Intermediate TCPIP

1
Intermediate TCP/IP

• Module 10
• CCNA 2 - Version 3.0

2
IP Review

• IP
• Does not provide any services to help insure that
  the packet actually reaches the destination
• Unreliable
• Connectionless
• Uses best-effort delivery
• IP relies upon Transmission Control Protocol
  (TCP) to correct transmission problems
• The Transport Layer is responsible for reliable
  transport and regulation of data flow from source
  to destination
• Accomplished using
• sliding windows
• sequencing numbers
• synchronization process that ensures each host is
  ready and willing to communicate

3
TCP Operation

• TCP is a Transport Layer protocol responsible for
  breaking data into segments
• Data must be broken into smaller pieces to allow
  for proper data transmission
• Once the data is segmented, it must be
  transmitted to the destination device
• TCP handles flow control, which regulates how
  much data is sent during a given transmission
  period
• The process of flow control is known as windowing

4
TCP Segment Fields
NOTE Sequence and Acknowledgment Number fields
not present in UDP Segment
5
Windowing

• Window size determines the amount of data that
  can be transmitted at one time w/o an
  acknowledgment from the destination
• TCP utilizes a sliding window when determining
  transmission size
• A sliding window allows for devices to negotiate
  a window size
• A sliding window allows the destination device to
  indicate to the source a need to decrease or
  increase the amount of data being sent

6
Three-Way Open Handshake

• TCP is a connection-oriented protocol
• Prior to data transmission, hosts go through a
  synchronization process to establish a virtual
  connection
• Establishes a round-trip connection bet.
  sender/receiver before data is ent
• This process is known as a three-way handshake

7
Simple Windowing
Window Size 1
Window Size 3
8
Denial of Service Attacks (DoS)

• Denial of service (DoS) attacks are designed to
  deny services to legitimate hosts attempting to
  establish connections
• One type of DoS is known as SYN flooding
• A hacker sends a packets (initiates a
  synchronization) but spoofs the source IP address
• Spoofing is a term used when the receiving device
  replies to a non-existent, unreachable IP address
  (the device is placed in a wait-state while
  waiting to receive the final ACK from the
  initiator)
• This waiting state requires the attacked device
  to commit system resources, such as memory, until
  the connection timer times out
• To defend against DoS attacks, system
  administrators may
• decrease the connection timeout period
• increase the connection queue size

9
TCP Sequencing

• Each TCP segment is numbered before transmission
• At the receiving station, TCP uses the sequence
  numbers to reassemble the segments into a
  complete message to provide reliable delivery
• If a sequence number is missing in the series,
  that segment is re-transmitted
• This increases efficiency
• the sender only needs to re-transmit the missing
  segments instead of the entire set of data

10
PAR (Positive Acknowledgement and Retransmission)

• Positive acknowledgment and retransmission (PAR)
  is a common technique many protocols use to
  provide reliability
• the source sends a packet, starts a timer, and
  waits for an acknowledgment before sending the
  next packet
• If the timer expires before the source receives
  an acknowledgment, the source retransmits the
  packet and starts the timer over again
• TCP uses expectational acknowledgments in which
  the acknowledgment number refers to the next
  octet that is expected

11
The TCP/IP Protocol Stack

• TCP must be used when applications need to
  guarantee that a packet arrives intact, in
  sequence, and unduplicated
• Applications that do not need to guarantee
  delivery of the data packet use the faster,
  connectionless delivery mechanism afforded by UDP

12
UDP (User Datagram Protocol)

• UDP is a simple protocol that exchanges segments
  without acknowledgments or guaranteed delivery
• UDP does not use windowing or acknowledgments so
  application layer protocols must provide error
  detection
• The Destination Port field in the UDP header
  determines the application to which a UDP segment
  will be delivered
• UDP segments do not contain sequence or
  acknowledgement fields
• The checksum field provides for error checking

A UDP Segment
13
TCP or UDP?

• Protocols that use TCP
• SMTP
• FTP
• HTTP
• DNS
• Protocols that use UDP
• SNMP
• TFTP
• DHCP
• DNS

14
Port Numbers

• If a client wants to send both an email and
  browse a web page using one server at the same
  time, a method for separating transport layer
  conversations must be used
• If a server is running both SMTP and WWW, it uses
  the destination port field to determine what
  service the source is requesting
• Both TCP and UDP segments contain fields for
  source and destination ports
• A port number must be associated with the
  conversation between hosts to ensure that the
  packet reaches the appropriate service on the
  server
• Port numbers are used to keep track of different
  conversations that cross the network at the same
  time

15
More on Port Numbers

• Both TCP and UDP use port or socket numbers to
  pass information to the upper layers
• Allows host to determine which application should
  receive the segment
• Source port numbers are dynamically assigned by
  the source host - usually a number larger than
  1023
• Port numbers in the range of 0-1023 are
  controlled by the Internet Assigned Numbers
  Authority (IANA)
• Port numbers have the following assigned ranges
• Numbers below 255 are reserved for public
  applications (well-known)
• Numbers from 255-1023 are assigned to companies
  for marketable applications
• Numbers above 1023 are unregulated

16
From IANAs Website

• Port numbers are divided into three ranges
• Well Known Ports are those from 0 through 1023
• Registered Ports are those from 1024 through
  49151
• Dynamic and/or Private Ports are those from 49152
  through 65535

17
How does it work?
Source port number dynamically assigned from
range above 1023
Destination port number applies to the
appropriate application
18
Sockets

• Port numbers are used to track multiple sessions
  that can occur between hosts
• The source and destination port numbers combine
  with the network address to form a socket
• A pair of sockets, one on each host, forms a
  unique connection

19
Common Port Numbers
20
Port, IP and MAC addresses

• Port s located at the transport layer but
  serviced by the network layer
• IP logical address assigned by network layer
  but serviced by data link layer
• MAC physical addressed assigned by data link
• Analogy
• Name on env. port
• City/state IP address
• Street Address MAC address

21
Intermediate TCP/IP

• Module 11
• CCNA 2 Version 3.0

THE END