2.1: TCP/IP Networking Model

Question 1

TCP/IP model

Answer 1

The TCP/IP model consists of four separate layers, each defining certain protocols and actions that allow successful communications between two systems over a network

Question 2

Media Access Control (MAC)
address

Answer 2

A MAC address is a unique, physical address on the network port in your workstation.

Question 3

File Transfer Protocol (FTP)

Answer 3

FTP (File Transfer Protocol) is a standard network protocol used for transferring files between a client and a server on a computer network. It provides a straightforward method for uploading, downloading, and managing files on remote servers.

1. Description: FTP operates on the client-server model, where a client initiates a connection to a server to transfer files. It uses separate control and data connections: the control connection is used for sending commands and receiving responses, while the data connection is used for transferring actual file data.
2. Functionality: FTP supports various operations, including uploading (put), downloading (get), renaming, deleting, and listing files and directories on the server. It allows users to authenticate themselves using a username and password to access their designated directories on the server.
3. Modes: FTP supports two modes of operation: active mode and passive mode. In active mode, the server initiates the data connection to the client, while in passive mode, the client initiates the data connection to the server. Passive mode is often used to bypass firewall restrictions.
4. Security: FTP originally transmitted data in plaintext, making it vulnerable to eavesdropping attacks. To address this, secure versions of FTP, such as FTPS (FTP Secure) and SFTP (SSH File Transfer Protocol), have been developed, which add encryption and authentication mechanisms to ensure secure data transfer.
5. Usage: FTP is commonly used for uploading and downloading files to and from web servers, managing website content, and transferring large files between computers on a network. It is also widely used in industries such as web development, publishing, and software distribution.

In summary, FTP is a widely adopted protocol for transferring files over a network, providing a simple and efficient method for file management and sharing between clients and servers. While traditional FTP lacks security features, secure alternatives like FTPS and SFTP offer encryption and authentication to ensure secure data transfer.

Question 4

Simple Mail Transport protocol (SMTP)

Answer 4

SMTP (Simple Mail Transfer Protocol) is a standard protocol used for sending and receiving email messages over the internet. It is primarily responsible for the transmission of emails from a sender’s email client to the recipient’s email server.

1. Description: SMTP operates on the application layer of the TCP/IP protocol suite. It provides a set of rules and commands that govern the exchange of email messages between mail servers. SMTP clients (mail user agents) initiate connections to SMTP servers (mail transfer agents) to send outgoing messages.
2. Functionality: SMTP defines how email messages are formatted, addressed, and delivered between mail servers. When a sender composes an email using an email client, the client communicates with an SMTP server to transmit the message. The SMTP server then routes the message to the recipient’s email server, which stores it until the recipient retrieves it using their email client.
3. Reliability: SMTP ensures reliable delivery of email messages by employing error-checking mechanisms and message queuing. If a recipient’s email server is temporarily unavailable, SMTP servers will retry delivery at regular intervals until successful transmission or until the message expires.
4. Authentication: SMTP servers may require authentication from clients before accepting outgoing email messages. This helps prevent unauthorized use of the server for sending spam or malicious emails.
5. Extensions: SMTP has been extended over time to include additional features such as SMTP authentication, message encryption (SMTPS), and email forwarding (ESMTP). These extensions enhance security and functionality, making SMTP more robust and versatile for modern email communication.

In summary, SMTP is a vital protocol for the transmission of email messages over the internet, enabling seamless communication between email clients and servers. It provides a standardized method for sending, routing, and delivering email messages while ensuring reliability and security through various extensions and authentication mechanisms.

Question 5

Transmission Control Protocol (TCP)

Answer 5

TCP is a Transport layer protocol.

Summary: TCP provides reliable and ordered data transmission with features like error checking and flow control, making it suitable for applications where data integrity is paramount.

Description: TCP is a connection-oriented protocol that provides reliable, ordered, and error-checked delivery of data between applications running on hosts in a network. It operates at the transport layer of the TCP/IP model.

Functionality: TCP establishes a connection between two hosts before transmitting data. It ensures that data packets are delivered in the correct order, retransmits lost packets, and detects and corrects errors. This makes TCP ideal for applications that require guaranteed delivery of data, such as web browsing, email, and file transfer.

