Objectives

• TCP connection establishment and termination.

• TCP timers.

• TCP timeout and retransmission.

• TCP interactive data flow, using telnet as an example.

• TCP bulk data flow, using sock as a traffic generator.

• Further comparison of TCP and UDP.

• Tuning the TCP/IP kernel.

• Study TCP flow control, congestion control, and error control using DBS and NIST Net.

TCP service

TCP is the transport layer protocol in the TCP/IP protocol family that provides a connection-oriented, reliable service to applications. TCP achieves this by incorporating the following features.

• Error control: TCP uses cumulative acknowledgements to report lost segments or out of order reception, and a time out and retransmission mechanism to guarantee that application data is received reliably.

• Flow control: TCP uses sliding window flow control to prevent the receiver buffer from overflowing.

• Congestion control: TCP uses slow start, congestion avoidance, and fast retransmit/fast recovery to adapt to congestion in the routers and achieve high throughput.

The TCP header, shown in Fig. 0.16, consists of fields for the implementation of the above functions. Because of its complexity, TCP only supports unicast, while UDP, which is much simpler, supports both unicast and multicast. TCP is widely used in internet applications, e.g., the Web (HTTP), email (SMTP), file transfer (FTP), remote access (telnet), etc.

Objectives

• The HyperText Transfer Protocol and the Apache web server.

• The Common Gateway Interface.

• The Dynamic Host Configuration Protocol.

• The Network Time Protocol.

• The Network Address Translator and the Port Address Translator.

• An introduction to socket programming.

The HyperText Transfer Protocol

The HyperText Transfer Protocol and the Web

In the early days of the Internet, email, FTP, and remote login were the most popular applications. The first World Wide Web (WWW) browser was written by Tim Berners-Lee in 1990. Since then, WWW has become the second “Killer App” after email. Its popularity resulted in the exponential growth of the Internet.

In WWW, information is typically provided as HyperText Markup Language (HTML) files (called web pages). WWW resources are specified by Uniform Resource Locators (URL), each consisting of a protocol name (e.g., http, rtp, rtsp), a “://”, a server domain name or server IP address, and a path to a resource (an HTML file or a CGI script (see Section 8.2.2)). The HyperText Transfer Protocol (HTTP) is an application layer protocol for distributing information in the WWW. In common with many other Internet applications, HTTP is based on the client–server architecture. An HTTP server, or a web server, uses the well-known port number 80, while an HTTP client is also called a web browser.

Objectives

• Study sock as a traffic generator, in terms of its features and command line options.

• Study the User Datagram Protocol.

• IP fragmentation.

• MTU and path MTU discovery.

• UDP applications, using the Trivial File Transfer Protocol as an example.

• Compare UDP with TCP, using TFTP and the File Transfer Protocol.

The User Datagram Protocol

Since the Internet protocol suite is often referred to as TCP/IP, UDP, it may seem, suffers from being considered the “less important” transport protocol. This perception is changing rapidly as realtime services, such as Voice over IP (VoIP), which use UDP become an important part of the Internet landscape. This emerging UDP application will be further explored in Chapter 7.

UDP provides a means of multiplexing and demultiplexing for user processes, usingUDP port numbers. It extends the host-to-host delivery service of IP to the application-to-application level. There is no other transport control mechanism provided by UDP, except a checksum which protects the UDP header (see Fig. 0.14), UDP data, and several IP header fields.

Objectives

• Multicast addressing.

• Multicast group management.

• Multicast routing: configuring a multicast router.

• Realtime video streaming using the Java Media Framework.

• Protocols supporting realtime streaming: RTP/RTCP and RTSP.

• Analyzing captured RTP/RTCP packets using Ethereal.

IP multicast

IP provides three types of services, i.e., unicast, multicast, and broadcast. Unicast is a point-to-point type of service with one sender and one receiver. Multicast is a one-to-many or many-to-many type of service, which delivers packets to multiple receivers. Consider a multicast group consisting of a number of participants, any packet sent to the group will be received by all of the participants. In broadcasts, IP datagrams are sent to a broadcast IP address, and are received by all of the hosts.

Figure 7.1 illustrates the differences between multicast and unicast. As shown in Fig. 7.1(a), if a node A wants to send a packet to nodes B, C, and D using unicast service, it sends three copies of the same packet, each with a different destination IP address. Then, each copy of the packet will follow a possibly different path from the other copies. To provide a teleconferencing-type service for a group of N nodes, there need to be N(N - 1)/2 point-to-point paths to provide a full connection.

Objectives

• Network interfaces and interface configuration.

• Network load and statistics.

• The Address Resolution Protocol and its operations.

• ICMP messages and Ping.

• Concept of subnetting.

• Duplicate IP addresses and incorrect subnet masks.

Local area networks

Generally there are two types of networks: point-to-point networks or broadcast networks. A point-to-point network consists of two end hosts connected by a link, whereas in a broadcast network, a number of stations share a common transmission medium. Usually, a point-to-point network is used for long-distance connections, e.g., dialup connections and SONET/SDH links. Local area networks are almost all broadcast networks, e.g., Ethernet or wireless local area networks (LANs).

Point-to-Point networks

The Point-to-Point Protocol (PPP) is a data link protocol for PPP LANs. The main purpose of PPP is encapsulation and transmission of IP datagrams, or other network layer protocol data, over a serial link. Currently, most dial-up Internet access services are provided using PPP.

PPP consists of two types of protocols. The Link Control Protocol (LCP) of PPP is responsible for establishing, configuring, and negotiating the datalink connection, while for each network layer protocol supported by PPP, there is a Network Control Protocol (NCP). For example, the IP Control Protocol (IPCP) is used for transmitting IP datagrams over a PPP link. Once the link is successfully established, the network layer data, i.e., IP datagrams, are encapsulate in PPP frames and transmitted over the serial link.

Objectives

• SNMP and MIBs, using NET-SNMP as an example, and using NETSNMP utilities to query MIB objects.

• Encryption, confidentiality, and authentication, including DES, RSA, MD5 and DSS.

• Application layer security, using SSH and Kerberos as examples.

• Transport layer security, including SSL and the secure Apache server.

• Network layer security, IPsec and Virtual Private Networks.

• Firewalls and IPTABLES.

• Accounting, auditing, and intrusion detection.

Network management

The Simple Network Management Protocol

In addition to configuring network devices when they are initially deployed, network management requires the performing of many tasks to run the network efficiently and reliably. A network administrator may need to collect statistics from a device to see if it is working properly, or monitor the network traffic load on the routers to see if the load is appropriately distributed. When there is a network failure, the administrator may need to go through the information collected from the nearby devices to identify the cause. The Simple Network Management Protocol (SNMP) is an application layer protocol for exchanging management information between network devices. It is the de facto network management standard in the Internet.

Figure 9.1 illustrates a typical SNMP management scenario, consisting of an SNMP manager and multiple managed devices. A managed device, e.g., a host computer or a router, maintains a number of Management Information Bases (MIB), which record local management related information.