Module Overview
21.1 TCP
Operation
21.1.1 TCP
operation
21.1.2
Synchronization or three-way handshake
21.1.3 Denial of
service attacks
21.1.4 Windowing
and window size
21.1.5 Sequencing
numbers
21.1.6 Positive
acknowledgments
21.1.7 UDP
operation
21.2 Overview of
Transport Layer Ports
21.2.1 Multiple
conversations between hosts
21.2.2 Ports for
services
21.2.3 Ports for
clients
21.2.4 Port
numbering and well-known port numbers
21.2.5 Example of
multiple sessions between hosts
21.2.6 Comparison
of MAC addresses, IP addresses, and port numbers
Module:
Summary
Overview
Routers use the
IP address information in an IP packet header to determine the interface to
which a packet should be switched based on its destination. Since IP does not
ensure that the packet reaches the destination, it is described as an
unreliable, connectionless protocol, that uses best-effort delivery. If packets
are dropped in route, arrive in the wrong order, or are transmitted faster than
the receiver can accept them, IP alone cannot correct the problem. To address
these problems, IP relies on TCP. This module describes TCP and its functions
and introduces UDP, another important Layer 4 protocol.
Each layer within
the OSI reference model has various functions. These functions are independent
of the other layers. Each layer expects to receive services from the layer
beneath it, and each layer provides certain services to the layer above it. The
application, presentation, and session layers of the OSI model, which are all
considered to be part of the application layer in the TCP/IP model, access the
services of the transport layer through logical entities called ports. This
module will introduce the concept of ports and will explain the critical
importance of ports and port numbers in data networking.
This module
covers some of the objectives for the CCNA 640-801, INTRO 640-821, and ICND
640-811 exams. -
Students who
complete this module should be able to perform the following tasks:
- Describe TCP and its functions
- Describe TCP synchronization
and flow control
- Describe UDP operation and
processes
- Identify common port numbers
- Describe multiple conversations
between hosts
- Identify ports used for
services and clients
- Describe port numbering and
well known ports
- Understand the differences and
the relationship between MAC addresses, IP addresses, and port numbers
21.1 TCP
Operation
21.1.1 TCP
operation
This page will
explain how the transport layer provides reliability and flow control.
IP addresses
allow for the routing of packets between networks. However, IP makes no
guarantees about delivery. The transport layer is responsible for the reliable
transport of and regulation of data flow from source to destination. This is
accomplished through the use of sliding windows and sequencing numbers along
with a synchronization process. This process ensures that each host is ready
and willing to communicate.
To understand reliability and
flow control, think of a student who studies a foreign language for one year.
Now imagine the student visits a country where the language is used. The
student must ask people to repeat their words for reliability and to speak
slowly for comprehension, which relates to the concept of flow control. The
transport layer, which is Layer 4 of the OSI model, uses TCP to provide these
services to Layer 5.
The next page
will describe the concept of synchronization.
21.1 TCP Operation
21.1.2 Synchronization or three-way handshake
This page will explain the
synchronization process that TCP uses. The process is also called a three-way
handshake.
TCP is a
connection-oriented protocol. Prior to data transmission, the two communicating
hosts go through a synchronization process to establish a virtual connection
for each session between hosts. This synchronization process ensures that both
sides are ready for data transmission and allows the devices to determine the initial
sequence numbers for that session. This process is known as a three-way
handshake. This is a three-step process that establishes the virtual connection
between the two devices. It is also important to note that the three-way
handshake is initiated by a client host. To establish a TCP session, the client
host will use the well-known port number of the service it wishes to contact on
a server host.
In step one, the
initiating host (client) sends a synchronization (SYN flag set) packet to
initiate a connection. This indicates that a packet has a valid initial
Sequence Number value in this segment for this session of x. The SYN bit set in
the header indicates a connection request. The SYN bit is single bit in the
code field of the TCP segment header. The Sequence Number is a 32 bit field TCP
segment header.
In step two, the
other host receives the packet, records the Sequence Number of x from the
client, and replies with an acknowledgment (ACK flag set). The ACK control bit
set indicates that the Acknowledgment Number field contains a valid
acknowledgment value. The ACK flag is a single bit in the code field of the TCP
segment header and the Acknowledgment Number is a 32 bit field TCP segment
header. Once a connection is established, the ACK flag is set for all segments
during the session. The Acknowledgment Number field contains the next sequence
number that this host is expecting to receive (x + 1). The Acknowledgment
Number of x + 1 means the host has received all bytes up to and including x,
and expects to next receive byte x + 1. The host also initiates a return
session. This includes a TCP segment with its own initial Sequence Number value
of y and with the SYN flag set.
