TCP Ip

Chapter 1
Introduction
Objectives
Upon completion you will be able to:
• Understand how the Internet came into being

• Understand the meaning of the terms protocol and standard
• Understand the various organizations involved in the standards
• Understand the different levels of Internet service providers
• Understand the groups involved in Internet administration
TCP/IP Protocol Suite 1

1.1 A Brief History
A network is a group of connected, communicating devices. An internet
is two or more networks that can communicate with each other. The most
notable internet is called the Internet
Internet.. Millions of people are users. Yet
this extraordinary communication system only came into being in 1969.
The topics discussed in this section include:
ARPANET
Birth of the Internet
Transmission Control Protocol / Internetworking Protocol
MILNET
CSNET, NSFNET & ANSNET
The Internet Today
Time Line
Growth of the Internet

Figure 1.1 Internet today

1.2 Protocols and Standards
In this section, we define two widely used terms: protocols and standards.
First, we define protocol, which is synonymous with “rule.” Then we
discuss standards, which are agreed-
agreed-upon rules.

Protocols
Standards

1.3 Standards Organizations
Standards are developed through the cooperation of standards creation
committees, forums, and government regulatory agencies.

Standards Creation Committees
Forums
Regulatory Agencies

Note:
The websites for the standardization

organizations are given in Appendix F.

1.4 Internet Standards
An Internet standard is a thoroughly tested specification. There is a strict
procedure by which a specification attains Internet standard status. A
specification begins as an Internet draft, working document with no
official status and a six-
six-month lifetime. A draft may be published as a
Request for Comment (RFC).

Maturity Levels
Requirement Levels

Figure 1.2 Maturity levels of an RFC

Figure 1.3 Requirement levels of an RFC

Note:
RFCs can be found at

www.faqs.org/rfcs

1.5 Internet Administration
The Internet has evolved and gained a broader user base with significant
commercial activity. Various groups that coordinate Internet issues have
guided this growth and development.

Internet Society (ISOC)
Internet Architecture Board (IAB)
Internet Engineering Task Force (IETF)
Internet Research Task Force (IRTF)
Internet Assigned Numbers Authority (IANA)
Names and Numbers (ICANN)
Network Information Center (NIC)

Figure 1.4 Internet administration

Note:
The websites for Internet

organizations can be found in
Appendix F.

Chapter 2
The OSI Model and

the TCP/IP Protocol Suitea
Objectives
• Understand the architecture of the OSI model

• Understand the layers of the OSI model and their functions
• Understand the architecture of the TCP/IP Protocol Suite
• Differentiate between the OSI model and the TCP/IP Suite
• Differentiate between the three types of Internet addresses

2.1 The OSI Model
Established in 1947, the International Standards Organization (ISO) is a
multinational body dedicated to worldwide agreement on international
standards. An ISO standard that covers all aspects of network
communications is the Open Systems Interconnection (OSI) model. It
was first introduced in the late 1970s.
Layered Architecture
Peer--to-
Peer to-Peer Processes
Encapsulation

Note:
ISO is the organization.

OSI is the model

Figure 2.1 The OSI model

Figure 2.2 OSI layers

Figure 2.3 An exchange using the OSI model

2.2 Layers in the OSI Model
The functions of each layer in the OSI model is briefly described.
Physical Layer
Data Link Layer
Network Layer
Transport Layer
Session Layer
Presentation Layer
Application Layer
Summary of Layers

Figure 2.4 Physical layer

Note:
The physical layer is responsible

for the movement of individual bits
from one hop (node) to the next.

Figure 2.5 Data link layer

Note:
The data link layer is responsible for

moving frames from one hop (node) to
the next.

Figure 2.6 Hop-to-hop delivery

Figure 2.7 Network layer

Note:
The network layer is responsible for

the delivery of individual packets from
the source host to the destination host.

Figure 2.8 Source-to-destination delivery

Figure 2.9 Transport layer

Note:
The transport layer is responsible for

the delivery of a message from one
process to another.

Figure 2.10 Reliable process-to-process delivery of a message

Figure 2.11 Session layer

Figure 2.12 Presentation layer

Figure 2.13 Application layer

Figure 2.14 Summary of layers

2.3 TCP/IP Protocol Suite
The TCP/IP protocol suite is made of five layers: physical, data link,
network, transport, and application. The first four layers provide physical
standards, network interface, internetworking, and transport functions
that correspond to the first four layers of the OSI model. The three
topmost layers in the OSI model, however, are represented in TCP/IP by
a single layer called the application layer.
Physical and Data Link Layers

Network Layer
Transport Layer
Application Layer

Figure 2.15 TCP/IP and OSI model

2.4 Addressing
Three different levels of addresses are used in an internet using the
TCP/IP protocols: physical (link) address,
address, logical (IP) address,
address, and
port address.
address.

Physical Address
Logical Address
Port Address

Figure 2.16 Addresses in TCP/IP

Figure 2.17 Relationship of layers and addresses in TCP/IP

EXAMPLE 1
In Figure 2.18 a node with physical address 10 sends

a frame to a node with physical address 87. The two
nodes are connected by a link. At the data link level
this frame contains physical (link) addresses in the
header. These are the only addresses needed. The rest
of the header contains other information needed at
this level. The trailer usually contains extra bits
needed for error detection.
See Next Slide

Figure 2.18 Physical addresses

EXAMPLE 2
As we will see in Chapter 3, most local area networks

use a 48-bit (6 bytes) physical address written as 12
hexadecimal digits, with every 2 bytes separated by a
colon as shown below:
07:01:02:01:2C:4B
A 6-byte (12 hexadecimal digits) physical address.

EXAMPLE 3
In Figure 2.19 we want to send data from a node with network

address A and physical address 10, located on one LAN, to a
node with a network address P and physical address 95, located
on another LAN. Because the two devices are located on
different networks, we cannot use link addresses only; the link
addresses have only local jurisdiction. What we need here are
universal addresses that can pass through the LAN
boundaries. The network (logical) addresses have this
characteristic.
See Next Slide

EXAMPLE 3 (Continued)
The packet at the network layer contains the logical addresses,

which remain the same from the original source to the final
destination (A and P, respectively, in the figure). They will not
change when we go from network to network. However, the
physical addresses will change as the packet moves from one
network to another. The boxes labeled routers are
internetworking devices, which we will discuss in Chapter 3.
See Next Slide

Figure 2.19 IP addresses

EXAMPLE 4
As we will see in Chapter 4, an Internet address (in

IPv4) is 32 bits in length, normally written as four
decimal numbers, with each number representing 1
byte. The numbers are separated by a dot. Below is an
example of such an address.
132.24.75.9
An internet address in IPv4 in decimal numbers

EXAMPLE 5
Figure 2.20 shows an example of transport layer

communication. Data coming from the upperlayers
have port addresses j and k ( j is the address of the
sending process, and k is the address of the receiving
process). Since the data size is larger than the network
layer can handle, the data are split into two packets,
each packet retaining the service-point addresses ( j
and k). Then in the network layer, network addresses
(A and P) are added to each packet.
See Next Slide

EXAMPLE 5 (Χοντινυεδ)
The packets can travel on different paths and arrive at

the destination either in order or out of order. The two
packets are delivered to the destination transport
layer, which is responsible for removing the network
layer headers and combining the two pieces of data
for delivery to the upper layers.
See Next Slide

Figure 2.20 Port addresses

EXAMPLE 6
As we will see in Chapters 11, 12, and 13, a port

address is a 16-bit address represented by one decimal
number as shown below.
753
A 16-bit port address represented as one single number.

2.5 IP Versions
IP became the official protocol for the Internet in 1983. As the Internet
has evolved, so has IP. There have been six versions since its inception.
We look at the latter three versions here.

Version 4
Version 5
Version 6

Chapter 3
Underlying Technology
Objectives
• Understand the different versions of wired Ethernet
• Understand wireless Ethernet
• Understand the types of point-to-point WANs
• Understand the types of switched WANs, especially ATM
• Differentiate between repeaters, bridges, routers, and hubs

Figure 3.1 Internet model

3.1 Local Area Networks
A local area network (LAN) is a data communication system that allows
a number of independent devices to communicate directly with each
other in a limited geographic area such as a single department, a single
building, or a campus. A large organization may need several connected
LANs.The most popular LANs are Ethernet and wireless LANs. We
briefly review these technologies in this section.
Wired LANs: Ethernet

Wireless LANs: IEEE 802.11

Figure 3.2 CSMA/CD

Figure 3.3 Ethernet layers

Figure 3.4 Ethernet frame

Figure 3.5 Ethernet implementations

Figure 3.6 Fast Ethernet implementations

Figure 3.7 Gigabit Ethernet implementations

Figure 3.8 BSSs

Figure 3.9 ESS

Figure 3.10 Physical layer

Figure 3.11 FHSS

Figure 3.12 DSSS

Figure 3.13 MAC layers in IEEE 802.11 standard

Figure 3.14 CSMA/CA

Figure 3.15 Frame

Table 3.1 Addresses in IEEE 802.11

3.2 Point-to-Point WANs
A second type of network we encounter in the Internet is the point-
point-to
to--
point wide area network. A point
point--to-
to-point WAN connects two remote
devices using a line available from a public network such as a telephone
network. We discuss the physical and data link layers of these
technologies here..
Physical Layer
Data Link Layer

Figure 3.16 56K modem

Note:
ADSL is an asymmetric communication

technology designed for residential users;
it is not suitable for businesses.

Figure 3.17 Bandwidth division

Figure 3.18 ADSL and DSLAM

Figure 3.19 Cable bandwidth

Figure 3.20 Cable modem configurations

Table 3.2 T line rates

Table 3.3 SONET rates

Figure 3.21 PPP frame

3.3 Switched WANs
The backbone networks in the Internet are usually switched WANs. A
switched WAN is a wide area network that covers a large area (a state or
a country) and provides access at several points to the users. Inside the
network, there is a mesh of point-
point-to-
to-point networks that connects
switches. The switches, multiple port connectors, allow the connection of
several inputs and outputs.
X.25
Frame Relay
ATM

Figure 3.22 Frame Relay network

Note:
A cell network uses the cell as the basic unit

of data exchange. A cell is defined as a
small, fixed-
fixed-size block of information.

Figure 3.23 ATM multiplexing

Figure 3.24 Architecture of an ATM network

Figure 3.25 Virtual circuits

Note:
Note that a virtual connection is defined by

a pair of numbers:
the VPI and the VCI
VCI..

Figure 3.26 An ATM cell

Figure 3.27 ATM layers

Note:
The IP protocol uses the AAL5 sublayer.

Νοτε:
Ωε ωιλλ δισχυσσ ΙΠ οϖερ ΑΤΜ ιν

Χηαπτερ 23.

3.4 Connecting Devices
LANs or WANs do not normally operate in isolation. They are connected
to one another or to the Internet. To connect LANs or WANs, we use
connecting devices.
devices. Connecting devices can operate in different layers of
the Internet model. We discuss three kinds of connecting devices:
repeaters (or hubs), bridges (or two
two--layer switches), and routers (or
three--layer switches).
three switches). Repeaters and hubs operate in the first layer of the
Internet model. Bridges and two-
two-layer switches operate in the first two
layers. Routers and three-
three-layer switches operate in the first three layers
Repeaters
Hubs
Bridges
Router

Figure 3.28 Connecting devices

Figure 3.29 Repeater

Note:
A repeater connects segments of a LAN.

Note:
A repeater forwards every bit;

it has no filtering capability.

Note:
A repeater is a regenerator, not an amplifier.

Figure 3.30 Function of a repeater

Note:
A bridge has a table used in filtering

decisions.

Figure 3.31 Bridge

Note:
A bridge does not change the physical

(MAC) addresses in a frame.

Figure 3.32 Learning bridge

Note:
A router is a three-layer
(physical, data link, and network)
device.

Note:
A repeater or a bridge connects segments of

a LAN.
A router connects independent LANs or
WANs to create an internetwork (internet).

Figure 3.33 Routing example

Note:
A router changes the physical addresses

in a packet.

Chapter 4
IP Addresses:
Classful Addressing
Objectives
• Understand IPv4 addresses and classes

• Identify the class of an IP address
• Find the network address given an IP address
• Understand masks and how to use them
• Understand subnets and supernets

4.1 INTRODUCTION
The identifier used in the IP layer of the TCP/IP protocol suite to identify
each device connected to the Internet is called the Internet address or IP
address. An IP address is a 32
32--bit address that uniquely and universally
defines the connection of a host or a router to the Internet. IP addresses
are unique. They are unique in the sense that each address defines one,
and only one, connection to the Internet. Two devices on the Internet can
never have the same address.
Address Space
Notation

Note:
An IP address is a 32-bit address.

Note:
The IP addresses are unique.

Note:
The address space of IPv4 is

232 or 4,294,967,296.

Figure 4.1 Dotted-decimal notation

Note:
The binary, decimal, and hexadecimal

number systems are reviewed in
Appendix B.

EXAMPLE 1
Change the following IP addresses from binary notation to

dotted-decimal notation.
a. 10000001 00001011 00001011 11101111
b. 11000001 10000011 00011011 11111111
c. 11100111 11011011 10001011 01101111
d. 11111001 10011011 11111011 00001111
Solution
We replace each group of 8 bits with its equivalent decimal
number (see Appendix B) and add dots for separation:
a. 129.11.11.239 b. 193.131.27.255
c. 231.219.139.111 d. 249.155.251.15

EXAMPLE 2
Change the following IP addresses from dotted-decimal

notation to binary notation.
a. 111.56.45.78 b. 221.34.7.82
c. 241.8.56.12 d. 75.45.34.78
Solution
We replace each decimal number with its binary equivalent:
a. 01101111 00111000 00101101 01001110
b. 11011101 00100010 00000111 01010010
c. 11110001 00001000 00111000 00001100
d. 01001011 00101101 00100010 01001110
EXAMPLE 3
Find the error, if any, in the following IP addresses:

a. 111.56.045.78 b. 221.34.7.8.20
c. 75.45.301.14 d. 11100010.23.14.67
Solution
a. There are no leading zeroes in dotted-decimal notation (045).
b. We may not have more than four numbers in an IP address.
c. In dotted-decimal notation, each number is less than or equal
to 255; 301 is outside this range.
d. A mixture of binary notation and dotted-decimal notation is not
allowed.
EXAMPLE 4
Change the following IP addresses from binary notation to

hexadecimal notation.
a. 10000001 00001011 00001011 11101111
b. 11000001 10000011 00011011 11111111
Solution
We replace each group of 4 bits with its hexadecimal equivalent
(see Appendix B). Note that hexadecimal notation normally has
no added spaces or dots; however, 0X (or 0x) is added at the
beginning or the subscript 16 at the end to show that the
number is in hexadecimal.
a. 0X810B0BEF or 810B0BEF16
b. 0XC1831BFF or C1831BFF16
4.2 CLASSFUL ADDRESSING
IP addresses, when started a few decades ago, used the concept of
classes. This architecture is called classful addressing.
addressing. In the mid-
mid-1990s,
a new architecture, called classless addressing, was introduced and will
eventually supersede the original architecture. However, part of the
Internet is still using classful addressing, but the migration is very fast.

Recognizing Classes
Netid and Hostid
Classes and Blocks
Network Addresses
Sufficient Information
Mask
CIDR Notation
Address Depletion

Figure 4.2 Occupation of the address space

Table 4.1 Addresses per class

Figure 4.3 Finding the class in binary notation

Figure 4.4 Finding the address class

EXAMPLE 5
How can we prove that we have 2,147,483,648 addresses in

class A?
Solution
In class A, only 1 bit defines the class. The remaining 31 bits
are available for the address. With 31 bits, we can have 231
or 2,147,483,648 addresses.

EXAMPLE 6
Find the class of each address:

a. 00000001 00001011 00001011 11101111
b. 11000001 10000011 00011011 11111111
c. 10100111 11011011 10001011 01101111
d. 11110011 10011011 11111011 00001111
Solution
See the procedure in Figure 4.4.
a. The first bit is 0. This is a class A address.
b. The first 2 bits are 1; the third bit is 0. This is a class C address.
c. The first bit is 0; the second bit is 1. This is a class B address.
d. The first 4 bits are 1s. This is a class E address..
Figure 4.5 Finding the class in decimal notation

EXAMPLE 7
Find the class of each address:

a. 227.12.14.87 b.193.14.56.22 c.14.23.120.8
d. 252.5.15.111 e.134.11.78.56
Solution
a. The first byte is 227 (between 224 and 239); the class is D.
b. The first byte is 193 (between 192 and 223); the class is C.
c. The first byte is 14 (between 0 and 127); the class is A.
d. The first byte is 252 (between 240 and 255); the class is E.
e. The first byte is 134 (between 128 and 191); the class is B.

EXAMPLE 8
In Example 5 we showed that class A has 231 (2,147,483,648)

addresses. How can we prove this same fact using dotted-
decimal notation?
Solution
The addresses in class A range from 0.0.0.0 to 127.255.255.255.
We need to show that the difference between these two numbers
is 2,147,483,648. This is a good exercise because it shows us
how to define the range of addresses between two addresses.
We notice that we are dealing with base 256 numbers here.
Each byte in the notation has a weight. The weights are as
follows (see Appendix B):
See Next Slide

EXAMPLE 8 (CONTINUED)
2563, 2562, 2561, 2560

Now to find the integer value of each number, we multiply each
byte by its weight:
Last address: 127 × 2563 + 255 × 2562 +
255 × 2561 + 255 × 2560 = 2,147,483,647
First address: = 0
If we subtract the first from the last and add 1 to the result
(remember we always add 1 to get the range), we get
2,147,483,648 or 231.

Figure 4.6 Netid and hostid

Note:
Millions of class A addresses are

wasted.

Figure 4.7 Blocks in class A

Figure 4.8 Blocks in class B

Note:
Many class B addresses are wasted.

Figure 4.9 Blocks in class C

Note:
The number of addresses in class C is

smaller than the needs of most
organizations.

Note:
Class D addresses are used for

multicasting; there is only one block in
this class.

Note:
Class E addresses are reserved for

future purposes; most of the block is
wasted.

Note:
In classful addressing, the network

address (the first address in the block)
is the one that is assigned to the
organization. The range of addresses
can automatically be inferred from the
network address.

EXAMPLE 9
Given the network address 17.0.0.0, find the class, the block,
and the range of the addresses.
Solution
The class is A because the first byte is between 0 and 127. The
block has a netid of 17. The addresses range from 17.0.0.0 to
17.255.255.255.

EXAMPLE 10
Given the network address 132.21.0.0, find the class, the block,
and the range of the addresses.
Solution
The class is B because the first byte is between 128 and 191.
The block has a netid of 132.21. The addresses range from
132.21.0.0 to 132.21.255.255.

EXAMPLE 11
Given the network address 220.34.76.0, find the class, the

block, and the range of the addresses.
Solution
The class is C because the first byte is between 192
and 223. The block has a netid of 220.34.76. The
addresses range from 220.34.76.0 to 220.34.76.255.

Figure 4.10 Masking concept

Figure 4.11 AND operation

Table 4.2 Default masks

Note:
The network address is the beginning

address of each block. It can be found
by applying the default mask to any of
the addresses in the block (including
itself). It retains the netid of the block
and sets the hostid to zero.

EXAMPLE 12
Given the address 23.56.7.91, find the beginning address

(network address).
Solution
The default mask is 255.0.0.0, which means that only the first
byte is preserved and the other 3 bytes are set to 0s. The
network address is 23.0.0.0.

EXAMPLE 13

(network address).
Solution
The default mask is 255.255.0.0, which means that the first 2
bytes are preserved and the other 2 bytes are set to 0s. The
network address is 132.6.0.0.

EXAMPLE 14

(network address).
Solution
The default mask is 255.255.255.0, which means that the first 3
bytes are preserved and the last byte is set to 0. The network
address is 201.180.56.0.

Note:
Note that we must not apply the

default mask of one class to an address
belonging to another class.

4.3 OTHER ISSUES
In this section, we discuss some other issues that are related to
addressing in general and classful addressing in particular.

Multihomed Devices
Location, Not Names
Special Addresses
Private Addresses
Unicast, Multicast, and Broadcast Addresses

Figure 4.12 Multihomed devices

Table 4.3 Special addresses

Figure 4.13 Network address

Figure 4.14 Example of direct broadcast address

Figure 4.15 Example of limited broadcast address

Figure 4.16 Examples of “this host on this network”

Figure 4.17 Example of “specific host on this network”

Figure 4.18 Example of loopback address

Table 4.5 Addresses for private networks

Note:
Multicast delivery will be discussed in

depth in Chapter 15.

Table 4.5 Category addresses

Table 4.6 Addresses for conferencing

Figure 4.19 Sample internet

4.4 SUBNETTING AND
SUPERNETTING
In the previous sections we discussed the problems associated with
classful addressing. Specifically, the network addresses available for
assignment to organizations are close to depletion. This is coupled with
the ever-
ever-increasing demand for addresses from organizations that want
connection to the Internet. In this section we briefly discuss two
solutions: subnetting and supernetting.