Features: TCP includes features such as flow control, congestion control, and error recovery mechanisms to maintain the integrity and reliability of data transmission.

Question 6

User Datagram Protocol (UDP)

Answer 6

UDP is a Transport layer protocol.

Summary: UDP offers low-latency, connectionless communication, making it ideal for real-time applications where speed is prioritized over reliability.

Description: UDP is a connectionless protocol that provides a minimalistic and unreliable mechanism for transmitting data between applications. Like TCP, it operates at the transport layer of the TCP/IP model.

Functionality: UDP does not establish a connection before sending data and does not guarantee delivery, order, or error checking. It simply encapsulates data into packets and sends them to the destination without waiting for acknowledgments or retransmissions.

Usage: UDP is commonly used in applications where real-time communication is crucial, such as online gaming, live video streaming, DNS (Domain Name System) queries, and Voice over IP (VoIP). It offers lower latency compared to TCP but sacrifices reliability.

Question 7

Internet Work Protocol (IP)

Answer 7

IP (Internet Protocol) is a core protocol in the TCP/IP protocol suite, which governs how data packets are transmitted across networks. It provides the addressing and routing mechanism that enables devices to communicate with each other on the internet.

1. Description: IP is a network-layer protocol responsible for addressing packets and routing them across interconnected networks. It provides a standardized format for packet headers, including source and destination IP addresses, which are used by routers to forward packets toward their destination.
2. Functionality: IP operates in a best-effort delivery model, meaning it does not guarantee packet delivery, order, or reliability. Instead, it focuses on efficiently routing packets through networks, choosing the best available path based on routing tables and algorithms.
3. Versions: The two main versions of IP in use today are IPv4 and IPv6. IPv4, the older version, uses 32-bit addresses, limiting the number of available IP addresses, while IPv6 uses 128-bit addresses, providing a vastly expanded address space to accommodate the growing number of devices connected to the internet.
4. Addressing: IP addresses are numerical identifiers assigned to devices on a network. IPv4 addresses are typically represented in dotted-decimal notation (e.g., 192.0.2.1), while IPv6 addresses are represented in hexadecimal notation (e.g., 2001:0db8:85a3:0000:0000:8a2e:0370:7334). IP addresses are essential for routing packets to their intended destinations.
5. Routing: IP routers use routing tables to determine the next hop for forwarding packets toward their destination. Routers examine the destination IP address of incoming packets and compare it to entries in their routing tables to determine the appropriate outgoing interface.

In summary, IP is a foundational protocol that enables devices to communicate across networks by providing addressing and routing capabilities. It forms the basis of internet communication, allowing data packets to traverse complex networks and reach their intended destinations.

Question 8

Broadcast domain

Answer 8

A broadcast domain is a smaller region of a larger network.

Question 9

Virtual LAN

Answer 9

A virtual LAN is a smaller region of a larger network.

Question 10

Data Link

Answer 10

Data Link is a sublayer of the Link layer.

Question 11

Physical

Answer 11

Physical is a sublayer of the Link layer.

Question 12

HTTP(S)

Answer 12

HTTP (Hypertext Transfer Protocol) and its secure counterpart HTTPS (Hypertext Transfer Protocol Secure) are fundamental protocols used for communication on the internet.

HTTP:

1. Description: HTTP is a protocol that governs how data is transferred between a client (such as a web browser) and a server (where a website is hosted) over the internet. It operates on top of the TCP/IP protocol suite.
2. Functionality: It facilitates the request-response cycle. A client sends an HTTP request to a server, which then processes the request and returns an HTTP response containing the requested data (such as a web page).
3. Statelessness: HTTP is stateless, meaning each request from a client to a server is independent and unrelated to any previous requests. This simplifies implementation and enhances scalability but can pose challenges for maintaining session information.