In step three,
the initiating host responds with a simple Acknowledgment Number value of y +
1, which is the Sequence Number value of Host B + 1. This indicates that it
received the previous acknowledgment and finalizes the connection process for
this session.
It is important
to understand that initial sequence numbers are used to initiate communication
between two devices. They act as reference starting numbers between the two
devices. The sequence numbers give each host a way to acknowledge so that the
receiver knows the sender is responding to the proper connection request.
The Interactive
Media Activity will help students understand synchronization.
The next page
will discuss denial of service attacks.
21.1 TCP Operation
21.1.3 Denial of service attacks
This page will
teach students about denial of service (DoS) attacks. DoS attacks are designed
to deny services to legitimate hosts that try to establish connections. DoS
attacks are commonly used by hackers to halt system responses. One type of DoS
is known as SYN flooding. SYN flooding exploits the normal three-way handshake
and causes targeted devices to acknowledge to source addresses that will not
complete the handshake.
The three-way
handshake begins when the initiating host sends a SYN packet. The SYN packet
includes the source IP address and the destination IP address. This source and
destination address information is used by the recipient to send the
acknowledgment packet back to the initiating device.
In a DoS attack, the hacker
initiates a SYN but spoofs the source IP address. The waiting request is placed
in a connection queue or a holding area in memory. This wait state requires the
attacked device to use system resources, such as memory, until the connection
timer times out. Hackers will flood the attacked host with false SYN requests
to utilize all of its connection resources and prevent it from responding to
legitimate connection requests.
To defend against
these attacks, system administrators may decrease the connection timeout period
and increase the connection queue size. Software also exists that can detect
these types of attacks and initiate defensive measures.
The next page
will discuss the concept of windowing.
21.1 TCP Operation
21.1.4 Windowing and window size
This page will
explain how TCP uses windows to provide flow control.
The amount of
data that needs to be transmitted is often too large to be sent in a single
data segment. In this case, the data must be broken into smaller pieces to
allow for proper data transmission. TCP is responsible for breaking data into segments.
This can be compared to the way that small children are fed. Their food is cut
into smaller pieces that their mouths can accommodate. Additionally, a device
may not be able to receive data as quickly as the source can send it. The
device may be busy with other tasks or the sender may be a more robust device.
Once the data is
segmented, it must be transmitted to the destination device. One of the
services provided by TCP is flow control, which regulates how much data is sent
during a given transmission period. The process of flow control is known as
windowing.
Window size
determines the amount of data that can be transmitted at one time before the
destination responds with an acknowledgment. After a host transmits the
window-sized number of bytes, the host must receive an acknowledgment that the
data has been received before it can send any more data. For example, if the
window size is 1, each byte must be acknowledged before the next byte is sent.
TCP utilizes
windowing to dynamically determine transmission size. Devices negotiate a
window size to allow a specific number of bytes to be transmitted before an
acknowledgment.
This process of
dynamically varying the window size increases reliability. The window size can
be varied based upon acknowledgments.
The Interactive
Media Activity will help students understand the concept of windowing.
The next page
describes TCP sequence numbers.
21.1 TCP Operation
21.1.5 Sequencing numbers
This page
explains how TCP uses sequence numbers for reliable data transmissions.
TCP breaks data
into segments. After the synchronization process occurs and the window size has
been established, the data segments are transported from the sender to the
receiver. The data segments must be reassembled after all the data is received.
There is no guarantee that the data will arrive in the order it was
transmitted. TCP applies sequence numbers to the data segments that are
transmitted so that the receiver can reassemble the bytes in their original
order. This way, if TCP segments arrive out of order, the segments will still
be assembled correctly.
These sequencing numbers also
act as reference numbers so that the receiver will know if it has received all
of the data. They also identify the missing data pieces to the sender so it can
retransmit the missing data. This offers
increased efficiency since the sender only needs to resend the missing segments
instead of the entire set of data.
Each TCP segment
is numbered before transmission.
