1. Transport Layer Protocols TCP UDP Stream Control Transmission Protocol (SCTP)

2. TCP and UDP One or the other is used in most client/server applications UDP is a simple unreliable datagram protocol TCP is a sophisticated reliable byte- stream protocol

3. SCTP Newer protocol Designed for transport of telephony signaling across the internet Similar to TCP as a reliable transport protocol, but it also –provides message boundaries –transport-level support for multi-homing –way to minimize head-of-line blocking

4. Network Layer Transport layer protocols use IP –IPv4 –IPv6 It is possible to use IP directly, bypassing transport layer –Called raw sockets –Used less frequently –Detailed description of IPv4, IPv6, ICMPv4, and ICMPv6 is in Appendix A

5. Big Picture tcp- dump m- routed pingtrac- route appl trace- route ping TCPSCT P UDP ICMP IGMPIPv4IPv6ICMP v6 ARP, RARP BPF, DLPI data link IPv4 applicationsIPv6 applications 32-bit addresses 128-bit addresses API

6. Big Picture for IPv4 tcp-dumpm-routedpingtrace-routeappl TCPSCTPUDP ICMP IGMPIPv4 ARP, RARP BPF, DLPI data link IPv4 applications 32-bit addresses API

7. Big Picture for IPv6 tcp-dumpappl trace-routeping TCPSCTPUDP IPv6ICMPv6 BPE, DLPI data-link IPv6 applications 128-bit addresses API

8. tcp-dump Communicates directly with data-link layer using –BSD Packet Filter (BPF), or –Datalink Provider Interface (DLPI) Does not use sockets or XTI

9. API Dashed line indicates API which is normally –sockets, or –XTI

10. traceroute Uses two sockets –One for iP, and –Another for ICMP

11. Internet Protocol version 4 (IPv4) Often say as just IP Uses 32 bit addresses Workhorse protocol of IP suite since 80s Provides packet delivery service for TCP, UDP, SCTP, ICMP, and IGMP

12. Internet Protocol version 6 (IPv6) Replacement in 90s for IPv4 Uses 128 bit addresses Addresses explosive growth of Internet Packet delivery service for TCP, UDP, SCTP, and ICMPv6

13. Transmission Control Protocol (TCP) Connection-oriented protocol that provides reliable full-duplex byte stream to users TCP sockets are stream sockets TCP handles ack, timeout, retransmission, etc Used by most Internet applications Can use IPv4 or IPv6

14. User Datagram Protocol (UDP) Connectionless protocol UDP sockets are datagram sockets No guarantee that UDP datagrams will reach destination Can use IPv4 or IPv6

15. Stream Control Transmission Protocol (SCTP) Stream Control Transmission Protocol Connection-oriented protocol that provides reliable full-duplex association Association refers to SCTP connection because it is multi-homed –set of IP addresses –single port for each side of an association SCTP provides message service and maintains record boundaries Can use IPv4, IPv6, or both at the same time

16. Internet Control message Protocol (ICMP) Handles error and control information generated by TCP/IP between routers and hosts Used by ping and traceroute Sometimes call ICMPv4 to distinguish from ICMPv6

17. Internet Group Management Protocol (IGMP) Used with multicasting Optional with IPv4

18. Address Resolution Protocol (ARP) Maps an IPv4 address to hardware (i.e., Ethernet) address Normally used on broadcast networks like Ethernet token ring or FDDI Not needed on point-to-point networks

19. Reverse Address Resolution Protocol (RARP) Maps hardware address to IPv4 address Sometimes used when diskless node is booting

20. Internet Group Management Protocol Version 6 (IGMPv6) Combines functionality of ICMPv4, IGMP, and ARP

21. BSD Packet Filter (BPF) Provides access to datalink layer Normally found on Berkeley-derived kernels

22. Datalink Provider Interface (DLPI) Provides access to datalink layer Normally provided with SVR4

23. More about UDP Application writes message to a UDP socket Message is encapsulated in a UDP datagram, and then in an IP datagram Datagram is sent to destination No delivery guarantee – Even if delivered, if checksum detects error the datagram will probably not be retransmitted Must build in ack, retransmission, timeouts Unreliable Each datagram has a lentgth. Length is passed to receiver with data No need for long-term relationship between client and server – connectionless Client can create socket and send datagram to one server and then immediately send another datagram to another server on the same socket Similarly, a server can receive datagrams on a single socket from different clients

24. More About TCP Provides reliability Requires an ack – if ack is not received, TCP automatically retransmits data and waits longer for reply Cannot be described as 100% reliable Estimates round-trip time (RTT) dynamically – RTT on LAN may be msecs, whereas on WAN it may be secs Continuously estimates RTT because time varies according to workload Sequences data with sequence number Segment is unit of data TCP passes to IP – If segments arrive out of order, receiving TCP reorders segments and drops duplicate segments Provides flow control Full duplex

