Monday, December 10, 2007

TCP/IP Works

TCP/IP protocol layers

The OSI model

How TCP/IP protocols interact

TCP/IP is a system (or suite) of protocols, and a protocol is a system of rules and procedures. For the most part, the hardware and software of the communicating computers carry out the rules of TCP/IP communications—the user does not have to get involved with the details. Still, a working knowledge of TCP/IP is essential if you want to navigate through the configuration and troubleshooting problems you'll face with TCP/IP networks.

This hour describes the TCP/IP protocol system and shows how the components of TCP/IP work together to send and receive data across the network.

At the completion of this hour, you will be able to

Describe the layers of the TCP/IP protocol system and the purpose of each layer

Describe the layers of the OSI protocol model and explain how the OSI layers relate to TCP/IP

Explain TCP/IP protocol headers and how data is enclosed with header information at each layer of the protocol stack

Name the data package at each layer of the TCP/IP stack

Discuss the TCP, UDP, and IP protocols and how they work together to provide TCP/IP functionality
The TCP/IP Protocol System
Before looking at the elements of TCP/IP, it is best to begin with a brief review of the responsibilities of a protocol system.

A protocol system such as TCP/IP must be responsible for the following tasks:

Dividing messages into manageable chunks of data that will pass efficiently through the transmission medium.

Interfacing with the network adapter hardware.

Addressing: The sending computer must be capable of targeting data to a receiving computer. The receiving computer must be capable of recognizing a message that it is supposed to receive.

Routing data to the subnet of the destination computer, even if the source subnet and the destination subnet are dissimilar physical networks.

Performing error control, flow control, and acknowledgment: For reliable communication, the sending and receiving computers must be able to identify and correct faulty transmissions and control the flow of data.

Accepting data from an application and passing it to the network.

Receiving data from the network and passing it to an application.

To accomplish the preceding tasks, the creators of TCP/IP settled on a modular design. The TCP/IP protocol system is divided into separate components that theoretically function independently from one another. Each component is responsible for a piece of the communication process.

The advantage of this modular design is that it lets vendors easily adapt the protocol software to specific hardware and operating systems. For instance, the Network Access layer (as you'll learn in Hour 3, "The Network Access Layer") includes functions relating to a specific LAN architecture, such as token ring or ethernet. Because of TCP/IP's modular design, a vendor such as Microsoft does not have to build a completely different software package for token ring TCP/IP (as opposed to ethernet TCP/IP) networks. The upper layers are not affected; only the Network Access layer must change.

The TCP/IP protocol system is subdivided into layered components, each of which performs specific duties (see Figure 2.1). This model, or stack, comes from the early days of TCP/IP, and it is sometimes called the TCP/IP model. The official TCP/IP protocol layers and their functions are described in the following list.

Figure 2.1. The TCP/IP model's protocol layers.


Compare the functions in the list with the responsibilities listed earlier in this section, and you'll see how the responsibilities of the protocol system are distributed among the layers.

By the Way

The four-layer model shown in Figure 2.1 is a common model for describing TCP/IP networking, but it isn't the only model. The ARPAnet model, for instance, as described in RFC 871, describes three layers: the Network Interface layer, the Host-to-Host layer, and the Process-Level/Applications layer. Other descriptions of TCP/IP call for a five-layer model, with Physical and Data Link layers in place of the Network Access layer (to match OSI). Still other models might exclude either the Network Access or the Application layer, which are less uniform and harder to define than the intermediate layers.

The names of the layers also vary. The ARPAnet layer names still appear in some discussions of TCP/IP, and the Internet layer is sometimes called the Internetwork layer or the Network layer.

This book uses the four-layer model, with names shown in Figure 2.1.



Network Access layer— Provides an interface with the physical network. Formats the data for the transmission medium and addresses data for the subnet based on physical hardware addresses. Provides error control for data delivered on the physical network.

Internet layer— Provides logical, hardware-independent addressing so that data can pass among subnets with different physical architectures. Provides routing to reduce traffic and support delivery across the internetwork. (The term internetwork refers to an interconnected, greater network of LANs, such as what you find in a large company or on the Internet.) Relates physical addresses (used at the Network Access layer) to logical addresses.

Transport layer— Provides flow control, error control, and acknowledgment services for the internetwork. Serves as an interface for network applications.