The sequence number
portion comes after the destination port in the segment format. At the
receiving station, TCP uses the sequence numbers to reassemble the segments
into a complete message. If a sequence number is missing in the series, that
segment is retransmitted.
The next page
discusses positive acknowledgments.
21.1
TCP Operation
21.1.6 Positive acknowledgments
This page
explains how positive acknowledgments are used to enhance reliability.
Acknowledgment is
a common step in the synchronization process, which includes sliding windows
and data sequencing. In a TCP segment, the sequence number field is followed by
the Acknowledgment Number field. This
field is where tracking of transmitted and received bytes are indicated.
One problem with
the IP protocol is that there is no verification method to determine if data
segments reach their destination. So data segments may be constantly forwarded
with no knowledge as to whether or not they were actually received. TCP uses
positive acknowledgment and retransmission (PAR) to control data flow and
confirm data delivery.
Many protocols use PAR to
provide reliability. With PAR, the source sends a packet, starts a timer, and
waits for an acknowledgment before it sends the next packet in the session. If
the timer expires before the source receives an acknowledgment, the source
retransmits the packet and resets the timer. The acknowledgment is provided by
the value of Acknowledgment Number and the ACK flag set in the TCP header. TCP
uses expectational acknowledgment in which the Acknowledgment Number value
refers to the next octet that is expected as part of the TCP session.
Windowing is a
flow control mechanism that requires the source device to receive an
acknowledgment from the destination after a specific amount of data bytes has
been transmitted. With a window size of three, the source device can send three
octets to the destination. It must then wait for an acknowledgment of these
bytes. If the destination receives the three octets, it sends an acknowledgment
to the source device, which can then transmit three more octets. If the
destination does not receive the three octets, it does not send an
acknowledgment. This may be caused by overflowing buffers or packets lost in
transit. Since the source does not receive an acknowledgment, it knows that the
octets should be retransmitted and that the window size should be reduced. This
window size reduction provides the receiving host less bytes to process from
its buffers before more data arrives. This effectively slows the communication
between hosts to provide more reliability between the hosts.
The Lab Activity
will teach students how to enable and monitor multiple host sessions. The
Interactive Media Activity will help students become more familiar with windows.
The next page
will explain how UDP works.
21.1
TCP Operation
21.1.7 UDP operation
This page will
explain the similarities and differences between TCP and UDP.
The TCP/IP
protocol stack contains many different protocols, each designed to perform a
certain task. IP provides Layer 3 connectionless transport through an
internetwork. TCP enables connection-oriented, reliable transmission of packets
at Layer 4 of the OSI model. UDP provides connectionless, unreliable
transmission of packets at Layer 4 of the OSI model.
Both TCP and UDP
use IP as their Layer 3 protocol. In addition, TCP and UDP are used by various
application layer protocols. TCP provides services for applications such as
FTP, HTTP, SMTP, and DNS. UDP is the transport layer protocol used by DNS,
TFTP, SNMP, and DHCP.
TCP must be used when
applications need to guarantee that a packet arrives intact, in sequence, and
unduplicated. The overhead necessary to ensure delivery of a packet is
sometimes a problem with TCP. Not all applications need to guarantee delivery
of the data packet, so they use the faster, connectionless delivery mechanism
afforded by UDP. The UDP protocol standard is described in RFC 768.
UDP does not use
windowing or ACKs so application layer protocols must provide error detection.
The Source Port
field is an optional field used only if information needs to return to the
sending host. When a destination router receives a routing update, the source
router is not requesting anything so nothing needs to return to the source. The
Destination Port field specifies the application to which UDP needs to pass the
data. A DNS request from a host to a DNS server would have a Destination Port
field of 53, the UDP port number for DNS. The Length field identifies the number
of octets in the UDP segment. The UDP checksum is optional but should be used
to ensure that the data has not been damaged during transmission. For transport
across the network, UDP is encapsulated within the IP packet.
Once a UDP
segment arrives at the destination IP address, a mechanism must exist which
allows the receiving host to determine the exact destination application.
Destination ports are used for this purpose. If a host is running both TFTP and
DNS services, it must be able to determine what service the arriving UDP
segments need. The Destination Port field in the UDP header determines the
application to which a UDP segment will be delivered.
This page
concludes this lesson. The next lesson will provide an overview of transport
layer ports. The first page describes multiple conversations between hosts.
