CSE306: Computer Networks

Module 3 The Transport and Application Layers

⭐The Transport Layer

Overview
- Responsibility:
  - The transport layer manages key aspects of reliable computer networking, including multiplexing, demultiplexing, connection management, and data integrity.
- Key Functions:
  - Multiplexing: Directing incoming traffic to multiple receiving services.
  - Demultiplexing: Delivering incoming traffic to the appropriate service or application.
  - Connection Establishment: Handling the setup and maintenance of long-running connections.
  - Data Integrity: Ensuring error checking and verification of data.
Learning Objectives
- Multiplexing and Demultiplexing:
  - Understand how multiplexing and demultiplexing work and their roles in network communication.
- TCP vs. UDP:
  - Identify and explain the differences between TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).
- Three-Way Handshake:
  - Describe the process of the TCP three-way handshake.
  - Understand the use of TCP flags in this process.
- Firewalls:
  - Learn the basics of how firewalls contribute to network security.
Multiplexing and Demultiplexing
- Multiplexing:
  - Definition: The process of directing network traffic to multiple services on the same node.
  - How It Works: Allows a single network connection to carry traffic for multiple applications by directing it to specific ports.
- Demultiplexing:
  - Definition: The process of taking incoming traffic aimed at a single node and directing it to the appropriate service.
  - How It Works: Ensures that data arriving at a node is delivered to the correct application based on port numbers.
Ports
- Definition: A 16-bit number used to direct traffic to specific services on a networked computer.
- Usage:
  - Ports enable multiple services to run on a single device, each listening on a different port number.
  - Socket Address: Combination of an IP address and a port number (e.g., 10.1.1.100:80).
Examples of Port Usage
- HTTP (Web Traffic):
  - Port: 80
  - Example: A web server listening for HTTP requests might be accessed at 10.1.1.100:80.
- FTP (File Transfer Protocol):
  - Port: 21
  - Example: An FTP server listening for file transfer requests might be accessed at 10.1.1.100:21.
Server and Client Concept

Server: A program waiting to respond to data requests.
Client: A program that initiates requests for data from a server.
Functionality: Multiplexing allows a single server to handle multiple types of requests (e.g., web, file transfer) simultaneously by listening on different ports.

1) Dissection of a TCP Segment

Overview
- Purpose: Analyzing TCP segments is crucial for troubleshooting network issues and understanding the inner workings of TCP traffic.
- Encapsulation:
  - Ethernet Frame: Encapsulates an IP datagram.
  - IP Datagram: Encapsulates a TCP segment.
  - TCP Segment: Contains a TCP header and a data section (payload).
Structure of a TCP Segment
- TCP Header: Contains several fields with specific functions.
- Data Section: The payload where application layer data is placed.
Fields in the TCP Header

Source Port:
- Definition: Port from which the segment originated.
- Purpose: Keeps track of outgoing connections and ensures data is returned to the correct application.
- Ephemeral Ports: Special range of ports used for source ports to distinguish between multiple outgoing connections.
Destination Port:
- Definition: Port of the service the traffic is intended for.
- Purpose: Directs traffic to the appropriate service (e.g., port 80 for HTTP).
Sequence Number:
- Definition: A 32-bit number used to track the order of segments in a data stream.
- Purpose: Ensures that TCP segments are reassembled in the correct order and manages data flow.
Acknowledgment Number:
- Definition: Indicates the number of the next expected segment.
- Purpose: Used for confirming receipt of segments and managing flow control (e.g., "Segment 1 received, expect Segment 2 next").
Data Offset:
- Definition: A four-bit number specifying the length of the TCP header.
- Purpose: Helps the receiving device determine where the data payload begins.
TCP Control Flags:
- Definition: Six bits reserved for control flags (e.g., SYN, ACK, FIN).
- Purpose: Used to manage the state and control of the TCP connection.
TCP Window:
- Definition: A 16-bit number that specifies the range of sequence numbers that can be sent before requiring an acknowledgment.
- Purpose: Manages flow control and ensures data is properly received before sending more data.
Checksum:
- Definition: A 16-bit number used for error checking.
- Purpose: Verifies the integrity of the TCP segment by comparing the calculated checksum with the value in the header.
Urgent Pointer:
- Definition: Points to the position of urgent data in the segment.
- Purpose: Indicates segments that need immediate processing (rarely used in modern networking).
Options Field:
- Definition: Contains optional fields for extended functionality.
- Purpose: Used for additional features such as flow control protocols (rarely used in practice).
Padding:

Definition: Sequence of zeros added to align the TCP header.
Purpose: Ensures that the data payload begins at the correct location according to the TCP header length.

