Transport and application layer protocols notes — Unit 5

While the Network Layer is responsible for host-to-host delivery (moving a packet from one computer to another), the Transport Layer (Layer 4) is responsible for process-to-process delivery (moving a message from a specific application program on one computer to a specific application program on another).

⇒1.1 Key Responsibilities

• Service-Point Addressing (Port Numbers): Identifying the exact application software sending or receiving data.
• Segmentation and Reassembly: Breaking large messages from the Application layer into transmittable segments and reassembling them at the destination.
• Connection Control: Choosing between connection-oriented (TCP) or connectionless (UDP) delivery.
• End-to-End Reliability: Providing flow control and error control strictly between the two communicating end-systems, ignoring the intermediate routers.

⇒2.1 Port Numbers

A port number is a 16-bit integer (ranging from 0 to 65535) that acts as a logical gateway for an application.

• Well-Known Ports (0 - 1023): Assigned and controlled by IANA. Used for standard universal services (e.g., HTTP is 80, HTTPS is 443, FTP is 21).
• Registered Ports (1024 - 49151): Used by specific applications or vendors (e.g., MySQL is 3306).
• Dynamic/Ephemeral Ports (49152 - 65535): Temporarily assigned to client applications by the OS when establishing an outbound connection.

⇒2.2 Sockets

A Socket Address is the combination of an IP address and a Port number (e.g., `192.168.1.15:80`). Communication between two processes requires a pair of sockets (client socket and server socket).

UDP is a highly simplified, connectionless transport layer protocol.

⇒3.1 Characteristics of UDP

• Connectionless: No handshake is required before sending data. The sender just blasts packets.
• Unreliable: It provides no guarantee of delivery, no error recovery (retransmissions), and no sequence numbering (packets can arrive out of order).
• No Flow/Congestion Control: A sender can easily overwhelm a slow receiver or the network.
• Extremely Fast: The lack of overhead makes UDP incredibly fast and lightweight.

⇒3.2 Use Cases for UDP

UDP is preferred for applications where raw speed is more critical than absolute reliability. Examples include Live Video Streaming, Voice over IP (VoIP), Online Multiplayer Gaming, and simple request-response queries like DNS.

The UDP header is fixed at an incredibly small size of just 8 bytes, making it highly efficient.

Because it relies on IP for delivery, if a UDP checksum fails, the receiver simply silently drops the packet. The application layer must handle the loss if it cares.

TCP is the backbone of the Internet. It is a connection-oriented, highly reliable transport protocol.

⇒5.1 Characteristics of TCP

• Connection-Oriented: A dedicated logical connection (handshake) must be established before data transfer begins.
• Highly Reliable: Guarantees that data sent will arrive exactly as it was sent, completely error-free.
• Stream-Oriented: TCP accepts data as a continuous stream of bytes, dividing it into 'segments' internally.
• In-Order Delivery: Uses sequence numbers to reassemble packets that arrive out of order.
• Flow and Congestion Control: Dynamically adjusts transmission speed to prevent overwhelming the receiver and the network.

The TCP header is significantly more complex than UDP. It is a minimum of 20 bytes long, but can be up to 60 bytes if options are used.

Before sending a single byte of data, TCP must establish a logical connection using the famous Three-Way Handshake.

⇒7.1 The Three-Way Handshake

• Step 1: SYN (Synchronize). The Client sends a segment with the SYN flag set to 1. This requests a connection and declares the client's Initial Sequence Number (ISN).
• Step 2: SYN-ACK. The Server receives the SYN, allocates buffers, and responds with a segment having both SYN and ACK flags set to 1. It acknowledges the client's ISN and provides its own ISN.
• Step 3: ACK. The Client receives the SYN-ACK, allocates its own buffers, and sends a final segment with the ACK flag set. The connection is now established.

Note: This mechanism effectively prevents old, delayed duplicate packets from causing ghost connections.

Because a TCP connection is full-duplex (data flows in both directions independently), closing it requires a Four-Way Handshake to ensure neither side has data left to send.

⇒8.1 The Termination Process

• Step 1 (FIN): When the Client is done sending data, it sends a segment with the FIN flag set.
• Step 2 (ACK): The Server receives the FIN and sends an ACK. At this point, the connection is 'half-closed'. The server can still send data to the client, but the client cannot send data to the server.
• Step 3 (FIN): When the Server finishes sending its remaining data, it sends its own FIN segment.
• Step 4 (ACK): The Client acknowledges the server's FIN with a final ACK. After a brief wait state, the connection is completely destroyed.

TCP ensures a fast sender does not overwhelm a slow receiver by using a dynamic Sliding Window mechanism.