21.2
Overview of Transport Layer Ports
21.2.1 Multiple conversations between hosts
This page will
explain how hosts handle multiple conversations at the same time.
At any given
moment, thousands of packets that provide hundreds of different services travel
through a modern network. Many servers use a multitude of services and this
causes unique problems for the addressing of packets. If a server is running
both SMTP and HTTP, it uses the destination port field to determine what
service the source is requesting. The source cannot construct a packet destined
for just the server IP address because the destination would not know what
service was being requested. A port number
must be associated with the conversation between hosts to ensure that the
packet reaches the appropriate service on the server. If a server could not
distinguish between different conversations, a client could not send an e-mail
and browse a Web page at the same time. A method for transport layer
conversations to be separated must be used.
Hosts running
TCP/IP associate ports at the transport layer with certain applications. Port
numbers are used to keep track of different conversations that cross the network
at the same time. Port numbers are needed for a host to communicate with a
server that uses multiple services. Both TCP and UDP use port or socket numbers
to pass information to the upper layers.
Application
software developers have agreed to use the well-known port numbers that are
defined in RFC1700. Any conversation bound for the FTP application uses the
standard port number 21. Conversations
that do not involve applications with well-known port numbers are assigned port
numbers that have been randomly selected from within a specific range. These
port numbers are used as source and destination addresses in the TCP segment.
Port numbers have
the following assigned ranges:
- The Well Known Ports are those
from 0 through 1023
- The Registered Ports are those
from 1024 through 49151
- The Dynamic and/or Private
Ports are those from 49152 through 65535
Systems initiating
communication requests use port numbers to select proper applications. Source
port numbers for these requests are dynamically assigned by the originating
host, and are usually a number larger than 1023. Port numbers in the range of
0-1023 are considered public port numbers and are controlled by the Internet
Assigned Numbers Authority (IANA).
Post office box
numbers are a good analogy for port numbers. A piece of mail may be sent to a
zip code, city, and P.O. box. The zip code and city direct mail to the correct
general mail facility while the P.O. box ensures the item is delivered to the
one individual to whom the mail is addressed. Similarly, the IP address gets
the packet to the correct server, but the TCP or UDP port number guarantees the
packet is passed to the correct application.
The next page
will discuss well-known ports.
21.2 Overview of Transport Layer Ports
21.2.2 Ports for services
This page introduces port
numbers that are used for different services.
Services running
on hosts must have a port number assigned to them so communication can occur. A
remote host attempting to connect to a service expects that service to use
specific transport layer protocols and ports. Some ports, which are defined in
RFC 1700, are known as the well-known ports. These ports are reserved in both
TCP and UDP.
These well-known
ports define applications that run above the transport layer protocols. For
example, a server that runs FTP will use ports 20 and 21 to forward TCP
connections from clients to its FTP application. This allows the server to
determine which service a client requests. TCP and UDP use port numbers to
determine the correct service to which requests are forwarded.
The next page
will discuss ports in greater detail.
21.2 Overview of Transport Layer Ports
21.2.3 Ports for clients
This page will
discuss source ports, which are set by clients.
Whenever a client
connects to a service on a server, a source and destination port must be
specified. TCP and UDP segments contain fields for source and destination
ports. Destination ports, or ports for
services, are normally defined using the well-known ports. Source ports set by
the client are determined dynamically.
In general, a client determines
the source port by randomly assigning a number above 1023. For example, a
client that attempts to communicate with a Web server will use TCP and assign
the destination port as 80 and the source port as 1045. When the packet arrives
at the server, it moves up to the transport layer and eventually to the HTTP
service, which operates at port 80. The HTTP server responds to the clients
request with a segment that uses port 80 as the source and 1045 as the
destination. Clients and servers use ports to distinguish which process each
segment is associated with.
The next page
will teach students about the three categories of port numbers.
21.2 Overview of Transport Layer Ports
21.2.4
Port numbering and well-known port numbers
This page will
discuss the three categories of port numbers.
Port numbers are
represented by 2 bytes in the header of a TCP or UDP segment. This 16-bit value
can result in port numbers ranging from 0 to 65535. The three categories of
port numbers are well-known ports, registered ports, and dynamic or private
ports. The first 1023 ports are well-known ports. These ports are used for
well-known network services such as FTP, Telnet, or DNS.