Application layer— Provides applications for network troubleshooting, file transfer, remote control, and Internet activities. Also supports the network Application Programming Interfaces (APIs) that enable programs written for a particular operating environment to access the network.

Part II, "The TCP/IP Protocol System," provides more detailed descriptions of the activities at each of these TCP/IP protocol layers.

When the TCP/IP protocol software prepares a piece of data for transmission across the network, each layer on the sending machine adds a layer of information to the data that will be relevant to the corresponding layer on the receiving machine. For instance, the Internet layer of the computer sending the data adds a header with some information that is significant to the Internet layer of the computer receiving the message. This process is sometimes referred to as encapsulation. At the receiving end these headers are removed as the data is passed up the protocol stack.

By the Way

The term layer is used throughout the computer industry for protocol component levels such as the ones shown in Figure 2.1. Header information is applied in layers to the data as it passes through the components of the protocol stack. (You'll learn more about this later in this hour.) When it comes to the components themselves, however, the term layer is somewhat metaphorical.

Diagrams such as Figure 2.1 are meant to show that the data passes across a series of interfaces. As long as the interfaces are maintained, the processes within one component are not affected by the processes in other components. If you turned Figure 2.1 sideways, it would look more like an assembly line, and this is also a useful analogy for the relationship of the protocol components. The data stops at each point in the line and, as long as it arrives at each point as specified, the components can operate independently.
TCP/IP and the OSI Model
The networking industry has a standard seven-layer model for network protocol architecture called the Open Systems Interconnection (OSI) model. The OSI model represents an effort by ISO, an international standards organization, to standardize the design of network protocol systems to promote interconnectivity and open access to protocol standards for software developers.

TCP/IP was already on the path of development when the OSI standard architecture appeared and, strictly speaking, TCP/IP does not conform to the OSI model. However, the two models did have similar goals, and there was enough interaction among the designers of these standards that they emerged with a certain compatibility. The OSI model has been very influential in the growth and development of protocol implementations, and it is quite common to see the OSI terminology applied to TCP/IP. Figure 2.2 shows the relationship between the four-layer TCP/IP standard and the seven-layer OSI model. Note that the OSI model divides the duties of the Application layer into three layers: Application, Presentation, and Session. OSI splits the activities of the Network Interface layer into a Data Link layer and a Physical layer. This increased subdivision adds some complexity, but it also adds flexibility for developers by targeting the protocol layers to more specific services.

Figure 2.2. The seven-layer OSI model.


The seven layers of the OSI model are as follows:

Physical layer— Converts the data into the stream of electric or analog pulses that will actually cross the transmission medium and oversees the transmission of the data.

Data Link layer— Provides an interface with the network adapter; maintains logical links for the subnet.

Network layer— Supports logical addressing and routing.

Transport layer— Provides error control and flow control for the internetwork.

Session layer— Establishes sessions between communicating applications on the communicating computers.

Presentation layer— Translates data to standard format; manages encryption and data compression.

Application layer— Provides a network interface for applications; supports network applications for file transfer, communications, and so forth.

It is important to remember that the TCP/IP model and the OSI model are standards, not implementations. Real-world implementations of TCP/IP, do not always map cleanly to the models shown in Figures 2.1 and 2.2, and the perfect correspondence depicted in Figure 2.2 is also a matter of some discussion within the industry.

Notice that the OSI and TCP/IP models are most similar at the important Transport and Internet (called Network in OSI) layers. These layers include the most identifiable and distinguishing components of the protocol system, and it is no coincidence that protocol systems are sometimes named for their Transport and Network layer protocols. As you'll learn later in this book, the TCP/IP protocol suite is named for TCP, a Transport layer protocol, and IP, an Internet/Network layer protocol.
Data Packages
The important thing to remember about the TCP/IP protocol stack is that each layer plays a role in the overall communication process. Each layer invokes services that are necessary for that layer to perform its role. As an outgoing transmission passes down through the stack, each layer includes a bundle of relevant information called a header along with the actual data. The little data package containing the header and the data then becomes the data that is repackaged at the next lower level with the next lower layer's header. This process is shown in Figure 2.3. The reverse process occurs when data is received on the destination computer. As the data moves up through the stack, each layer unpacks the corresponding header and uses the information.