Subnetting
Supernetting
Supernet Mask
Obsolescence

Note:
IP addresses are designed with two

levels of hierarchy.

Figure 4.20 A network with two levels of hierarchy (not subnetted)

Figure 4.21 A network with three levels of hierarchy (subnetted)

Figure 4.22 Addresses in a network with and without subnetting

Figure 4.23 Hierarchy concept in a telephone number

Figure 4.24 Default mask and subnet mask

EXAMPLE 15
What is the subnetwork address if the destination address is

200.45.34.56 and the subnet mask is 255.255.240.0?
Solution
We apply the AND operation on the address and the subnet
mask.
Address ➡ 11001000 00101101 00100010 00111000
Subnet Mask ➡ 11111111 11111111 11110000 00000000
Subnetwork Address ➡ 11001000 00101101 00100000 00000000.

Figure 4.25 Comparison of a default mask and a subnet mask

Figure 4.26 A supernetwork

Note:
In subnetting, we need the first
address of the subnet and the subnet
mask to define the range of addresses.
In supernetting, we need the first
address of the supernet and the
supernet mask to define the range of
addresses.
Figure 4.27 Comparison of subnet, default, and supernet masks

Note:
The idea of subnetting and

supernetting of classful addresses is
almost obsolete.

Chapter 5
IP Addresses:
Classless Addressing
Objectives
• Understand the concept of classless addressing
• Be able to find the first and last address given an IP address
• Be able to find the network address given a classless IP address
• Be able to create subnets from a block of classless IP addresses
• Understand address allocation and address aggregation

5.1 VARIABLE-LENGTH BLOCKS
In classless addressing variable-
variable-length blocks are assigned that belong to
no class. In this architecture, the entire address space (232 addresses) is
divided into blocks of different sizes.
Restrictions
Finding the Block
Granted Block

Figure 5.1 Variable-length blocks

EXAMPLE 1
Which of the following can be the beginning address

of a block that contains 16 addresses?
a. 205.16.37.32 b.190.16.42.44
c. 17.17.33.80 d.123.45.24.52
Solution
Only two are eligible (a and c). The address
205.16.37.32 is eligible because 32 is divisible by 16.
The address 17.17.33.80 is eligible because 80 is
divisible by 16.
EXAMPLE 2

a.205.16.37.32 b.190.16.42.0
c.17.17.32.0 d.123.45.24.52
Solution
In this case, the right-most byte must be 0. As we
mentioned in Chapter 4, the IP addresses use base 256
arithmetic. When the right-most byte is 0, the total
address is divisible by 256. Only two addresses are
eligible (b and c).
EXAMPLE 3

a. 205.16.37.32 b.190.16.42.0
c. 17.17.32.0 d.123.45.24.52
Solution
In this case, we need to check two bytes because
1024 = 4 × 256. The right-most byte must be divisible
by 256. The second byte (from the right) must be
divisible by 4. Only one address is eligible (c).

Figure 5.2 Format of classless addressing address

Table 5.1 Prefix lengths

Note:
Classful addressing is a special case of

classless addressing.

EXAMPLE 4
What is the first address in the block if one of the

addresses is 167.199.170.82/27?
Solution
The prefix length is 27, which means that we must
keep the first 27 bits as is and change the remaining
bits (5) to 0s. The following shows the process:
Address in binary: 10100111 11000111 10101010 01010010
Keep the left 27 bits: 10100111 11000111 10101010 01000000
Result in CIDR notation: 167.199.170.64/27
EXAMPLE 5
What is the first address in the block if one of the

addresses is 140.120.84.24/20?
Solution
Figure 5.3 shows the solution. The first, second, and
fourth bytes are easy; for the third byte we keep the
bits corresponding to the number of 1s in that group.
The first address is 140.120.80.0/20.
See Next Slide

Figure 5.3 Example 5

EXAMPLE 6
Find the first address in the block if one of the

addresses is 140.120.84.24/20.
Solution
The first, second, and fourth bytes are as defined in
the previous example. To find the third byte, we write
84 as the sum of powers of 2 and select only the
leftmost 4 (m is 4) as shown in Figure 5.4. The first
address is 140.120.80.0/20.
See Next Slide


EXAMPLE 7
Find the number of addresses in the block if one of

the addresses is 140.120.84.24/20.
Solution
The prefix length is 20. The number of addresses in
the block is 232−20 or 212 or 4096. Note that
this is a large block with 4096 addresses.

EXAMPLE 8
Using the first method, find the last address in the

block if one of the addresses is 140.120.84.24/20.
Solution
We found in the previous examples that the first
address is 140.120.80.0/20 and the number of
addresses is 4096. To find the last address, we need to
add 4095 (4096 − 1) to the first address.
See Next Slide

To keep the format in dotted-decimal notation, we

need to represent 4095 in base 256 (see Appendix B)
and do the calculation in base 256. We write 4095 as
15.255. We then add the first address to this number
(in base 255) to obtain the last address as shown
below:
140 . 120 . 80 . 0
15 . 255
-------------------------
140 . 120 . 95 . 255
The last address is 140.120.95.255/20.
EXAMPLE 9
Using the second method, find the last address in the

block if one of the addresses is 140.120.84.24/20.
Solution
The mask has twenty 1s and twelve 0s. The
complement of the mask has twenty 0s and twelve 1s.
In other words, the mask complement is
00000000 00000000 00001111 11111111
or 0.0.15.255. We add the mask complement to the
beginning address to find the last address.
See Next Slide
We add the mask complement to the beginning

address to find the last address.
140 . 120 . 80 . 0
0 . 0 . 15 . 255
----------------------------
140 . 120 . 95 . 255
The last address is 140.120.95.255/20.

EXAMPLE 10
Find the block if one of the addresses is

190.87.140.202/29.
Solution
We follow the procedure in the previous examples to
find the first address, the number of addresses, and
the last address. To find the first address, we notice
that the mask (/29) has five 1s in the last byte. So we
write the last byte as powers of 2 and retain only the
leftmost five as shown below:
See Next Slide
202 ➡ 128 + 64 + 0 + 0 + 8 + 0 + 2 + 0
The leftmost 5 numbers are ➡ 128 + 64 + 0 + 0 + 8
The first address is 190.87.140.200/29
The number of addresses is 232−29 or 8. To find the last address,

we use the complement of the mask. The mask has twenty-nine
1s; the complement has three 1s. The complement is 0.0.0.7. If
we add this to the first address, we get 190.87.140.207/29. In
other words, the first address is 190.87.140.200/29, the last
address is 190.87.140.207/20. There are only 8 addresses in this
block.
EXAMPLE 11
Show a network configuration for the block in the previous

example.
Solution
The organization that is granted the block in the previous
example can assign the addresses in the block to the hosts in its
network. However, the first address needs to be used as the
network address and the last address is kept as a special
address (limited broadcast address). Figure 5.5 shows how the
block can be used by an organization. Note that the last
address ends with 207, which is different from the 255 seen in
classful addressing.
See Next Slide


Note:
In classless addressing, the last

address in the block does not
necessarily end in 255.

Note:
In CIDR notation, the block granted is

defined by the first address and the
prefix length.

5.2 SUBNETTING
When an organization is granted a block of addresses, it can create
subnets to meet its needs. The prefix length increases to define the subnet
prefix length.
Finding the Subnet Mask

Finding the Subnet Addresses
Variable--Length Subnets
Variable

Note:
In fixed-length subnetting, the number

of subnets is a power of 2.

EXAMPLE 12
An organization is granted the block 130.34.12.64/26.

The organization needs 4 subnets. What is the subnet
prefix length?
Solution
We need 4 subnets, which means we need to add two
more 1s (log2 4 = 2) to the site prefix. The subnet
prefix is then /28.

EXAMPLE 13
What are the subnet addresses and the range of

addresses for each subnet in the previous example?
Solution
Figure 5.6 shows one configuration.
See Next Slide


The site has 232−26 = 64 addresses. Each subnet has

232–28 = 16 addresses. Now let us find the first and last
address in each subnet.
1. The first address in the first subnet is 130.34.12.64/28,
using the procedure we showed in the previous examples.
Note that the first address of the first subnet is the first
address of the block. The last address of the subnet can
be found by adding 15 (16 −1) to the first address. The
last address is 130.34.12.79/28.
See Next Slide

2.The first address in the second subnet is

130.34.12.80/28; it is found by adding 1 to the last
address of the previous subnet. Again adding 15 to
the first address, we obtain the last address,
130.34.12.95/28.
3. Similarly, we find the first address of the third

subnet to be 130.34.12.96/28 and the last to be
130.34.12.111/28.
4. Similarly, we find the first address of the fourth

subnet to be 130.34.12.112/28 and the last to be
130.34.12.127/28.
EXAMPLE 14
An organization is granted a block of addresses with the

beginning address 14.24.74.0/24. There are 232−24= 256
addresses in this block. The organization needs to have 11
subnets as shown below:
a. two subnets, each with 64 addresses.
b. two subnets, each with 32 addresses.
c. three subnets, each with 16 addresses.
d. four subnets, each with 4 addresses.
Design the subnets.
See Next Slide For One Solution


EXAMPLE 14 (CONTINUTED)
1. We use the first 128 addresses for the first two

subnets, each with 64 addresses. Note that the mask
for each network is /26. The subnet address for each
subnet is given in the figure.
2. We use the next 64 addresses for the next two
See Next Slide

EXAMPLE 14 (CONTINUTED)
3. We use the next 48 addresses for the next three

4. We use the last 16 addresses for the last four
subnets, each with 4 addresses. Note that the mask for
each network is /30. The subnet address for each

EXAMPLE 15
As another example, assume a company has three

offices: Central, East, and West. The Central office is
connected to the East and West offices via private,
point-to-point WAN lines. The company is granted a
block of 64 addresses with the beginning address
70.12.100.128/26. The management has decided to
allocate 32 addresses for the Central office and
divides the rest of addresses between the two offices.
Figure 5.8 shows the configuration designed by the
management.
See Next Slide

The company will have three subnets, one at Central, one at

East, and one at West. The following lists the subblocks
allocated for each network:
a. The Central office uses the network address

70.12.100.128/27. This is the first address, and the mask
/27 shows that there are 32 addresses in this network.
Note that three of these addresses are used for the
routers and the company has reserved the last address
in the sub-block. The addresses in this subnet are
70.12.100.128/27 to 70.12.100.159/27. Note that the
interface of the router that connects the Central subnet
to the WAN needs no address because it is a point-to-
point connection.
TCP/IP Protocol Suite
See Next Slide 215
b. The West office uses the network address

70.12.100.160/28. The mask /28 shows that there are
only 16 addresses in this network. Note that one of these
addresses is used for the router and the company has
reserved the last address in the sub-block. The
addresses in this subnet are 70.12.100.160/28 to
70.12.100.175/28. Note also that the interface of the
router that connects the West subnet to the WAN needs
no address because it is a point-to- point connection.
See Next Slide

c. The East office uses the network address

70.12.100.176/28. The mask /28 shows that there are
only 16 addresses in this network. Note that one of these
addresses is used for the router and the company has
reserved the last address in the sub-block. The
addresses in. this subnet are 70.12.100.176/28 to
70.12.100.191/28. Note also that the interface of the
router that connects the East subnet to the WAN needs
no address because it is a point-to-point connection.

5.3 ADDRESS ALLOCATION
Address allocation is the responsibility of a global authority called the
Internet Corporation for Assigned Names and Addresses (ICANN). It
usually assigns a large block of addresses to an ISP to be distributed to
its Internet users.

EXAMPLE 16
An ISP is granted a block of addresses starting with

190.100.0.0/16 (65,536 addresses). The ISP needs to
distribute these addresses to three groups of customers
as follows:
a. The first group has 64 customers; each needs 256
addresses.
b. The second group has 128 customers; each needs 128
addresses
c. The third group has 128 customers; each needs 64
addresses.
See Next Slide

Design the subblocks and find out how many

addresses are still available after these allocations.
Solution
Figure 5.9 shows the situation.
See Next Slide


Group 1
For this group, each customer needs 256 addresses.
This means the suffix length is 8 (28 =256). The prefix
length is then 32 − 8 = 24. The addresses are:
1st Customer 190.100.0.0/24 190.100.0.255/24

2nd Customer 190.100.1.0/24 190.100.1.255/24
...
64th Customer 190.100.63.0/24 190.100.63.255/24
Total = 64 × 256 = 16,384
See Next Slide

Group 2
This means the suffix length is 7 (27 =128). The prefix
1st Customer 190.100.64.0/25 190.100.64.127/25

2nd Customer 190.100.64.128/25 190.100.64.255/25
···
128th Customer 190.100.127.128/25 190.100.127.255/25
Total = 128 × 128 = 16,384
See Next Slide

Group 3
This means the suffix length is 6 (26 = 64). The prefix
1st Customer 190.100.128.0/26 190.100.128.63/26

2nd Customer 190.100.128.64/26 190.100.128.127/26
···
128th Customer 190.100.159.192/26 190.100.159.255/26
Total = 128 × 64 = 8,192
See Next Slide

Number of granted addresses to the ISP: 65,536

Number of allocated addresses by the ISP: 40,960
Number of available addresses: 24,576

Chapter 6
Delivery, Forwarding,
and Routing of IP Packets
Objectives
• Understand the different types of delivery and the connection

• Understand forwarding techniques in classful addressing
• Understand forwarding techniques in classless addressing
• Understand how a routing table works
• Understand the structure of a router

6.1 DELIVERY
The network layer supervises delivery, the handling of the packets by the
underlying physical networks. Two important concepts are the type of
connection and direct versus indirect delivery.
Connection Types
Direct Versus Indirect Delivery

Note:
IP is a connectionless protocol.

Figure 6.1 Direct delivery

Figure 6.2 Indirect delivery

6.2 FORWARDING
Forwarding means to place the packet in its route to its destination.
Forwarding requires a host or a router to have a routing table. .

Forwarding Techniques
Forwarding with Classful Addressing
Forwarding with Classless Addressing
Combination

Figure 6.3 Next-hop method

Figure 6.4 Network-specific method

Figure 6.5 Host-specific routing

Figure 6.6 Default routing

Figure 6.7 Simplified forwarding module in classful address without subnetting

EXAMPLE 1
Figure 6.8 shows an imaginary part of the Internet.

Show the routing tables for router R1.
See Next Slide

Figure 6.8 Configuration for routing, Example 1

Solution
Figure 6.9 shows the three tables used by router R1.
Note that some entries in the next-hop address
column are empty because in these cases, the
destination is in the same network to which the router
is connected (direct delivery). In these cases, the next-
hop address used by ARP is simply the destination
address of the packet as we will see in Chapter 7.
See Next Slide

Figure 6.9 Tables for Example 1

EXAMPLE 2
Router R1 in Figure 6.8 receives a packet with

destination address 192.16.7.14. Show how the packet
is forwarded.
Solution
The destination address in binary is 11000000 00010000
00000111 00001110. A copy of the address is shifted 28 bits to
the right. The result is 00000000 00000000 00000000 00001100
or 12. The destination network is class C. The network address
is extracted by masking off the leftmost 24 bits of the
destination address; the result is 192.16.7.0. The table for Class
C is searched. The network address is found in the first row.
The next-hop address 111.15.17.32. and the interface m0 are
passed to ARP.
EXAMPLE 3
Router R1 in Figure 6.8 receives a packet with destination

address 167.24.160.5. Show how the packet is forwarded.
Solution
The destination address in binary is 10100111 00011000
10100000 00000101. A copy of the address is shifted 28 bits to
the right. The result is 00000000 00000000 00000000
00001010 or 10. The class is B. The network address can be
found by masking off 16 bits of the destination address, the
result is 167.24.0.0. The table for Class B is searched. No
matching network address is found. The packet needs to be
forwarded to the default router (the network is somewhere else
in the Internet). The next-hop address 111.30.31.18 and the
interface number m0 are passed to ARP.
Figure 6.10 Simplified forwarding module in classful address with subnetting

EXAMPLE 4
Figure 6.11 shows a router connected to four subnets.
See Next Slide

Note several points. First, the site address is

145.14.0.0/16 (a class B address). Every packet with
destination address in the range 145.14.0.0 to
145.14.255.255 is delivered to the interface m4 and
distributed to the final destination subnet by the
router. Second, we have used the address x.y.z.t/n for
the interface m4 because we do not know to which
network this router is connected. Third, the table has
a default entry for packets that are to be sent out of
the site. The router is configured to apply the mask
/18 to any destination address.
Figure 6.11 Configuration for Example 4

EXAMPLE 5
The router in Figure 6.11 receives a packet with

destination address 145.14.32.78. Show how the
packet is forwarded.
Solution
The mask is /18. After applying the mask, the subnet
address is 145.14.0.0. The packet is delivered to ARP
with the next-hop address 145.14.32.78 and the
outgoing interface m0.

EXAMPLE 6
A host in network 145.14.0.0 in Figure 6.11 has a

packet to send to the host with address 7.22.67.91.
Show how the packet is routed.
Solution
The router receives the packet and applies the mask
(/18). The network address is 7.22.64.0. The table is
searched and the address is not found. The router
uses the address of the default router (not shown in
figure) and sends the packet to that router.

Note:
In classful addressing we can have a

routing table with three columns;
in classless addressing, we need at
least four columns.

Figure 6.12 Simplified forwarding module in classless address

EXAMPLE 7
Make a routing table for router R1 using the

configuration in Figure 6.13.
See Next Slide
Solution
Table 6.1 shows the corresponding table.
See the table after the figure.

Figure 6.13 Configuration for Example 7

Table 6.1 Routing table for router R1 in Figure 6.13

EXAMPLE 8
Show the forwarding process if a packet arrives at R1

in Figure 6.13 with the destination address
180.70.65.140.
Solution
The router performs the following steps:
1. The first mask (/26) is applied to the destination
address. The result is 180.70.65.128, which does not
match the corresponding network address.
See Next Slide

2. The second mask (/25) is applied to the

destination address. The result is 180.70.65.128,
which matches the corresponding network address.
The next-hop address (the destination address of the
packet in this case) and the interface number m0
are passed to ARP for further processing.

EXAMPLE 9

201.4.22.35.
Solution
The router performs the following steps:
See Next Slide

1. The first mask (/26) is applied to the destination address. The

result is 201.4.22.0, which does not match the corresponding
network address (row 1).
2. The second mask (/25) is applied to the destination address.
The result is 201.4.22.0, which does not match the
corresponding network address (row 2).
3. The third mask (/24) is applied to the destination address.
The result is 201.4.22.0, which matches the corresponding
network address. The destination address of the package and
the interface number m3 are passed to ARP.

EXAMPLE 10

18.24.32.78.
Solution
This time all masks are applied to the destination
address, but no matching network address is found.
When it reaches the end of the table, the module gives
the next-hop address 180.70.65.200 and interface
number m2 to ARP. This is probably an outgoing
package that needs to be sent, via the default router, to
some place else in the Internet.
EXAMPLE 11
Now let us give a different type of example. Can we

find the configuration of a router, if we know only its
routing table? The routing table for router R1 is given
in Table 6.2. Can we draw its topology?
See Next Slide

Table 6.2 Routing table for Example 11

Solution
We know some facts but we don’t have all for a
definite topology. We know that router R1 has three
interfaces: m0, m1, and m2. We know that there are
three networks directly connected to router R1. We
know that there are two networks indirectly connected
to R1. There must be at least three other routers
involved (see next-hop column). We know to which
networks these routers are connected by looking at
their IP addresses. So we can put them at their
appropriate place.
See Next Slide
We know that one router, the default router, is

connected to the rest of the Internet. But there is some
missing information. We do not know if network
130.4.8.0 is directly connected to router R2 or through
a point-to-point network (WAN) and another router.
We do not know if network140.6.12.64 is connected to
router R3 directly or through a point-to-point network
(WAN) and another router. Point-to-point networks
normally do not have an entry in the routing table
because no hosts are connected to them. Figure 6.14
shows our guessed topology.
See Next Slide
Figure 6.14 Guessed topology for Example 6

Figure 6.15 Address aggregation

Figure 6.16 Longest mask matching

EXAMPLE 12
As an example of hierarchical routing, let us consider Figure

6.17. A regional ISP is granted 16384 addresses starting from
120.14.64.0. The regional ISP has decided to divide this block
into four subblocks, each with 4096 addresses. Three of these
subblocks are assigned to three local ISPs, the second subblock
is reserved for future use. Note that the mask for each block is
/20 because the original block with mask /18 is divided into 4
blocks.
See Next Slide

Figure 6.17 Hierarchical routing with ISPs

The first local ISP has divided its assigned subblock into 8
smaller blocks and assigned each to a small ISP. Each small
ISP provides services to 128 households (H001 to H128), each
using four addresses. Note that the mask for each small ISP is
now /23 because the block is further divided into 8 blocks.
Each household has a mask of /30, because a household has
only 4 addresses (232−30 is 4).
The second local ISP has divided its block into 4 blocks and
has assigned the addresses to 4 large organizations (LOrg01 to
LOrg04). Note that each large organization has 1024 addresses
and the mask is /22.
See Next Slide
The third local ISP has divided its block into 16 blocks and
assigned each block to a small organization (SOrg01 to
SOrg15). Each small organization has 256 addresses and the
mask is /24.
There is a sense of hierarchy in this configuration. All routers
in the Internet send a packet with destination address
120.14.64.0 to 120.14.127.255 to the regional ISP. The regional
ISP sends every packet with destination address 120.14.64.0 to
120.14.79.255 to Local ISP1. Local ISP1 sends every packet
with destination address 120.14.64.0 to 120.14.64.3 to H001.

