1. DMET 602: Networks and Media Lab
Amr El Mougy
Yasmeen Essam
Mohamed Karam

2. Exp 3: Higher Layer Protocols

3. Classifying Application Protocols
Method of communication
Stateful or stateless
In-band or out-of-band
2: Application Layer

4. Method of Communication
Communication between devices either involves message passing, or request/response
Request/response is the most prevalent type. Uses client/server model to describe the roles of hosts
Has the advantage of being simple. However, only two machines are involved

5. N-Tier Request/Response
Layered system. Each tier provides a service for the higher level
Advantages include: information hiding, scalability, better management

6. Stateful vs. Stateless
Stateful: server knows which step (state) has been reached
Individual messages need to carry less data
Server does not have to re-establish context every time
Stateless:
Client remembers the state, sends to server each time  simpler architecture
Server processes each request independently  requests have to be more self-describing
More scalable, facilitates load balancing
Can vary with level
Many systems like Web run stateless protocols (e.g. HTTP) over streams…at the packet level, TCP streams are stateful
HTTP itself is mostly stateless, but many HTTP requests (typically POSTs) update persistent state at the server

7. In-Band vs Out-of-Band
In-band: control data and application data coexist on the same connection (same transport layer port numbers)
HTTP and SMTP are in-band protocols
Out-of-band: control data is on a separate connection
Typically the control connection establishes the data exchange
FTP is an out-of-band protocol

8. Web and HTTP Web page consists of objects
Object can be HTML file, JPEG image, Java applet, audio file,…
Web page consists of base HTML-file which includes several referenced objects
Each object is addressable by a URL
Example URL:
host name
path name

9. Resource Identification
Resources are identified by a Uniform Resource Locator (URL), or Uniform Resource Name (URN)  Uniform Resource Identifier (URI)
URI can be a URL or URN
URL tells you the name of the resource, and how to retrieve it  has to specify the protocol used to retrieve this resource
[scheme]://[Domain]:[port]/[path]?[QueryString]#[FragmentId]
URN is only a name give to a resource
urn:[namespace identifier]:[namespace specific string]
urn:isbn:

10. HTTP overview HTTP: hypertext transfer protocol
Web’s application layer protocol
client/server model
client: browser that requests, receives, “displays” Web objects
server: Web server sends objects in response to requests
HTTP request
PC running
Explorer
HTTP response
HTTP request
Server
running
Apache Web
server
HTTP response
Mac running
Navigator

11. HTTP overview (continued)
HTTP is “stateless”
server maintains no information about past client requests
Uses TCP:
client initiates TCP connection (creates socket) to server, port 80
server accepts TCP connection from client
HTTP messages (application-layer protocol messages) exchanged between browser (HTTP client) and Web server (HTTP server)
TCP connection closed
aside
Protocols that maintain “state” are complex!
past history (state) must be maintained
if server/client crashes, their views of “state” may be inconsistent, must be reconciled
2: Application Layer

12. HTTP connections Nonpersistent HTTP
At most one object is sent over a TCP connection
Persistent HTTP
Multiple objects can be sent over single TCP connection between client and server
2: Application Layer

13. Suppose user enters URL www.someSchool.edu/someDepartment/home.index
Nonpersistent HTTP
Suppose user enters URL
(contains text, references to 10 jpeg images)
1a. HTTP client initiates TCP connection to HTTP server (process) at on port 80
1b. HTTP server at host waiting for TCP connection at port 80. “accepts” connection, notifying client
2. HTTP client sends HTTP request message (containing URL) into TCP connection socket. Message indicates that client wants object someDepartment/home.index
3. HTTP server receives request message, forms response message containing requested object, and sends message into its socket
time
2: Application Layer

14. Nonpersistent HTTP (cont.)
4. HTTP server closes TCP connection
5. HTTP client receives response message containing html file, displays html. Parsing html file, finds 10 referenced jpeg objects
time
6. Steps 1-5 repeated for each of 10 jpeg objects
2: Application Layer

15. Non-Persistent HTTP: Response time
time to
transmit
file
initiate TCP
connection
RTT
request
received
time
Definition of RTT: time for a small packet to travel from client to server and back
Response time:
one RTT to initiate TCP connection
one RTT for HTTP request and first few bytes of HTTP response to return
file transmission time
total = 2RTT+transmit time
2: Application Layer

16. Persistent HTTP Nonpersistent HTTP issues: requires 2 RTTs per object
OS overhead for each TCP connection
browsers often open parallel TCP connections to fetch referenced objects
Persistent HTTP
server leaves connection open after sending response
subsequent HTTP messages between same client/server sent over open connection
client sends requests as soon as it encounters a referenced object
as little as one RTT per referenced object
2: Application Layer

17. HTTP request message two types of HTTP messages: request, response
ASCII (human-readable format)
request line
(GET, POST,
HEAD commands)
GET /somedir/page.html HTTP/1.1
Host:
User-agent: Mozilla/4.0
Connection: close
Accept-language:fr
(extra carriage return, line feed)
header
lines
Carriage return,
line feed
indicates end
of message
2: Application Layer

18. HTTP request message: general format
2: Application Layer

19. Uploading form input Post method: Web page often includes form input
Input is uploaded to server in entity body
GET (URL) method:
Uses GET method
Input is uploaded in URL field of request line:
2: Application Layer