Figure 2.3. At each layer, the data is repackaged with that layer's header.


As the data moves down through the stack, the effect is a little like the nested Russian wooden dolls you might have seen; the innermost doll is enclosed in another doll, which is then enclosed in another doll, and so on. At the receiving end, the data packages will be unpacked, one by one, as the data climbs back up the protocol stack. The Internet layer on the receiving machine will use the information in the Internet layer header. The Transport layer will use the information in the Transport layer header. At each layer, the package of data takes a form that will provide the necessary information to the corresponding layer on the receiving machine. Because each layer is responsible for different functions, the form of the basic data package is very different at each layer.

By the Way

The networking industry has as many analogies as it has acronyms, and the Russian doll analogy, like any of the others, illustrates a point, but must not be taken too far. It is worth noting that on a physical network such as ethernet, the data is typically broken into smaller units at the Network Access layer. A more accurate analogy would call for this lowest layer to break the concentric doll system into smaller pieces, encapsulate those pieces into tinier dolls, then grind those tiny dolls into a pattern of ones and zeros. The ones and zeros will be received, reconstituted into tiny dolls, and rebuilt into the concentric doll system. The complexity of this scenario causes many to eschew the otherwise-promising analogy of the dolls.



The data packet looks different at each layer, and at each layer it goes by a different name. The names for the data packages created at each layer are as follows:

The data package created at the Application layer is called a message.

The data package created at the Transport layer, which encapsulates the Application layer message, is called a segment if it comes from the Transport layer's TCP protocol. If the data package comes from the Transport layer's UDP protocol, it is called a datagram.

The data package at the Internet layer, which encapsulates the Transport layer segment, is called a datagram.

The data package at the Network Access layer, which encapsulates and may subdivide the datagram, is called a frame. This frame is then turned into a bitstream at the lowest sublayer of the Network Access layer.

You'll learn more about the data packages for each layer in Part II.

TCP/IP

Hour 1. What Is TCP/IP?
What You'll Learn in This Hour:

Networks and network protocols

History of TCP/IP

Important features of TCP/IP

TCP/IP is a protocol system—a collection of protocols that support network communications. The answer to the question What is a protocol? must begin with the question What is a network?

This hour describes what a network is and shows why networks need protocols. You'll also learn what TCP/IP is, what it does, and where it began.

At the completion of this hour, you'll be able to

Define the term network

Explain what a network protocol suite is

Explain what TCP/IP is

Discuss the history of TCP/IP

List some important features of TCP/IP

Identify the organizations that oversee TCP/IP and the Internet

Explain what RFCs are and where to find them

Networks and Protocols
A network is a collection of computers or computer-like devices that can communicate across a common transmission medium, as shown in Figure 1.1.

Figure 1.1. A typical local network.


In a network, requests and data from one computer pass across the transmission medium (which might be a network cable or a phone line) to another computer. In Figure 1.1, computer A must be able to send a message or request to computer B. Computer B must be able to understand computer A's message and respond to it by sending a message back to computer A.

A computer interacts with the world through one or more applications that perform specific tasks and manage input and output. If that computer is part of a network, some of those applications must be capable of communicating with applications on other network computers. A network protocol is a system of common rules that helps define the complex process of transferring data. The data travels from an application on one computer, through the computer's network hardware, across the transmission medium to the correct destination, and up through the destination computer's network hardware to a receiving application (see Figure 1.2).

Figure 1.2. The role of a network protocol suite.


The protocols of TCP/IP define the network communication process and, more importantly, define how a unit of data should look and what information it should contain so that a receiving computer can interpret the message correctly. TCP/IP and its related protocols form a complete system defining how data should be processed, transmitted, and received on a TCP/IP network. A system of related protocols, such as the TCP/IP protocols, is called a protocol suite.

The actual act of formatting and processing TCP/IP transmissions is performed by a software component known as the vendor's implementation of TCP/IP. For instance, Microsoft TCP/IP is a software component that enables Windows computers to process TCP/IP-formatted data and thus to participate in a TCP/IP network. As you read this book, be aware of the following distinction:

A TCP/IP standard is a system of rules defining communication on TCP/IP networks.

A TCP/IP implementation is a software component that performs the functions that enable a computer to participate in a TCP/IP network.