6.3 ROUTING
Routing deals with the issues of creating and maintaining routing tables.
Static Versus Dynamic Routing Tables

Routing Table

Figure 6.18 Common fields in a routing table

EXAMPLE 13
One utility that can be used to find the contents of a

routing table for a host or router is netstat in UNIX or
LINUX. The following shows the listing of the
contents of the default server. We have used two
options, r and n. The option r indicates that we are
interested in the routing table and the option n
indicates that we are looking for numeric addresses.
Note that this is a routing table for a host, not a
router. Although we discussed the routing table for a
router throughout the chapter, a host also needs a
routing table.
See Next Slide
$ netstat -rn
Kernel IP routing table
Destination Gateway Mask Flags Iface
153.18.16.0 0.0.0.0 255.255.240.0 U eth0
127.0.0.0 0.0.0.0 255.0.0.0 U lo
0.0.0.0 153.18.31. 254 0.0.0.0 UG eth0.
See Next Slide

More information about the IP address and physical address of

the server can be found using the ifconfig command on the
given interface (eth0).
$ ifconfig eth0
eth0 Link encap:Ethernet HWaddr 00:B0:D0:DF:09:5D
inet addr:153.18.17.11 Bcast:153.18.31.255 Mask:255.255.240.0
....
From the above information, we can deduce the configuration

of the server as shown in Figure 6.19.
See Next Slide

Figure 6.19 Configuration of the server for Example 13

6.4 STRUCTURE OF A ROUTER
We represent a router as a black box that accepts incoming packets from
one of the input ports (interfaces), uses a routing table to find the
departing output port, and sends the packet from this output port.
port.
Components

Figure 6.20 Router components

Figure 6.21 Input port

Figure 6.22 Output port

Figure 6.23 Crossbar switch

Figure 6.24 A banyan switch

Figure 6.25 Examples of routing in a banyan switch

Figure 6.26 Batcher-banyan switch

Chapter 7
ARP and RARP
Objectives
• Understand the need for ARP

• Understand the cases in which ARP is used
• Understand the components and interactions in an ARP package
• Understand the need for RARP

Figure 7.1 ARP and RARP

Figure 7.2 Position of ARP and RARP in TCP/IP protocol suite

7.1 ARP
ARP associates an IP address with its physical address.
address. On a typical
physical network, such as a LAN, each device on a link is identified by a
physical or station address that is usually imprinted on the NIC.
NIC.

Packet Format
Encapsulation
Operation
ARP over ATM
Proxy ARP

Figure 7.3 ARP operation

Figure 7.4 ARP packet

Figure 7.5 Encapsulation of ARP packet

Figure 7.6 Four cases using ARP

Note:
An ARP request is broadcast;

an ARP reply is unicast.

EXAMPLE 1
A host with IP address 130.23.43.20 and physical

address B2:34:55:10:22:10 has a packet to send to
another host with IP address 130.23.43.25 and
physical address A4:6E:F4:59:83:AB (which is
unknown to the first host). The two hosts are on the
same Ethernet network. Show the ARP request and
reply packets encapsulated in Ethernet frames.
See Next Slide

Solution
Figure 7.7 shows the ARP request and reply packets.
Note that the ARP data field in this case is 28 bytes,
and that the individual addresses do not fit in the 4-
byte boundary. That is why we do not show the
regular 4-byte boundaries for these addresses. Also
note that the IP addresses are shown in hexadecimal.
For information on binary or hexadecimal notation
see Appendix B.
See Next Slide


Figure 7.8 Proxy ARP

7.2 ARP PACKAGE
In this section, we give an example of a simplified ARP software package
to show the components and the relationships between the components.
components.
This ARP package involves five modules
modules:: a cache table, queues, an
output module, an input module, and a cache
cache--control module.
module.

Cache Table
Queues
Output Module
Input Module
Cache--Control Module
Cache

Figure 7.9 ARP components

Table 7.1 Original cache table used for examples

EXAMPLE 2
The ARP output module receives an IP datagram

(from the IP layer) with the destination address
114.5.7.89. It checks the cache table and finds that an
entry exists for this destination with the RESOLVED
state (R in the table). It extracts the hardware address,
which is 457342ACAE32, and sends the packet and
the address to the data link layer for transmission.
The cache table remains the same.

EXAMPLE 3
Twenty seconds later, the ARP output module receives

an IP datagram (from the IP layer) with the
destination address 116.1.7.22. It checks the cache
table and does not find this destination in the table.
The module adds an entry to the table with the state
PENDING and the Attempt value 1. It creates a new
queue for this destination and enqueues the packet. It
then sends an ARP request to the data link layer for
this destination. The new cache table is shown in
Table 7.2.
See Next Slide
Table 7.2 Updated cache table for Example 3

EXAMPLE 4
Fifteen seconds later, the ARP input module receives

an ARP packet with target protocol (IP) address
188.11.8.71. The module checks the table and finds
this address. It changes the state of the entry to
RESOLVED and sets the time-out value to 900. The
module then adds the target hardware address
(E34573242ACA) to the entry. Now it accesses queue
18 and sends all the packets in this queue, one by one,
to the data link layer. The new cache table is shown in
Table 7.3.
See Next Slide

EXAMPLE 5
Twenty-five seconds later, the cache-control module

updates every entry. The time-out values for the first
three resolved entries are decremented by 60. The
time-out value for the last resolved entry is
decremented by 25. The state of the next-to-the last
entry is changed to FREE because the time-out is
zero. For each of the three pending entries, the value
of the attempts
See Next Slide


7.3 RARP
RARP finds the logical address for a machine that only knows its
physical address.
address.

Packet Format
Encapsulation
RARP Server
Alternative Solutions to RARP

Note:
The RARP request packets are broadcast;

the RARP reply packets are unicast.

Figure 7.10 RARP operation

Figure 7.11 RARP packet

Figure 7.12 Encapsulation of RARP packet

Chapter 8
Internet Protocol
Objectives
• Understand the format and fields of a datagram

• Understand the need for fragmentation and the fields involved
• Understand the options available in an IP datagram
• Be able to perform a checksum calculation
• Understand the components and interactions of an IP package

Figure 8.1 Position of IP in TCP/IP protocol suite

8.1 DATAGRAM
A packet in the IP layer is called a datagram, a variable-
variable-length packet
consisting of two parts:
parts: header and data
data.. The header is 20 to 60 bytes in
length and contains information essential to routing and delivery
delivery..

Figure 8.2 IP datagram

Figure 8.3 Service type or differentiated services

Note:
The precedence subfield was designed,

but never used in version 4.

Table 8.1 Types of service

Table 8.2 Default types of service

Table 8.3 Values for codepoints

Note:
The total length field defines the total

length of the datagram including the
header.

Figure 8.4 Encapsulation of a small datagram in an Ethernet frame

Figure 8.5 Multiplexing

Table 8.4 Protocols

EXAMPLE 1
An IP packet has arrived with the first 8 bits as shown:
01000010
The receiver discards the packet. Why?
Solution
There is an error in this packet. The 4 left-most bits (0100)
show the version, which is correct. The next 4 bits (0010) show
the header length; which means (2 × 4 = 8), which is wrong.
The minimum number of bytes in the header must be 20. The
packet has been corrupted in transmission.
EXAMPLE 2
In an IP packet, the value of HLEN is 1000 in binary. How

many bytes of options are being carried by this packet?
Solution
The HLEN value is 8, which means the total number of bytes
in the header is 8 × 4 or 32 bytes. The first 20 bytes are the base
header, the next 12 bytes are the options.

EXAMPLE 3
In an IP packet, the value of HLEN is 516

and the value of the total length field is 002816 . How
many bytes of data are being carried by this packet?
Solution
The HLEN value is 5, which means the total number of bytes
in the header is 5 × 4 or 20 bytes (no options). The total length
is 40 bytes, which means the packet is carrying 20 bytes of data
(40 − 20).

EXAMPLE 4
An IP packet has arrived with the first few hexadecimal digits

as shown below:
45000028000100000102 . . .
How many hops can this packet travel before being dropped?
The data belong to what upper layer protocol?
Solution
To find the time-to-live field, we skip 8 bytes (16 hexadecimal
digits). The time-to-live field is the ninth byte, which is 01. This
means the packet can travel only one hop. The protocol field is
the next byte (02), which means that the upper layer protocol is
IGMP (see Table 8.4).
8.2 FRAGMENTATION
The format and size of a frame depend on the protocol used by the
physical network
network.. A datagram may have to be fragmented to fit the
protocol regulations.
regulations.

Maximum Transfer Unit (MTU)
Fields Related to Fragmentation

Figure 8.6 MTU

Table 8.5 MTUs for some networks

Figure 8.7 Flags field

Figure 8.8 Fragmentation example

Figure 8.9 Detailed fragmentation example

EXAMPLE 5
A packet has arrived with an M bit value of 0. Is this the first

fragment, the last fragment, or a middle fragment? Do we
know if the packet was fragmented?
Solution
If the M bit is 0, it means that there are no more fragments; the
fragment is the last one. However, we cannot say if the original
packet was fragmented or not. A nonfragmented packet is
considered the last fragment.

EXAMPLE 6
A packet has arrived with an M bit value of 1. Is this the first

fragment, the last fragment, or a middle fragment? Do we
know if the packet was fragmented?
Solution
If the M bit is 1, it means that there is at least one more
fragment. This fragment can be the first one or a middle one,
but not the last one. We don’t know if it is the first one or a
middle one; we need more information (the value of the
fragmentation offset). See also the next example.

EXAMPLE 7
A packet has arrived with an M bit value of 1 and a

fragmentation offset value of zero. Is this the first fragment,
the last fragment, or a middle fragment?.
Solution
Because the M bit is 1, it is either the first fragment or a middle
one. Because the offset value is 0, it is the first fragment.

EXAMPLE 8
A packet has arrived in which the offset value is 100. What is

the number of the first byte? Do we know the number of the
last byte?
Solution
To find the number of the first byte, we multiply the offset value
by 8. This means that the first byte number is 800. We cannot
determine the number of the last byte unless we know the
length of the data.

EXAMPLE 9
A packet has arrived in which the offset value is 100, the value
of HLEN is 5 and the value of the total length field is 100.
What is the number of the first byte and the last byte?
Solution
The first byte number is 100 × 8 = 800. The total length is 100
bytes and the header length is 20 bytes (5 × 4), which means
that there are 80 bytes in this datagram. If the first byte
number is 800, the last byte number must be 879.

8.3 OPTIONS
The header of the IP datagram is made of two parts:
parts: a fixed part and a
variable part
part.. The variable part comprises the options that can be a
maximum of 40 bytes.
bytes.

Format
Option Types

Figure 8.10 Option format

Figure 8.11 Categories of options

Figure 8.12 No operation option

Figure 8.13 End of option option

Figure 8.14 Record route option

Figure 8.15 Record route concept

Figure 8.16 Strict source route option

Figure 8.17 Strict source route concept

Figure 8.18 Loose source route option

Figure 8.19 Timestamp option

Figure 8.20 Use of flag in timestamp

Figure 8.21 Timestamp concept

EXAMPLE 10
Which of the six options must be copied to each fragment?
Solution
We look at the first (left-most) bit of the code for each option.
a. No operation: Code is 00000001; not copied.

b. End of option: Code is 00000000; not copied.
c. Record route: Code is 00000111; not copied.
d. Strict source route: Code is 10001001; copied.
e. Loose source route: Code is 10000011; copied.
f. Timestamp: Code is 01000100; not copied.

EXAMPLE 11
Which of the six options are used for datagram control and
which are used for debugging and management?
Solution
We look at the second and third (left-most) bits of the code.
a. No operation: Code is 00000001; datagram control.

b. End of option: Code is 00000000; datagram control.
c. Record route: Code is 00000111; datagram control.
d. Strict source route: Code is 10001001; datagram control.
e. Loose source route: Code is 10000011; datagram control.
f. Time stamp: Code is 01000100; debugging and management
control.

EXAMPLE 12
One of the utilities available in UNIX to check the travelling of

the IP packets is ping. In the next chapter, we talk about the
ping program in more detail. In this example, we want to show
how to use the program to see if a host is available. We ping a
server at De Anza College named fhda.edu. The result shows
that the IP address of the host is 153.18.8.1.
$ ping fhda.edu
PING fhda.edu (153.18.8.1) 56(84) bytes of data.
64 bytes from tiptoe.fhda.edu (153.18.8.1): ....
The result shows the IP address of the host and the number of
bytes used.

EXAMPLE 13
We can also use the ping utility with the -R option to implement
the record route option.
$ ping -R fhda.edu
PING fhda.edu (153.18.8.1) 56(124) bytes of data.
64 bytes from tiptoe.fhda.edu (153.18.8.1): icmp_seq=0 ttl=62 time=2.70 ms
RR: voyager.deanza.fhda.edu (153.18.17.11)
Dcore_G0_3-69.fhda.edu (153.18.251.3)
Dbackup_V13.fhda.edu (153.18.191.249) tiptoe.fhda.edu (153.18.8.1)
Dbackup_V62.fhda.edu (153.18.251.34)
Dcore_G0_1-6.fhda.edu (153.18.31.254)
voyager.deanza.fhda.edu (153.18.17.11)
The result shows the interfaces and IP addresses.

EXAMPLE 14
The traceroute utility can also be used to keep track of the

route of a packet.
$ traceroute fhda.edu
traceroute to fhda.edu (153.18.8.1), 30 hops max, 38 byte packets
1 Dcore_G0_1-6.fhda.edu (153.18.31.254) 0.972 ms 0.902 ms 0.881 ms
2 Dbackup_V69.fhda.edu (153.18.251.4) 2.113 ms 1.996 ms 2.059 ms
3 tiptoe.fhda.edu (153.18.8.1) 1.791 ms 1.741 ms 1.751 ms
The result shows the three routers visited.

EXAMPLE 15
The traceroute program can be used to implement loose source

routing. The -g option allows us to define the routers to be
visited, from the source to destination. The following shows
how we can send a packet to the fhda.edu server with the
requirement that the packet visit the router 153.18.251.4.
$ traceroute -g 153.18.251.4 fhda.edu.

1 Dcore_G0_1-6.fhda.edu (153.18.31.254) 0.976 ms 0.906 ms 0.889 ms

EXAMPLE 16
The traceroute program can also be used to implement strict

source routing. The -G option forces the packet to visit the
routers defined in the command line. The following shows how
we can send a packet to the fhda.edu server and force the
packet to visit only the router 153.18.251.4, not any other one.
$ traceroute -G 153.18.251.4 fhda.edu.


8.4 CHECKSUM
The error detection method used by most TCP/IP protocols is called the
checksum.. The checksum protects against the corruption that may occur
checksum
during the transmission of a packet
packet.. It is redundant information added to
the packet
packet..

Checksum Calculation at the Sender
Checksum Calculation at the Receiver
Checksum in the IP Packet

Note:
To create the checksum the sender does the following:
❏ The packet is divided into k sections, each of n bits.
❏ All sections are added together using 1’s complement

arithmetic.
❏ The final result is complemented to make the

checksum.

Figure 8.22 Checksum concept

Figure 8.23 Checksum in one’s complement arithmetic

EXAMPLE 17
Figure 8.24 shows an example of a checksum calculation for

an IP header without options. The header is divided into 16-bit
sections. All the sections are added and the sum is
complemented. The result is inserted in the checksum field.
See Next Slide

Figure 8.24 Example of checksum calculation in binary

EXAMPLE 18
Let us do the same example in hexadecimal. Each row has four

hexadecimal digits. We calculate the sum first. Note that if an
addition results in more than one hexadecimal digit, the right-
most digit becomes the current-column digit and the rest are
carried to other columns. From the sum, we make the
checksum by complementing the sum. However, note that we
subtract each digit from 15 in hexadecimal arithmetic (just as
we subtract from 1 in binary arithmetic). This means the
complement of E (14) is 1 and the complement of 4 is B (11).
Figure 8.25 shows the calculation. Note that the result (8BB1)
is exactly the same as in Example 17.
See Next Slide

Figure 8.25 Example of checksum calculation in hexadecimal

Note:
Check Appendix C for a detailed

description of checksum calculation
and the handling of carries.

8.5 IP PACKAGE
We give an example of a simplified IP software package to show its
components and the relationships between the components
components.. This IP
package involves eight modules
modules..
Header-Adding Module
Header-
Processing Module
Queues
Routing Table
Forwarding Module
MTU Table
Fragmentation Module
Reassembly Table
Reassembly Module

Figure 8.26 IP components

Figure 8.27 MTU table

Figure 8.28 Reassembly table

Chapter 9
Internet Control Message

Protocol
Objectives
• Be familiar with the ICMP message format

• Know the types of error reporting messages
• Know the types of query messages
• Be able to calculate the ICMP checksum
• Know how to use the ping and traceroute commands
• Understand the modules and interactions of an ICMP package
Figure 9.1 Position of ICMP in the network layer

Figure 9.2 ICMP encapsulation

9.1 TYPES OF MESSAGES
ICMP messages are divided into errorerror--reporting messages and query
messages.. The error
messages error--reporting messages report problems that a router or
a host (destination) may encounter.
encounter. The query messages get specific
information from a router or another host.
host.

Figure 9.3 ICMP messages

Table 9.1 ICMP messages

9.2 MESSAGE FORMAT
An ICMP message has an 8-byte header and a variable
variable--size data section.
section.
Although the general format of the header is different for each message
type, the first 4 bytes are common to all
all..

Figure 9.4 General format of ICMP messages

9.3 ERROR REPORTING
IP, as an unreliable protocol, is not concerned with error checking and
error control
control.. ICMP was designed, in part, to compensate for this
shortcoming.. ICMP does not correct errors, it simply reports them.
shortcoming them.
Destination Unreachable
Source Quench
Time Exceeded
Parameter Problem
Redirection

Note:
ICMP always reports error messages

to the original source.

Figure 9.5 Error-reporting messages

Note:
The following are important points about ICMP

error messages:
❏ No ICMP error message will be generated in response
to a datagram carrying an ICMP error message.
❏ No ICMP error message will be generated for a
fragmented datagram that is not the first fragment.
datagram having a multicast address.
datagram having a special address such as 127.0.0.0 or
0.0.0.0.

Figure 9.6 Contents of data field for the error messages

Figure 9.7 Destination-unreachable format

Note:
Destination-unreachable messages
with codes 2 or 3 can be created only
by the destination host.
Other destination-unreachable
messages can be created only by
routers.

Note:
A router cannot detect all problems

that prevent the delivery of a packet.

Note:
There is no flow-control mechanism in

the IP protocol.

Figure 9.8 Source-quench format

Note:
A source-quench message informs the

source that a datagram has been
discarded due to congestion in a router
or the destination host.
The source must slow down the
sending of datagrams until the
congestion is relieved.
Note:
One source-quench message is sent for

each datagram that is discarded due to
congestion.

Note:
Whenever a router decrements a

datagram with a time-to-live value to
zero, it discards the datagram and
sends a time-exceeded message to the
original source.

Note:
When the final destination does not

receive all of the fragments in a set
time, it discards the received fragments
and sends a time-exceeded message to
the original source.

Note:
In a time-exceeded message, code 0 is

used only by routers to show that the
value of the time-to-live field is zero.
Code 1 is used only by the destination
host to show that not all of the
fragments have arrived within a set
time.
Figure 9.9 Time-exceeded message format

Note:
A parameter-problem message can be

created by a router or the destination
host.

Figure 9.10 Parameter-problem message format

Figure 9.11 Redirection concept

Note:
A host usually starts with a small

routing table that is gradually
augmented and updated. One of the
tools to accomplish this is the
redirection message.

Figure 9.12 Redirection message format

Note:
A redirection message is sent from a

router to a host on the same local
network.

9.4 QUERY
ICMP can also diagnose some network problems through the query
messages, a group of four different pairs of messages.
messages. In this type of
ICMP message, a node sends a message that is answered in a specific
format by the destination node
node..