HTTPS:

1. Description: HTTPS is an extension of HTTP that adds a layer of encryption using SSL/TLS protocols to secure data transmission over the internet. It encrypts the data exchanged between the client and server, ensuring confidentiality and integrity.
2. Security: HTTPS encrypts sensitive data, such as login credentials, payment information, and personal details, preventing unauthorized access or tampering by malicious actors.
3. Authentication: HTTPS also provides authentication, verifying the identity of the server to the client, thus mitigating the risk of man-in-the-middle attacks.

In summary, HTTP is the foundation of data communication on the web, while HTTPS enhances security by encrypting and securing the data exchanged between clients and servers.

Question 13

Application layer

Answer 13

The Application layer, also called the Process-to-Process layer, corresponds to the Session, Presentation, and Application layers of the OSI model.

Question 14

Transport layer

Answer 14

The Transport layer, also called the Host-to-Host layer, is comparable to the Transport layer of the OSI model. It is responsible for error checking and reliable packet delivery. The Transport layer breaks the data stream into segments and assigns sequence numbers so that the segments can be reassembled correctly at the destination.

Question 15

Internet layer

Answer 15

The Internet layer is comparable to the Network layer of the OSI model. It is responsible for moving packets through a network. This involves addressing and making routing decisions to identify how the packet traverses the network.

Question 16

Link layer

Answer 16

The Link layer corresponds to the functions of the Physical and Data Link layers of the OSI model. It is responsible for describing the physical layout of the network and how messages are formatted on the transmission medium. Sometimes this layer is divided into the Data Link and the Physical layers.

Question 17

Telnet/SSH

Answer 17

TELNET (Telecommunication Network) and SSH (Secure Shell) are both network protocols used for remote access to computers or devices over a network. While TELNET provides basic remote access capabilities, SSH offers enhanced security features, making it the preferred choice for secure remote access.

TELNET:

1. Description: TELNET is a network protocol that enables users to establish a virtual terminal connection with a remote host over a network, typically the internet. It allows users to log in to a remote system and interact with it as if they were physically present at the system’s console.
2. Functionality: TELNET provides a text-based interface for remote access, allowing users to execute commands, run applications, and access resources on a remote system. It operates on the application layer of the TCP/IP protocol suite and uses TCP for communication.
3. Security: TELNET lacks built-in encryption and authentication mechanisms, making it susceptible to eavesdropping and interception attacks. User credentials, commands, and data transmitted over a TELNET connection are sent in plaintext, posing significant security risks, especially over untrusted networks.

SSH (Secure Shell):

1. Description: SSH is a network protocol that provides secure remote access, secure file transfer, and secure tunneling capabilities over a network. It establishes encrypted connections between clients and servers, ensuring confidentiality, integrity, and authenticity of data transmission.
2. Functionality: SSH offers a secure alternative to TELNET for remote access. It encrypts all communication between the client and server, including user authentication, command execution, and data transfer. SSH operates on the application layer of the TCP/IP protocol suite and typically uses TCP port 22 for communication.
3. Security: SSH employs strong cryptographic algorithms to encrypt data transmitted over the network, preventing eavesdropping and unauthorized access to sensitive information. It also supports various authentication methods, including password-based authentication, public-key authentication, and multi-factor authentication, enhancing security and access control.

In summary, TELNET and SSH are network protocols used for remote access to computers or devices over a network. While TELNET provides basic remote access capabilities, SSH offers enhanced security features, making it the preferred choice for secure remote access in modern network environments.

Question 18

Application (Process-to-Process)

Answer 18

The Application layer contains high-level protocols used by processes (applications) running on a host for network communications. The Application layer integrates network functionality into the host operating system and enables network services. The Application layer does not include specific applications that provide services, but rather provides the capability for services to operate on the network.
Processes operating at the Application layer on the source host send data to other processes running on a destination host at the Application layer. For example, a web browser on a client system can send an HTTP GET request to the web service running on a network server to request that it send a particular web page.

Processes running on the source host produce the data to be transmitted and encode it using the appropriate Application layer protocol. Some commonly-used Application layer protocols include FTP, HTTP, Telnet, SMTP, DNS, and SSH. Once encoded, the data is then sent to the Transport layer where it is encapsulated using the appropriate Transport layer protocol.

The Application layer in the TCP/IP model corresponds to the Session, Presentation, and Application layers of the OSI model.

