2 TCP/IP Flashcards
What does TCP/IP stand for ?
Transmission Control Protocol/Internet Protocol
The DoD (Department of Defense) Model
The DoD model is basically a condensed version of the OSI model that comprises four instead of seven layers:
- Process/Application layer
- Host-to-Host layer or Transport layer
- Internet layer
- Network Access layer or Link layer
Telnet
Telnet’s specialty is terminal emulation. It allows a user on a remote client machine, called the Telnet client, to access the resources of another machine, the Telnet server, in order to access a command-line interface. Telnet achieves this by making the client machine appear as though it were a terminal directly attached to the local network. This projection is actually a software image—a virtual terminal that can interact with the chosen remote host. A major drawback is that there are no encryption techniques available within the Telnet protocol, so everything must be sent in clear text—including passwords! Users begin a Telnet session by running the Telnet client software and then logging into the Telnet server. Telnet uses an 8-bit, byte-oriented data. connection over TCP, which makes it very thorough. It’s still in use today because it is so simple and easy to use, with very low overhead, but again, as with everything sent in clear text, it’s not recommended in production.
Secure Shell (SSH)
Secure Shell (SSH) protocol sets up a secure session that’s similar to Telnet over a standard TCP/IP connection. It’s used for doing things like logging into systems, running programs on remote systems and moving files from one system to another, and it does all of this while maintaining an encrypted connection. The client must send the data encrypted.
File Transfer Protocol (FTP)
File Transfer Protocol (FTP) actually lets us transfer files, and it can accomplish this between any two machines using it. But FTP isn’t just a protocol; it’s also a program. Operating as a protocol, FTP is used by applications. As a program, it’s employed by users to perform file tasks by hand. FTP also allows for access to both directories and files and can accomplish certain types of directory operations, such as relocating into different ones. Even when employed by users manually as a program, FTP’s functions are limited to listing and manipulating directories, typing file contents and copying files between hosts. It can’t execute remote files as programs.
Trivial File Transfer Protocol (TFTP)
Trivial File Transfer Protocol (TFTP) is the stripped-down, stock version of FTP. It’s the protocol of choice if you know exactly what you want and where to find it because it’s so fast and easy to use. But TFTP doesn’t offer the abundance of functions that FTP does because it has no directory-browsing abilities, meaning that it can only send and receive files. It’s heavily used for managing file systems on Cisco devices. This compact little protocol also skimps in the data department, sending much smaller blocks of data than FTP. Also, there’s no authentication as with FTP, so it’s even more insecure. Few sites support it because of the inherent security risks.
Simple Network Management Protocol (SNMP)
Simple Network Management Protocol (SNMP) collects and manipulates valuable network information. It gathers data by polling the devices on the network from a network management station (NMS) at fixed or random intervals, requiring them to disclose certain information, or even asking for certain information from the device. In addition, network devices can inform the NMS station about problems as they occur, so the network administrator is alerted. When all is well, SNMP receives something called a baseline—a report delimiting the operational traits of a healthy network. This protocol can also stand as a watchdog over the network, quickly notifying managers of any sudden turn of events. These network watchdogs are called agents, and when aberrations occur, agents send an alert called a trap to the management station.
Hypertext Transfer Protocol (HTTP)
It’s used to manage communications between web browsers and web servers and opens the right resource when you click a link, wherever that resource may actually reside. In order for a browser to display a web page, it must first find the exact server that has the right web page, plus the exact details that identify the information requested. This information must be then be sent back to the browser. Nowadays, it’s highly doubtful that a web server would have only one page to display! Your browser can understand what you need when you enter a Uniform Resource Locator (URL), which we usually refer to as a web address. Each URL defines the protocol used to transfer data, the name of the server, and the particular web page on that server.
Hypertext Transfer Protocol Secure (HTTPS)
Hypertext Transfer Protocol Secure (HTTPS) is also known as Secure Hypertext Transfer Protocol. It uses Secure Sockets Layer (SSL) and keeps data being sent encrypted. Since Microsoft supported HTTPS, it became the de facto standard for securing web communication.
Network Time Protocol (NTP)
Protocol that’s used to synchronize the clocks on our computers to one standard time source (typically, an atomic clock). Network Time Protocol (NTP) works by synchronizing devices to ensure that all computers on a given network agree on the time. So many of the transactions done today are time and date stamped.