Echo Request and Reply
Timestamp Request and Reply
Address--Mask Request and Reply
Address
Router Solicitation and Advertisement

Figure 9.13 Query messages

Note:
An echo-request message can be sent

by a host or router. An echo-reply
message is sent by the host or router
which receives an echo-request
message.

Note:
Echo-request and echo-reply messages

can be used by network managers to
check the operation of the IP protocol.

Note:
Echo-request and echo-reply messages

can test the reachability of a host. This
is usually done by invoking the ping
command.

Figure 9.14 Echo-request and echo-reply messages

Figure 9.15 Timestamp-request and timestamp-reply message format

Note:
Timestamp-request and timestamp-

reply messages can be used to
calculate the round-trip time between
a source and a destination machine
even if their clocks are not
synchronized.

Note:
The timestamp-request and timestamp-

reply messages can be used to
synchronize two clocks in two
machines if the exact one-way time
duration is known.

Figure 9.16 Mask-request and mask-reply message format

Figure 9.17 Router-solicitation message format

Figure 9.18 Router-advertisement message format

9.5 CHECKSUM
In ICMP the checksum is calculated over the entire message (header
and data).
data).

Checksum Calculation
Checksum Testing

EXAMPLE 1
Figure 9.19 shows an example of checksum calculation for a

simple echo-request message (see Figure 9.14). We randomly
chose the identifier to be 1 and the sequence number to be 9.
The message is divided into 16-bit (2-byte) words. The words
are added together and the sum is complemented. Now the
sender can put this value in the checksum field.
See Next Slide

Figure 9.19 Example of checksum calculation

9.6 DEBUGGING TOOLS
We introduce two tools that use ICMP for debugging
debugging:: ping and
traceroute..
traceroute

Ping
Traceroute

EXAMPLE 2
We use the ping program to test the server fhda.edu. The result
is shown below:
$ ping fhda.edu
PING fhda.edu (153.18.8.1) 56 (84) bytes of data.
See Next Slide


--- fhda.edu ping statistics ---

11 packets transmitted, 11 received, 0% packet loss, time 10103ms
rtt min/avg/max = 1.899/1.955/2.041 ms

EXAMPLE 3
For the this example, we want to know if the adelphia.net mail

server is alive and running. The result is shown below:
$ ping mail.adelphia.net
PING mail.adelphia.net (68.168.78.100) 56(84) bytes of data.
64 bytes from mail.adelphia.net (68.168.78.100): icmp_seq=0 ttl=48 time=85.4 ms
See Next Slide


--- mail.adelphia.net ping statistics ---
14 packets transmitted, 13 received, 7% packet loss, time 13129ms
rtt min/avg/max/mdev = 84.207/84.694/85.469

Figure 9.20 The traceroute program operation

EXAMPLE 4
We use the traceroute program to find the route from the

computer voyager.deanza.edu to the server fhda.edu. The
following shows the result:
$ traceroute fhda.edu
1 Dcore.fhda.edu (153.18.31.254) 0.995 ms 0.899 ms 0.878 ms
2 Dbackup.fhda.edu (153.18.251.4) 1.039 ms 1.064 ms 1.083 ms
3 tiptoe.fhda.edu (153.18.8.1) 1.797 ms 1.642 ms 1.757 ms
See Next Slide

The un-numbered line after the command shows that the destination is
153.18.8.1. The TTL value is 30 hops. The packet contains 38 bytes: 20
bytes of IP header, 8 bytes of UDP header, and 10 bytes of application data.
The application data is used by traceroute to keep track of the packets.
The first line shows the first router visited. The router is named
Dcore.fhda.edu with IP address 153.18.31.254. The first round trip time was
0.995 milliseconds, the second was 0.899 milliseconds, and the third was
0.878 milliseconds.
The second line shows the second router visited. The router is named
Dbackup.fhda.edu with IP address 153.18.251.4. The three round trip times
are also shown.
The third line shows the destination host. We know that this is the
destination host because there are no more lines. The destination host is the
server fhda.edu, but it is named tiptoe. fhda.edu with the IP address
153.18.8.1. The three round trip times are also shown.
EXAMPLE 5
In this example, we trace a longer route, the route to

xerox.com
$ traceroute xerox.com
traceroute to xerox.com (13.1.64.93), 30 hops max, 38 byte packets
2 Ddmz.fhda.edu (153.18.251.40) 2.132 ms 2.266 ms 2.094 ms
...
18 alpha.Xerox.COM (13.1.64.93) 11.172 ms 11.048 ms 10.922 ms
Here there are 17 hops between source and destination. Note that some
round trip times look unusual. It could be that a router is too busy to
process the packet immediately.

EXAMPLE 6
An interesting point is that a host can send a traceroute packet

to itself. This can be done by specifying the host as the
destination. The packet goes to the loopback address as we
expect.
$ traceroute voyager.deanza.edu
traceroute to voyager.deanza.edu (127.0.0.1), 30 hops max, 38 byte packets
1 voyager (127.0.0.1) 0.178 ms 0.086 ms 0.055 ms

EXAMPLE 7
Finally, we use the traceroute program to find the route

between fhda.edu and mhhe.com (McGraw-Hill server). We
notice that we cannot find the whole route. When traceroute
does not receive a response within 5 seconds, it prints an
asterisk to signify a problem, and then tries the next hop..
$ traceroute mhhe.com
traceroute to mhhe.com (198.45.24.104), 30 hops max, 38 byte packets
2 Ddmz.fhda.edu (153.18.251.40) 2.141 ms 2.159 ms 2.103 ms
3 Cinic.fhda.edu (153.18.253.126) 2.159 ms 2.050 ms 1.992 ms
...
16 * * *
17 * * *
...............
9.7 ICMP PACKAGE
To give an idea of how ICMP can handle the sending and receiving of
ICMP messages, we present our version of an ICMP package made of
two modules
modules:: an input module and an output module
module..

Input Module
Output Module

Figure 9.21 ICMP package

Chapter 10
Internet Group
Management Protocol
Objectives
• Know the purpose of IGMP

• Know the types of IGMP messages
• Understand how a member joins a group and leaves a group
• Understand membership monitoring
• Understand how an IGMP message is encapsulated
• Understand the interactions of the modules of an IGMP package
Figure 10.1 Position of IGMP in the network layer

10.1 GROUP MANAGEMENT
IGMP is a protocol that manages group membership.
membership. The IGMP
protocol gives the multicast routers information about the membership
status of hosts (routers) connected to the network
network.. .

Note:
IGMP is a group management

protocol. It helps a multicast router
create and update a list of loyal
members related to each router
interface.

10.2 IGMP MESSAGES
IGMP has three types of messages:
messages: the query, the membership report,
and the leave report.
report. There are two types of query messages, general and
special..
special
Message Format

Figure 10.2 IGMP message types

Figure 10.3 IGMP message format

Table 10.1 IGMP type field

10.3 IGMP OPERATION
A multicast router connected to a network has a list of multicast
addresses of the groups with at least one loyal member in that network.
network.
For each group, there is one router that has the duty of distributing the
multicast packets destined for that group
group..
Joining a Group
Leaving a Group
Monitoring Membership

Figure 10.4 IGMP operation

Figure 10.5 Membership report

Note:
In IGMP, a membership report is sent

twice, one after the other.

Figure 10.6 Leave report

Note:
The general query message does not

define a particular group.

Figure 10.7 General query message

EXAMPLE 1
Imagine there are three hosts in a network as shown in Figure

10.8.
A query message was received at time 0; the random delay time

(in tenths of seconds) for each group is shown next to the
group address. Show the sequence of report messages.
See Next Slide


Solution
The events occur in this sequence:
a. Time 12: The timer for 228.42.0.0 in host A expires and a
membership report is sent, which is received by the router and every
host including host B which cancels its timer for 228.42.0.0.
b. Time 30: The timer for 225.14.0.0 in host A expires and a

host including host C which cancels its timer for 225.14.0.0.
c. Time 50: The timer for 238.71.0.0 in host B expires and a

host.
See Next Slide

d. Time 70: The timer for 230.43.0.0 in host C expires and a

host including host A which cancels its timerfor 230.43.0.0.
Note that if each host had sent a report for every group in its
list, there would have been seven reports; with this strategy
only four reports are sent.

10.4 ENCAPSULATION
The IGMP message is encapsulated in an IP datagram, which is itself
encapsulated in a frame
frame..
IP Layer
Data Link Layer
Netstat Utility

Figure 10.9 Encapsulation of IGMP packet

Note:
The IP packet that carries an IGMP

packet has a value of 2 in its
protocol field.

Note:
The IP packet that carries an IGMP

packet has a value of 1 in its
TTL field.

Table 10.2 Destination IP addresses

Figure 10.10 Mapping class D to Ethernet physical address

Note:
An Ethernet multicast physical

address is in the range
01:00:5E:00:00:00
to
01:00:5E:7F:FF:FF.

EXAMPLE 2
Change the multicast IP address 230.43.14.7 to an Ethernet

multicast physical
Solution
We can do this in two steps:
a. We write the rightmost 23 bits of the IP address in hexadecimal.
This can be done by changing the rightmost 3 bytes to hexadecimal
and then subtracting 8 from the leftmost digit if it is greater than or
equal to 8. In our example, the result is 2B:0E:07.
b. We add the result of part a to the starting Ethernet multicast

address, which is (01:00:5E:00:00:00). The result is
01:00:5Ε:2Β:0Ε:07

EXAMPLE 3
Change the multicast IP address 238.212.24.9 to an Ethernet

multicast address.
Solution
a. The right-most three bytes in hexadecimal are D4:18:09. We need
to subtract 8 from the leftmost digit, resulting in 54:18:09..
b. We add the result of part a to the Ethernet multicast starting

address. The result is
01:00:5Ε:54:18:09

Figure 10.11 Tunneling

EXAMPLE 4
We use netstat with three options, -n, -r, and -a. The -n option gives the
numeric versions of IP addresses, the -r option gives the routing table, and
the -a option gives all addresses (unicast and multicast). Note that we show
only the fields relative to our discussion.
$ netstat -nra
Kernel IP routing table
Destination Gateway Mask Flags Iface
153.18.16.0 0.0.0.0 255.255.240.0 U eth0
169.254.0.0 0.0.0.0 255.255.0.0 U eth0
127.0.0.0 0.0.0.0 255.0.0.0 U lo
224.0.0.0 0.0.0.0 224.0.0.0 U eth0
0.0.0.0 153.18.31.254 0.0.0.0 UG eth0
Any packet with a multicast address from 224.0.0.0 to 239.255.255.255 is

masked and delivered to the Ethernet interface.

10.5 IGMP PACKAGE
We can show how IGMP can handle the sending and receiving of IGMP
packets through our simplified version of an IGMP package
package.. In our
design an IGMP package involves a group table, a set of timers, and four
software modules
modules..
Group Table
Timers
Group--Joining Module
Group
Group--Leaving Module
Group
Input Module
Output Module

Figure 10.12 IGMP package

Figure 10.13 Group table

Chapter 11
User Datagram
Protocol
Objectives
• Be able to explain process-to-process communication

• Know the format of a UDP user datagram
• Be able to calculate a UDP checksum
• Understand the operation of UDP
• Know when it is appropriate to use UDP
• Understand the modules in a UDP package
Figure 11.1 Position of UDP in the TCP/IP protocol suite

11.1 PROCESS-TO-PROCESS
COMMUNICATION
Before we examine UDP, we must first understand host- host-to
to--host
communication and process
process--to-
to-process communication and the
difference between them.
them.
Port Numbers
Socket Addresses

Figure 11.2 UDP versus IP

Figure 11.3 Port numbers

Figure 11.4 IP addresses versus port numbers

Figure 11.5 ICANN ranges

Note:
The well-known port numbers are less

than 1024.

Table 11.1 Well
Well--known ports used with UDP

EXAMPLE 1
In UNIX, the well-known ports are stored in a file called

/etc/services. Each line in this file gives the name of the server
and the well-known port number. We can use the grep utility to
extract the line corresponding to the desired application. The
following shows the port for TFTP. Note TFTP can use port 69
on either UDP or TCP.
$ grep tftp /etc/services

tftp 69/tcp
tftp 69/udp
See Next Slide

SNMP uses two port numbers (161 and 162), each for a
different purpose, as we will see in Chapter 21.
$ grep snmp /etc/services

snmp 161/tcp #Simple Net Mgmt Proto
snmp 161/udp #Simple Net Mgmt Proto
snmptrap 162/udp #Traps for SNMP

Figure 11.6 Socket address

11.2 USER DATAGRAM
UDP packets are called user datagrams and have a fixed-
fixed-size header of 8
bytes..
bytes

Figure 11.7 User datagram format

Note:
UDP length =
IP length − IP header’s length

11.3 CHECKSUM
UDP checksum calculation is different from the one for IP and ICMP.
ICMP.
Here the checksum includes three sections:
sections: a pseudoheader, the UDP
header, and the data coming from the application layer
layer..
Checksum Calculation at Sender

Checksum Calculation at Receiver
Optional Use of the Checksum

Figure 11.8 Pseudoheader for checksum calculation

Figure 11.9 Checksum calculation of a simple UDP user datagram

11.4 UDP OPERATION
UDP uses concepts common to the transport layer.
layer. These concepts will be
discussed here briefly, and then expanded in the next chapter on the TCP
protocol..
protocol
Connectionless Services
Flow and Error Control
Encapsulation and Decapsulation
Queuing
Multiplexing and Demultiplexing

Figure 11.10 Encapsulation and decapsulation

Figure 11.11 Queues in UDP

Figure 11.12 Multiplexing and demultiplexing

11.5 USE OF UDP
We discuss some uses of the UDP protocol in this section
section..

11.6 UDP PACKAGE
To show how UDP handles the sending and receiving of UDP packets,
we present a simple version of the UDP package.
package. The UDP package
involves five components:
components: a control
control--block table, input queues, a control-
control-
block module, an input module, and an output module
module..

Control-Block Table
Control-
Input Queues
Control--Block Module
Control
Input Module
Output Module

Figure 11.13 UDP design

Table 11.2 The control-
control-block table at the beginning of examples

EXAMPLE 2
The first activity is the arrival of a user datagram with

destination port number 52,012. The input module searches for
this port number and finds it. Queue number 38 has been
assigned to this port, which means that the port has been
previously used. The input module sends the data to queue 38.
The control-block table does not change.

EXAMPLE 3
After a few seconds, a process starts. It asks the operating

system for a port number and is granted port number 52,014.
Now the process sends its ID (4,978) and the port number to
the control-block module to create an entry in the table. The
module takes the first FREE entry and inserts the information
received. The module does not allocate a queue at this moment
because no user datagrams have arrived for this destination
(see Table 11.3).
See Next Slide

Table 11.3 Control
Control--block table after Example 3

EXAMPLE 4
A user datagram now arrives for port 52,011. The input module
checks the table and finds that no queue has been allocated for
this destination since this is the first time a user datagram has
arrived for this destination. The module creates a queue and
gives it a number (43). See Table 11.4.
See Next Slide

Table 11.4 Control
Control--block after Example 4

EXAMPLE 5
After a few seconds, a user datagram arrives for port 52,222.

The input module checks the table and cannot find an entry for
this destination. The user datagram is dropped and a request is
made to ICMP to send an “unreachable port” message to the
source.

Chapter 12
Transmission
Control Protocol
Objectives
• Be able to name and understand the services offered by TCP
• Understand TCP’s flow and error control and congestion control
• Be familiar with the fields in a TCP segment
• Understand the phases in a connection-oriented connection
• Understand the TCP transition state diagram
• Be able to name and understand the timers used in TCP
• Be familiar with the TCP options
Figure 12.1 TCP/IP protocol suite

12.1 TCP SERVICES
We explain the services offered by TCP to the processes at the application
layer..
layer
Process-to-
Process- to-Process Communication
Stream Delivery Service
Full--Duplex Communication
Full
Connection--Oriented Service
Connection
Reliable Service

Table 12.1 Well
Well--known ports used by TCP

EXAMPLE 1
As we said in Chapter 11, in UNIX, the well-known ports are

stored in a file called /etc/services. Each line in this file gives
the name of the server and the well-known port number. We
can use the grep utility to extract the line corresponding to the
desired application. The following shows the ports for FTP.
$ grep ftp /etc/services

ftp-data 20/tcp
ftp-control 21/tcp

Figure 12.2 Stream delivery

Figure 12.3 Sending and receiving buffers

Figure 12.4 TCP segments

12.2 TCP FEATURES
To provide the services mentioned in the previous section, TCP has
several features that are briefly summarized in this section.
section.
Numbering System
Flow Control
Error Control
Congestion Control

Note:
The bytes of data being transferred in

each connection are numbered by TCP.
The numbering starts with a randomly
generated number.

EXAMPLE 2
Suppose a TCP connection is transferring a file of 5000 bytes.

The first byte is numbered 10001. What are the sequence
numbers for each segment if data is sent in five segments, each
carrying 1000 bytes?
Solution
The following shows the sequence number for each segment:
Segment 1 ➡ Sequence Number: 10,001 (range: 10,001 to 11,000)

Note:
The value in the sequence number

field of a segment defines the number
of the first data byte contained
in that segment.

Note:
The value of the acknowledgment field

in a segment defines the number of the
next byte a party expects to receive.
The acknowledgment number is
cumulative.

12.3 SEGMENT
A packet in TCP is called a segment
Format
Encapsulation

Figure 12.5 TCP segment format

Figure 12.6 Control field

Table 12.2 Description of flags in the control field

Figure 12.7 Pseudoheader added to the TCP datagram

Note:
The inclusion of the checksum in TCP

is mandatory.

Figure 12.8 Encapsulation and decapsulation

12.4 A TCP CONNECTION
TCP is connection
connection--oriented
oriented.. A connection-
connection-oriented transport protocol
establishes a virtual path between the source and destination
destination.. All of the
segments belonging to a message are then sent over this virtual path.
path. A
connection--oriented transmission requires three phases:
connection phases: connection
establishment, data transfer, and connection termination
termination..
Connection Establishment
Data Transfer
Connection Termination
Connection Reset

Figure 12.9 Connection establishment using three-way handshaking

Note:
A SYN segment cannot carry data, but

it consumes one sequence number.

Note:
A SYN + ACK segment cannot carry

data, but does consume one
sequence number.

Note:
An ACK segment, if carrying no data,

consumes no sequence number.

Figure 12.10 Data transfer

Note:
The FIN segment consumes one

sequence number if it does not carry
data.

Figure 12.11 Connection termination using three-way handshaking

Note:
The FIN + ACK segment consumes

one sequence number if it does not
carry data.

Figure 12.12 Half-close

12.5 STATE TRANSITION DIAGRAM
To keep track of all the different events happening during connection
establishment, connection termination, and data transfer, the TCP
software is implemented as a finite state machine.
machine. .
Scenarios

Table 12.3 States for TCP

Figure 12.13 State transition diagram

Figure 12.14 Common scenario

Note:
The common value for MSL is

between 30 seconds and 1 minute.

Figure 12.15 Three-way handshake

Figure 12.16 Simultaneous open

Figure 12.17 Simultaneous close

Figure 12.18 Denying a connection

Figure 12.19 Aborting a connection

12.6 FLOW CONTROL
Flow control regulates the amount of data a source can send before
receiving an acknowledgment from the destination
destination.. TCP defines a
window that is imposed on the buffer of data delivered from the
application program
program..
Sliding Window Protocol

Silly Window Syndrome

Figure 12.20 Sliding window

Note:
A sliding window is used to make

transmission more efficient as well as
to control the flow of data so that the
destination does not become
overwhelmed with data.
TCP’s sliding windows are byte
oriented.
EXAMPLE 3
What is the value of the receiver window (rwnd) for host A if

the receiver, host B, has a buffer size of 5,000 bytes and 1,000
bytes of received and unprocessed data?
Solution
The value of rwnd = 5,000 − 1,000 = 4,000. Host B can receive
only 4,000 bytes of data before overflowing its buffer. Host B
advertises this value in its next segment to A.

EXAMPLE 4
What is the size of the window for host A if the value of rwnd is
3,000 bytes and the value of cwnd is 3,500 bytes?
Solution
The size of the window is the smaller of rwnd and cwnd, which
is 3,000 bytes.

EXAMPLE 5
Figure 12.21 shows an unrealistic example of a sliding

window. The sender has sent bytes up to 202. We assume that
cwnd is 20 (in reality this value is thousands of bytes). The
receiver has sent an acknowledgment number of 200 with an
rwnd of 9 bytes (in reality this value is thousands of bytes). The
size of the sender window is the minimum of rwnd and cwnd or
9 bytes. Bytes 200 to 202 are sent, but not acknowledged. Bytes
203 to 208 can be sent without worrying about
acknowledgment. Bytes 209 and above cannot be sent.


EXAMPLE 6
In Figure 12.21 the server receives a packet with an

acknowledgment value of 202 and an rwnd of 9. The host has
already sent bytes 203, 204, and 205. The value of cwnd is still
20. Show the new window.
Solution
Figure 12.22 shows the new window. Note that this is a case in
which the window closes from the left and opens from the right
by an equal number of bytes; the size of the window has not
been changed. The acknowledgment value, 202, declares that
bytes 200 and 201 have been received and the sender needs not
worry about them; the window can slide over them.