Registered ports
range from 1024 to 49151. Ports between 49152 and 65535 are defined as dynamic
or private ports.
The Interactive Media Activity
will help students become more familiar with port numbers.
The next page
will give an example of multiple sessions.
21.2 Overview of Transport Layer Ports
21.2.5 Example of multiple sessions between
hosts
This page will
explain how port numbers are used to track multiple sessions that can occur
between hosts. The source and destination port numbers combine with the network
address to form a socket. A pair of sockets, one on each host, forms a unique
connection. For instance, a host might have a Telnet connection through port 23
and an Internet connection through port 80. The IP and the MAC addresses would
be the same because the packets are received from the same host. Therefore,
each conversation on the source side needs its own port number, and each
service requested needs its own port number.
In the Lab
Activity, students will enable HTTP on a router and observe well-known ports.
The next page
will discuss the three types of addresses.
21.2
Overview of Transport Layer Ports
21.2.6 Comparison of MAC addresses, IP addresses,
and port numbers
This page will
describe the three types of addresses in reference to the OSI model. Port
numbers are located at the transport layer and are serviced by the network
layer. The network layer assigns the logical address, or IP address, and is
then serviced by the data link layer, which assigns the physical address, or
MAC address.
A good analogy can be made with
a normal letter. The address on a letter consists of a name, street, city, and
state. These can be compared to the port, MAC, and IP address used for network
data. The name on the envelope would be equivalent to a port number, the street
address is the MAC, and the city and state is the IP address. Multiple letters
can be mailed to the same street address, city and state, but contain different
names on the letters. For instance, two letters could be mailed to the same
house with one addressed to “John Doe” and the other to “Jane Doe”. This is
analogous to multiple sessions with different port numbers.
This page
concludes this lesson. The next page will summarize the main points from this
module.
Summary
This page
summarizes the topics discussed in this module.
The transport layer of the OSI
model is responsible for the reliable transport and regulation of data flow
from a source to a destination. TCP makes sure that each host on the network is
ready and willing to communicate.
A three-way
handshake is a process that ensures that each side is ready for data
transmission and allows each device to determine the initial sequence number. A
three-way handshake starts with a host initiating a connection. The other host
receives a packet, records a sequence number and then replies with an ACK. The
initiating host then responds back and finalizes the connection.
DoS attacks are
designed to deny services to legitimate hosts that attempt to establish
connections. It is used by hackers to halt system response. SYN flooding is one
type of DoS attack. It exploits the normal three-way handshake and causes
targeted devices to ACK to source addresses that will not complete the
handshake. Spoofing occurs when a receiving device replies to a non-existent,
unreachable IP address and is placed in a wait state until it receives the
final ACK from the initiator. In addition to software specifically created as a
defense against these kinds of attacks, an administrator can decrease the
connection timeout period and increase the connection queue size.
Breaking data
into smaller pieces is called segmenting and is done with TCP. Once the data is
segmented, it must be transmitted to the destination device. TCP applies
sequence numbers to the data segments so that the receiver can reassemble the
bytes properly and the sender knows when all the segments have been received.
Windowing is the process of flow control that regulates how much data is sent
during a given transmission period. TCP uses a sliding window when determining
transmission size. A sliding window allows for devices to negotiate a window
size to allow for more than one byte to be sent during a single transmission.
Many protocols
use PAR to provide reliability. With PAR, the source sends a packet, starts a
timer, and waits for an ACK before it sends the next packet. If the timer
expires before the source receives an ACK, the source retransmits the packet
and resets the timer. TCP uses expectational ACKs in which the Acknowledgment
Number refers to the next octet that is expected.
UDP provides
connectionless, non-guaranteed transmission of packets at Layer 4 of the OSI
model. Since UDP does not use windowing or acknowledgments, application layer
protocols must provide error detection.
A port number
must be associated with the conversation between hosts to ensure that the
packet reaches the appropriate service on the server. Port numbers have the
following assigned ranges:
- The Well Known Ports are those
from 0 through 1023
- The Registered Ports are those
from 1024 through 49151
- The Dynamic and/or Private
Ports are those from 49152 through 65535
The three methods of addressing
include port numbers, which are located at the transport layer and serviced by
the network layer. The network layer assigns the logical or IP address and the
data link layer assigns the physical or MAC address.
No comments:
Post a Comment