2) TCP Control Flags and the Three-Way Handshake

Overview
- Purpose: TCP (Transmission Control Protocol) is used to establish and maintain reliable connections for long data transmissions.
- Contrast with Lower Layer Protocols: Unlike IP and Ethernet which handle individual packets, TCP manages a continuous stream of data segments.
TCP Control Flags
- Definition: Flags in the TCP header used to control the state and behavior of a TCP connection.
- Types of TCP Control Flags:
  1. URG (Urgent):
    - Purpose: Indicates that the segment contains urgent data.
    - Usage: The urgent pointer field will have additional data about the urgent content.
    - Adoption: Rarely used in modern networking.
  2. ACK (Acknowledgment):
    - Purpose: Signifies that the acknowledgment number field should be processed.
    - Function: Used to confirm receipt of data.
  3. PSH (Push):
    - Purpose: Requests immediate delivery of buffered data to the application.
    - Function: Ensures that data is pushed to the application promptly, bypassing intermediate buffers.
  4. RST (Reset):
    - Purpose: Resets the connection if there are errors or issues in processing segments.
    - Function: Indicates that one side of the connection cannot continue and will restart the process.
  5. SYN (Synchronize):
    - Purpose: Initiates a connection by synchronizing sequence numbers.
    - Function: Used during the establishment of a TCP connection to signal the start of a new session.
  6. FIN (Finish):
    - Purpose: Signals that the sender has finished sending data and wants to close the connection.
    - Function: Indicates that no more data will be sent, allowing for orderly connection termination.
Three-Way Handshake
- Purpose: Establishes a TCP connection between two devices.
- Process:
  1. Step 1 - SYN:
    - Initiator: Computer A
    - Action: Sends a TCP segment with the SYN flag set.
    - Message: "Let's establish a connection. Here is my sequence number."
  2. Step 2 - SYN/ACK:
    - Responder: Computer B
    - Action: Responds with a TCP segment with both SYN and ACK flags set.
    - Message: "Connection accepted. I acknowledge your sequence number and here is my own."
  3. Step 3 - ACK:
    - Initiator: Computer A
    - Action: Sends a final TCP segment with the ACK flag set.
    - Message: "Acknowledged your acknowledgment. We can now begin data transfer."
- Nickname: This sequence is commonly known as the "three-way handshake."
Connection State
- Full Duplex:
  - Definition: Both sides of the connection can send and receive data simultaneously.
  - ACKs: Each segment sent must be acknowledged with an ACK to confirm receipt.
Connection Termination

Four-Way Handshake:
1. Step 1 - FIN:
  - Initiator: The computer that wants to close the connection.
  - Action: Sends a TCP segment with the FIN flag set.
2. Step 2 - ACK:
  - Responder: Acknowledges with an ACK flag.
3. Step 3 - FIN:
  - Responder: If ready to close, sends a FIN flag.
4. Step 4 - ACK:
  - Initiator: Sends an ACK flag to acknowledge the final FIN.
Simplex Mode:

Definition: A connection might technically remain open if only one side closes it, but this is uncommon.