EXAMPLE 7
In Figure 12.22 the sender receives a packet with an

not sent any new bytes. The value of cwnd is still 20. Show the
new window.
Solution
The value of rwnd is less than cwnd, so the size of the window
is 12. Figure 12.23 shows the new window. Note that the
window has been opened from the right by 7 and closed from
the left by 4; the size of the window has increased.


EXAMPLE 8
In Figure 12.23 the host receives a packet with an

sent bytes 206, 207, 208, and 209. The value of cwnd is still 20.
Show the new window.
Solution
The value of rwnd is less than cwnd, so the size of the window
is 5. Figure 12.24 shows the situation. Note that this is a case
not allowed by most implementations. Although the sender has
not sent bytes 215 to 217, the receiver does not know this.


EXAMPLE 9
How can the receiver avoid shrinking the window in the

previous example?
Solution
The receiver needs to keep track of the last acknowledgment
number and the last rwnd. If we add the acknowledgment
number to rwnd we get the byte number following the right
wall. If we want to prevent the right wall from moving to the
left (shrinking), we must always have the following
relationship.
new ack + new rwnd ≥ last ack + last rwnd
or
new rwnd ≥ (last ack + last rwnd) − new ack
Note:
To avoid shrinking the sender window,

the receiver must wait until more
space is available in its buffer.

Note:
Some points about TCP’s sliding windows:

❏ The size of the window is the lesser of rwnd and cwnd.
❏ The source does not have to send a full window’s
worth of data.
❏ The window can be opened or closed by the receiver,
but should not be shrunk.
❏ The destination can send an acknowledgment at any
time as long as it does not result in a shrinking window.
❏ The receiver can temporarily shut down the window;
the sender, however, can always send a segment of one
byte after the window is shut down.

12.7 ERROR CONTROL
TCP provides reliability using error control, which detects corrupted,
lost, out
out--of
of--order, and duplicated segments
segments.. Error control in TCP is
achieved through the use of the checksum, acknowledgment, and time-
time-
out..
out

Checksum
Acknowledgment
Acknowledgment Type
Retransmission
Out--of
Out of--Order Segments
Some Scenarios

Note:
ACK segments do not consume

sequence numbers and are not
acknowledged.

Note:
In modern implementations, a
retransmission occurs if the
retransmission timer expires or three
duplicate ACK segments have arrived.

Note:
No retransmission timer is set for an

ACK segment.

Note:
Data may arrive out of order and be

temporarily stored by the receiving TCP,
but TCP guarantees that no out-of-order
segment is delivered to the process.

Figure 12.25 Normal operation

Figure 12.26 Lost segment

Note:
The receiver TCP delivers only

ordered data to the process.

Figure 12.27 Fast retransmission

Figure 12.28 Lost acknowledgment

Figure 12.29 Lost acknowledgment corrected by resending a segment

Note:
Lost acknowledgments may create

deadlock if they are not properly
handled.

12.8 CONGESTION CONTROL
Congestion control refers to the mechanisms and techniques to keep the
load below the capacity
capacity..
Network Performance
Congestion Control Mechanisms
Congestion Control in TCP

Figure 12.30 Router queues

Figure 12.31 Packet delay and network load

Figure 12.32 Throughput versus network load

Figure 12.33 Slow start, exponential increase

Note:
In the slow start algorithm, the size of

the congestion window increases
exponentially until it reaches a
threshold.

Figure 12.34 Congestion avoidance, additive increase

Note:
In the congestion avoidance algorithm

the size of the congestion window
increases additively until
congestion is detected.

Note:
Most implementations react differently to

congestion detection:
❏ If detection is by time-out, a new slow start phase
starts.
❏ If detection is by three ACKs, a new congestion
avoidance phase starts.

Figure 12.35 TCP congestion policy summary

Figure 12.36 Congestion example

12.9 TCP TIMERS
To perform its operation smoothly, most TCP implementations use at
least four timers.
timers.
Retransmission Timer
Persistence Timer
Keepalive Timer
TIME--WAIT Timer
TIME

Figure 12.37 TCP timers

Note:
In TCP, there can be only be one RTT

measurement in progress at any time.

EXAMPLE 10
Let us give a hypothetical example. Figure 12.38 shows part of

a connection. The figure shows the connection establishment
and part of the data transfer phases.
1. When the SYN segment is sent, there is no value for RTTM , RTTS , or
RTTD . The value of RTO is set to 6.00 seconds. The following shows the
value of these variables at this moment:
RTTM = 1.5 RTTS = 1.5

RTTD = 1.5 / 2 = 0.75 RTO = 1.5 + 4 . 0.75 = 4.5
2. When the SYN+ACK segment arrives, RTTM is measured and is equal to

1.5 seconds. The next slide shows the values of these variables:

RTTM = 1.5 RTTS = 1.5

RTTD = 1.5 / 2 = 0.75 RTO = 1.5 + 4 . 0.75 = 4.5
3.When the first data segment is sent, a new RTT measurement

starts. Note that the sender does not start an RTT measurement
when it sends the ACK segment, because it does not consume a
sequence number and there is no time-out. No RTT
measurement starts for the second data segment because a
measurement is already in progress.
RTTM = 2.5
RTTS = 7/8 (1.5) + 1/8 (2.5) = 1.625
RTTD = 3/4 (7.5) + 1/4 |1.625 − 2.5| = 0.78
RTO = 1.625 + 4 (0.78) = 4.74


Note:
TCP does not consider the RTT of a

retransmitted segment in its
calculation of a new RTO.

EXAMPLE 11
Figure 12.39 is a continuation of the previous example. There

is retransmission and Karn’s algorithm is applied. The first
segment in the figure is sent, but lost. The RTO timer expires
after 4.74 seconds. The segment is retransmitted and the timer
is set to 9.48, twice the previous value of RTO. This time an
ACK is received before the time-out. We wait until we send a
new segment and receive the ACK for it before recalculating
the RTO (Karn’s algorithm).


12.10 OPTIONS
The TCP header can have up to 40 bytes of optional information.
information.
Options convey additional information to the destination or align other
options..
options

Figure 12.40 Options

Figure 12.41 End-of-option option

Note:
EOP can be used only once.

Figure 12.42 No-operation option

Note:
NOP can be used more than once.

Figure 12.43 Maximum-segment-size option

Note:
The value of MSS is determined

during connection establishment and
does not change during the
connection.

Figure 12.44 Window-scale-factor option

Note:
The value of the window scale factor

can be determined only during
connection establishment; it does not
change during the connection.

Figure 12.45 Timestamp option

Note:
One application of the timestamp

option is the calculation of round trip
time (RTT).

EXAMPLE 12
Figure 12.46 shows an example that calculates the round-trip

time for one end. Everything must be flipped if we want to
calculate the RTT for the other end.
The sender simply inserts the value of the clock (for example,
the number of seconds past from midnight) in the timestamp
field for the first and second segment. When an
acknowledgment comes (the third segment), the value of the
clock is checked and the value of the echo reply field is
subtracted from the current time. RTT is 12 s in this scenario.

The receiver’s function is more involved. It keeps track of the

last acknowledgment sent (12000). When the first segment
arrives, it contains the bytes 12000 to 12099. The first byte is
the same as the value of lastack. It then copies the timestamp
value (4720) into the tsrecent variable. The value of lastack is
still 12000 (no new acknowledgment has been sent). When the
second segment arrives, since none of the byte numbers in this
segment include the value of lastack, the value of the
timestamp field is ignored. When the receiver decides to send
an accumulative acknowledgment with acknowledgment
12200, it changes the value of lastack to 12200 and inserts the
value of tsrecent in the echo reply field. The value of tsrecent
will not change until it isreplaced by a new segment that
carries byte 12200 (next segment).
Note that as the example shows, the RTT calculated is the time
difference between sending the first segment and receiving the
third segment. This is actually the meaning of RTT: the time
difference between a packet sent and the acknowledgment
received. The third segment carries the acknowledgment for
the first and second segments.


Note:
The timestamp option can also be used

for PAWS.

Figure 12.47 SACK

EXAMPLE 13
Let us see how the SACK option is used to list out-of-order blocks. In
Figure 12.48 an end has received five segments of data.
The first and second segments are in consecutive order. An accumulative

acknowledgment can be sent to report the reception of these two segments.
Segments 3, 4, and 5, however, are out of order with a gap between the
second and third and a gap between the fourth and the fifth. An ACK and a
SACK together can easily clear the situation for the sender. The value of
ACK is2001, which means that the sender need not worry about bytes 1 to
2000. The SACK has two blocks. The first block announces that bytes 4001
to 6000 have arrived out of order. The second block shows that bytes 8001 to
9000 have also arrived out of order. This means that bytes 2001 to 4000 and
bytes 6001 to 8000 are lost or discarded. The sender can resend only these
bytes.


EXAMPLE 14
The example in Figure 12.49 shows how a duplicate segment

can be detected with a combination of ACK and SACK. In this
case, we have some out-of-order segments (in one block) and
one duplicate segment. To show both out-of-order and
duplicate data, SACK uses the first block, in this case, to show
the duplicate data and other blocks to show out-of-order data.
Note that only the first block can be used for duplicate data.
The natural question is how the sender, when it receives these
ACK and SACK values knows that the first block is for
duplicate data (compare this example with the previous
example). The answer is that the bytes in the first block are
already acknowledged in the ACK field; therefore, this block
must be a duplicate.

EXAMPLE 15
The example in Figure 12.50 shows what happens if one of the

segments in the out-of-order section is also duplicated. In this
example, one of the segments (4001:5000) is duplicated. The
SACK option announces this duplicate data first and then the
out-of-order block. This time, however, the duplicated block is
not yet acknowledged by ACK, but because it is part of the out-
of-order block (4001:5000 is part of 4001:6000), it is
understood by the sender that it defines the duplicate data.


12.11 TCP PACKAGE
We present a simplified, bare
bare--bones TCP package to simulate the heart of
TCP.. The package involves tables called transmission control blocks, a
TCP
set of timers, and three software modules.
modules.
Transmission Control Blocks (TCBs)

Timers
Main Module
Input Processing Module
Output Processing Module

Figure 12.51 TCP package

Figure 12.52 TCBs

Chapter 13
Stream Control
Transmission Protocol
Objectives
• Be able to name and understand the services offered by SCTP

• Understand SCTP’s flow and error control and congestion control
• Be familiar with the fields in a SCTP segment
• Understand the phases in an SCTP association
• Understand the SCTP state transition diagram

Figure 13.1 TCP/IP protocol suite

Note:
SCTP is a message-oriented, reliable

protocol that combines the
good features of UDP and TCP.

13.1 SCTP SERVICES
We explain the services offered by SCTP to the application layer
processes..
processes
Process-to-
Process- to-Process Communication
Multiple Streams
Multihoming
Full--Duplex Communication
Full
Connection--Oriented Service
Connection
Reliable Service

Table 13.1 Some SCTP applications

Figure 13.2 Multiple-stream concept

Note:
An association in SCTP can involve

multiple streams.

Figure 13.3 Multihoming concept

Note:
SCTP association allows multiple IP

addresses for each end.

13.2 SCTP FEATURES
We discuss the general features of SCTP and then compare them with
those of TCP
TCP..
Transmission Sequence Number (TSN)

Stream Identifier (SI)
Stream Sequence Number (SSN)
Packets
Acknowledgment Number
Flow Control
Error Control
Congestion Control

Note:
In SCTP, a data chunk is numbered

using a TSN.

Note:
To distinguish between different

streams, SCTP uses a SI.

Note:
To distinguish between different data

chunks belonging to the same stream,
SCTP uses SSNs.

Figure 13.4 Comparison between a TCP segment and an SCTP packet

Note:
TCP has segments;

SCTP has packets.

Note:
In SCTP, control information and data

information are carried in separate
chunks.

Figure 13.5 Packet, data chunks, and streams

Note:
Data chunks are identified by three

identifiers: TSN, SI, and SSN.
TSN is a cumulative number
identifying the association; SI defines
the stream; SSN defines the chunk in
a stream.

Note:
In SCTP, acknowledgment numbers

are used to acknowledge only data
chunks; control chunks are
acknowledged by other control chunks
if necessary.

13.3 PACKET FORMAT
We show the format of a packet and different types of chunks.
chunks. An SCTP
packet has a mandatory general header and a set of blocks called
chunks.. There are two types of chunks:
chunks chunks: control chunks and data chunks.
chunks.
General Header
Chunks

Figure 13.6 SCTP packet format

Note:
In an SCTP packet, control chunks

come before data chunks.

Figure 13.7 General header

Figure 13.8 Common layout of a chunk

Note:
Chunks need to terminate on a 32-bit

(4 byte) boundary.

Table 13.2 Chunks

Note:
The number of padding bytes are not

included in the value of
the length field.

Figure 13.9 DATA chunk

Note:
A DATA chunk cannot carry data belonging

to more than one message, but a message
can be split into several chunks.
The data field of the DATA chunk must

carry at least one byte of data, which means
the value of length field cannot be
less than 17.

Figure 13.10 INIT chunk

Note:
No other chunk can be carried in a

packet that carries an INIT chunk.

Figure 13.11 INIT ACK chunk

Note:
No other chunk can be carried in a

packet that carries an
INIT ACK chunk.

Figure 13.12 COOKIE ECHO chunk

Figure 13.13 COOKIE ACK

Figure 13.14 SACK chunk

Figure 13.15 HEARTBEAT and HEARTBEAT ACK chunks

Figure 13.16 SHUTDOWN, SHUTDOWN ACK, and SHUTDOWN
COMPLETE chunks

Figure 13.17 ERROR chunk

Table 13.3 Errors

Figure 13.18 ABORT chunk

13.4 AN SCTP ASSOCIATION
SCTP, like TCP, is a connection
connection--oriented protocol.
protocol. However, a
connection in SCTP is called an association to emphasize multihoming

Association Establishment
Data Transfer
Association Termination
Association Abortion

Note:
A connection in SCTP is called an

association.

Figure 13.19 Four-way handshaking

Note:
No other chunk is allowed in a packet

carrying an INIT or INIT ACK chunk.
A COOKIE ECHO or a COOKIE ACK
chunk can carry DATA chunks.

Note:
In SCTP, only DATA chunks consume

TSNs;
DATA chunks are the only chunks that
are acknowledged.

Figure 13.20 Simple data transfer

Note:
The acknowledgment in SCTP defines

the cumulative TSN, the TSN of the
last DATA chunk received in order.

Figure 13.21 Association termination

Figure 13.22 Association abortion

13.5 STATE TRANSITION DIAGRAM
To keep track of all the different events happening during association
establishment, association termination, and data transfer, the SCTP
software, like TCP, is implemented as a finite state machine.
machine.
Scenarios
Simultaneous Close

Figure 13.23 State transition diagram

Table 13.4 States for SCTP

Figure 13.24 A common scenario of states

Figure 13.25 Simultaneous open

Figure 13.26 Simultaneous close

13.6 FLOW CONTROL
Flow control in SCTP is similar to that in TCPTCP.. In SCTP, we need to
handle two units of data, the byte and the chunk
chunk..
Receiver Site
Sender Site
A Scenario

Figure 13.27 Flow control, receiver site

Figure 13.28 Flow control, sender site

Figure 13.29 Flow control scenario

13.7 ERROR CONTROL
SCTP uses a SACK chunk to report the state of the receiver buffer to the
sender.. Each implementation uses a different set of entities and timers
sender
for the receiver and sender sites.
sites.
Receiver Site
Sender Site
Sending Data Chunks
Generating SACK Chunks

Figure 13.30 Error control, receiver site

Figure 13.31 Error control, sender site

Figure 13.32 New state at the sender site after receiving a SACK chunk

13.8 CONGESTION CONTROL
SCTP uses the same strategies for congestion control as TCP.
TCP. SCTP uses
slow start, congestion avoidance, and congestion detection phases.
phases. SCTP
also uses fast retransmission and fast recovery.
recovery.
Congestion Control and Multihoming

Explicit Congestion Notification

Chapter 14
Unicast Routing Protocols:

RIP, OSPF, and BGP
Objectives
• Distinguish between intra and interdomain routing

• Understand distance vector routing and RIP
• Understand link state routing and OSPF
• Understand path vector routing and BGP

14.1 INTRA- AND INTERDOMAIN
ROUTING
Routing inside an autonomous system is referred to as intradomain
routing.. Routing between autonomous systems is referred to as
routing
interdomain routing
routing..

Figure 14.1 Autonomous systems

Figure 14.2 Popular routing protocols

14.2 DISTANCE VECTOR ROUTING
In distance vector routing, the least cost route between any two nodes is
the route with minimum distance
distance.. In this protocol each node maintains a
vector (table) of minimum distances to every node
Initialization
Sharing
Updating
When to Share
Two--Node Loop Instability
Two
Three--Node Instability
Three

Figure 14.3 Distance vector routing tables

Figure 14.4 Initialization of tables in distance vector routing

Note:
In distance vector routing, each node

shares its routing table with its
immediate neighbors periodically and
when there is a change.

Figure 14.5 Updating in distance vector routing

Figure 14.6 Two-node instability

Figure 14.7 Three-node instability

14.3 RIP
The Routing Information Protocol (RIP) is an intradomain routing
protocol used inside an autonomous system
system.. It is a very simple protocol
based on distance vector routing.
routing.
RIP Message Format

Requests and Responses
Timers in RIP
RIP Version 2
Encapsulation

Figure 14.8 Example of a domain using RIP

Figure 14.9 RIP message format

Figure 14.10 Request messages

EXAMPLE 1
Figure 14.11 shows the update message sent from router R1 to

router R2 in Figure 14.8. The message is sent out of interface
130.10.0.2.
The message is prepared with the combination of split horizon
and poison reverse strategy in mind. Router R1 has obtained
information about networks 195.2.4.0, 195.2.5.0, and 195.2.6.0
from router R2. When R1 sends an update message to R2, it
replaces the actual value of the hop counts for these three
networks with 16 (infinity) to prevent any confusion for R2.
The figure also shows the table extracted from the message.
Router R2 uses the source address of the IP datagram carrying
the RIP message from R1 (130.10.02) as the next hop address.
See Next Slide

Figure 14.11 Solution to Example 1

Figure 14.12 RIP timers

EXAMPLE 2
A routing table has 20 entries. It does not receive information

about five routes for 200 s. How many timers are running at
this time?
Solution
The 21 timers are listed below:
Periodic timer: 1
Expiration timer: 20 − 5 = 15
Garbage collection timer: 5

Figure 14.13 RIP version 2 format

Figure 14.14 Authentication

Note:
RIP uses the services of UDP on

well-known port 520.

14.4 LINK STATE ROUTING
In link state routing, if each node in the domain has the entire topology
of the domain, the node can use Dijkstra’s algorithm to build a routing
table..
table
Building Routing Tables

Figure 14.15 Concept of link state routing

Figure 14.16 Link state knowledge

Figure 14.17 Dijkstra algorithm

Figure 14.18 Example of formation of shortest path tree

Table 14.1 Routing table for node A

14.5 OSPF
The Open Shortest Path First (OSPF) protocol is an intradomain routing
protocol based on link state routing.
routing. Its domain is also an autonomous
system..
system

Areas
Metric
Types of Links
Graphical Representation
OSPF Packets
Link State Update Packet
Other Packets
Encapsulation

Figure 14.19 Areas in an autonomous system

Figure 14.20 Types of links

Figure 14.21 Point-to-point link

Figure 14.22 Transient link

Figure 14.23 Stub link

Figure 14.24 Example of an AS and its graphical representation in OSPF

Figure 14.25 Types of OSPF packets

Figure 14.26 OSPF common header

Figure 14.27 Link state update packet

Figure 14.28 LSA general header

Figure 14.29 Router link

Figure 14.30 Router link LSA

Table 14.2 Link types, link identification, and link data

EXAMPLE 3
Give the router link LSA sent by router 10.24.7.9 in

Figure 14.31.
See Next Slide
Solution
This router has three links: two of type 1 (point-to-
point) and one of type 3 (stub network). Figure 14.32
shows the router link LSA.
See Figure 14.32



Figure 14.33 Network link

Figure 14.34 Network link advertisement format

EXAMPLE 4
Give the network link LSA in Figure 14.35.
See Next Slide
Solution.
See Figure 14.36



EXAMPLE 5
In Figure 14.37, which router(s) sends out router link LSAs?
See Next Slide
Solution
All routers advertise router link LSAs.
a. R1 has two links, N1 and N2.
b. R2 has one link, N1.
c. R3 has two links, N2 and N3.

