TCP/IP Protocol Suite

Although the OSI model does a great job of describing in detail how the network operates, it is actually considered a reference model. To ensure proper communication between network devices, the TCP/IP protocol suite is used instead.

 

Note:    The OSI reference model was created by the International Organization for Standardization (ISO), while the TCP/IP protocol suite was created and first implemented by the Internet Engineering Task Force (IETF).

The TCP/IP protocol suite is a modern adaptation of the OSI reference model and it contains five layers:

• Application Layer
• Transport Layer
• Internet Layer
• Data Link Layer
• Physical Layer

In some documentation, the Data Link Layer and the Physical Layer are combined into a single layer called the Network Access Layer or the Network Interface Layer. Figure 1.4 below shows the TCP/IP protocol suite next to the OSI reference model:

  

Figure 1.4 – TCP/IP Protocol Suite

 

TCP/IP Application Layer

The Application Layer in the TCP/IP protocol suite covers the functionality of the Session, Presentation, and Application Layers in the OSI reference model. Various protocols can be used at this layer, among which include the following:

• SMTP, POP3: used to provide e-mail services
• HTTP: World Wide Web browser content delivery protocol
• FTP: used in file transfers
• DNS: used in domain name translation
• SNMP: network management protocol
• DHCP: used to automatically assign IP addresses to network devices
• Telnet: used to manage and control network devices

 

TCP/IP Transport Layer

Both the TCP/IP Transport Layer and the Internet Layer display considerable differences when compared with the corresponding OSI layers. The Transport Layer is based on two protocols:

• Transmission Control Protocol (TCP): This protocol provides a connection-oriented transmission. This means that the path the data travels on through the network is reliable, as the endpoints establish a synchronized connection before sending the data. Every data packet is acknowledged by the receiving host. File Transfer Protocol (FTP) is an example of a protocol that uses TCP.
• User Datagram Protocol (UDP): This protocol provides an unreliable, connectionless transmission between hosts. Unlike TCP, UDP does not check the segments that arrive at the destination to make sure that they are valid and in the proper order. This means that integrity verifications and the error correction process will occur at the Application Layer. On the other hand, UDP has a smaller overhead compared with TCP because the UDP header is much smaller. Trivial File Transfer Protocol (TFTP) is an example of a protocol that uses UDP.

The TCP and UDP protocol data units are segments, and each segment contains a number of fields that carry different information about the data, as shown in Figure 1.5 below:

  

Figure 1.5 – UDP and TCP Segment Fields

 

The UDP fields are described in Table 1.3 below:

 

Table 1.3 – UDP Fields

 

The TCP fields are described in Table 1.4 below:

 

Table 1.4 – TCP Fields

 

The TCP header is larger than the UDP header because extra fields are needed to ensure a reliable connection.

Port numbers can have values up to 65535. Most of the common applications are assigned well-known port numbers, which are 0 to 1023. Port numbers 1024 through 49151 are registered port numbers, and the range of 49152 to 65535 defines dynamic port numbers (automatically assigned by network devices). Port numbers are used to distinguish applications running on the same device. Examples of well-known port numbers include the following:

• HTTP: TCP port 80
• FTP: TCP port 20 (data) and port 21 (control)
• TFPT: UDP port 69
• POP3: TCP port 110
• SMTP: TCP port 25
• DNS: TCP and UDP port 53
• SNMP: UDP port 161
• Telnet: TCP port 23

When a TCP connection is established, it follows a process called a three-way handshake. This process uses a TCP segment with SYN and ACK bits, and this segment includes the Code Bits, Sequence Number, and Acknowledgement Number fields. The three-way handshake process is illustrated in Figure 1.6 below:

  

Figure 1.6 – TCP Three-Way Handshake Process

 

In Figure 1.6 above, Host A tries to establish a TCP connection with Host B. Host A sends a segment with a SYN bit set, letting the other device know that it wants to synchronize, and this segment includes the initial sequence number that Host A is using, which is 5. Host B accepts synchronization with Host A and sends back a segment with a SYN bit set and an ACK bit set to acknowledge that it has received the initial segment sent by Host A. The acknowledgement number sent by Host B represents the next segment it expects to receive, which is 6 (this is also called an expectational acknowledgment). The new segment also includes the initial sequence number that Host B is using, which is 14. Host A replies with an ACK segment that contains a sequence number of 6 (because that is what Host B is expecting) and an acknowledgement number of 15, informing Host B that it can send the next segment. This concludes the TCP session establishment phase.

During the window size negotiation phase, the remote host learns the number of bytes a device will accept before it must send an ACK. The window sizes of the two endpoints may not match, so negotiation must take place. In Figure 1.6, Host A has a window size of 2 and Host B has a window size of 3. When Host A sends data, it can send 3 bytes before waiting for an ACK, while Host B can send only 2 bytes before receiving an ACK.

 

Note:    The Window Size field specifies the number of bytes (octets) a device will accept, not the number of segments.

After all the data has been sent between the two hosts during the data transmission phase, the session closing phase begins. Host A sends a segment with a FIN bit set, letting Host B know that it wants to end the TCP session. This segment includes the sequence number Host B is using at that specific moment, which is 341. Host B acknowledges the request and sends an ACK bit set with an acknowledgement number of 342 to confirm that it received acknowledgement number 341. This segment also includes the current sequence number of Host B, which is 125. Host B sends a new segment with a FIN bit set, announcing that the application it is running also requests an end to the session. In the last step before the session is closed, Host A sends an ACK segment with the number 126 to confirm that it received number 125 from Host B.

 

TCP/IP Internet Layer

The Internet Layer in the TCP/IP protocol suite corresponds to OSI Layer 3 (Network Layer) and includes the following protocols:

• Internet Protocol (IP): This protocol is a connectionless protocol that offers best-effort delivery of packets in the network. It relies on Transport Layer protocols such as TCP to ensure a reliable connection. IP addresses are assigned to each network device or interface in the network. The IP protocol comes in two flavors: IPv4 and IPv6. These aspects will be covered in detail later in this book.
• Internet Control Message Protocol (ICMP): This protocol sends messages and error reports through the network. The most commonly used application that relies on ICMP is ping. The ping application sends an ICMP Echo Request message to the destination and expects an ICMP Echo Reply back to test that the destination can be reached and to get information about any delays between the two endpoints.

 

TCP/IP Network Access Layer

The Network Access Layer is comprised of the Data Link Layer and the Physical Layer and has the same functionality as the same two layers in the OSI reference model.

A common protocol used at the Data Link Layer is the Address Resolution Protocol (ARP), which requests the MAC addresses of a host with a known IP address. Once the MAC address is known, it is used as a destination address in the frames sent in that specific direction.