The purpose of the TCP/IP standards is to ensure the compatibility of all TCP/IP implementations regardless of version or vendor.

By the Way

The important distinction between the TCP/IP standards and a TCP/IP implementation is often blurred in popular discussions of TCP/IP, and this is sometimes confusing for readers. For instance, authors often talk about the layers of the TCP/IP model providing services for other layers. In fact, it is not the TCP/IP model that provides services. The TCP/IP model defines the services that should be provided. The vendor software implementations of TCP/IP actually provide these services.
The Development of TCP/IP
Present-day TCP/IP networking represents the synthesis of two developments that began in the 1970s and have subsequently revolutionized the world of computing:

The Internet

The local area network

The Internet
TCP/IP's design is a result of its historical role as the protocol system for what was to become the Internet. The Internet, like so many other high-tech developments, grew from research originally performed by the United States Department of Defense. In the late 1960s, Defense Department officials began to notice that the military was accumulating a large and diverse collection of computers. Some of those computers weren't networked, and others were grouped in small, closed networks with incompatible proprietary protocols.

Proprietary, in this case, means that the technology is controlled by a private entity (such as a corporation). That entity might not have any interest in divulging enough information about the protocol so that users can use it to connect to other (rival) network protocols.

Defense officials began to wonder if it would be possible for these disparate computers to share information. Accustomed as they were to considerations of security, the Defense Department reasoned that, if such a network were possible, it would likely become a target for military attack. One of the primary requirements of this new network, therefore, was that it must be decentralized. Critical services must not be concentrated in a few vulnerable failure points. Because every failure point is vulnerable in the age of the missile, they wanted a network with no failure points at all—where a bomb could land on any part of the infrastructure without bringing down the whole network. These visionary soldiers created a network that became known as ARPAnet, named for the Defense Department's Advanced Research Projects Agency (ARPA). The protocol system that supported this interconnectable, decentralized network was the beginning of what we now know as TCP/IP.

A few years later, when the National Science Foundation wanted to build a network to connect research institutions, it adopted ARPAnet's protocol system and began to build what we know as the Internet. As you'll learn later in this book, the original decentralized vision of ARPAnet survives to this day in the design of the TCP/IP protocol system and is a big part of the success of TCP/IP and the Internet.

Two important features of TCP/IP that provide for this decentralized environment are as follows:

End node verification— The two computers that are actually communicating—called the end nodes because they are at each end of the chain passing the message—are responsible for acknowledging and verifying the transmission. All computers basically operate as equals, and there is no central scheme for overseeing communications.

Dynamic routing— Nodes are connected through multiple paths, and the routers choose a path for the data based on present conditions. You'll learn more about routing and router paths in later hours.

The Local Area Network (LAN)
As the Internet began to emerge around universities and research institutions, another network concept, the local area network (LAN) was also taking form. LANs developed along with the computer industry and were a response to the need for offices to share computer resources.

Early LAN protocols did not provide Internet access and were designed around proprietary protocol systems. Many did not support routing of any kind. Eventually, some companies began to want a protocol that would connect their incompatible, noncontiguous LANs, and they looked to TCP/IP. As the Internet became more popular, LAN users began to clamor for Internet access, and a variety of solutions began to emerge for getting LAN users connected. Specialized gateways provided the protocol translation necessary for these local networks to reach the Internet. Gradually, LAN software vendors began to provide more complete support for TCP/IP. Recent versions of NetWare, Mac OS, and Windows have continued to expand the role of TCP/IP on local networks. TCP/IP grew up around Unix, and all Unix variants are fluent in TCP/IP. The recent popularity of Unix-based systems such as Linux, BSD, Solaris, and Apple OS X has increased the dominance of TCP/IP in the networking world.

By the Way

The term gateway is used inconsistently in discussions of TCP/IP. A gateway is sometimes just an ordinary router that connects a LAN to a larger network (see the discussion of routers later in this hour), and sometimes the term is used to refer to a routing device that performs some form of protocol translation.



As you'll learn in Hour 3, "The Network Access Layer," the need to accommodate local area networks has caused considerable innovation in the implementation of the hardware-conscious protocols that underlie TCP/IP.

TCP/IP Features
TCP/IP includes many important features that you'll learn about in this book. In particular, pay close attention to the way the TCP/IP protocol suite addresses the following problems:

Logical addressing

Routing

Name service

Error control and flow control

Application support

These issues are at the heart of TCP/IP. The following sections introduce these important features. You'll learn more about these features later in this book.