25. TCP Flow Control Tells peer exactly how many bytes of data it can accept Called the “advertised window” Sender cannot overflow the receive buffer Window changes dynamically over time Decreases as data is received from sender Increases as receiving application reads data Window size can reach 0 when TCP receive buffer for a socket is full

26. More about SCTP Provides services similar to UDP and TCP The word association is used instead of connection – can communicate with more than two IP addresses Provides applications with reliability, sequencing, flow control, and full-duplex data transfer like TCP Unlike TCP, SCTP is message oriented Provides sequenced delivery of individual records – length of record written by sender is passed to receiver application Can provide multiple streams between connection endpoints, each with reliable sequenced delivery Lost message in one stream does not block message delivery to other streams – Contrast with TCP Multi-homing feature allows single SCTP endpoint to support multiple IP addresses – Provides robustness against network failure

27. Three-Way Handshake 1.Server is prepared to accept incoming connection (socket, bind, listen) – Called passive open 2.Client issues active open with connect Client TCP sends SYN segment Tells server that client’s initial sequence number Normally, no data is sent with SYN 3.Server acknowledges with ACK and sends its own SYN containing initial sequence number for data (This is done in a single segment) 4.Client acknowledges the server’s SYN

28. TCP Three-Way Handshake socket connect (blocks) (active open) connect returns socket,bind,listen (passive open) accept (blocks) accept returns read (blocks) SYN J SYN K, ACK J+1 ACK K+1 server client

29. Minimum Handshake Packets A minimum of three packets must be sent to completed TCP 3-way handshake In previous figure, J and K are packet sequence numbers SYN occupies one byte in the sequence number space, so ACK for each SYN is initial sequence number plus 1

30. MSS Option On sending SYN, TCP announces its max segment size This is max amount of data it is willing to accept on each TCP segment on this connection Sending TCP uses receiver’s MSS value as max segment size Set the TCP MSS option with TCP_MAXSEG socket option

31. Window Scale Option Window size field is 16 bits, so max size TCP can advertise is 65,535 However, high speed connections (45 Mbits/sec and faster) require larger window to improve throughput Similarly, long delay paths (i.e., satellite links) require larger window to improve throughput

32. New Window Scale Option New option allows window option to be scaled by left shifting 0 to 14 bits. Max window size is almost one gigabyte (65,535x10 14 ) Both TCP end-systems must support this option The SO_RCVBUF socket option sets this option TCP sends the option with SYN as part of active open – Scale is set only if other end sends the option back with its SYN

33. Timestamp Option Needed by high-speed connections Prevents data corruption caused by old, delayed, or duplicated segments It is negotiated similar to window option

34. Long Fat Pipe Options The Window Scale and Timestamp options are sometimes called the “RFC 1323 options” They are also called “long fat pipe options” since a network with either a high bandwidth or a long delay is called a long fat pipe

35. TCP Connection Termination 1.One application calls close first (active close) and TCP sends a FIN segment (finished sending data) 2.Other end receives FIN and performs passive close. The received FIN is acknowledged by TCP. FIN is also passed to receiver’s application as end- of-file to be placed after any data that may have already been queued. Additional data will not be receive on connection. 3.Sometime later, application that performed the passive close will close its socket causing TCP to send a FIN to the application that performed the active close 4.Then, TCP on the system that performed the active close acknowledges the FIN

36. Closing a TCP Connection close (active close (passive close) read returns 0 close FIN M ACK M+1 ACK N+1 server client FIN N

37. Active Close Either client or server can perform active close Usually client performs active close However, in some protocols such as HTTP/1.0 the server performs the active close

38. Key for State Transition Diagram Normal transitions for client Normal transitions for server appl:State transitions taken when application issues operation recv:State transitions taken when segment received send:What is sent for this transaction

39. State Translation Diagram (Top) starting point appl:close send:FIN data transfer state recv:RST recv:SYN;send:SYN,ACK FIN_WAIT_1 passive open LISTEN SYN_RCVD appl:passive open send: recv:RSTAppl:active open send:SYN appl:close or timeout recv:SYN,ACK send:ACK SYN_SENT recv:SYN send:SYN,ACK simultaneous open recv:ACK send:,nothing recv:FIN send:ACK ESTABLISHEDCLOSE_WAIT CLOSED