Question 19

Transport (Host-to-Host)

Answer 19

The Transport layer is responsible for error checking and reliable delivery. The Transport layer provides the following key functions:
The sending Transport layer receives a stream of information from the Application layer and breaks it into smaller chunks called segments . Segmentation is necessary to enable the data to meet network size and format restrictions.
The receiving Transport layer uses packet sequence numbers to reassemble segments into the original message.
The Transport layer establishes a communication channel that can be used to transfer data to a remote host.
Protocols that are associated with the Transport layer include:

Transport Control Protocol (TCP)
TCP creates a connection-oriented communication channel. Prior to transmission, TCP negotiates a connection with the remote host using a three-way handshake:
The source host sends the destination host a TCP SYN message.
The destination host responds with TCP SYN/ACK message.
The source host responds with a TCP ACK message.
TCP uses acknowledgements after each packet is transmitted to ensure that the data arrived correctly. Any missing, damaged, or discarded packets are retransmitted.
TCP ensures a high degree of reliability. However, it also incurs a degree of latency, due to the extra overhead required to ensure data integrity.
TCP is most appropriate for communications where data integrity is more important than transmission speed. For example, when saving a file on a network server using the SMB protocol, a few milliseconds of latency is of little concern, but the integrity of the data is critical.
User-Datagram Protocol (UDP):
UDP uses connectionless communications.
Unlike TCP, UDP does not set up a connection, nor does it use acknowledgements to ensure the data arrived properly.
UDP assumes that lower-level protocols can reliably deliver packets to the destination host.
This protocol is most appropriate for application-level processes that require low-latency transmissions and can tolerate a degree of missing or out-of-sequence packets.
UDP is commonly used by streaming audio, streaming video, and Voice over IP (VoIP) applications.
The Transport layer uses ports to enable application-to-application communications between hosts. A port number is logically assigned to each service running on a system. Using ports allows a network host with a single IP address to provide multiple services, each sending and receiving data on its own port. The Transport layer header applied to each segment before transmission identifies the source port on the sending host as well as the destination port on the receiving host. Standardized port numbers have been defined for well-known services. For example:

Service Port Number
FTP 20 and 21
SSH 22
SMTP 25
DNS 53
HTTP 80
POP3 110
IMAP 143
HTTPS 443
The Transport layer is comparable to the Transport layer of the OSI model.

Question 20

Internet

Answer 20

The Internet layer is responsible for forwarding packets through multiple networks. This process is called routing . The Internet layer manages host addressing and routing decisions to identify how packets traverse networks. Protocols that reside at the Internet layer include:
Internet Protocol (IP)
Address Resolution Protocol (ARP)
Internet Control Message Protocol (ICMP)
Internet Group Management Protocol (IGMP)
The Internet layer uses logically-assigned IP addresses to uniquely identify networks and network hosts. Each address assigned to a host identifies:

The network the host resides on.
The host’s unique identity on that network.
The Internet layer header applied to each packet before transmission includes the source IP address of the sending host and the destination IP address of the receiving host. When transmitting data, the Internet layer uses the source and destination network addresses to determine whether the hosts reside on the same network or on different networks:

If they reside on the same network, the data can be sent directly to the destination host.
If they reside on different networks, the Internet layer forwards packets from router to router until the packets reach the appropriate destination host.
Key Internet layer functions include:

Maintaining addresses of neighboring routers.
Maintaining a list of known networks.
Determining the next network point to which data should be sent. Routers use a routing protocol to take into account various factors, such as the number of hops in the path, link speed, and link reliability to select the optimal path for data.
The Internet layer is not concerned with reliable delivery of information. Instead, it relies on the Transport layer to establish a host-to-host communication channel and ensure information arrives correctly at the destination host.

The Internet layer is comparable to the Network layer of the OSI model.

Question 21

Link

Answer 21

The Link layer is responsible for describing the physical layout of the network and how messages are electrically transmitted. It is used to move information between hosts by controlling how individual bits are transmitted and received on the network medium.
Each host is uniquely identified at the Link layer using a Media Access Control (MAC) address. Every network interface has a physical MAC address assigned to it by the manufacturer. This address is stored in the firmware of the network interface itself. Theoretically, no two network interfaces in the world should have the same MAC address assigned.