3) TCP Socket States

Definition: A TCP socket represents the endpoint of a TCP connection. It is instantiated by a program and involves the actual implementation of a connection as defined by the TCP protocol.
Ports vs. Sockets:
- Ports: Virtual descriptors used to direct traffic to specific services. Simply having a port number does not guarantee communication; a program must be listening on that port.
- Sockets: Concrete implementations of endpoints for TCP connections, requiring active programs to handle them.
Common TCP Socket States:
1. LISTEN:
  - Definition: The socket is actively waiting for incoming connection requests.
  - Occurrence: Typically observed on the server side.
2. SYN_SENT:
  - Definition: A synchronization request (SYN) has been sent to establish a connection, but a full connection has not been established yet.
  - Occurrence: Seen on the client side of the connection.
3. SYN_RECEIVED:
  - Definition: The socket was previously in the LISTEN state, has received a SYN request, and has responded with SYN/ACK, but has not yet received the final ACK from the client.
  - Occurrence: Seen on the server side after the initial SYN request is received.
4. ESTABLISHED:
  - Definition: The connection is fully established, and both sides can freely exchange data.
  - Occurrence: Present on both the client and server sides during an active connection.
5. FIN_WAIT:
  - Definition: A FIN (finish) signal has been sent to close the connection, but the acknowledgment (ACK) from the other end has not yet been received.
  - Occurrence: Seen on the side that initiated the closure of the connection.
6. CLOSE_WAIT:
  - Definition: The connection has been closed at the TCP layer, but the application has not yet released the socket.
  - Occurrence: Seen on the side that received the FIN signal and is waiting for the application to close the socket.
7. CLOSED:
  - Definition: The connection has been fully terminated, and no further communication is possible.
  - Occurrence: Final state when both sides have completed the termination process.
Variability:
- Other States: There are additional TCP socket states, and the exact names and definitions may vary depending on the operating system.
- Operating System Differences: While TCP as a protocol is standardized, how socket states are reported and described can differ between systems.
Troubleshooting Tips:

Check Socket States: Verify the exact definitions and names of socket states in the specific operating system you are working with.
Understand State Transitions: Knowing how sockets transition between states can help diagnose and resolve connectivity issues.

4) Connection-oriented and Connectionless Protocols

Definition: Protocols that establish a connection before data transmission and ensure reliable data delivery.
Characteristics:
- Connection Establishment: A connection must be set up before data can be transmitted. This involves a handshake process to establish the connection.
- Acknowledgments: Every segment of data sent is acknowledged by the receiving end. This ensures that both sides are aware of which data has been successfully received and which has not.
- Error Handling: If data is lost or corrupted, the protocol is responsible for retransmitting the data. This includes detecting errors, requesting retransmission, and ensuring the data is delivered correctly.
- Sequence Numbers: Used to keep track of data segments, allowing the receiving end to reassemble the data correctly even if segments arrive out of order.
- Overhead: Due to the connection setup, acknowledgments, and teardown processes, connection-oriented protocols like TCP introduce additional traffic and overhead.
Importance:
- Reliability: Ensures data is delivered accurately and completely, which is crucial in many applications where data integrity is essential.
- Error Protection: Protects against various issues like line errors, congestion, and other disruptions by ensuring data is properly transmitted and acknowledged.

Connectionless Protocols

Definition: Protocols that send data without establishing a connection or providing acknowledgments.
Characteristics:
- No Connection Setup: Data packets are sent directly to the destination without a prior connection setup.
- No Acknowledgments: There is no mechanism for confirming that the data has been received. Each packet is treated independently.
- Lower Overhead: Because there is no need for connection establishment or acknowledgment, connectionless protocols have less overhead, which can be beneficial for high-performance applications.
- Unreliable Delivery: Packets may be lost, duplicated, or arrive out of order, and it is up to the application layer to handle such issues if necessary.
Example:
- UDP (User Datagram Protocol): A common connectionless protocol used for applications where occasional data loss is acceptable.
  - Use Case: Streaming video or audio, where minor data loss does not significantly impact the overall quality of the experience.
  - Advantages: Reduces latency and increases throughput by eliminating the overhead associated with connection-oriented protocols.
Comparison:

Connection-oriented (e.g., TCP): Suitable for applications where data integrity and reliability are crucial, such as file transfers, email, and web browsing.
Connectionless (e.g., UDP): Suitable for applications where speed is more critical than reliability, such as real-time video streaming, online gaming, and voice-over-IP (VoIP).

5) Firewalls

Definition: A firewall is a network security device or software that monitors, filters, and controls incoming and outgoing network traffic based on predetermined security rules. Its primary function is to prevent unauthorized access to or from a network.
Purpose:
- Traffic Filtering: Blocks or allows traffic based on specific criteria to protect the network from threats and unauthorized access.
- Network Security: Serves as a barrier between a trusted internal network and an untrusted external network, such as the Internet.

