Network Flashcards
OSI Layer architecture
The Open Systems Interconnection model (OSI model) is a conceptual model that characterizes and standardizes the communication functions of a telecommunication or computing system without regard to its underlying internal structure and technology.
- Application Layer (HTTP, FTP. SMTP, POP3):
High-level APIs, including resource sharing, remote file access.
- Presentation Layer:
Translation of data between a networking service and an application; including character encoding, data compression, and encryption/decryption
- Session Layer (SSL, RPC):
Managing communication sessions, i.e., a continuous exchange of information in the form of multiple back-and-forth transmissions between two nodes.
- Transport Layer (TCP, UDP, segment):
Reliable transmission of data segments between points on a network, including segmentation, acknowledgment, and multiplexing.
- Network Layer (IP IPv6 Router):
Structuring and managing a multi-node network, including addressing, routing and traffic control
- Data Link Layer (CDP, ARP):
Reliable transmission of data frames between two nodes connected by a physical layer
- Physical (IEEE802,2 Ethernet, Interwork):
Transmission and reception of raw bit streams over a physical medium
TCP/IP
Transmission control protocol/Internet protocol, used to govern the connection of computer systems to the Internet. An implementation of OSI conceptual model.
4 layers:
top3 => Application layer
Transport Layer
Network layer
physical & data link => link layer
TCP three-way handshake
TCP uses a three-way handshake to establish a reliable connection. The connection is full-duplex, and both sides synchronize (SYN) and acknowledge (ACK) each other. The exchange of these four flags is performed in three steps—SYN, SYN-ACK, and ACK
n TCP, the two parties keep track of what they have sent by using a Sequence number. Effectively it ends up being a running byte count of everything that was sent. The receiving party can use the opposite speaker’s sequence number to acknowledge what it has received.
But the sequence number starts at the ISN (Initial Sequence Number), which is a randomly chosen value. And since TCP is a bi-directional communication, both parties can “speak”, and therefore both must randomly generate an ISN as their starting Sequence Number. Which in turn means, both parties need to notify the other party of their starting ISN.
- Alice —> Bob SYNchronize with my Initial Sequence Number of X
- Alice <— Bob I received your syn, I ACKnowledge that I am ready for [X+1]
- Alice <— Bob SYNchronize with my Initial Sequence Number of Y
- Alice —> Bob I received your syn, I ACKnowledge that I am ready for [Y+1]
Notice, four events are occurring:
Alice picks an ISN and SYNchronizes it with Bob.
Bob ACKnowledges the ISN.
Bob picks an ISN and SYNchronizes it with Alice.
Alice ACKnowledges the ISN.
TCP merges the middle steps
Bob <— Alice SYN
Bob —> Alice SYN ACK
Bob <— Alice ACK
Notice the two instances of “SYN” and “ACK”, one of each, in both directions.
Why we need a three-way handshake
The short answer is because a two-way handshake would only allow one party to establish an ISN, and the other party to acknowledge it. Which means only one party can send data.
But TCP is a bi-directional communication protocol, which means either end ought to be able to send data reliably. Both parties need to establish an ISN, and both parties need to acknowledge the other’s ISN.
So in effect, what you have is exactly your description of the two-way handshake, but in each direction. Hence, four events occurring. And again, the middle two flags happen in the same packet. As such three packets are involved in a full TCP connection initiation process.
SYN timeout – first handshake
server received client SYN, reply with SYN-ACK but not receiving ACK;
The server will keep sending until timeout, LINUX default will wait 63 (1+2+4+8+16 wait 32) 5 try
SYN Flood
A client keeps sending the first handshake, then offline to exploit the syn request to collapse server.
when SYN queue is full, LINUX adopt a TCP - syncookies to send back SYN cookies; a malicious client will not respond but a normal one could establish a connection with the syncookie
TCP keepalive
Check the connected socket (also known as TCP sockets), and determine whether the connection is still up and running or if it has broken.