Unlike an IP address, a MAC address only identifies the host. It does not identify the network where the host resides. As a result, the link layer is not concerned with which network the sending and receiving hosts reside on. It simply transmits data from interface to interface using electrical signals on the network medium.

The Link layer converts the data to be transmitted into frames by adding a Link layer header, which includes physical device addressing information. Each frame processed by the Link layer includes the source MAC address and the destination MAC address. The Link layer then converts the frames into bits for transmission across the network media.

The Link layer corresponds to the functions of the Physical and Data Link layers of the OSI model.

Question 22

ICANN Port Categories

Answer 22

Well-known

A well-known port is:
Assigned for specific protocols and services.
Has port numbers ranging from 0 to 1023.

Registered

A registered port:
Is assigned by ICANN for a newly created network service.
Has port numbers ranging from 1024 to 49151.

Dynamic (private or high)

A dynamic port:
Is assigned when a network service establishes contact and released when the session ends.
Allows applications to listen to the assigned port for other incoming requests. Traffic for a protocol can be received through a port other than the port which the protocol is assigned. This requires that the destination application or service is listening for that type of traffic on that port.
Has port numbers ranging from 49,152 to 65,535.

Question 23

Well known ports list

Answer 23

TCP 20, 21 File Transfer Protocol (FTP)
TCP, UDP 22 Secure Shell (SSH)
TCP, UDP 23 Telnet
TCP, UDP 25 Simple Mail Transfer Protocol (SMTP)
TCP, UDP 53 Domain Name Server (DNS)
UDP 67, 68 Dynamic Host Configuration Protocol (DHCP)
UDP 69 Trivial File Transfer Protocol (TFTP)
TCP 80 Hypertext Transfer Protocol (HTTP)
TCP 110 Post Office Protocol (POP3)
TCP 119 Network News Transport Protocol (NNTP)
UDP 123 Network Time Protocol (NTP)
TCP 143 Internet Message Access Protocol (IMAP4)
TCP, UDP 161, 162 Simple Network Management Protocol (SNMP)
TCP 389 Lightweight Directory Access Protocol (LDAP)
TCP 443 HTTP with Secure Sockets Layer (SSL)

Question 24

What is the purpose of a network model?

Answer 24

The purpose of a network model is to standardize processes at each layer so that the receiving system can make sense of what was sent. This includes data security, addressing, and formatting.

The browser’s job is to provide you an interface for submitting web requests.

Telnet is used to either remotely access applications on remote systems or connect to a Cisco device remotely to reconfigure it.

The Internet Protocol (IP) provides the logical addressing required to locate your destination node.

Question 25

Which of the following are limitations of the TCP/IP model?

Answer 25

You must remember the following limitations of the TCP/IP model:

TCP/IP layers are theoretical and do not actually perform real functions.
Industry implementations rarely have a layer-to-layer correspondence with the TCP/IP layers.
Different protocols within the stack perform different functions, which help send or receive the overall message.
A particular protocol implementation may not represent every layer (or it may spread across multiple layers).

Question 26

Match the layers of the TCP/IP model to the corresponding layers of the OSI model.

Answer 26

The Application layer (also called the Process-to-Process layer) corresponds to the Session, Presentation, and Application layers of the OSI model.

The Transport layer (also called the Host-to-Host layer) is comparable to the Transport layer of the OSI model and is responsible for error checking and reliable packet delivery. At this layer, the data stream is broken into segments that must be assigned sequence numbers so that the segments can be reassembled correctly on the remote side.

The Internet layer is comparable to the Network layer of the OSI model. It is responsible for moving packets through a network. This involves the addressing of hosts and making routing decisions to identify how the packet traverses the network.

The Link layer corresponds to the functions of the Physical and Data Link layers of the OSI model. It is responsible for describing the physical layout of the network and how messages are formatted on the transmission medium. Sometimes, this layer is divided into the Data Link and Physical layers.

Question 27

How does TCP handle data sequencing?