⇒9.1 The Receive Window (rwnd)

Every time the receiver sends an acknowledgment back to the sender, it populates the 'Window Size' field in the TCP header. This value specifies exactly how many bytes of free buffer space the receiver currently has.

⇒9.2 Dynamic Adjustment

• If the receiver's application is processing data slowly, its buffer fills up. It advertises a progressively smaller window size to the sender.
• The sender is strictly forbidden from sending more unacknowledged bytes than the advertised window size.
• If the window size drops to `0` (Zero Window), the sender completely stops transmitting until it receives a window update.

Flow control prevents overwhelming the receiver, but Congestion Control prevents overwhelming the entire network (the intermediate routers).

⇒10.1 The Congestion Window (cwnd)

The sender maintains a second window called the Congestion Window. The actual amount of data the sender can transmit is determined by: `min(cwnd, rwnd)`.

⇒10.2 TCP Congestion Algorithm Phases

• Slow Start: The sender starts extremely conservatively (cwnd = 1 segment). For every ACK received, cwnd doubles exponentially. This quickly discovers the network's capacity.
• Congestion Avoidance: Once cwnd hits a certain threshold, it stops growing exponentially and switches to linear growth (adds 1 segment per RTT) to probe for the absolute maximum limit cautiously.
• Multiplicative Decrease: If a packet loss is detected (indicated by a timeout or duplicate ACKs), TCP assumes the network is congested. It brutally cuts the cwnd threshold in half and drastically slows down transmission to clear the traffic jam.

The Application Layer (Layer 7) provides the actual interface between the software applications on a host and the underlying network.

⇒11.1 The Client-Server Paradigm

Most network applications operate on a Client-Server model.

• Server: An always-on process listening on a known, fixed IP address and a well-known port. It passively waits for requests (e.g., Apache web server).
• Client: A temporary process that actively initiates a connection to the server when a user needs a service (e.g., Chrome web browser).

⇒11.2 Peer-to-Peer (P2P) Paradigm

An alternative architecture where there are no dedicated servers. Every node (peer) acts as both a client and a server simultaneously (e.g., BitTorrent). Highly scalable but harder to secure.

Computers route traffic using numerical IP addresses (`142.250.190.46`), but humans prefer memorable names (`google.com`). DNS is the phonebook of the Internet that translates hostnames into IP addresses.

⇒12.1 DNS Architecture

DNS operates on UDP Port 53. It uses a massive, globally distributed hierarchical database.

• Root Name Servers: The top of the hierarchy. They direct queries to the appropriate TLD server.
• TLD (Top-Level Domain) Servers: Handle domains like `.com`, `.org`, `.edu`.
• Authoritative Name Servers: Owned by the organization. They hold the actual IP address for a specific domain name.

⇒12.2 Resolution Process

When a user types a URL, their OS queries a Local DNS Resolver (usually provided by the ISP). The resolver queries the Root, then the TLD, then the Authoritative server to find the IP, which it returns to the user and caches for future use.

Email is fundamentally an asynchronous, store-and-forward communication system. It relies on a combination of several different protocols.

⇒13.1 SMTP (Simple Mail Transfer Protocol)

Operates over TCP Port 25. SMTP is strictly a push protocol. It is used to send emails from the sender's mail client to the sender's mail server, and to relay the email from the sender's mail server across the internet to the receiver's mail server.

⇒13.2 Mail Access Protocols

Because SMTP cannot 'pull' emails, a receiver uses different protocols to retrieve messages from their mail server.

• POP3 (Post Office Protocol v3): Downloads the email to the local device and typically deletes it from the server. Best for single-device access.
• IMAP (Internet Message Access Protocol): Syncs the email with the server. Emails remain on the server, allowing the user to view the same inbox identically across multiple devices (phones, laptops, tablets).

⇒14.1 File Transfer Protocol (FTP)

FTP is used for copying files from one host to another. It uses two separate TCP connections simultaneously:

• Control Connection (Port 21): Stays open for the entire session. Used to send commands (login, change directory).
• Data Connection (Port 20): Opens and closes for each individual file transferred.

⇒14.2 Hypertext Transfer Protocol (HTTP)

HTTP powers the World Wide Web. It relies on TCP Port 80.

• Stateless Protocol: The server retains absolutely no memory of past client requests. Every request is treated as brand new. (Cookies were invented to add state to HTTP).
• Non-Persistent (HTTP/1.0): Opens a new TCP connection for every single object on a web page (images, CSS files). Highly inefficient.
• Persistent (HTTP/1.1): Keeps the TCP connection open to fetch multiple objects, drastically reducing page load times.

DHCP is a client-server protocol that automatically provides an Internet Protocol (IP) host with its IP address and other related configuration information (like the subnet mask and default gateway).