Figure 14.37 Example 5 and Example 6

EXAMPLE 6
In Figure 14.37, which router(s) sends out the network link

LSAs?
Solution
All three network must advertise network links:
a. Advertisement for N1 is done by R1 because it is the only
attached router and therefore the designated router.
b. Advertisement for N2 can be done by either R1, R2, or R3,
depending on which one is chosen as the designated router.
c. Advertisement for N3 is done by R3 because it is the only
attached router and therefore the designated router.

Figure 14.38 Summary link to network

Figure 14.39 Summary link to network LSA

Figure 14.40 Summary link to AS boundary router

Figure 14.41 Summary link to AS boundary router LSA

Figure 14.42 External link

Figure 14.43 External link LSA

Figure 14.44 Hello packet

Figure 14.45 Database description packet

Figure 14.46 Link state request packet

Figure 14.47 Link state acknowledgment packet

Note:
OSPF packets are encapsulated in IP

datagrams.

14.6 PATH VECTOR ROUTING
Path vector routing is similar to distance vector routing.
routing. There is at least
one node, called the speaker node, in each AS that creates a routing table
and advertises it to speaker nodes in the neighboring ASs..
ASs..
Initialization
Sharing
Updating

Figure 14.48 Initial routing tables in path vector routing

Figure 14.49 Stabilized tables for four autonomous systems

14.7 BGP
Border Gateway Protocol (BGP) is an interdomain routing protocol
using path vector routing.
routing. It first appeared in 1989 and has gone through
four versions.
versions.

Types of Autonomous Systems
Path Attributes
BGP Sessions
External and Internal BGP
Types of Packets
Packet Format
Encapsulation

Figure 14.50 Internal and external BGP sessions

Figure 14.51 Types of BGP messages

Figure 14.52 BGP packet header

Figure 14.53 Open message

Figure 14.54 Update message

Note:
BGP supports classless addressing and

CIDR.

Figure 14.55 Keepalive message

Figure 14.56 Notification message

Table 14.3 Error codes

Note:
BGP uses the services of TCP

on port 179.

Chapter 15
Multicasting and
Multicast Routing Protocols
Objectives
• Differentiate between a unicast, multicast, and broadcast message
• Know the many applications of multicasting
• Understand multicast link state routing and MOSPF
• Understand multicast link state routing and DVMRP
• Understand the Core-Based Tree Protocol
• Understand the Protocol Independent Multicast Protocols
• Understand the MBONE concept
15.1 UNICAST, MULTICAST,
AND BROADCAST
A message can be unicast, multicast, or broadcast.
broadcast. Let us clarify these
terms as they relate to the Internet
Internet..
Unicasting
Multicasting
Broadcasting
Multicasting versus Multiple Unicasting

Figure 15.1 Unicasting

Note:
In unicasting, the router forwards the

received packet through only
one of its interfaces.

Figure 15.2 Multicasting

Note:
In multicasting, the router may

forward the received packet
through several of its interfaces.

Figure 15.3 Multicasting versus multiple unicasting

Note:
Emulation of multicasting through

multiple unicasting is not efficient and
may create long delays, particularly
with a large group.

15.2 MULTICAST APPLICATIONS
Multicasting has many applications today such as access to distributed
databases, information dissemination, teleconferencing, and distance
learning..
learning

Access to Distributed Databases
Information Dissemination
Dissemination of News
Teleconferencing
Distance Learning

15.3 MULTICAST ROUTING
In this section, we first discuss the idea of optimal routing, common in
all multicast protocols
protocols.. We then give an overview of multicast routing
protocols..
protocols
Optimal Routing: Shortest Path Trees

Routing Protocols

Note:
In unicast routing, each router in the

domain has a table that defines a
shortest path tree to possible
destinations.

Figure 15.4 Shortest path tree in unicast routing

Note:
In multicast routing, each involved

router needs to construct a shortest
path tree for each group.

Note:
In the source-based tree approach,

each router needs to have one shortest
path tree for each group.

Figure 15.5 Source-based tree approach

Figure 15.6 Group-shared tree approach

Note:
In the group-shared tree approach,

only the core router, which has a
shortest path tree for each group, is
involved in multicasting.

Figure 15.7 Taxonomy of common multicast protocols

15.4 MULTICAST LINK STATE
ROUTING: MOSPF
In this section, we briefly discuss multicast link state routing and its
implementation in the Internet, MOSPF.
MOSPF.
Multicast Link State Routing

MOSPF

Note:
Multicast link state routing uses the

source-based tree approach.

15.5 MULTICAST DISTANCE
VECTOR: DVMRP
In this section, we briefly discuss multicast distance vector routing and
its implementation in the Internet, DVMRP.
DVMRP.
Multicast Distance Vector Routing

DVMRP

Note:
Flooding broadcasts packets, but

creates loops in the systems.

Note:
RPF eliminates the loop in the

flooding process.

Figure 15.8 RPF

Figure 15.9 Problem with RPF

Figure 15.10 RPF versus RPB

Note:
RPB creates a shortest path broadcast

tree from the source to each destination.
It guarantees that each destination
receives one and only one
copy of the packet.

Figure 15.11 RPF, RPB, and RPM

Note:
RPM adds pruning and grafting to

RPB to create a multicast shortest path
tree that supports dynamic
membership changes.

15.6 CBT
The Core-
Core-Based Tree (CBT) protocol is a group-group-shared protocol that
uses a core as the root of the tree
tree.. The autonomous system is divided into
regions and a core (center router or rendezvous router) is chosen for
each region
region..
Formation of the Tree

Sending Multicast Packets
Selecting the Rendezvous Router

Figure 15.12 Group-shared tree with rendezvous router

Figure 15.13 Sending a multicast packet to the rendezvous router

Note:
In CBT, the source sends the multicast

packet (encapsulated in a unicast packet)
to the core router.
The core router decapsulates the packet

and forwards it to all interested
interfaces.

15.7 PIM
Protocol Independent Multicast (PIM) is the name given to two
independent multicast routing protocols:
protocols: Protocol Independent
Multicast, Dense Mode (PIM-
(PIM-DM) and Protocol Independent Multicast,
Sparse Mode (PIM-
(PIM-SM)
SM)..
PIM-DM
PIM-
PIM--SM
PIM

Note:
PIM-DM is used in a dense multicast

environment, such as a LAN.

Note:
PIM-DM uses RPF and

pruning/grafting strategies to handle
multicasting.
However, it is independent from the

underlying unicast protocol.

Note:
PIM-SM is used in a sparse multicast

environment such as a WAN.

Note:
PIM-SM is similar to CBT but uses a

simpler procedure.

15.8 MBONE
A multicast router may not find another multicast router in the
neighborhood to forward the multicast packet. packet. A solution for this
problem is tunneling.
tunneling. We make a multicast backbone (MBONE) out of
these isolated routers using the concept of tunneling.
tunneling.

Figure 15.14 Logical tunneling

Figure 15.15 MBONE

Chapter 16
Host Configuration:
BOOTP and DHCP
Objectives
• Know the types of information required by a system on boot-up

• Know how BOOTP operates
• Know how DHCP operates
• Understand the differences between BOOTP and DHCP
• Understand the DHCP transition state diagram

16.1 BOOTP
The Bootstrap Protocol (BOOTP) is a client/server protocol that
configures a diskless computer or a computer that is booted for the first
time.. BOOTP provides the IP address, net mask, the address of a default
time
router, and the address of a name server
server..
Operation
Packet Format

Figure 16.1 Client and server on the same network

Figure 16.2 Client and server on two different networks

Figure 16.3 Use of UDP ports

Figure 16.4 BOOTP packet format

Figure 16.5 Option format

Table 16.1 Options for BOOTP

16.2 DHCP
The Dynamic Host Configuration Protocol (DHCP) provides static and
dynamic address allocation that can be manual or automatic
automatic..
Static Address Allocation

Dynamic Address Allocation
Manual and Automatic Configuration
Packet Format
Transition States
Exchanging Messages

Note:
DHCP provides static and dynamic

address allocation that can be manual
or automatic.

Figure 16.6 DHCP packet

Table 16.2 Options for DHCP

Figure 16.7 DHCP transition diagram

Figure 16.8 Exchanging messages

Chapter 17
Domain Name
System: DNS
Objectives
• Understand how the DNS is organized

• Know the domains in the DNS
• Know how a name or address is resolved
• Be familiar with the query and response formats
• Understand the need for DDNS

17.1 NAME SPACE
The names assigned to machines must be unique because the addresses
are unique
unique.. A name space that maps each address to a unique name can
be organized in two ways
ways:: flat or hierarchical
hierarchical..
Flat Name Space

Hierarchical Name Space

17.2 DOMAIN NAME SPACE
The domain name space is hierarchical in design.
design. The names are defined
in an inverted-
inverted-tree structure with the root at the top.
top. The tree can have
128 levels:
levels: level 0 (root) to level 127.
127.
Label
Domain Name
Domain

Figure 17.1 Domain name space

Figure 17.2 Domain names and labels

Figure 17.3 FQDN and PQDN

Figure 17.4 Domains

17.3 DISTRIBUTION OF
NAME SPACE
The information contained in the domain name space is distributed
among many computers called DNS servers.
servers.
Hierarchy of Name Servers

Zone
Root Server
Primary and Secondary Servers

Figure 17.5 Hierarchy of name servers

Figure 17.6 Zones and domains

Note:
A primary server loads all information

from the disk file; the secondary server
loads all information from the primary
server. When the secondary downloads
information from the primary, it is called
zone transfer.

17.4 DNS IN THE INTERNET
The domain name space (tree) is divided into three different sections:
sections:
generic domains, country domains, and the inverse domain.
domain.
Generic Domains
Country Domains
Inverse Domain
Registrar

Figure 17.7 DNS used in the Internet

Figure 17.8 Generic domains

Table 17.1 Generic domain labels

Table 17.1 Generic domain labels (Continued)

Figure 17.9 Country domains

Figure 17.10 Inverse domain

17.5 RESOLUTION
Mapping a name to an address or an address to a name is called name-
name-
address resolution.
resolution.
Resolver
Mapping Names to Addresses
Mapping Addresses to Names
Recursive Resolution
Iterative Resolution
Caching

Figure 17.11 Recursive resolution

Figure 17.12 Iterative resolution

17.6 DNS MESSAGES
The DNS query message consists of a header and question records;
records; the
DNS response message consists of a header, question records, answer
records, authoritative records, and additional records
records..
Header

Figure 17.13 DNS messages

Figure 17.14 Query and response messages

Figure 17.15 Header format

Figure 17.16 Flags field

Table 17.2 Values of rCode

17.7 TYPES OF RECORDS
Two types of records are used in DNS.
DNS. The question records are used in
the question section of the query and response messages.
messages. The resource
records are used in the answer, authoritative, and additional information
sections of the response message.
message.
Question Record
Resource Record

Figure 17.17 Question record format

Figure 17.18 Query name format

Table 17.3 Types

Table 17.4 Classes

Figure 17.19 Resource record format

17.8 COMPRESSION
DNS requires that a domain name be replaced by an offset pointer if it is
repeated.. DNS defines a 2-byte offset pointer that points to a previous
repeated
occurrence of the domain name or part of it.
it.

Figure 17.20 Format of an offset pointer

EXAMPLE 1
A resolver sends a query message to a local server to find the

IP address for the host “chal.fhda.edu.”. We discuss the query
and response messages separately.
Figure 17.21 shows the query message sent by the resolver. The first 2 bytes
show the identifier (1333). It is used as a sequence number and relates a
response to a query. Because a resolver may even send many queries to the
same server, the identifier helps to sort responses that arrive out of order.
The next bytes contain the flags with the value of 0x0100 in hexadecimal.
In binary it is 0000000100000000, but it is more meaningful to divide it into
the fields as shown below:
QR OpCode AA TC RD RA Reserved rCode

0 0000 0 0 1 0 000 0000
Figure 17.21 Example 1: Query message

The QR bit defines the message as a query. The OpCode is 0000, which
defines a standard query. The recursion desired (RD) bit is set. (Refer back
to Figure 17.16 for the flags field descriptions.) The message contains only
one question record. The domain name is 4chal4fhda3edu0. The next 2
bytes define the query type as an IP address; the last 2 bytes define the class
as the Internet.
Figure 17.22 shows the response of the server. The response is similar to the
query except that the flags are different and the number of answer records
is one. The flags value is 0x8180 in hexadecimal. In binary it is
1000000110000000, but again we divide it into fields as shown below:

1 0000 0 0 1 1 000 0000

The QR bit defines the message as a response. The OpCode is 0000, which
defines a standard response. The recursion available (RA) and RD bits are
set. The message contains one question record and one answer record. The
question record is repeated from the query message. The answer record has
a value of 0xC00C (split in two lines), which points to the question record
instead of repeating the domain name. The next field defines the domain
type (address). The field after that defines the class (Internet). The field with
the value 12,000 is the TTL (12,000 s). The next field is the length of the
resource data, which is an IP address (153.18.8.105).

Figure 17.22 Example 1: Response message

EXAMPLE 2
An FTP server has received a packet from an FTP client with

IP address 153.2.7.9. The FTP server wants to verify that the
FTP client is an authorized client. The FTP server can consult
a file containing the list of authorized clients. However, the file
consists only of domain names. The FTP server has only the IP
address of the requesting client, which was the source IP
address in the received IP datagram. The FTP server asks the
resolver (DNS client) to send an inverse query to a DNS server
to ask for the name of the FTP client. We discuss the query and
response messages separately.

Figure 17.23 shows the query message sent from the resolver to the server.
The first 2 bytes show the identifier (0x1200). The flags value is 0x0900 in
hexadecimal. In binary it is 0000100100000000, and we divide it into fields
as shown below:

0 0001 0 0 1 0 000 0000
The OpCode is 0001, which defines an inverse query. The message contains
only one question record. The domain name is 19171231537in-addr4arpa.
The next 2 bytes define the query type as PTR, and the last 2 bytes define
the class as the Internet.

Figure 17.23 Example 2: Inverse query message

Figure 17.24 shows the response. The flags value is 0x8D80 in

hexadecimal. In binary it is 1000110110000000, and we divide it into fields
as shown below:

1 0001 1 0 1 1 000 0000

Figure 17.24 Example 2: Inverse response message

EXAMPLE 3
In UNIX and Windows, the nslookup utility can be used to

retrieve address/name mapping. The following shows how we
can retrieve an address when the domain name is given.
$ nslookup fhda.edu
Name: fhda.edu
Address: 153.18.8.1
The nslookup utility can also be used to retrieve the domain

name when the address is given as shown below:
$ nslookup 153.18.8.1
1.8.18.153.in-addr.arpa name = tiptoe.fhda.edu.

17.9 DDNS
The Dynamic Domain Name System (DDNS) updates the DNS master
file dynamically
dynamically..

17.10 ENCAPSULATION
DNS uses UDP as the transport protocol when the size of the response
message is less than 512 bytes.
bytes. If the size of the response message is
more than 512 bytes, a TCP connection is used.
used.

Note:
DNS can use the services of UDP or

TCP using the well-known port 53.

Chapter 18
Remote Login:
Telnet
Objectives
• Understand how TELNET works

• Understand the role of NVT in a TELNET communication
• Understand TELNET option and suboption negotiation
• Know how control characters are used
• Know the TELNET modes of operation

Note:
TELNET is a general-purpose
client-server application program.

18.1 CONCEPT
TELNET enables the establishment of a connection to a remote system
in such a way that the local terminal appears to be a terminal at the
remote system.
system.
Time-Sharing Environment
Time-
Login

Figure 18.1 Local login

Figure 18.2 Remote login

18.2 NETWORK VIRTUAL
TERMINAL (NVT)
Via a universal interface called the Network Virtual Terminal (NVT)
character set, the TELNET client translates characters (data or
commands) that come from the local terminal into NVT form and
delivers them to the network
network.. The TELNET server translates data and
commands from NVT form into the form acceptable by the remote
computer..
computer

Figure 18.3 Concept of NVT

18.3 NVT CHARACTER SET
NVT uses two sets of characters, one for data and one for control
control.. Both
are 8-bit bytes
bytes..
Data Characters
Control Characters

Figure 18.4 Format of data characters

Figure 18.5 Format of control characters

Table 18.1 Some NVT control characters

18.4 EMBEDDING
The same connection is used by TELNET for sending both data and
control characters
characters.. TELNET accomplishes this by embedding the control
characters in the data stream
stream..

Figure 18.6 An example of embedding

18.5 OPTIONS
TELNET lets the client and server negotiate options before or during the
use of the service
service.. Options are extra features available to a user with a
more sophisticated terminal
terminal..

Table 18.2 Options

18.6 OPTION NEGOTIATION
To use any of the options first requires option negotiation between the
client and the server
server.. Four control characters are used for this purpose.
purpose.
Enabling an Option
Disabling an Option
Symmetry

Table 18.3 NVT character set for option negotiation

Figure 18.7 Offer to enable an option

Figure 18.8 Request to enable an option

Figure 18.9 Offer to disable an option

Figure 18.10 Request to disable an option

EXAMPLE 1
Figure 18.11 shows an example of option negotiation. In this

example, the client wants the server to echo each character
sent to the server. In other words, when a character is typed at
the user keyboard terminal, it goes to the server and is sent
back to the screen of the user before being processed. The echo
option is enabled by the server because it is the server that
sends the characters back to the user terminal. Therefore, the
client should request from the server the enabling of the option
using DO. The request consists of three characters: IAC, DO,
and ECHO. The server accepts the request and enables the
option. It informs the client by sending the three character
approval: IAC, WILL, and ECHO.
See Next Slide

Figure 18.11 Example 1: Echo option

18.7 SUBOPTION NEGOTIATION
Some options require additional information
information.. The client and server agree
through a process called suboption negotiation
negotiation..

Table 18.4 NVT character set for suboption negotiation

Figure 18.12 Example of suboption negotiation

18.8 CONTROLLING THE SERVER
Control characters can be used to control the remote server.
server.

Table 18.5 Characters used to control the application
program running on remote server

Figure 18.13 Example of interrupting an application program

18.9 OUT-OF-BAND SIGNALING
To make control characters effective in special situations, TELNET uses
out--of
out of--band signaling, a technique in which the control characters are
preceded by IAC and are sent out of order to the remote process.
process.

Figure 18.14 Out-of-band signaling

18.10 ESCAPE CHARACTER
When a user wants characters interpreted by the client instead of the
server, he can use an escape character, normally Ctrl+] (shown as ^])
^])..

Figure 18.15 Two different interruptions

18.11 MODE OF OPERATION
Most TELNET implementations operate in one of three modes:
modes: default
mode, character mode, or line mode
mode..
Default Mode
Character Mode
Line Mode

EXAMPLE 2
In this example, we use the default mode to show the concept

and its deficiencies even though it is almost obsolete today. The
client and the server negotiate the terminal type and terminal
speed and then the server checks the login and password of the
user (see Figure 18.16).
See Next Slide


EXAMPLE 3
In this example, we show how the client switches to the

character mode. This requires that the client request the server
to enable the SUPPRESS GO AHEAD and ECHO options (see
Figure 18.17).
See Next Slide


18.12 USER INTERFACE
The operating system (UNIX, for example) defines an interface to
TELNET with useruser--friendly commands
commands.. The interface is responsible for
translating the user
user--friendly commands to the TELNET commands
commands..

Table 18.6 Examples of interface commands

18.13 SECURITY ISSUE
TELNET suffers from security problems.
problems. TELNET requires a login
name and password (when exchanging text)
text).. A microcomputer connected
to a broadcast LAN can easily eavesdrop using snooper software to
capture a login name and the corresponding password (even if it is
encrypted)..
encrypted)

Chapter 19
File Transfer:
FTP and TFTP
Objectives
• Understand the connections needed for FTP file transfer

• Be familiar with FTP commands and responses
• Know the differences between FTP and TFTP
• Be familiar with TFTP message types
• Understand TFTP flow and error control

19.1 FILE TRANSFER
PROTOCOL (FTP)
File Transfer Protocol (FTP) is the standard mechanism provided by
TCP/IP for copying a file from one host to another.
another.
Connections
Communication
Command Processing
File Transfer
Anonymous FTP

Note:
FTP uses the services of TCP. It needs

two TCP connections.
The well-known port 21 is used for the
control connection and the well-
known port 20 for the data connection.