Answer 27

TCP preserves the sequence of the segments it creates and waits for an acknowledgement before sending the next segment.

UDP simply assigns each segment a number and sends them without paying attention to their order or checking to ensure they arrived at their destination.

Question 28

Which of the following methods helps to detect lost packets?

Answer 28

Lost packets can be detected using sequencing or acknowledgements:

Sequencing assigns a number to each packet. A missing sequence number in received packets indicates a lost packet.
The receiving device sends acknowledgements to notify the sending device of received packets. If an acknowledgement is not received by the sending device, it assumes a lost packet and retransmits.
Flow control is the mechanism for controlling how much data is sent at a time. Various mechanisms exist for speeding up or slowing down the data transfer rate.

A Cyclical Redundancy Check (CRC) is a mathematical calculation added to each frame. The CRC detects errors in received frames.

Buffering is a method of holding data that needs to be sent. Buffering can be used in flow control to hold packets that cannot yet be transmitted.

Question 29

Which of the following lists accurately describes TCP and UDP?

Answer 29

TCP and UDP are both Transport and Host-to-Host level protocols, but they have different characteristics.

TCP characteristics include:

Connection-oriented
Reliable
Sequenced
High overhead
UDP characteristics include:

Connectionless
Unreliable
Unsequenced
Low overhead

Question 30

Match each layer of the TCP/IP model to its functions.

Answer 30

The Application layer contains high-level protocols used by processes (applications) running on a host for network communications. The Application layer integrates network functionality into the host operating system and enables network services. The Application layer does not include specific applications that provide services, but rather provides the capability for services to operate on the network.

The Transport layer is responsible for error checking and reliable delivery. The Transport layer also uses ports to enable application-to-application communications between hosts.

The Internet layer is responsible for forwarding packets through multiple networks. This process is called routing. The Internet layer manages the host addressing and routing decisions to identify how packets traverse networks. The Internet layer is not concerned with reliable delivery of information. Instead, it relies on the Transport layer to establish a host-to-host communication channel and ensure information arrives correctly at the destination host.

The Link layer is responsible for describing the physical layout of the network and how messages are electrically transmitted. It is used to move information between hosts by controlling how individual bits are transmitted and received on the network medium.

Question 31

An internet server has a single network interface that has been assigned an IP address. The server is running both the FTP and HTTP services. A client computer initiates a session with the HTTP server.

How is the HTTP request from the client routed to the correct service running on the server?

Answer 31

Port or socket numbers are used to identify a service running on the server. For example, FTP uses ports 20 and 21 to send communications to the FTP service running on the server, while port number 80 is used for HTTP.

Sequence numbers are used in packets to make sure that packets can be reassembled in the proper order and identify lost packets. The IP address identifies a network interface. Communication instances within the same service but between different clients (or multiple instances with the same client) are kept separate by session IDs. Routing Information Protocol (RIP) is a routing protocol for routing data through an internetwork.

Question 32

The TCP/IP protocol stack uses port numbers to determine protocol use. Port usage is regulated by the Internet Corporation for Assigning Names and Numbers (ICANN). Which of the following are characteristics of registered ports?

Answer 32

A registered port:

Is assigned by ICANN for a network service.
Has port numbers ranging from 1024 to 49151.
A well-known port is:

Assigned for specific protocols and services.
Has port numbers ranging from 0 to 1023.
A dynamic port:

Is assigned when a network service establishes contact and released when the session ends.
Allows applications to listen to the assigned port for other incoming requests. Traffic for a protocol can be received through a port other than the port which the protocol is assigned. This requires that the destination application or service is listening for that type of traffic on that port.
Has port numbers ranging from 49152 to 65535.

Question 33

Match each TCP and/or UDP ports to the service that uses it.

Answer 33

TCP and UDP use port 23 for Telnet

TCP and UDP use port 53 for Domain Name System (DNS)

UDP uses ports 67 and 68 for Dynamic Host Configuration Protocol (DHCP)

UDP uses port 69 for Trivial File Transfer Protocol (TFTP)

TCP uses port 119 for Network News Transport Protocol (NNTP)

UDP uses ports 161 and 162 usually for Simple Network Management Protocol (SNMP)