Logical Addressing
A network adapter has a unique and permanent physical address. The physical address is a number that was given to the card at the factory. On a local area network, low-lying hardware-conscious protocols deliver data across the physical network using the adapter's physical address. There are many network types, and each has a different way of delivering data. On a basic ethernet network, for example, a computer sends messages directly onto the transmission medium. The network adapter of each computer listens to every transmission on the local network to determine whether a message is addressed to its own physical address.

By the Way

As you'll learn in Hour 9, "Network Hardware," today's ethernet networks are a bit more complicated than the idealized scenario of a computer sending messages directly onto the transmission line. Ethernet networks sometimes contain hardware devices such as switches and hubs to manage the signal.



On large networks, of course, every network adapter can't listen to every message. (Imagine your computer listening to every piece of data sent over the Internet.) As the transmission medium becomes more populated with computers, a physical addressing scheme cannot function efficiently. Network administrators often segment networks using devices such as routers to reduce network traffic. On routed networks, administrators need a way to subdivide the network into smaller subnetworks (called subnets) and impose a hierarchical design so that a message can travel efficiently to its destination. TCP/IP provides this subnetting capability through logical addressing. A logical address is an address configured through the network software. In TCP/IP, a computer's logical address is called an IP address. As you'll learn in Hour 4, "The Internet Layer," and Hour 5, "Subnetting," an IP address can include

A network ID number identifying a network

A subnet ID number identifying a subnet on the network

A host ID number identifying the computer on the subnet

The IP addressing system also lets the network administrator impose a sensible numbering scheme on the network so that the progression of addresses reflects the internal organization of the network.

By the Way

If your network is isolated from the Internet, you are free to use any IP addresses you want (as long as your network follows the basic rules for IP addressing). If your network will be part of the Internet, however, Internet Corporation for Assigned Names and Numbers (ICANN), which was formed in 1998, will assign a network ID to your network, and that network ID will form the first part of the IP address.

TCP/IP Features
TCP/IP includes many important features that you'll learn about in this book. In particular, pay close attention to the way the TCP/IP protocol suite addresses the following problems:

Logical addressing

Routing

Name service

Error control and flow control

Application support

These issues are at the heart of TCP/IP. The following sections introduce these important features. You'll learn more about these features later in this book.

Logical Addressing
A network adapter has a unique and permanent physical address. The physical address is a number that was given to the card at the factory. On a local area network, low-lying hardware-conscious protocols deliver data across the physical network using the adapter's physical address. There are many network types, and each has a different way of delivering data. On a basic ethernet network, for example, a computer sends messages directly onto the transmission medium. The network adapter of each computer listens to every transmission on the local network to determine whether a message is addressed to its own physical address.

By the Way

As you'll learn in Hour 9, "Network Hardware," today's ethernet networks are a bit more complicated than the idealized scenario of a computer sending messages directly onto the transmission line. Ethernet networks sometimes contain hardware devices such as switches and hubs to manage the signal.



On large networks, of course, every network adapter can't listen to every message. (Imagine your computer listening to every piece of data sent over the Internet.) As the transmission medium becomes more populated with computers, a physical addressing scheme cannot function efficiently. Network administrators often segment networks using devices such as routers to reduce network traffic. On routed networks, administrators need a way to subdivide the network into smaller subnetworks (called subnets) and impose a hierarchical design so that a message can travel efficiently to its destination. TCP/IP provides this subnetting capability through logical addressing. A logical address is an address configured through the network software. In TCP/IP, a computer's logical address is called an IP address. As you'll learn in Hour 4, "The Internet Layer," and Hour 5, "Subnetting," an IP address can include

A network ID number identifying a network

A subnet ID number identifying a subnet on the network

A host ID number identifying the computer on the subnet

The IP addressing system also lets the network administrator impose a sensible numbering scheme on the network so that the progression of addresses reflects the internal organization of the network.

By the Way

If your network is isolated from the Internet, you are free to use any IP addresses you want (as long as your network follows the basic rules for IP addressing). If your network will be part of the Internet, however, Internet Corporation for Assigned Names and Numbers (ICANN), which was formed in 1998, will assign a network ID to your network, and that network ID will form the first part of the IP address. (See Hours 4 and 5.)



