Lecture 2-TCP-IP Protocols (view only).pptx

TCP/IP PROTOCOLS
Dr. Shaima’ Safa aldin
Computer Networks’ Protocols

To find out about:
1. Hyper-Text-Transfer & Secure Protocols: HTTP & HTTPS
2. Simple Mail Transfer, Post Office & Internet Message Access
Protocols: SMTP, POP & IMAP
3. Domain Name Service: DNS
4. Dynamic Host Control Protocol: DHCP
5. File Transfer Protocol & Server Message Block: FTP & SMB
6. Address Resolution Protocol: ARP
7. IP Control Messaging: ICMP
8. Network & Port Address Translations: NAT & PAT
Topic’s objectives

TCP/IP Layer Protocols
• The TCP/IP application protocols specify the format
and control information necessary for many common
internet communication functions.
• Application layer protocols are used by both the
source and destination devices during a
communication session.
• For the communications to be successful, the
application layer protocols that are implemented on
the source and destination host must be compatible.

Web and Email Protocols
Hypertext Transfer Protocol and
Hypertext Markup Language
When a web address or Uniform Resource Locator (URL) is
typed into a web browser, the web browser establishes a
connection to the web service. The web service is running on
the server that is using the HTTP protocol.
To better understand how the web browser and web server
interact, examine how a web page is opened in a browser.
Step 1
The browser interprets the three parts of the URL:
• http (the protocol or scheme)
• www.cisco.com (the server name)
• index.html (the specific filename requested)

Step 2
The browser then checks
with a name server to
convert www.cisco.com into
a numeric IP address,
which it uses to connect to
the server.
The client initiates an HTTP
request to a server by
sending a GET request to
the server and asks for the
index.html file.
Step 3
In response to the request, the
server sends the HTML code for
this web page to the browser.

Step 4
The browser deciphers the HTML code and formats the page for the
browser window.

HTTP and HTTPS
HTTP is a request/response
protocol that specifies the
message types used for that
communication.
The three common message
types are GET, POST, and PUT:
• GET - This is a client request
for data. A client (web
browser) sends the GET
message to the web server
to request HTML pages.
• POST - This uploads data
files to the web server, such
as form data.
• PUT - This uploads resources
or content to the web
server, such as an image.
Note: HTTP is not a secure protocol.
For secure communications sent
across the internet, HTTPS should
be used.

Email Protocols
Email is a store-and-forward method
of sending, storing, and retrieving
electronic messages across a
network. Email messages are stored
in databases on mail servers. Email
clients communicate with mail
servers to send and receive email.
The email protocols used for
operation are:
• Simple Mail Transfer Protocol
(SMTP) – used to send mail.
• Post Office Protocol (POP) &
IMAP – used for clients to receive
mail.

SMTP, POP and IMAP
• When a client sends email, the
client SMTP process connects
with a server SMTP process on
well-known port 25.
• After the connection is made,
the client attempts to send the
email to the server across the
connection.
• When the server receives the
message, it either places the
message in a local account, if
the recipient is local, or
forwards the message to
another mail server for
delivery.
• The destination email server
may not be online or may be
busy. If so, SMTP spools
messages to be sent at a later
time.
Note: SMTP message formats require a
message header (recipient email
address & sender email address) and a
message body.

POP is used by an application to retrieve mail from a mail server. When mail is
downloaded from the server to the client using POP the messages are then deleted
on the server.
• The server starts the POP service by
passively listening on TCP port 110 for
client connection requests.
• When a client wants to make use of
the service, it sends a request to
establish a TCP connection with the
server.
• When the connection is established,
the POP server sends a greeting.
• The client and POP server then
exchange commands and responses
until the connection is closed or
aborted.
Note: Since POP does not store messages, it is not
recommended for small businesses that need a centralized
backup solution.
SMTP, POP and IMAP
(Cont.)

SMTP, POP and IMAP
(Cont.)
IMAP is another protocol
that describes a method to
retrieve email messages.
• Unlike POP, when a user
connects to an IMAP
server, copies of the
messages are
downloaded to the client
application. The original
messages are kept on the
server until manually
deleted.
• When a user decides to
delete a message, the
server synchronizes that
action and deletes the
message from the server.