20. Method types HTTP/1.0 GET POST HEAD HTTP/1.1 GET, POST, HEAD PUT
asks server to leave requested object out of response
HTTP/1.1
GET, POST, HEAD
PUT
uploads file in entity body to path specified in URL field
DELETE
deletes file specified in the URL field
2: Application Layer

21. (protocol, status code, status phrase)
HTTP response message
status line
(protocol, status code, status phrase)
HTTP/ OK
Connection close
Date: Thu, 06 Aug :00:15 GMT
Server: Apache/1.3.0 (Unix)
Last-Modified: Mon, 22 Jun 1998 …...
Content-Length: 6821
Content-Type: text/html
data data data data data ...
header
lines
data, e.g.,
requested
HTML file
2: Application Layer

22. HTTP response status codes
In first line in server->client response message.
A few sample codes:
200 OK
request succeeded, requested object later in this message
301 Moved Permanently
requested object moved, new location specified later in this message (Location:)
400 Bad Request
request message not understood by server
404 Not Found
requested document not found on this server
505 HTTP Version Not Supported
2: Application Layer

23. FTP Purpose: To Transfer files between two computers
Goals of FTP Service
Promote sharing of files (programs and/or data)
Encourage indirect/implicit use of remote computers
Shield users from variations in file storage among hosts
Transfer data reliably and efficiently
Why is it needed, file transfer seems simple?
Answer: Heterogeneous systems use different operating systems, character sets, naming conventions, directory and file structures
FTP addresses this heterogeneity

24. FTP Connection

25. TCP Connections
Control Connection
Combined Connection

26. FTP Commands Command Description get filename mget filename*
Retrieve file from server
mget filename*
Retrieve multiple files from server*
put filename
Copy local file to server
mput filename*
Copy multiple local files to server*
open server
Begin login to server
bye / close / exit
Logoff server
ls / dir
List files in current remote dir on server
lcd
Change local directory cd
Change remote directory
rhelp / remotehelp
Lists commands the server accepts

27. Secure Shell (SSH)
SSH is a protocol for secure remote login and other secure network services over an insecure network
SSH Transport Layer Protocol
provides server authentication, confidentiality, and integrity services
runs on top of any reliable transport layer (e.g., TCP)
SSH User Authentication Protocol
provides client-side user authentication
runs on top of the SSH Transport Layer Protocol
SSH Connection Protocol
multiplexes the secure tunnel provided by the SSH Transport Layer and User Authentication Protocols into several logical channels. These logical channels can be used for a wide range of purposes
secure interactive shell sessions
TCP port forwarding
carrying X11 connections

28. SSH Security Features Strong algorithms Large key size
uses well established strong algorithms for encryption, integrity, key exchange, and public key management
Large key size
requires encryption to be used with at least 128 bit keys
supports larger keys too
Algorithm negotiation
encryption, integrity, key exchange, and public key algorithms are negotiated
it is easy to switch to some other algorithm without modifying the base protocol

29. SSH TLP Protocol SSH version string exchange
both side must send a version string of the following form:
“SSH-protoversion-softwareversion comments” \CR \LF
used to indicate the capabilities of an implementation
triggers compatibility extensions
all packets that follow the version string exchange is sent using the Binary Packet Protocol
MAC = message authentication code. Used to check message integrity

30. Encryption
The encryption algorithm is negotiated during the key exchange
Supported algorithms
3des-cbc (required) (168 bit key)
blowfish-cbc (recommended)
twofish256-cbc (opt) / twofish192-cbc (opt) / twofish128-cbc (recomm)
aes256-cbc (opt) / aes192-cbc (opt) / aes128-cbc (recomm)
serpent256-cbc (opt) / serpent192-cbc (opt) / serpent128-cbc (opt)
arcfour (opt) (RC4)
idea-cbc (opt) / cast128-cbc (opt)
Key and IV are also established during the key exchange
All packets sent in one direction is considered a single data stream
IV is passed from the end of one packet to the beginning of the next one
Encryption algorithm can be different in each direction

31. Message Authentication Code (MAC)
MAC algorithm and key are negotiated during the key exchange
Supported algorithms
hmac-sha1 (required) [MAC length = key length = 160 bits]
hmac-sha1-96 (recomm) [MAC length = 96, key length = 160 bits]
hmac-md5 (opt) [MAC length = key length = 128 bits]
hmac-md5-96 (opt) [MAC length = 96, key length = 128 bits]
MAC algorithms used in each direction can be different
MAC = mac( key, seq. number | clear packet )
sequence number is implicit, not sent with the packet
sequence number is represented on 4 bytes
sequence number initialized to 0 and incremented after each packet
it is never reset (even if keys and algs are renegotiated later)

32. SSH Authentication Protocol
The protocol assumes that the underlying transport protocol provides integrity and confidentiality (e.g., SSH Transport Layer Protocol)
The protocol has access to the session ID
The server should have a timeout for authentication and disconnect if the authentication has not been accepted within the timeout period
recommended value is 10 minutes
The server should limit the number of failed authentication attempts a client may perform in a single session
recommended value is 20 attempts
Three authentication methods are supported
Public key
Password: most widely used (user name and password)
Host-based

33. SSH Connection Protocol
Provides
interactive login sessions
remote execution of commands
forwarded TCP/IP connections
forwarded X11 connections
All these applications are implemented as “channels”
All channels are multiplexed into the single encrypted tunnel provided by the SSH Transport Layer Protocol
Channels are identified by channel numbers at both ends of the connection
Channel numbers for the same channel at the client and server sides may differ