In TCP/IP, a logical address is resolved to and from the corresponding hardware-specific physical address using the ARP and RARP protocols, which are discussed in Hour 4.

Routing
A router is a special device that can read logical addressing information and direct data across the network to its destination. At the simplest level, a router divides a local subnet from the larger network (see Figure 1.3).

Figure 1.3. A router connecting a LAN to a large network.


Data addressed to another computer or device on the local subnet does not cross the router and therefore doesn't clutter up the transmission lines of the greater network. If data is addressed to a computer outside the subnet, the router forwards the data accordingly. As has already been mentioned this hour, very large networks such as the Internet include many routers and provide multiple paths from the source to the destination (see Figure 1.4).

Figure 1.4. A routed network.


TCP/IP includes protocols that define how the routers will find a path through the network. You'll learn more about TCP/IP routing and routing protocols in Hour 10, "Routing."

By the Way

As you'll also learn in Hour 9, network devices such as bridges, switches, and smart hubs also can filter traffic and reduce network traffic. Because these devices work with physical addresses rather than logical addresses, they cannot perform the complex routing functions shown in Figure 1.4.



Name Resolution
Although the numeric IP address is probably more user friendly than the network adapter's prefabricated physical address, the IP address is still designed for the convenience of the computer rather than the convenience of the user. People might have trouble remembering whether a computer's address is 111.121.131.146 or 111.121.131.156. TCP/IP, therefore, provides for a parallel structure of user-oriented alphanumeric names, called domain names or DNS names. This mapping of domain names to an IP address is called name resolution. Special computers called name servers store tables showing how to translate these domain names to and from IP addresses.

The computer addresses commonly associated with email or the World Wide Web are expressed as DNS names (for example, www.microsoft.com, falcon.ukans.edu, and idir.net). TCP/IP's name service system provides for a hierarchy of name servers that supply domain name/IP address mappings for DNS-registered computers on the network. This means that the everyday user rarely has to enter or decipher an actual IP address.

DNS is the name resolution system for the Internet and is the most common name resolution method. However, some TCP/IP networks also support other methods for resolving alphanumeric names to IP addresses. Another common name resolution scheme is the Windows Internet Name Services (WINS) for resolving Microsoft Windows NetBIOS names to IP addresses.

You'll learn more about TCP/IP name resolution in Hour 11, "Name Resolution."

Error Control and Flow Control
The TCP/IP protocol suite provides features that ensure the reliable delivery of data across the network. These features include checking data for transmission errors (to ensure that the data that arrives is exactly what was sent) and acknowledging successful receipt of a network message. TCP/IP's Transport layer (see Hour 6, "The Transport Layer") defines many of these error-checking, flow-control, and acknowledgment functions through the TCP protocol. Lower-level protocols at TCP/IP's Network Access layer (see Hour 3) also play a part in the overall system of error control.

Application Support
Several network applications might be running on the same computer. The protocol software must provide some means for determining which incoming packet belongs with each application. In TCP/IP, this interface from the network to the applications is accomplished through a system of logical channels called ports. Each port has a number that is used to identify the port. You can think of these ports as logical pipelines within the computer through which data can flow from the application to (and from) the protocol software (see Figure 1.5).

Figure 1.5. Applications access the network through port addresses.


Hour 6 describes TCP and UDP ports at TCP/IP's Transport layer. You'll learn more about application support and TCP/IP's Application layer in Hour 7, "The Application Layer."

The TCP/IP suite also includes a number of ready-made applications designed to assist with various network tasks. Some typical TCP/IP utilities are shown in Table 1.1. You'll learn more about these TCP/IP utilities in Part IV, "TCP/IP Utilities."

Table 1.1. Typical TCP/IP Utilities Utility
Purpose

ftp
File Transfer

lpr
Printing

ping
Configuration/Troubleshooting

route
Configuration/Troubleshooting

telnet
Remote Terminal Access

traceroute
Configuration/Troubleshooting



By the Way

TCP/IP is actually entering into a new phase at the time of this writing. New technologies such as wireless networks, virtual private networks, and network address translation are adding new complexities that the creators of TCP/IP wouldn't have imagined. You'll learn more about these technologies in later chapters.