IP Addressing Services
Domain Name Service
• Domain names were created to convert the
numeric IP addresses into a simple,
recognizable name.
• Fully-qualified domain names (FQDNs), such
as http://www.cisco.com, are much easier
for people to remember than 198.133.219.25.
• The DNS protocol defines an automated
service that matches resource names with
the required numeric network address. It
includes the format for queries, responses,
and data.
1
2
3
4
5

DNS Message Format
The DNS server stores different types of resource records that
are used to resolve names. These records contain the name,
address, and type of record.
Some of these record types are as follows:
• A - An end device IPv4 address
• NS - An authoritative name server
• AAAA - An end device IPv6 address (pronounced quad-A)
• MX - A mail exchange record
When a client makes a query, the server DNS process first
looks at its own records to resolve the name. If it is unable to
resolve the name by using its stored records, it contacts
other servers to resolve the name.
After a match is found and returned to the original
requesting server, the server temporarily stores the
numbered address in the event that the same name is
requested again.

DNS Message Format
(Cont.)
DNS uses the same message format between
servers, consisting of a question, answer,
authority, and additional information for all types
of client queries and server responses, error
messages, and transfer of resource record
information.
DNS message section Description
Question The question for the name server
Answer Resource Records answering the question
Authority Resource Records pointing toward an authority
Additional Resource Records holding additional information

DNS Hierarchy
• DNS uses a hierarchical system to create a database to provide name resolution.
• Each DNS server maintains a specific database file and is only responsible for managing
name-to-IP mappings for that small portion of the entire DNS structure.
• When a DNS server receives a request for a name translation that is not within its DNS zone,
the DNS server forwards the request to another DNS server within the proper zone for
translation.
• Examples of top-level domains:
• .com - a business or industry
• .org - a non-profit organization
• .au - Australia

The nslookup Command
• Nslookup is a computer
operating system utility that
allows a user to manually
query the DNS servers
configured on the device to
resolve a given host name.
• This utility can also be used to
troubleshoot name resolution
issues and to verify the current
status of the name servers.
• When the nslookup command
is issued, the default DNS server
configured for your host is
displayed.
• The name of a host or domain
can be entered at
the nslookup prompt.

Dynamic Host Configuration
Protocol
• The Dynamic Host Configuration Protocol
(DHCP) for IPv4 service automates the
assignment of IPv4 addresses, subnet
masks, gateways, and other IPv4
networking parameters.
• DHCP is considered dynamic addressing
compared to static addressing. Static
addressing is manually entering IP
address information.
• When a host connects to the network,
the DHCP server is contacted, and an
address is requested. The DHCP server
chooses an address from a configured
range of addresses called a pool and
assigns (leases) it to the host.
• Many networks use both DHCP and static
addressing. DHCP is used for general
purpose hosts, such as end user devices.
Static addressing is used for network
devices, such as gateway routers,
switches, servers, and printers.
Note: DHCP for IPv6 (DHCPv6) provides similar
services for IPv6 clients. However, DHCPv6
does not provide a default gateway address. This
can only be obtained dynamically from the
Router Advertisement message of the router.

DHCP Operation
The DHCP Process:
• When an IPv4, DHCP-configured device boots up
or connects to the network, the client broadcasts a
DHCP discover (DHCPDISCOVER) message to
identify any available DHCP servers on the network.
• A DHCP server replies with a DHCP offer
(DHCPOFFER) message, which offers a lease to the
client. (If a client receives more than one offer due
to multiple DHCP servers on the network, it must
choose one.)
• The client sends a DHCP request (DHCPREQUEST)
message that identifies the explicit server and lease
offer that the client is accepting.
• The server then returns a DHCP acknowledgment
(DHCPACK) message that acknowledges to the
client that the lease has been finalized.
• If the offer is no longer valid, then the selected
server responds with a DHCP negative
acknowledgment (DHCPNAK) message and the
process must begin with a new DHCPDISCOVER
message.
Note: DHCPv6 has a set of messages that is similar to those for
DHCPv4. The DHCPv6 messages are SOLICIT, ADVERTISE,
INFORMATION REQUEST, and REPLY.