Types of Firewalls

Network Firewalls:
- Definition: Dedicated hardware or software devices that protect entire networks.
- Functions:
  - Packet Filtering: Examines packets at the network layer and allows or blocks them based on source/destination IP addresses and port numbers.
  - Stateful Inspection: Monitors the state of active connections and makes decisions based on the context of traffic (e.g., allowing only packets that are part of an established connection).
  - Proxy Service: Acts as an intermediary between clients and servers, forwarding requests and responses, which can hide the internal network structure.
Host-based Firewalls:
- Definition: Software firewalls installed on individual computers or servers.
- Functions:
  - Application Filtering: Controls traffic based on specific applications and their ports.
  - Local Protection: Provides security directly on the host system, protecting it from both incoming and outgoing threats.
Application Layer Firewalls:
- Definition: Firewalls that operate at the application layer of the OSI model.
- Functions:
  - Deep Packet Inspection: Analyzes application data, such as HTTP or FTP traffic, to enforce security policies and block specific types of application-level threats.

Common Firewall Configurations

Port-Based Filtering:
- Description: Firewalls can be configured to allow or block traffic based on TCP or UDP port numbers.
- Example: A firewall may allow incoming traffic on port 80 (HTTP) for web access but block all other ports to protect sensitive internal services.
IP Address Filtering:
- Description: Firewalls can permit or deny traffic based on source or destination IP addresses.
- Example: Allowing traffic from trusted IP addresses while blocking unknown or potentially harmful IP addresses.
Protocol Filtering:
- Description: Firewalls can filter traffic based on the network protocol used (e.g., TCP, UDP, ICMP).
- Example: Blocking ICMP traffic to prevent ping-based network reconnaissance.

Firewall Placement and Integration

Perimeter Firewalls:
- Description: Placed at the boundary of the network, such as between a company's internal network and the Internet.
- Purpose: Provides a first line of defense against external threats and controls access to the internal network.
Internal Firewalls:
- Description: Positioned within the internal network to segment and protect different areas.
- Purpose: Provides additional security layers by controlling traffic between different network segments or departments.
Integrated Firewalls:
- Description: Many modern routers and network devices include built-in firewall functionality.
- Purpose: Combines routing and firewall capabilities in a single device, simplifying network security management.

Host-Based Firewalls

Functionality: Built into or installed on individual devices (computers, servers).
Benefits:
- Granular Control: Provides control over traffic specific to the device it is protecting.
- Complementary: Works alongside network firewalls to provide layered security.
Common Operating Systems with Built-in Firewalls:

Windows Firewall: Provides outbound and inbound traffic control.
macOS Firewall: Configurable via system preferences for specific applications and services.
Linux iptables: A flexible firewall configuration tool used to manage network traffic.

⭐The Application Layer

Definition: The application layer is the topmost layer in the network model and is responsible for handling high-level protocols and services that applications use to communicate over a network. It is where the actual data being transmitted is generated and interpreted by networked applications.
Purpose:
- Data Generation and Interpretation: It provides a set of protocols that define how data is formatted, transmitted, and received by applications.
- Application Interaction: Facilitates communication between applications running on different devices, ensuring that data is correctly understood and processed.

Role of the Application Layer

Data Payload:
- Contents: The payload in TCP segments at this layer can include a variety of data types, such as web page content, video streams, print jobs, or other application-specific data.
- Examples:
  - Web browsers use HTTP to request and receive web page content.
  - Email clients use protocols like SMTP, POP3, or IMAP to send and receive emails.
  - Streaming services use protocols such as RTSP (Real-Time Streaming Protocol) or HTTP for delivering video content.
Standardized Protocols:
- Importance: Protocols at the application layer ensure that different applications and devices can communicate effectively despite variations in software and hardware.
- Interoperability: Protocols standardize how data is formatted and exchanged, allowing diverse systems to understand each other and work together.