Figure 19.1 FTP

Figure 19.2 Opening the control connection

Figure 19.3 Creating the data connection

Figure 19.4 Using the control connection

Figure 19.5 Using the data connection

Figure 19.6 Command processing

Table 19.1 Access commands

Table 19.2 File management commands

Table 19.3 Data formatting commands

Table 19.4 Port defining commands

Table 19.5 File transfer commands

Table 19.5 File transfer commands (continued)

Table 19.6 Miscellaneous commands

Table 19.7 Responses

Table 19.7 Responses (continued)




Figure 19.7 File transfer

EXAMPLE 1
Figure 19.8 shows an example of using FTP for retrieving a

list of items in a directory.
1. After the control connection to port 21 is created, the FTP
server sends the 220 (service ready) response on the control
connection.
2. The client sends the USER command.
3. The server responds with 331 (user name is OK, password is
required).
4. The client sends the PASS command.
5. The server responds with 230 (user login is OK)
See Next Slide

6. The client issues a passive open on an ephemeral port for the

data connection and sends the PORT command (over the
control connection) to give this port number to the server.
7. The server does not open the connection at this time, but it
prepares itself for issuing an active open on the data
connection between port 20 (server side) and the ephemeral
port received from the client. It sends response 150 (data
connection will open shortly).
8. The client sends the LIST message.
9. Now the server responds with 125 and opens the data
connection.
See Next Slide

10. The server then sends the list of the files or directories (as a
file) on the data connection. When the whole list (file) is
sent, the server responds with 226 (closing data connection)
over the control connection.
11. The client now has two choices. It can use the QUIT
command to request the closing of the
control connection or it can send another command to
start another activity (and eventually open another data
connection). In our example, the client sends a QUIT
command.
12. After receiving the QUIT command, the server responds
with 221 (service closing) and then closes the control
connection.
See Next Slide

EXAMPLE 2
The following shows an actual FTP session that parallels

Example 1. The colored lines show the responses from the
server control connection; the black lines show the commands
sent by the client. The lines in white with black background
shows data transfer.
$ ftp voyager.deanza.fhda.edu
Connected to voyager.deanza.fhda.edu.
220 (vsFTPd 1.2.1)
530 Please login with USER and PASS.
Name (voyager.deanza.fhda.edu:forouzan): forouzan
331 Please specify the password.
See Next Slide

EXAMPLE 2
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls reports
227 Entering Passive Mode (153,18,17,11,238,169)
150 Here comes the directory listing.
drwxr-xr-x 2 3027 411 4096 Sep 24 2002 business

drwxr-xr-x 2 3027 411 4096 Sep 24 2002 personal
drwxr-xr-x 2 3027 411 4096 Sep 24 2002 school
226 Directory send OK.

ftp> quit
221 Goodbye.

EXAMPLE 3
Figure 19.9 shows an example of how an image (binary) file is

stored.
1. After the control connection to port 21 is created, the FTP
server sends the 220 (service
ready) response on the control connection.
2. The client sends the USER command.
3. The server responds with 331 (user name is OK, a password
is required).
4. The client sends the PASS command.
5. The server responds with 230 (user login is OK).
6. The client issues a passive open on an ephemeral port for
the data connection and sends the PORT command (over
the control connection) to give this port number to the server.
See Next Slide
7. The server does not open the connection at this time, but
prepares itself for issuing an active
open on the data connection between port 20 (server side)
and the ephemeral port received
from the client. It sends the response 150 (data connection
will open shortly).
8. The client sends the TYPE command.
9. The server responds with the response 200 (command OK).
10. The client sends the STRU command.
11. The server responds with 200 (command OK).
12. The client sends the STOR command.
13. The server opens the data connection and sends the
response 250.
See Next Slide
14. The client sends the file on the data connection. After the
entire file is sent, the data connection is closed. Closing the
data connection means end-of-file.
15. The server sends the response 226 on the control
connection.
16. The client sends the QUIT command or uses other
commands to open another data connection
for transferring another file. In our example, the QUIT
command is sent.
17. The server responds with 221 (service closing) and it closes
the control connection.
See Next Slide


EXAMPLE 4
We show an example of anonymous FTP. We assume that

some public data are available at internic.net.
$ ftp internic.net
Connected to internic.net
220 Server ready
Name: anonymous
331 Guest login OK, send “guest” as password
Password: guest
ftp > pwd
257 ’/’ is current directory
See Next Slide

EXAMPLE 4
bin
...
...
...
ftp > close
221 Goodbye
ftp > quit

19.2 TRIVIAL FILE TRANSFER
PROTOCOL (TFTP)
Trivial File Transfer Protocol (TFTP) is a simple file transfer protocol
without the sophisticated features of FTP.
FTP.

Messages
Connection
Data Transfer
UDP Ports
TFTP Example
TFTP Options
Security
Applications

Note:
TFTP uses the services of UDP on the

well-known port 69.

Figure 19.10 Message categories

Figure 19.11 RRQ format

Figure 19.12 WRQ format

Figure 19.13 DATA format

Figure 19.14 ACK format

Figure 19.15 ERROR format

Table 19.8 Error numbers and their meanings

Figure 19.16 Connection establishment

Figure 19.17 Sorcerer’s apprentice bug

Figure 19.18 UDP port numbers used by TFTP

Figure 19.19 TFTP example

Figure 19.20 Use of TFTP with BOOTP

Chapter 20
Electronic Mail:
SMTP, POP, and IMAP
Objectives
• Understand four configurations of email architecture

• Understand the functions and formats of a user agent
• Understand MIME and its capabilities and data types
• Understand the functions and commands of an MTA
• Understand the function of POP3 and IMAP4

20.1 ARCHITECTURE
To explain the architecture of email, we give four scenarios
scenarios.. We begin
with the simplest situation and add complexity as we proceed
proceed.. The fourth
scenario is the most common in the exchange of email
email..
First Scenario
Second Scenario
Third Scenario
Fourth Scenario

Figure 20.1 First scenario

Note:
When the sender and the receiver of

an email are on the same system, we
need only two user agents.

Figure 20.2 Second scenario

Note:
When the sender and the receiver of

an email are on different systems, we
need two UAs and a pair of MTAs
(client and server).

Figure 20.3 Third scenario

Note:
When the sender is connected to the

mail server via a LAN or a WAN, we
need two UAs and two pairs of MTAs
(client and server).

Figure 20.4 Fourth scenario

Figure 20.5 Push vs. pull

Note:
When both sender and receiver are

connected to the mail server via a LAN
or a WAN, we need two UAs, two pairs
of MTAs (client and server), and a pair
of MAAs (client and server). This is
the most common situation today.

20.2 USER AGENT
The user agent (UA) provides service to the user to make the process of
sending and receiving a message easier.
easier.
Services Provided by a User Agent

User Agent Types
Sending Mail
Receiving Mail
Addresses
Mailing List
MIME

Figure 20.6 User agent

Note:
Some examples of command-driven

user agents are mail, pine, and elm

Note:
Some examples of GUI-based user

agents are Eudora, Outlook, and
Netscape.

Figure 20.7 Format of an email

Figure 20.8 Email address

Figure 20.9 MIME

Figure 20.10 MIME header

Table 20.1 Data types and subtypes in MIME

Table 20.1 Data types and subtypes in MIME (Continued)

Table 20.2 Content
Content--transfer-
transfer-encoding

Figure 20.11 Base64

Table 20.3 Base64 encoding table

Figure 20.12 Quoted-printable

20.3 MESSAGE TRANSFER AGENT:
SMTP
The actual mail transfer requires message transfer agents (MTAs).
(MTAs). The
protocol that defines the MTA client and server in the Internet is called
Simple Mail Transfer Protocol (SMTP).
(SMTP).
Commands and Responses

Mail Transfer Phases

Figure 20.13 SMTP range

Figure 20.14 Commands and responses

Figure 20.15 Command format

Table 20.4 Commands

Table 20.5 Responses

Table 20.5 Responses (Continued)

Figure 20.16 Connection establishment

Figure 20.17 Message transfer

Figure 20.18 Connection termination

EXAMPLE 1
Let us see how we can directly use SMTP to send an email and simulate the
commands and responses we described in this section. We use TELNET to
log into port 25 (the well-known port for SMTP). We then use the
commands directly to send an email. In this example,
forouzanb@adelphia.net is sending an email to himself. The first few lines
show TELNET trying to connect to the adelphia mail server.
$ telnet mail.adelphia.net 25
Trying 68.168.78.100...
Connected to mail.adelphia.net (68.168.78.100).
After connection, we can type the SMTP commands and then receive the
responses as shown below. We have shown the commands in black and the
responses in color. Note that we have added for clarification some comment
lines, designated by the “=” sign. These lines are not part of the email
procedure.
================== Connection Establishment ================

220 mta13.adelphia.net SMTP server ready Fri, 6 Aug 2004 . . .
HELO mail.adelphia.net
250 mta13.adelphia.net
===================== Envelope ===================
MAIL FROM: forouzanb@adelphia.net
250 Sender <forouzanb@adelphia.net> Ok
RCPT TO: forouzanb@adelphia.net
250 Recipient <forouzanb@adelphia.net> Ok
=================== Header and Body ==================
DATA
354 Ok Send data ending with <CRLF>.<CRLF>
From: Forouzan
TO: Forouzan
This is a test message

to show SMTP in action.
.
============= Connection Termination===============

250 Message received: adelphia.net@mail.adelphia.net
QUIT
221 mta13.adelphia.net SMTP server closing connection
Connection closed by foreign host.

20.4 MESSAGE ACCESS AGENT:
POP AND IMAP
The third stage of mail delivery uses a message access agent;
agent; the client
must pull messages from the server
server.. Currently two message access
protocols are available
available:: Post Office Protocol, version 3 (POP3
(POP3) and
Internet Mail Access Protocol, version 4.
POP3
IMAP4

Figure 20.19 POP3 and IMAP4

Figure 20.20 POP3

20.5 WEB-BASED MAIL
Some websites such as Hotmail and Yahoo provide email service to
anyone who accesses the site
site.. Mail transfer and retrieval requires the use
of HTTP
HTTP..

Chapter 21
Network Management:
SNMP
Objectives
• Understand the SNMP manager and the SNMP agent

• Understand the roles of SMI and MIB in network management
• Be familiar with SMI object attributes and encoding methods
• Know how an MIB variable is accessed
• Be familiar with the SNMP PDU and format

21.1 CONCEPT
SNMP defines a manager, usually a host, that controls and monitors a
set of agents, usually routers
routers..
Managers and Agents

Figure 21.1 SNMP concept

21.2 MANAGEMENT COMPONENTS
SNMP requires the use of two other protocols:
protocols: Structure of Management
Information (SMI) and Management Information Base (MIB)(MIB).. Network
management on the Internet is done through the cooperation of SNMP,
SMI, and MIB
MIB..

Role of SNMP
Role of SMI
Role of MIB
An Analogy
An Overview

Figure 21.2 Components of network management on the Internet

Note:
SNMP defines the format of packets

exchanged between a manager and an
agent. It reads and changes the status
(values) of objects (variables) in
SNMP packets.

Note:
SMI defines the general rules for naming

objects, defining object types (including
range and length), and showing how to
encode objects and values. SMI defines
neither the number of objects an entity
should manage, nor names the objects to
be managed nor defines the association
between the objects and their values.

Note:
MIB creates a collection of named

objects, their types, and their
relationships to each other in an entity
to be managed.

Note:
We can compare the task of network
management to the task of writing a
program.
❏ Both tasks need rules. In network management
this is handled by SMI.
❏ Both tasks need variable declarations. In network
management this is handled by MIB.
❏ Both tasks have actions performed by statements.
In network management this is handled by SNMP.

Figure 21.3 Management overview

21.3 SMI
SMI is a component used in network management.
management. It names objects,
defines the type of data that can be stored in an object, and shows how
data can be encoded for transmission over the network
Name
Type
Encoding Method

Figure 21.4 Object attributes

Figure 21.5 Object identifier

Note:
All objects managed by SNMP are

given an object identifier.
The object identifier always starts with
1.3.6.1.2.1.

Figure 21.6 Data type

Table 21.1 Data types

Figure 21.7 Conceptual data types

Figure 21.8 Encoding format

Table 21.2 Codes for data types

Figure 21.9 Length format

EXAMPLE 1
Figure 21.10 shows how to define INTEGER 14.
See Next Slide

Figure 21.10 Example 1, INTEGER 14

EXAMPLE 2
Figure 21.11 shows how to define the OCTET STRING

“HI.”
See Next Slide

Figure 21.11 Example 2, OCTET STRING “HI”

EXAMPLE 3
Figure 21.12 shows how to define ObjectIdentifier

1.3.6.1 (iso.org.dod.internet).
See Next Slide

Figure 21.12 Example 3, ObjectIdentifier 1.3.6.1

EXAMPLE 4
Figure 21.13 shows how to define IPAddress

131.21.14.8.
See Next Slide

Figure 21.13 Example 4, IPAddress 131.21.14.8

21.4 MIB
MIB is a component used in network management.
management. Each agent has its
own MIB, a collection of all the objects that the manager can manage.
manage.
Accessing MIB Variables

Lexicographic Ordering

Figure 21.14 mib-2

Figure 21.15 udp group

Figure 21.16 udp variables and tables

Figure 21.17 Indexes for udpTable

Figure 21.18 Lexicographic ordering

21.5 SNMP
SNMP is an application program that allows 1) a manager to retrieve the
value of an object defined in an agent;
agent; 2) a manager to store a value in
an object defined in an agent;
agent; and 3) an agent to send an alarm message
about an abnormal situation to the manager
PDUs
Format

Figure 21.19 SNMP PDUs

Figure 21.20 SNMP PDU format

Table 21.3 Types of errors

21.6 MESSAGES
A message in SNMP is made of four elements
elements:: version, header, security
parameters, and data (which includes the encoded PDU).
PDU).

Figure 21.21 SNMP message

Table 21.4 Codes for SNMP messages

EXAMPLE 5
In this example, a manager station (SNMP client) uses the

GetRequest message to retrieve the number of UDP datagrams
that a router has received. There is only one VarBind entity.
The corresponding MIB variable related to this information is
udpInDatagrams with the object identifier 1.3.6.1.2.1.7.1.0.
The manager wants to retrieve a value (not to store a value), so
the value defines a null entity. Figure 21.22 shows the
conceptual view of the packet showing the hierarchical nature
of sequences. We have used white and color boxes for the
sequence and a gray one for the PDU.
See Next Slide

EXAMPLE 5
The VarBind list has only one VarBind. The variable is of type
06 and length 09. The value is of type 05 and length 00. The
whole is a sequence of length 0D (13). The VarBind list is also
a sequence of length 0F (15). The GetRequest PDU is of length
1D (29). Now we have three OCTET STRINGs related to
security parameter, security model, and flags. Then we have
two integers defining maximum size (1024) and message ID
(64). The header is a sequence of length 12, which we left
blank for simplicity. There is one integer, version (version 3).
The whole message is a sequence of 52 bytes. Figure 21.23
shows the actual message sent by the manager station (client)
to the agent (server).
See Next Slide


Figure 21.23 GetRequest message

21.7 UDP PORTS
SNMP uses the services of UDP on two well-
well-known ports, 161 and 162
162..
The well-
well-known port 161 is used by the server (agent), and the well
well--
known port 162 is used by the client (manager)
(manager)..

Figure 21.24 Port numbers for SNMP

21.8 SECURITY
The main difference between SNMPv3
SNMPv3 and SNMPv
SNMPv22 is the enhanced
security.. SNMPv
security SNMPv33 provides two types of security:
security: general and specific.
specific.
SNMPv33 provides message authentication, privacy, and manager
SNMPv
authorization..
authorization

Chapter 22
World Wide Web:

HTTP
Objectives
• Understand the components of a browser and a server

• Understand the function of the URL and cookies
• Understand how HTML is related to static documents
• Understand how CGI is related to dynamic documents
• Understand how Java is related to active documents
• Know how HTTP accesses data on the WWW
22.1 ARCHITECTURE
The WWW is a distributed client
client--server service, in which a client using a
browser can access a service using a server.
server. The service provided is
distributed over many locations called sites.
sites.
Client (Browser)
Server
Uniform Resource Locator (URL)
Cookies

Figure 22.1 Architecture of WWW

Figure 22.2 Browser

Figure 22.3 URL

22.2 WEB DOCUMENTS
The documents in the WWW can be grouped into three broad categories:
categories:
static, dynamic, and active
active.. The category is based on the time the
contents of the document are determined
determined..
Static Documents
Dynamic Documents
Active Documents

Figure 22.4 Static document

Figure 22.5 Boldface tags

Figure 22.6 Effect of boldface tags

Figure 22.7 Beginning and ending tags

Figure 22.8 Dynamic document using CGI

Figure 22.9 Dynamic document using server-site script

Note:
Dynamic documents are sometimes

referred to as server-site dynamic
documents.

Figure 22.10 Active document using Java applet

Figure 22.11 Active document using client-site script

Note:
Active documents are sometimes

referred to as client-site dynamic
documents.

22.3 HTTP
The Hypertext Transfer Protocol (HTTP) is a protocol used mainly to
access data on the World Wide Web.
Web. HTTP functions like a combination
of FTP and SMTP
SMTP..
HTTP Transaction
Persistent versus Nonpersistent Connection
Proxy Server

Note:
HTTP uses the services of TCP on

well-known port 80.

Figure 22.12 HTTP transaction

Figure 22.13 Request and response messages

Figure 22.14 Request and status lines

Table 22.1 Methods

Table 22.2 Status codes

Table 22.2 Status codes (continued)

Figure 22.15 Header format

Table 22.3 General headers

Table 22.4 Request headers

Table 22.5 Response headers

Table 22.6 Entity headers

EXAMPLE 1
This example retrieves a document. We use the GET method to

retrieve an image with the path /usr/bin/image1. The request
line shows the method (GET), the URL, and the HTTP version
(1.1). The header has two lines that show that the client can
accept images in the GIF or JPEG format. The request does
not have a body. The response message contains the status line
and four lines of header. The header lines define the date,
server, MIME version, and length of the document. The body
of the document follows the header (see Figure 22.16).
See Next Slide


EXAMPLE 2
In this example, the client wants to send data to the server. We

use the POST method. The request line shows the method
(POST), URL, and HTTP version (1.1). There are four lines of
headers. The request body contains the input information. The
response message contains the status line and four lines of
headers. The created document, which is a CGI document, is
included as the body (see Figure 22.17).
See Next Slide


EXAMPLE 3
HTTP uses ASCII characters. A client can directly connect to a

server using TELNET, which logs into port 80. The next three
lines shows that the connection is successful. We then type
three lines. The first shows the request line (GET method), the
second is the header (defining the host), the third is a blank
terminating the request. The server response is seven lines
starting with the status line. The blank line at the end
terminates the server response. The file of 14230 lines is
received after the blank line (not shown here). The last line is
the output by the client.
See Next Slide

EXAMPLE 3
$ telnet www.mhhe.com 80
Trying 198.45.24.104...
Connected to www.mhhe.com (198.45.24.104).
Escape character is '^]'.
GET /engcs/compsci/forouzan HTTP/1.1
From: forouzanbehrouz@fhda.edu
HTTP/1.1 200 OK
Date: Thu, 28 Oct 2004 16:27:46 GMT
Server: Apache/1.3.9 (Unix) ApacheJServ/1.1.2 PHP/4.1.2 PHP/3.0.18
MIME-version:1.0
Content-Type: text/html
Last-modified: Friday, 15-Oct-04 02:11:31 GMT
Content-length: 14230
Connection closed by foreign host.
Note:
HTTP version 1.1 specifies a persistent

connection by default.

Chapter 23
IP Over ATM
Objectives
• Review the features of an ATM WAN

• Understand how an a datagram can pass through an ATM WAN
• Understand how an IP packet is encapsulated in cells
• Understand how cells are routed in an ATM network
• Understand the function of ATMARP

23.1 ATM WANS
We review some features of the ATM WAN needed to understand IP over
ATM.. The only AAL used by the Internet is AAL5
ATM AAL5, sometimes called the
simple and efficient adaptation layer (SEAL).
(SEAL).
Layers

Figure 23.1 An ATM WAN in the Internet

Figure 23.2 ATM layers in routers and switches

Note:
End devices such as routers use all

three layers, while switches use only
the bottom two layers.

Figure 23.3 AAL5

Note:
The AAL layer used by the IP protocol

is AAL5.

Figure 23.4 ATM layer

Figure 23.5 ATM headers

23.2 CARRYING A DATAGRAM
IN CELLS
We show how an example of a datagram encapsulated in four cells and
transmitted through an ATM network.
network.
Why Use AAL5?

Figure 23.6 Fragmentation

Note:
Only the last cell carries the 8-byte

trailer added to the IP datagram.
Padding can be added only to the last
cell or the last two cells.

Note:
The value of the PT field is 000 in all

cells carrying an IP datagram
fragment except for the last cell;
the value is 001 in the last cell.

Figure 23.7 ATM cells

23.3 ROUTING THE CELLS
The ATM network creates a route between two routers.routers. We call these
routers entering-
entering-point and exiting
exiting--point routers
routers..
Addresses
Address Binding

Figure 23.8 Entering-point and exiting-point routers

23.4 ATMARP
ATMARP finds (maps) the physical address of the exiting-
exiting-point router
given the IP address of the exiting
exiting--point router
router.. No broadcasting is
involved..
involved
Packet Format
ATMARP Operation

Figure 23.9 ATMARP packet

Table 23.1 OPER field

Note:
The inverse request and inverse reply

messages can bind the physical
address to an IP address in a PVC
situation.