File Sharing Services
File Transfer Protocol
FTP was developed to allow for data transfers between a client and a
server. An FTP client is an application which runs on a computer that is
being used to push and pull data from an FTP server.
Step 1 - The client establishes the first
connection to the server for control traffic
using TCP port 21. The traffic consists of
client commands and server replies.
Step 2 - The client establishes the
second connection to the server for the
actual data transfer using TCP port 20.
This connection is created every time
there is data to be transferred.
Step 3 - The data transfer can happen in
either direction. The client can download
(pull) data from the server, or the client
can upload (push) data to the server.

File Sharing Services
Server Message Block
The Server Message Block (SMB) is
a client/server, request-response
file sharing protocol. Servers can
make their own resources
available to clients on the network.
Three functions of SMB messages:
• Start, authenticate, and terminate
sessions
• Control file and printer access
• Allow an application to send or receive
messages to or from another device
Unlike the file sharing supported by
FTP, clients establish a long-term
connection to servers. After the
connection is established, the user
of the client can access the
resources on the server as though
the resource is local to the client
host.

There are two primary addresses assigned to a device on an
Ethernet LAN:
• Layer 2 physical address (the MAC address) – Used for NIC
to NIC communications on the same Ethernet network.
• Layer 3 logical address (the IP address) – Used to send the
packet from the source device to the destination device.
Layer 2 addresses are used to deliver frames from one NIC to
another NIC on the same network. If a destination IP address is
on the same network, the destination MAC address will be
that of the destination device.
MAC and IP
Destination on Same Network

When the destination IP address is on a remote network, the
destination MAC address is that of the default gateway.
• ARP is used by IPv4 to associate the IPv4 address of a
device with the MAC address of the device NIC.
• ICMPv6 is used by IPv6 to associate the IPv6 address of a
device with the MAC address of the device NIC.
MAC and IP
Destination on Remote Network

A device uses ARP to
determine the destination
MAC address of a local
device when it knows its IPv4
address.
ARP provides two basic
functions:
• Resolving IPv4 addresses to
MAC addresses
• Maintaining an ARP table
of IPv4 to MAC address
mappings
ARP
ARP Overview

To send a frame, a device will search its ARP table for a
destination IPv4 address and a corresponding MAC address.
• If the packet’s destination IPv4 address is on the same
network, the device will search the ARP table for the
destination IPv4 address.
• If the destination IPv4 address is on a different network,
the device will search the ARP table for the IPv4 address
of the default gateway.
• If the device locates the IPv4 address, its corresponding
MAC address is used as the destination MAC address in
the frame.
• If there is no ARP table entry is found, then the device
sends an ARP request.
ARP
ARP Functions

• Entries in the ARP table are not permanent and are removed
when an ARP cache timer expires after a specified period of
time.
• The duration of the ARP cache timer differs depending on the
operating system.
• ARP table entries can also be removed manually by the
administrator.
ARP
Removing Entries from an ARP Table

• The show ip arp command displays the ARP table on a
Cisco router.
• The arp –a command displays the ARP table on a
Windows 10 PC.
ARP
ARP Tables on Networking Devices
R1# show ip arp
Protocol Address Age (min) Hardware Addr Type Interface
Internet 192.168.10.1 - a0e0.af0d.e140 ARPA GigabitEthernet0/0/0
C:UsersPC> arp -a
Interface: 192.168.1.124 --- 0x10
Internet Address Physical Address Type
192.168.1.1 c8-d7-19-cc-a0-86 dynamic
192.168.1.101 08-3e-0c-f5-f7-77 dynamic

• ARP requests are received and processed by every device on the local
network.
• Excessive ARP broadcasts can cause some reduction in performance.
• ARP replies can be spoofed by a threat actor to perform an ARP
poisoning attack.
• Enterprise level switches include mitigation techniques to protect against
ARP attacks.
ARP
ARP Issues – ARP Broadcasting and ARP Spoofing

INTERNET CONTROL MESSAGE
PROTOCOL (ICMP)

ICMP Messages
ICMPv4 & ICMPv6 Messages
• Internet Control Message Protocol (ICMP) provides feedback
about issues related to the processing of IP packets under certain
conditions.
• ICMPv4 is the messaging protocol for IPv4. ICMPv6 is the
messaging protocol for IPv6 and includes additional functionality.
• The ICMP messages common to both ICMPv4 and ICMPv6 include:
• Host reachability
• Destination or Service Unreachable
• Time exceeded
Note: ICMPv4 messages are not required and are often not allowed
within a network for security reasons.