40. State Translation Diagram (Bottom) starting point active close recv:FIN sendACK recv:FIN send:ACK appl:close send:FIN data transfer state FIN_WAIT_1 recv:FIN send:ACK ESTABLISHEDCLOSE_WAIT FIN_WAIT_2 CLOSING FIN_WAIT_1 recv:ACK send: recv:ACK send: LAST_ACK appl:close send:FIN recv:ACK send: 2MSL Timeout CLOSED

41. Example Open Connect socket connect (blocks) (active open) SYN _SENT ESTABLISHED connect returns socket,bind,listen LISTEN (passive open) accept (blocks) SYN_RCVD ESTABLISHED accept returns read (blocks) SYN J, MSS = 536 SYN K, ACK J+1, MSS=1460 ACK K+1 serverclient

42. Example Data Exchange write read (blocks) read returns write read (blocks) data (request) data (reply) ACK of request ACK of reply serverclient

43. Piggybacking Acknowledgement of client’s request is sent concurrently with server’s reply This is called piggybacking Takes place when time it takes server to process request and generate reply is less than 200 ms If the server takes longer (say one second) the acknowledgement would be sent followed later by the reply

44. Closing a TCP Connection close (active close) FIN_WAIT_1 FIN_WAIT_2 TIME_WAIT Close Wait (passive close) read returns 0 close, LAST_ACK CLOSED FIN M ACK M+1 ACK N+1 server client FIN N

45. Analysis Purpose of connection is to send one segment request and receive one segment reply Overhead using TCP is 8 segments If UDP were used, only two packets would be exchanged, the request and the reply Trade off is reliability and congestion control vs efficiency

46. TIME_WAIT State One of the most misunderstood aspects of TCP The end that performs the active close goes through this state Duration that the endpoint remains in this state is 2 x maximum segment lifetime or 2MSL. 2MSL is traditionally 1-4 minutes This is the max time any IP datagram can live in a network Bounded by an 8-bit hop limit field Packet with a hop limit of 255 cannot exist in a network for more than MSL seconds

47. Lost Packets Packets usually get lost due to routing anomalies For example, when routing table stabilizes after a router crash, there may be routing loops A packet was miss sent and then the routing table is corrected If the packet is retransmitted, the original is a lost duplicate or wandering duplicate

48. Reasons for TIME_WAIT State 1.To implement TCP’s full duplex connection termination reliably If final ACK is lost, server will resend final FIN Client must maintain state info allowing it to resend final ACK 2.To allow old duplicate segments to expire in the network If a connection is closed and then reopened using the same IP addresses and ports (incarnation),any old duplicates could be misinterpreted as belonging to new connection However, TCP will not initiate a new connection while old connection is in TIME_WAIT state

49. Port Numbers At any given time multiple processes can be using TCP, UDP, and SCTP 16 bit port numbers differentiate between these processes

50. Well-Known Ports Identify well-known services –FTP 21 –Trivial File Transfer Protocol 69 –Web Services 80

51. Allocation of Port Numbers IANA Well-known IANA registered portsIANA dynamic or ports 1 10231024 49151 private 49152 ports 65535 BSD reserved traditional BSD ephemeralBSD servers ports 1 1023 ports 1024 5000 (nonprivileged) 5001 65535 rresvport Solaris ephemeral ports 513 1023 ports 32768 65535

52. Internet Assigned Numbers Authority (IANA) Well-known ports – FTP, Telnet, Web Server, Mail Server, etc. Registered ports – Not controlled by IANA, but it lists the uses as a convenience. 6000 – 6063 are assigned to X-window servers Dynamic ports –Traditional ephemeral ports –49152 is three-fourths of 65536

53. UNIX Systems Reserved ports –Can be assigned to socket by a privileged process –IANA well-known ports are UNIX reserved ports –Server must have superuser privileges when it starts Ephemeral ports –In the range 1024 – 5000 –More ephemeral ports may be needed so modern systems may augment with IANA or Solaris ephemeral

54. Client/Server Authentication Some clients require a reserved port to perform client/server authentication rlogin and rsh clients are common examples These clients use rresvport to create a TCP socket assigning an unused port in the 513-1024 range

55. Socket Pair Four-tuple that defines two endpoints for a connection –Local IP address –Local port –Foreign IP address –Foreign port The two values that identify an endpoint (IP address and port) are often called a socket Applies to UDP and SCTP as well

56. Socket Connections 12.106.32.254 192.168.42.1 server (*:21,*,*) listening socket server (child1) fork {12.106.32.254:21, 206.168.112.219;1500} connected socket server (child2) {12.106.32.254:21, 206.168.112.219;1501} connected socket 206.168.112.219 client1 {206.168.112.219;1500, 12.106.32.254:21} client2 {206.168.112.219;1500, 12.106.32.254:21}