A timer deal with the keepalive procedure. When the keepalive timer reaches zero, you send your peer a keepalive probe packet with no data in it and the ACK flag turned on. You can do this because of the TCP/IP specifications, as a sort of duplicate ACK, and the remote endpoint will have no arguments, as TCP is a stream-oriented protocol. On the other hand, you will receive a reply from the remote host, with no data and the ACK set.
If you receive a reply to your keepalive probe, you can assert that the connection is still up and running without worrying about the user-level implementation.
This procedure is useful because if the other peers lose their connection (for example by rebooting) you will notice that the connection is broken, even if you don’t have traffic on it. If the keepalive probes are not replied to by your peer, you can assert that the connection cannot be considered valid and then take the correct action.
TCP connect termination 4-way-handshake
The connection termination phase uses a four-way handshake, with each side of the connection terminating independently.
When an endpoint wishes to stop its half of the connection, it transmits a FIN packet, which the other end acknowledges with an ACK. Therefore, a typical tear-down requires a pair of FIN and ACK segments from each TCP endpoint. After the side that sent the first FIN has responded with the final ACK, it waits for a timeout before finally closing the connection, during which time the local port is unavailable for new connections; this prevents confusion due to delayed packets being delivered during subsequent connections.
A connection can be “half-open”, in which case one side has terminated its end, but the other has not. The side that has terminated can no longer send any data into the connection, but the other side can. The terminating side should continue reading the data until the other side terminates as well.
Why there is time-wait in four-way handshake
- make sure there is enough time for the server to receive the final ACK packet
- to avoid overlap of new connection and old connection
why need a four-way handshake to terminate connection
TCP is a duplex connection, both side need FIN and ACK
Difference of TCP and UDP
UDP: User Datagram Protocol
- source port, destination port, length, checksum, data
- not connection-oriented, do not maintain a connection, support send to multiple clients the same package at the same time
- header is short: 8 byte
- throughput is only limited by data generation rate, transport limit, and computer power
- not guarantee reliable receiving package
- do not split or merge message
Difference
- connection - non-connection; TCP is one-one connection transport, UDP is one to many
- reliability. Although UDP provides integrity verification (via checksum) of the header and payload, it provides no guarantees to the upper layer protocol for message delivery and the UDP layer retains no state of UDP messages once sent. For this reason, UDP sometimes is referred to as the Unreliable Datagram Protocol.
- Ordering. UDP no.
- Speed. UDP > TCP
- size. TCP 20 byte header
What is TCP windowing concept
TCP windowing concept is primarily used to avoid congestion in the traffic. - It controls the amount of unacknowledged data a sender can send before it gets an acknowledgment back from the receiver that it has received it. - It is one of the key factors for efficient data transmission.
HTTP and its characteristics
The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed, collaborative, hypermedia information systems. HTTP is the foundation of data communication for the World Wide Web, where hypertext documents include hyperlinks to other resources that the user can easily access, for example by a mouse click or by tapping the screen in a web browser.
It is a request-response protocol that supports the client-server model; It uses reliable TCP connections by default on TCP port 80.
特点：
- HTTP is media independent: It specifies that any type of media content can be sent by HTTP as long as both the server and the client can handle the data content.
- HTTP is connectionless: It is a connectionless approach in which HTTP client i.e., a browser initiates the HTTP request and after the request is sent the client disconnects from the server and waits for the response.
- It is stateless means each request is considered as the new request. In other words, the server doesn’t recognize the user by default.
What happens after you type in URL in the browser?
- DNS resolve domain name(URL) to be the IP address
(DNS cache: browser cache, system cache, router cache, IPX server cache, DNS server cache, Root name server cache)
- establish a TCP connection with the server on that IP address
- The client sends an HTTP request for files to the server.
- The Server process that request and send back the response
- Browser (the client) parse the response content and render the page
- Browser release/terminate the TCP connection(4-way handshake)
GET vs POST
- request parameter: GET is in the URL, POST is in the request body
- database: GET is idempotent and secure, POST is not
- GET can be cached, stored, POST can’t