ICMP Messages
Host Reachability
ICMP Echo Message can be used to test the reachability of a host
on an IP network.
In the example:
• The local host sends an ICMP Echo Request to a host.
• If the host is available, the destination host responds with an
Echo Reply.

ICMP Messages
Destination or Service Unreachable
• An ICMP Destination Unreachable message can be used to notify the
source that a destination or service is unreachable.
• The ICMP message will include a code indicating why the packet could
not be delivered.
A few Destination
Unreachable codes for
ICMPv4 are as follows:
• 0 - Net unreachable
• 1 - Host unreachable
• 2 - Protocol unreachable
• 3 - Port unreachable
A few Destination Unreachable
codes for ICMPv6 are as follows:
• 0 - No route to destination
• 1 - Communication with the destination
is administratively prohibited (e.g.,
firewall)
• 2 – Beyond scope of the source
address
• 3 - Address unreachable
• 4 - Port unreachable
Note: ICMPv6 has similar but slightly different codes for Destination Unreachable messages

ICMP Messages
Time Exceeded
• When the Time to Live (TTL) field in a packet is decremented to
0, an ICMPv4 Time Exceeded message will be sent to the
source host.
• ICMPv6 also sends a Time Exceeded message. Instead of the
IPv4 TTL field, ICMPv6 uses the IPv6 Hop Limit field to determine
if the packet has expired.
Note: Time Exceeded messages are used by the traceroute tool.

ICMP Error Messages
Sent when a router determines that a packet cannot be
delivered.
It is specified whether destination host is unreachable or the
network
Type (3) Code (0 to 12) Checksum
Identifier Sequence Number
Optional data
. . .
0 8 16 31

When a router discards a packet due to lack of buffer space, it
sends a source quench message to the source host (so that it
slows down)
Type (4) Code Checksum
Optional data
. . .
0 8 16 31
ICMP Error Messages

Type (11) Code (0 or 1) Checksum
Optional data
. . .
0 8 16 31
1) When Time to Live (TTL) is decremented to zero,
2) When Reassembly timer expires before all fragments arrive
at dest.
“Time exceeded” ICMP message sent to datagram source in two
cases:
ICMP Error Messages

Optional data
. . .
0 8 16 31
Any of the datagram’s parameter is
incorrect
ICMP Error Messages

Type (5) Code (0 to 3) Checksum
Optional data
. . .
0 8 16 31
Sent if a router determines that a host has incorrectly sent
datagram that should be sent to different router
Redirect can specify either a change for a host or complete
network
ICMP Error Messages

Used by the ping command to
determine connectivity between
two end-points
Type (8 or 0) Code Checksum
Optional data
. . .
0 8 16 31
ICMP Error Messages

Type (13 or 14) Code Checksum
Optional data
. . .
0 8 16 31
Used for requesting and replying with the
system’s time
ICMP Error Messages

Used by hosts at boot up to get
information about subnet mask
being used
Type (17or 18) Code (0) Checksum
Optional data
. . .
0 8 16 31
ICMP Error Messages

Used by a host to solicit the services of a
router
Optional data
. . .
0 8 16 31
ICMP Error Messages

Ping and Traceroute Tests
Ping – Test Connectivity
• The ping command is an IPv4 and IPv6 testing utility that uses ICMP
echo request and echo reply messages to test connectivity
between hosts and provides a summary that includes the success
rate and average round-trip time to the destination.
• If a reply is not received within the timeout, ping provides a
message indicating that a response was not received.
• It is common for the first ping to timeout if address resolution (ARP or
ND) needs to be performed before sending the ICMP Echo Request.

Ping the Loopback
Ping can be used to test the
internal configuration of IPv4
or IPv6 on the local host. To
do this, ping the local
loopback address of
127.0.0.1 for IPv4 (::1 for IPv6).
• A response from 127.0.0.1
for IPv4, or ::1 for IPv6,
indicates that IP is properly
installed on the host.
• An error message indicates
that TCP/IP is not
operational on the host.

