Layer