Domain Name Service (DNS)
Domain Name Service (DNS) resolves hostnames—specifically, Internet names, such as www.google.com. An IP address identifies hosts on a network and the Internet as well. DNS allows you to use a domain name to specify an IP address. You can change the IP address as often as you want and no one will know the difference. To resolve a DNS address from a host, you’d type in a URL on a browser, which would hand the data to the Application layer interface to be transmitted on the network. The application would look up the DNS address and send a UDP request to your DNS server to resolve the name. If your first DNS server doesn’t know the answer to the query, then the DNS server forwards a TCP request to its root DNS server. Once the query is resolved, the answer is transmitted back to the originating host, which means the host can now request the information from the correct web server. DNS is used to resolve a fully qualified domain name (FQDN).
Dynamic Host Configuration Protocol (DHCP)/Bootstrap
Protocol (BootP)
Dynamic Host Configuration Protocol (DHCP) assigns IP addresses to hosts. It allows for easier administration and works well in small to very large network environments. Many types of hardware can be used as a DHCP server, including a Cisco router. DHCP differs from BootP in that BootP assigns an IP address to a host but the host’s hardware address must be entered manually in a BootP table. You can think of DHCP as a dynamic BootP, but remember that BootP is also used to send an operating system that a host can boot from. DHCP can’t do that. Even so, there’s still a lot of information a DHCP server can provide to a host when the host is requesting an IP address from the DHCP server. Here’s a list of the most common types of information a DHCP server can provide:
■ IP address
■ Subnet mask
■ Domain name
■ Default gateway (routers)
■ DNS server address
■ WINS server address
A client that sends out a DHCP Discover message in order to receive an IP address sends out a broadcast at both layer 2 and layer 3.
■ The layer 2 broadcast is all F s in hex, which looks like this: ff:ff:ff:ff:ff:ff.
■ The layer 3 broadcast is 255.255.255.255, which means all networks and all hosts.
DHCP is connectionless, which means it uses User Datagram Protocol (UDP) at the Transport layer. The Transport layer is also known as the Host-to-Host layer.
The four-step process a client takes to receive an IP address from a DHCP server using “DORA” (Discover, Offer, Request, Acknowledgment) :
- The DHCP client broadcasts a DHCP Discover message looking for a DHCP server (Port 67).
- The DHCP server that received the DHCP Discover message sends a layer 2 unicast DHCP Offer message back to the host.
- The client then broadcasts to the server a DHCP Request message asking for the offered IP address and possibly other information.
- The server finalizes the exchange with a unicast DHCP Acknowledgment message.
DHCP Conflicts
A DHCP address conflict occurs when two hosts use the same IP address. During IP address assignment, a DHCP server checks for conflicts using the Ping program to test the availability of the address before it’s assigned from the pool. If no host replies, then the DHCP server assumes that the IP address is not already allocated. To provide extra protection against IP conflict issue, the host can broadcast for its own address. A host uses something called a gratuitous ARP to help avoid a possible duplicate address. The DHCP client sends an ARP broadcast out on the local LAN or VLAN using its newly assigned address to solve conflicts before they occur. So, if an IP address conflict is detected, the address is removed from the DHCP pool (scope). And it’s really important to remember that the address will not be assigned to a host until the administrator resolves the conflict by hand!
Automatic Private IP Addressing (APIPA)
You can add IP information by hand, known as static IP addressing, but later Windows operating systems provide a feature called Automatic Private IP Addressing (APIPA). With APIPA, clients can automatically self-configure an IP address and subnet mask—basic IP information that hosts use to communicate—when a DHCP server isn’t available. The IP address range for APIPA is 169.254.0.1 through 169.254.255.254. The client also configures itself with a default Class B subnet mask of 255.255.0.0. But when you’re in your corporate network working and you have a DHCP server running, and your host shows that it’s using this IP address range, it means that either your DHCP client on the host is not working or the server is down or can’t be reached due to some network issue.
The Host-to-Host or Transport Layer Protocols
The main purpose of the Host-to-Host layer is to shield the upper-layer applications from the complexities of the network.
■ Transmission Control Protocol (TCP)
■ User Datagram Protocol (UDP)