Figure 23.10 Binding with PVC

Figure 23.11 Binding with ATMARP

Note:
The request and reply message can be

used to bind a physical address to an
IP address in an SVC situation.

Note:
The inverse request and inverse reply

can also be used to build the server’s
mapping table.

Figure 23.12 Building a table

23.5 LOGICAL IP SUBNET (LIS)
An ATM network can be divided into logical (not physical) subnetworks.
subnetworks.
This facilitates the operation of ATMARP and other protocols (such as
IGMP) that need to simulate broadcasting on an ATM network
network..

Figure 23.13 LIS

Note:
LIS allows an ATM network to be

divided into several logical subnets. To
use ATMARP, we need a separate
server for each subnet.

Chapter 24
Mobile IP
Objectives
• Understand the addressing scheme for mobile hosts.

• To define home, care-of, and co-located care-of addresses
• Understand the interactions between a home and a foreign agent
• Know the three phases involved in mobile communication
• Understand why mobile IP communication can be inefficient

24.1 ADDRESSING
The main problem that must be solved in providing mobile
communication using the IP protocol is addressing.
addressing.
Stationary Hosts
Mobile Hosts

Note:
The IP addresses are designed to work

with stationary hosts because part of
the address defines the network to
which the host is attached.

Figure 24.1 Home address and care-of address

Note:
Mobile IP has two addresses for a

mobile host: one home address and
one care-of address. The home address
is permanent; the care-of address
changes as the mobile host moves
from one network to another.

24.2 AGENTS
To make the change of address transparent to the rest of the Internet
requires a home agent and a foreign agent.
agent. The specific function of an
agent is performed in the application layer
layer..
Home Agent
Foreign Agent

Figure 24.2 Home agent and foreign agent

Note:
When the mobile host and the foreign

agent are the same, the care-of address
is called a co-located care-of address.

24.3 THREE PHASES
To communicate with a remote host, a mobile host goes through three
phases:: agent discovery, registration, and data transfer
phases transfer..
Agent Discovery
Registration
Data Transfer

Figure 24.3 Remote host and mobile host communication

Note:
Mobile IP does not use a new packet

type for agent advertisement; it uses
the router advertisement packet of
ICMP, and appends an agent
advertisement message.

Figure 24.4 Agent advertisement

Table 24.1 Code bits

Note:
Mobile IP does not use a new packet

type for agent solicitation; it uses the
router solicitation packet of ICMP.

Figure 24.5 Registration request and reply

Figure 24.6 Registration request format

Table 24.2 Registration request flag field bits

Figure 24.7 Registration reply format

Note:
A registration request or reply is sent by

UDP using the well-known port 434.

Figure 24.8 Data transfer

Note:
The movement of the mobile host is

transparent to the rest of the Internet.

24.4 INEFFICIENCY IN MOBILE IP
Communication involving mobile IP can be inefficient.
inefficient. A severe case is
called double crossing or 2X. A moderate case is called triangle routing
or dog-
dog-leg routing.
routing.
Double Crossing
Triangle Routing
Solution

Figure 24.9 Double crossing

Figure 24.10 Triangle routing

Chapter 25
Multimedia
Objectives
• Know the characteristics of the 3 types of services

• Understand the methods of digitizing and compressing.
• Understand jitter, translation, and mixing in real-time traffic
• Understand the role of RTP and RTCP in real-time traffic
• Understand how the Internet can be used as a telephone network

Figure 25.1 Internet audio/video

Note:
Streaming stored audio/video refers to

on-demand requests for compressed
audio/video files.

Note:
Streaming live audio/video refers to

the broadcasting of radio and TV
programs through the Internet.

Note:
Interactive audio/video refers to the

use of the Internet for interactive
audio/video applications.

25.1 DIGITIZING AUDIO AND VIDEO
Before audio or video signals can be sent on the Internet, they need to be
digitized.. We discuss audio and video separately.
digitized separately.
Digitizing Audio
Digitizing Video

Note:
Compression is needed to send video

over the Internet.

25.2 AUDIO AND VIDEO
COMPRESSION
To send audio or video over the Internet requires compression.
compression.
Audio Compression
Video Compression

Figure 25.2 JPEG gray scale

Figure 25.3 JPEG process

Figure 25.4 Case 1: uniform gray scale

Figure 25.5 Case 2: two sections

Figure 25.6 Case 3: gradient gray scale

Figure 25.7 Reading the table

Figure 25.8 MPEG frames

Figure 25.9 MPEG frame construction

25.3 STREAMING STORED
AUDIO/VIDEO
We turn our attention to a specific applications called streaming stored
audio and video
video.. We use four approaches to show how a file can be
downloaded, each with a different complexity
complexity..
First Approach: Using a Web Server

Second Approach: Using a Web Server with Metafile
Third Approach: Using a Media Server
Fourth Approach: Using a Media Server and RTSP

Figure 25.10 Using a Web server

Figure 25.11 Using a Web server with a metafile

Figure 25.12 Using a media server

Figure 25.13 Using a media server and RTSP

25.4 STREAMING LIVE
AUDIO/VIDEO
In streaming live audio/video the stations broadcast through the Internet
Internet..
Communication is multicast and live.
live. Live streaming is better suited to
the multicast services of IP and the use of protocols such as UDP and
RTP..
RTP

25.5 REAL-TIME INTERACTIVE
AUDIO/VIDEO
In real
real--time interactive audio/video, people communicate visually and
orally with one another in real time. time. Examples include video
conferencing and the Internet phone or voice over IP
IP..
Characteristics

Figure 25.14 Time relationship

Note:
Jitter is introduced in real-time data by

the delay between packets.

Figure 25.15 Jitter

Figure 25.16 Timestamp

Note:
To prevent jitter, we can timestamp the

packets and separate the arrival time
from the playback time.

Figure 25.17 Playback buffer

Note:
A playback buffer is required for

real-time traffic.

Note:
A sequence number on each packet is

required for real-time traffic.

Note:
Real-time traffic needs the support of

multicasting.

Note:
Translation means changing the

encoding of a payload to a lower
quality to match the bandwidth
of the receiving network.

Note:
Mixing means combining several

streams of traffic into one stream.

Note:
TCP, with all its sophistication, is not

suitable for interactive multimedia
traffic because we cannot allow
retransmission of packets.

Note:
UDP is more suitable than TCP for

interactive traffic. However, we need
the services of RTP, another transport
layer protocol, to make up for the
deficiencies of UDP.

25.6 RTP
Real-time Transport Protocol (RTP) is the protocol designed to handle
Real-
real--time traffic on the Internet
real Internet.. RTP does not have a delivery
mechanism;; it must be used with UDP
mechanism UDP..
RTP Packet Format

UDP Port

Figure 25.18 RTP

Figure 25.19 RTP packet header format

Table 25.1 Payload types

Note:
RTP uses a temporary even-numbered

UDP port.

25.7 RTCP
Real-time Transport Control Protocol (RTCP) is a protocol that allows
Real-
messages that control the flow and quality of data
data.. RTCP has five types
of messages
messages..

Sender Report
Receiver Report
Source Description Message
Bye Message
Application Specific Message
UDP Port

Figure 25.20 RTCP message types

Note:
RTCP uses an odd-numbered UDP

port number that follows the port
number selected for RTP.

25.8 VOICE OVER IP
Voice over IP, or Internet telephony is an application that allows
communication between two parties over the packet
packet--switched Internet.
Internet.
Two protocols have been designed to handle this type of communication:
communication:
SIP and H.323
323..
SIP
H.323

Figure 25.21 SIP messages

Figure 25.22 SIP formats

Figure 25.23 SIP simple session

Figure 25.24 Tracking the callee

Figure 25.25 H.323 architecture

Figure 25.26 H.323 protocols

Figure 25.27 H.323 example

Chapter 26
Virtual Private Networks and

Network Address Translation
Objectives
• Understand the difference between an internet and an extranet

• Understand private, hybrid, and virtual private networks
• Understand how VPN can guarantee privacy
• Understand the mechanism of NAT

26.1 PRIVATE NETWORKS
A private network is designed to be used only inside an organization.
organization. It
allows access to shared resources and, at the same time, provides privacy.
privacy.
Intranet
Extranet
Addressing

Table 26.1 Addresses for private networks

26.2 VIRTUAL PRIVATE
NETWORKS (VPN)
Virtual private network (VPN) is a technology for large organizations
that use the global Internet for both intra-
intra- and interorganization
communication, but require privacy in their intraorganization
communication..
communication
Achieving Privacy
VPN Technology

Figure 26.1 Private network

Figure 26.2 Hybrid network

Figure 26.3 Virtual private network

Figure 26.4 Tunneling

Figure 26.5 Addressing in a VPN

26.3 NETWORK ADDRESS
TRANSLATION (NAT)
Network address translation (NAT) allows a site to use a set of private
addresses for internal communication and a set of global Internet
addresses for communication with another site
site.. The site must have only
one single connection to the global Internet through a router that runs
NAT software.
software.
Address Translation
Translation Table
NAT and ISP

Figure 26.6 NAT

Figure 26.7 Address translation

Figure 26.8 Translation

Table 26.2 Five
Five--column translation table

Figure 26.9 An ISP and NAT

Chapter 27
Next Generation:
IPv6 and ICMPv6
Objectives
• Understand the shortcomings of IPv4

• Know the IPv6 address format, address types, and abbreviations
• Be familiar with the IPv6 header format
• Know the extension header types
• Know the differences between ICMPv4 and ICMPv6
• Know the strategies for transitioning from IPv4 to IPv6
27.1 IPv6
IPv6 has these advantages over IPv4:
1. larger address space
2. better header format
3. new options
4. allowance for extension
5. support for resource allocation
6. support for more security

IPv6 Addresses
Address Space Assignment
Packet Format
Comparison between IPv4 and IPv6

Figure 27.1 IPv6 address

Figure 27.2 Abbreviated address

Figure 27.3 Abbreviated address with consecutive zeros

Figure 27.4 CIDR address

Figure 27.5 Address structure

Table 27.1 Type prefixes for IPv6 addresses

Figure 27.6 Provider-based address

Figure 27.7 Address hierarchy

Figure 27.8 Unspecified address

Figure 27.9 Loopback address

Figure 27.10 Compatible address

Figure 27.11 Mapped address

Figure 27.12 Link local address

Figure 27.13 Site local address

Figure 27.14 Multicast address

Figure 27.15 IPv6 datagram

Figure 27.16 Format of an IPv6 datagram

Table 27.2 Next header codes

Table 27.3 Priorities for congestion-
congestion-controlled
traffic

Table 27.4 Priorities for noncongestion-
noncongestion-controlled
traffic

Table 27.5 Comparison between IPv4 and IPv6 packet header

Figure 27.17 Extension header format

Figure 27.18 Extension header types

Figure 27.19 Hop-by-hop option header format

Figure 27.20 The format of options in a hop-by-hop option header

Figure 27.21 Pad1

Figure 27.22 PadN

Figure 27.23 Jumbo payload

Figure 27.24 Source routing

Figure 27.25 Source routing example

Figure 27.26 Fragmentation

Figure 27.27 Authentication

Figure 27.28 Calculation of authentication data

Figure 27.29 Encrypted security payload

Figure 27.30 Transport mode encryption

Figure 27.31 Tunnel-mode encryption

Table 27.6 Comparison between IPv4 options and IPv6 extension
headers

27.2 ICMPv6
ICMPv6, while similar in strategy to ICMPv4
ICMPv6 ICMPv4, has changes that makes it
more suitable for IPv
IPv6
6. ICMPv
ICMPv6 6 has absorbed some protocols that were
independent in version 4.
Error Reporting
Query

Figure 27.32 Comparison of network layers in version 4 and version 6

Figure 27.33 Categories of ICMPv6 messages

Figure 27.34 General format of ICMP messages

Figure 27.35 Error-reporting messages

Table 27.7 Comparison of error-
error-reporting messages in ICMPv4
and ICMPv6

Figure 27.36 Destination-unreachable message format

Figure 27.37 Packet-too-big message format

Figure 27.38 Time-exceeded message format

Figure 27.39 Parameter-problem message format

Figure 27.40 Redirection message format

Figure 27.41 Query messages

Table 27.8 Comparison of query messages in ICMPv4
and ICMPv6

Figure 27.42 Echo request and reply messages

Figure 27.43 Router-solicitation and advertisement message formats

Figure 27.44 Neighbor-solicitation and advertisement message formats

Figure 27.45 Group-membership messages

Figure 27.46 Group-membership message formats

Figure 27.47 Four situations of group-membership operation

27.3 TRANSITION FROM IPv4
TO IPv6
Three strategies have been devised by the IETF to provide for a smooth
transition from IPv4
IPv4 to IPv
IPv6
6.
Dual Stack
Tunneling
Header Translation

Figure 27.48 Three transition strategies

Figure 27.49 Dual stack

Figure 27.50 Automatic tunneling

Figure 27.51 Configured tunneling

Figure 27.52 Header translation

Table 27.9 Header translation

Chapter 28
Security
Objectives
• Differentiate between two categories of cryptography schemes

• Understand four aspects of security
• Understand the concept of digital signature
• Understand the role of key management in entity authentication
• Know how and where IPSec, TLS, and PPG provide security

28.1 CRYPTOGRAPHY
The word cryptography in Greek means “secret writing.
writing.” The term today
refers to the science and art of transforming messages to make them
secure and immune to attacks
attacks..
Symmetric-Key Cryptography
Symmetric-
Asymmetric--Key Cryptography
Asymmetric
Comparison

Figure 28.1 Cryptography components

Note:
In cryptography, the
encryption/decryption algorithms are
public; the keys are secret.

Note:
In symmetric-key cryptography, the

same key is used by the sender (for
encryption) and the receiver (for
decryption). The key is shared.

Figure 28.2 Symmetric-key cryptography

Note:
In symmetric-key cryptography, the

same key is used in both directions.

Figure 28.3 Caesar cipher

Figure 28.4 Transpositional cipher

Figure 28.5 DES

Figure 28.6 Iteration block

Figure 28.7 Triple DES

Note:
The DES cipher uses the same concept

as the Caesar cipher, but the
encryption/ decryption algorithm is
much more complex.

Figure 28.8 Public-key cryptography

Figure 28.9 RSA

Note:
Symmetric-key cryptography is often

used for long messages.

Note:
Asymmetric-key algorithms are more

efficient for short messages.

28.2 PRIVACY
Privacy means that the sender and the receiver expect confidentiality.
confidentiality.
The transmitted message must make sense to only the intended receiver.
receiver.
To all others, the message must be unintelligible.
unintelligible.
Privacy with Symmetric-

Privacy with Asymmetric-
Asymmetric-Key Cryptography

Figure 28.10 Privacy using symmetric-key encryption

Figure 28.11 Privacy using asymmetric-key encryption

Note:
Digital signature can provide

authentication, integrity, and
nonrepudiation for a message.

28.3 DIGITAL SIGNATURE
Digital signature can provide authentication, integrity, and
nonrepudiation for a message.
message.
Signing the Whole Document

Signing the Digest

Figure 28.12 Signing the whole document

Note:
Digital signature does not provide

privacy. If there is a need for privacy,
another layer of encryption/decryption
must be applied.

Figure 28.13 Hash function

Figure 28.14 Sender site

Figure 28.15 Receiver site

28.4 ENTITY AUTHENTICATION
Entity authentication is a procedure that verifies the identity of one entity
for another
another.. An entity can be a person, a process, a client, or a server.
server. In
entity authentication, the identity is verified once for the entire duration
of system access.
access.
Entity Authentication with Symmetric-

Entity Authentication with Asymmetric-
Asymmetric-Key Cryptography

Figure 28.16 Using a symmetric key only

Figure 28.17 Using a nonce

Figure 28.18 Bidirectional authentication

28.5 KEY MANAGEMENT
In this section we explain how symmetric keys are distributed and how
public keys are certified
certified..
Symmetric-Key Distribution
Symmetric-
Public--Key Certification
Public
Kerberos

Note:
A symmetric key between two parties is

useful if it is used only once; it must be
created for one session and destroyed
when the session is over.

Figure 28.19 Diffie-Hellman method

Note:
The symmetric (shared) key in the

Diffie-Hellman protocol is
K = G xy mod N.

EXAMPLE 1
Let us give an example to make the procedure clear. Our example uses small
numbers, but note that in a real situation, the numbers are very large. Assume G
= 7 and N = 23. The steps are as follows:
1. Alice chooses x = 3 and calculates R1 = 73 mod 23 = 21.
2. Alice sends the number 21 to Bob.
3. Bob chooses y = 6 and calculates R2 = 76 mod 23 = 4.
4. Bob sends the number 4 to Alice.
5. Alice calculates the symmetric key K = 43 mod 23 = 18.
6. Bob calculates the symmetric key K = 216 mod 23 = 18.
The value of K is the same for both Alice and Bob; G xy mod N = 718 mod 23
= 18.

Figure 28.20 Man-in-the-middle attack

Figure 28.21 First approach using KDC

Figure 28.22 Needham-Schroeder protocol

Figure 28.23 Otway-Rees protocol

Note:
In public-key cryptography, everyone

has access to everyone’s public key.

Table 28.1 X.509 fields

Figure 28.24 PKI hierarchy

Figure 28.25 Kerberos servers

Figure 28.26 Kerberos example

28.6 SECURITY IN THE INTERNET
In this section we discuss a security method for each of the top 3 layers
of the Internet model
model.. At the IP level we discuss a protocol called IPSec;
IPSec;
at the transport layer we discuss a protocol that “glues” a new layer to
the transport layer
layer;; at the application layer we discuss a security method
called PGP
PGP..
IP Level Security: IPSec

Transport Layer Security
Application Layer Security: PGP

Figure 28.27 Transport mode

Figure 28.28 Tunnel mode

Figure 28.29 AH

Note:
The AH protocol provides message

authentication and integrity,
but not privacy.

Figure 28.30 ESP

Note:
ESP provides message authentication,

integrity, and privacy.

Figure 28.31 Position of TLS

Figure 28.32 TLS layers

Figure 28.33 Handshake protocol

Figure 28.34 Record Protocol

Figure 28.35 PGP at the sender site

Figure 28.36 PGP at the receiver site

28.7 FIREWALLS
A firewall is a device (usually a router or a computer) installed between
the internal network of an organization and the rest of the Internet.
Internet. It is
designed to forward some packets and filter (not forward) others.
others.
Packet-Filter Firewall
Packet-
Proxy Firewall

Figure 28.37 Firewall

Figure 28.38 Packet-filter firewall

Note:
A packet-filter firewall filters at the

network or transport layer.

Figure 28.39 Proxy firewall

Note:
A proxy firewall filters at the

application layer.

TCP Ip

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

TCP Ip

Uploaded by

Copyright:

Available Formats

Chapter 1

• Understand how the Internet came into being

TCP/IP Protocol Suite 1

TCP/IP Protocol Suite 2

TCP/IP Protocol Suite 3

The topics discussed in this section include:

TCP/IP Protocol Suite 4

The topics discussed in this section include:

TCP/IP Protocol Suite 5

The websites for the standardization

TCP/IP Protocol Suite 6

The topics discussed in this section include:

TCP/IP Protocol Suite 7

TCP/IP Protocol Suite 8

TCP/IP Protocol Suite 9

RFCs can be found at

TCP/IP Protocol Suite 10

The topics discussed in this section include:

TCP/IP Protocol Suite 11

TCP/IP Protocol Suite 12

The websites for Internet

TCP/IP Protocol Suite 13

The OSI Model and

• Understand the architecture of the OSI model

TCP/IP Protocol Suite 14

The topics discussed in this section include:

TCP/IP Protocol Suite 15

ISO is the organization.

TCP/IP Protocol Suite 16

TCP/IP Protocol Suite 17

TCP/IP Protocol Suite 18

TCP/IP Protocol Suite 19

The topics discussed in this section include:

TCP/IP Protocol Suite 20

TCP/IP Protocol Suite 21

The physical layer is responsible

TCP/IP Protocol Suite 22

TCP/IP Protocol Suite 23

The data link layer is responsible for

TCP/IP Protocol Suite 24

TCP/IP Protocol Suite 25

TCP/IP Protocol Suite 26

The network layer is responsible for

TCP/IP Protocol Suite 27

TCP/IP Protocol Suite 28

TCP/IP Protocol Suite 29

The transport layer is responsible for

TCP/IP Protocol Suite 30

TCP/IP Protocol Suite 31

TCP/IP Protocol Suite 32

TCP/IP Protocol Suite 33

TCP/IP Protocol Suite 34

TCP/IP Protocol Suite 35

The topics discussed in this section include:

Physical and Data Link Layers

TCP/IP Protocol Suite 36

TCP/IP Protocol Suite 37

The topics discussed in this section include:

TCP/IP Protocol Suite 38

TCP/IP Protocol Suite 39

TCP/IP Protocol Suite 40

In Figure 2.18 a node with physical address 10 sends