Common Application Layer Protocols

HTTP (Hypertext Transfer Protocol):
- Purpose: Used for transferring web pages and web content over the Internet.
- Usage: Web browsers (e.g., Chrome, Safari) and web servers (e.g., Apache, NGINX) use HTTP to communicate.
HTTPS (HTTP Secure):
- Purpose: A secure version of HTTP that uses encryption to protect data during transmission.
- Usage: Secure online transactions and communication.
FTP (File Transfer Protocol):
- Purpose: Used for transferring files between computers on a network.
- Usage: FTP clients and servers use this protocol to upload and download files.
SMTP (Simple Mail Transfer Protocol):
- Purpose: Used for sending emails between servers.
- Usage: Email servers and clients use SMTP to send messages.
IMAP (Internet Message Access Protocol) and POP3 (Post Office Protocol version 3):
- Purpose: Used for retrieving emails from a server.
- Usage: Email clients use IMAP or POP3 to access and download emails.
DNS (Domain Name System):
- Purpose: Translates domain names into IP addresses.
- Usage: DNS servers handle requests from applications to resolve domain names into IP addresses.

How Application Layer Protocols Ensure Communication

Protocol Specifications: Each application layer protocol has a detailed specification defining how data should be formatted and interpreted. This ensures that all parties in the communication understand the data in the same way.
Client-Server Model: Many application layer protocols follow a client-server model, where:
- Client: Requests data or services from a server.
- Server: Provides the requested data or services to the client.
Examples of Application Layer Communication:
- Web Browsing: A web browser (client) requests a web page from a web server (server) using HTTP.
- Email: An email client (client) sends an email to an email server (server) using SMTP.

Application Layer Protocols and Interoperability

Consistency: Standardized protocols allow different applications and devices to work together smoothly.
Compatibility: Regardless of the software or hardware used, as long as the protocols are followed correctly, communication can be successful.

1) The Application Layer and the OSI Model

Introduction:
- Network Models: In networking, there are various models used to describe how communication occurs between devices. While we've been working with a five-layer model, the OSI (Open Systems Interconnection) model is another commonly referenced framework.
OSI Model Overview:
- Purpose: The OSI model is a theoretical framework designed to standardize and describe network protocols and processes. It provides a more detailed and rigorous breakdown of network communication than simpler models.
Comparison with the Five-Layer Model:
- Five-Layer Model: Typically consists of the Physical, Data Link, Network, Transport, and Application layers.
- OSI Model: Expands on this with seven layers: Physical, Data Link, Network, Transport, Session, Presentation, and Application.

OSI Model Layers

Physical Layer:
- Function: Deals with the transmission of raw bit streams over physical media.
- Equivalent in Five-Layer Model: Physical layer.
Data Link Layer:
- Function: Manages node-to-node data transfer and handles error correction and frame synchronization.
- Equivalent in Five-Layer Model: Data Link layer.
Network Layer:
- Function: Handles routing and forwarding of data packets between devices across different networks.
- Equivalent in Five-Layer Model: Network layer.
Transport Layer:
- Function: Provides end-to-end communication services for applications, including error recovery and flow control.
- Equivalent in Five-Layer Model: Transport layer.
Session Layer:
- Function: Manages sessions or connections between applications, ensuring that data is properly organized and synchronized.
- Role in OSI: Facilitates communication between the application layer and transport layer by establishing, maintaining, and terminating sessions.
- Equivalent in Five-Layer Model: Functions are often integrated into the Application layer in the five-layer model.
Presentation Layer:
- Function: Ensures that data is presented in a format that the application layer can understand. Handles data encryption, decryption, compression, and translation.
- Role in OSI: Translates data between the application layer and the network format, handling issues like data encryption and compression.
- Equivalent in Five-Layer Model: Functions are often integrated into the Application layer in the five-layer model.
Application Layer:
- Function: Provides network services directly to end-user applications. Deals with high-level protocols like HTTP, FTP, SMTP, etc.
- Role in OSI: Facilitates application-to-application communication, including data exchange and network services.
- Equivalent in Five-Layer Model: Application layer encompasses the functionalities of the Session and Presentation layers.

Key Points

Encapsulation and Layering: In the OSI model, encapsulation and responsibilities are divided more granularly between the Session and Presentation layers. In contrast, the five-layer model often combines these functions into a single Application layer.
Practical Application: While the five-layer model is typically more practical for everyday networking and troubleshooting, the OSI model is useful for understanding the detailed, theoretical underpinnings of network communication.
Educational Value: Understanding both models provides a comprehensive view of how networks operate and prepares you for various certifications and academic contexts.