⇒15.1 The DORA Process

When a new client joins a network, it obtains an IP address through a 4-step process:

• Discover: Client broadcasts a DHCP Discover message (`255.255.255.255`) to find a DHCP server.
• Offer: The DHCP server responds with a DHCP Offer, proposing an available IP address.
• Request: The client broadcasts a DHCP Request, formally accepting the offered IP address.
• Acknowledge (ACK): The server sends a DHCP ACK confirming the lease of the IP address.

⇒16.1 Simple Network Management Protocol (SNMP)

SNMP is used for monitoring and managing devices on an IP network (routers, switches, servers, printers).

• Manager: A centralized software system that monitors the network.
• Agent: A software module residing on the managed device.
• MIB (Management Information Base): A database of hierarchical variables that can be queried or set by the Manager.

⇒16.2 Remote Login (SSH and Telnet)

These protocols allow a user to log into a remote computer and execute commands as if they were sitting at the terminal.

• Telnet (Port 23): An older protocol that sends all data, including passwords, in clear text. Highly insecure.
• SSH (Secure Shell - Port 22): The modern replacement for Telnet. It uses strong encryption (public key cryptography) to secure the entire session, ensuring confidentiality and integrity.

⇒17.1 HTTPS (HTTP Secure)

HTTPS operates on TCP Port 443. It is simply standard HTTP layered on top of the SSL/TLS (Secure Sockets Layer / Transport Layer Security) protocol.

• Encryption: Protects data from eavesdroppers.
• Data Integrity: Prevents data from being corrupted or modified during transfer.
• Authentication: Proves that users are communicating with the intended website (using Digital Certificates).

⇒17.2 HTTP/2 and HTTP/3

The web has evolved significantly to improve performance over the original HTTP/1.1 protocol.

• HTTP/2: Introduces Multiplexing (sending multiple requests for web assets in parallel over a single TCP connection) and Header Compression to drastically speed up page load times.
• HTTP/3: Replaces the underlying TCP transport layer entirely with QUIC (which runs over UDP) to achieve even lower latency and faster connection setups.

TCP is a stateful protocol. Both the client and server maintain specific states during the lifecycle of a connection.

⇒18.1 Connection Setup States

• LISTEN: The server is passively waiting for an incoming connection request.
• SYN-SENT: The client has sent a SYN segment and is waiting for a SYN-ACK.
• SYN-RCVD: The server received a SYN, sent a SYN-ACK, and is waiting for the final ACK.
• ESTABLISHED: The three-way handshake is complete, and data can flow in both directions.

⇒18.2 Connection Termination States

• FIN-WAIT-1 & FIN-WAIT-2: The client initiated the close by sending a FIN and is waiting for the server to acknowledge and send its own FIN.
• CLOSE-WAIT & LAST-ACK: The server's states when it receives the client's FIN, acknowledges it, and prepares to shut down its own side.
• TIME-WAIT: After sending the final ACK, the client waits for 2 Maximum Segment Lifetimes (2MSL) to ensure the server received the ACK and to prevent delayed duplicate segments from interfering with future connections.

TCP guarantees delivery by retransmitting lost segments. To know when a segment is lost, TCP relies on complex timer algorithms rather than a fixed timeout.

⇒19.1 Round Trip Time (RTT)

TCP continuously samples how long it takes for a segment to be acknowledged. Because network traffic fluctuates wildly, it maintains an Exponentially Weighted Moving Average (EWMA) to calculate the Smoothed RTT (SRTT).

⇒19.2 Retransmission Timeout (RTO)

The Retransmission Timeout (RTO) dictates how long TCP waits before assuming a packet is lost. It is calculated using Jacobson's Algorithm, which accounts for both the SRTT and the variance (deviation) in RTT measurements.

⇒19.3 Karn's Algorithm

A critical rule in TCP: When a segment is retransmitted, and an ACK eventually arrives, TCP cannot know if the ACK is for the original segment or the retransmitted one. Karn's Algorithm states that TCP must ignore RTT samples from retransmitted segments to prevent wildly inaccurate RTO calculations.

⇒20.1 HTTP Status Codes

When an HTTP server responds, it includes a 3-digit status code to inform the client of the result.

• 1xx (Informational): Request received, continuing process.
• 2xx (Success): The action was successfully received and accepted (e.g., `200 OK`, `201 Created`).
• 3xx (Redirection): Further action must be taken to complete the request (e.g., `301 Moved Permanently`).
• 4xx (Client Error): The request contains bad syntax or cannot be fulfilled (e.g., `404 Not Found`, `403 Forbidden`).
• 5xx (Server Error): The server failed to fulfill a valid request (e.g., `500 Internal Server Error`).

⇒20.2 DNS Record Types