Ping the Default Gateway
The ping command can be
used to test the ability of a host
to communicate on the local
network.
The default gateway address is
most often used because the
router is normally always
operational.
• A successful ping to the default gateway
indicates that the host and the router
interface serving as the default gateway
are both operational on the local
network.
• If the default gateway address does not
respond, a ping can be sent to the IP
address of another host on the local
network that is known to be operational.

Ping a Remote Host
Ping can also be used to test the
ability of a local host to
communicate across an
internetwork.
A local host can ping a host on a
remote network. A
successful ping across the
internetwork confirms
communication on the local
network.
Note: Many network administrators limit or prohibit the entry of ICMP messages therefore, the
lack of a ping response could be due to security restrictions.

Traceroute – Test the Path
• Traceroute (tracert) is a utility
that is used to test the path
between two hosts and
provide a list of hops that
were successfully reached
along that path.
• Traceroute provides round-trip
time for each hop along the
path and indicates if a hop
fails to respond. An asterisk (*)
is used to indicate a lost or
unreplied packet.
• This information can be used
to locate a problematic router
in the path or may indicate
that the router is configured
not to reply.
Note: Traceroute makes use of a function of the
TTL field in IPv4 and the Hop Limit field in IPv6 in
the Layer 3 headers, along with the ICMP Time
Exceeded message.

Traceroute – Test the Path
(Cont.)
• The first message sent from
traceroute will have a TTL field
value of 1. This causes the TTL
to time out at the first router.
This router then responds with
a ICMPv4 Time Exceeded
message.
• Traceroute then progressively
increments the TTL field (2, 3,
4...) for each sequence of
messages. This provides the
trace with the address of each
hop as the packets time out
further down the path.
• The TTL field continues to be
increased until the destination
is reached, or it is incremented
to a predefined maximum.

NAT Characteristics
IPv4 Private Address Space
• Private IP addresses are used within
an organization and home networks.
Did you ever notice
how all your labs
were based on
these addresses?
These are the IP addresses you will see
assigned to company devices.

NAT Characteristics
What is NAT?
• Private IP addresses cannot be routed over
the Internet.
• NAT is used to translate private IP addresses
used inside a company to public addresses
that can be routed over the Internet.
• NAT hides internal IPv4 addresses from
outside networks.
• A NAT-enabled router can be configured
with a public IPv4 address.
Important Concept—NAT is enabled on
one device (normally the border or edge
router)
A NAT-enabled router can be configured with multiple public IPv4 addresses to be
used in a pool or NAT pool for internal devices configured with private addresses.

NAT Characteristics
NAT Terminology
• Four types of addresses: inside,
outside, local, and global
• Always consider the device
that is having its private
address translated to
understand this concept.
• Inside address – address of
the company network
device that is being
translated by NAT
• Outside address – IP address
of the destination device
• Local address – any address
that appears on the inside
portion of the network
• Global address – any
address that appears on the
outside portion of the
network

NAT Characteristics
NAT Terminology (Cont.)

NAT Advantages
Advantages of NAT
• Conserves the legally registered addressing scheme
• Every company can use the private IP addresses
• Increases the flexibility of connections to the public network
• Multiple NAT pools, backup pools, and load-balancing across
NAT pools
• Provides consistency for internal network addressing
schemes
• Do not have to readdress the network if a new ISP or public IP
address is assigned
• Provides network security
• Hides user private IPv4 addresses

NAT Advantages
Disadvantages of NAT
• Performance is degraded.
• The NAT-enabled border device must track and process each session
destined for an external network.
• End-to-end functionality is degraded.
• Translation of each IPv4 address within the packet headers takes time.
• End-to-end IP traceability is lost.
• Some applications require end-to-end addressing and cannot be
used with NAT.
• Static NAT mappings can sometimes be used.
• Troubleshooting can be more challenging.
• Tunneling becomes more complicated.
• Initiating TCP connections can be disrupted.

ITN:
• Chapter 15 – Application
Layer
• Chapter 13 - ICMP
• Chapter 9 - Address
Resolution
References

Lecture 2-TCP-IP Protocols (view only).pptx

More Related Content

Similar to Lecture 2-TCP-IP Protocols (view only).pptx (20)

More from ShaimasafaaldinBahaa1 (6)

Recently uploaded (20)

Lecture 2-TCP-IP Protocols (view only).pptx

Editor's Notes