2) All the Layers Working in Unison

Scenario:

Network A: Address space 10.1.1.0/24
Network B: Address space 192.168.1.0/24
Network C: Address space 172.16.1.0/24

Devices:

Router A: Connects Network A and Network B
- IP on Network A: 10.1.1.1
- IP on Network B: 192.168.1.254
Router B: Connects Network B and Network C
- IP on Network B: 192.168.1.1
- IP on Network C: 172.16.1.1
Computer 1: On Network A, IP: 10.1.1.100
Computer 2: On Network C, IP: 172.16.1.100, running a web server on Port 80

1. Request Initiation from Computer 1

Action: User on Computer 1 enters 172.16.1.100 in a web browser to access a web page.
Application Layer: The web browser requests a connection to 172.16.1.100 on Port 80.

2. TCP Connection Establishment

Transport Layer:
- Computer 1’s networking stack creates a TCP segment with:
  - Source Port: 50,000 (ephemeral port)
  - Destination Port: 80
  - SYN Flag: Set to initiate the connection
- Sequence number and checksum are added.
Network Layer:
- IP Header:
  - Source IP: 10.1.1.100
  - Destination IP: 172.16.1.100
  - TTL: 64 (standard value)
  - Checksum for IP datagram calculated

3. Data Link Layer

Data Link Layer:
- ARP Request: Computer 1 sends an ARP request to find the MAC address of its gateway (10.1.1.1).
- Response: Router A responds with its MAC address (00:11:22:33:44:55).
Ethernet Frame Construction:
- Source MAC: Computer 1’s MAC
- Destination MAC: Router A’s MAC
- Payload: IP datagram with TCP segment

4. Physical Layer

Transmission:
- Ethernet frame sent as electrical signals over Cat 6 cable to a network switch.
- Switch Operation: Forwards frame based on destination MAC address to Router A.

5. Router A Processing

Data Link Layer:
- Router A receives the frame, verifies checksum, strips Ethernet header, and processes IP datagram.
Network Layer:
- Routing: Determines the next hop is Router B (IP: 192.168.1.1).
- TTL Decremented: New TTL value calculated.
- New IP Datagram: Created with updated TTL and checksum.
Data Link Layer:
- ARP Lookup: Finds MAC address of Router B’s interface (192.168.1.1).
- Ethernet Frame:
  - Source MAC: Router A’s MAC on Network B
  - Destination MAC: Router B’s MAC on Network B
  - Payload: Updated IP datagram

6. Router B Processing

Data Link Layer:
- Router B receives the frame, checks integrity, and processes the IP datagram.
Network Layer:
- Routing: Destination IP (172.16.1.100) is on the local network (Network C).
- TTL Decremented: New TTL value and checksum calculated.
- New IP Datagram: Created with updated TTL and checksum.
Data Link Layer:
- Ethernet Frame:
  - Source MAC: Router B’s MAC on Network C
  - Destination MAC: Computer 2’s MAC
  - Payload: Updated IP datagram

7. Computer 2 Processing

Data Link Layer:
- Frame Reception: Computer 2 receives the frame, verifies integrity, and strips Ethernet header.
Network Layer:
- IP Datagram Processing:
  - Checksum Verification
  - Destination IP: Matches Computer 2’s IP
  - TCP Segment Extraction
Transport Layer:
- TCP Processing:
  - Checksum Verification
  - SYN Flag Check: Computer 2 sees SYN flag, prepares to respond.
  - Sequence Number Storage: For acknowledgment in response.
Application Layer:
- Web Server Handling:
  - Port 80 is open, Apache server receives request, prepares SYN-ACK response.

8. Response to Computer 1

The process for sending the SYN-ACK from Computer 2 back to Computer 1 is similar:

Data is encapsulated in IP datagrams and Ethernet frames at Computer 2.
Routed through Router B and Router A back to Computer 1.
Each layer processes and verifies data, similar to the outbound process.

🚨Thanks for visiting classpdfindia✨

Welcome to a hub for 😇Nerds and knowledge seekers! Here, you'll find everything you need to stay updated on education, notes, books, and daily trends.

💗 Bookmark our site to stay connected and never miss an update!

💌 Have suggestions or need more content? Drop a comment below, and let us know what topics you'd like to see next! Your support means the world to us. 😍

CSE306: Computer Networks | Module 3 The Transport and Application Layers | The Bits and Bytes of Computer Networking | Google | Coursera