The TCP/IP Protocol Layers
Figure 2.1 shows the TCP/IP protocol suite in relationship to the OSI reference model. The network
interface layer, which corresponds to the OSI physical and data link layers, is not really part of the
specification. However, it has become a de facto layer either as shown in Figure 2.1 or as separate
physical and data link layers. It is described in this section in terms of the OSI physical and data link
layers.
The physical layer contains the protocols relating to the physical medium on which TCP/IP will be
communicating. Officially, the protocols of this layer fall within four categories that together describe all
aspects of physical media:
Electrical/optical protocols describe signal characteristics such as voltage or photonic levels, bit
timing, encoding, and signal shape.
Mechanical protocols are specifications such as the dimensions of a connector or the metallic
makeup of a wire.
Functional protocols describe what something does. For example, "Request to Send" is the
functional description of pin 4 of an EIA-232-D connector.
Procedural protocols describe how something is done. For example, a binary 1 is represented on
an EIA-232-D lead as a voltage more negative than –3 volts.
The data link layer was described in Chapter 1, "Basic Concepts: Internetworks, Routers, and Addresses."
This layer contains the protocols that control the physical layer: how the medium is accessed and shared,
how devices on the medium are identified, and how data is framed before being transmitted on the
medium. Examples of data link protocols are IEEE 802.3/Ethernet, IEEE 802.5/Token Ring, and FDDI.
The internet layer, corresponding to the OSI network layer, is primarily responsible for enabling the
routing of data across logical internetwork paths, such as in Figure 1.9, by defining a packet format and
an addressing format. This layer is, of course, the one with which this book is most concerned.
The host-to-host layer, corresponding to the OSI transport layer, specifies the protocols that control the
internet layer, much as the data link layer controls the physical layer. Both the host-to-host and data link
layers can define such mechanisms as flow and error control. The difference is that while data link
protocols control traffic on the data link— the physical medium connecting two devices— the transport
layer controls traffic on the logical link— the end-to-end connection of two devices whose logical
connection traverses a series of data links.
The application layer corresponds to the OSI session, presentation, and application layers. Although
some routing protocols such as BGP and RIP reside at this layer, the most common services of the
application layer provide the interfaces by which user applications access the network.
A function common to the protocol suite of Figure 2.1 and any other protocol suites is multiplexing
between layers. Many applications may use a service at the host-to-host layer, and many services at the
host-to-host layer may use the internet layer. Multiple protocol suites (IP, IPX, AppleTalk, for example)
may share a physical link via common data link protocols.
The IP Packet Header
Figure 2.2 shows the format of the IP packet header, specified in RFC 791. Most fields in this packet have
some importance to routing.
Version identifies the I P version to which the packet belongs. This four-bit field is usually set to binary
0100; version 4 (IPv4) is in current, common use. A newer version of the protocol, not yet in widespread
deployment, is version 6 (IPv6), sometimes referred to as" next-generation IP"(IPng). All currently
assigned version numbers can be seen in Table 2.1, along with a few of the relevant RFCs. All versions
other than 4 and 6 (built on an earlier proposal called Simple Internet Protocol, or SIP, which also carried
a version number of 6) now exist only as "culture," and it will be left to the curious to read their cited
RFCs.
Header Length is a four-bit field that tells, as the name implies, the length of the IP header. The reason
this field is included is that the Options field (described later in this section) can vary in size. The
minimum length of the IP header is 20 octets, and the options may increase this size up to a maximum of
24 octets. This field describes the length of the header in terms of 32-bit words— five for the minimum
160-bit size and six for the maximum.
Table 2.1. IP version numbers.
Number Version RFC
0 Reserved
1–3 Unassigned
4 Internet Protocol (IP) 791
5 ST Datagram Mode 1190
6 Simple Internet Protocol (SIP)
6 IPng 1883
7 TP/IX 1475
8 P Internet Protocol (PIP) 1621
9 TCP and UDP over Bigger Addresses (TUBA) 1347
10–14 Unassigned
15 Reserved
Type of Service (TOS) is an eight-bit field that can be used for specifying special handling of the packet.
This field actually can be broken down into two subfields: Precedence and TOS. Precedence sets a
priority for the packet, the way a package might be sent overnight, 2-day delivery, or general post. TOS
allows the selection of a delivery service in terms of throughput, delay, reliability, and monetary cost.
Although this field is not commonly used (all the bits will usually be set to zero), early specifications of
the Open Shortest Path First (OSPF) protocol called for TOS routing. Also, the Precedence bits are occasionally used in Quality of Service (QoS) applications. Figure 2.3 summarizes the eight TOS bits; for
more information , see RFC 1340 and RFC 1349.
Figure 2.3. The Type of Service field.
Total Length is a 16-bit field specifying the total length of the packet, including the header, in octets. By
subtracting the header length, a receiver may determine the size of the packet's data payload. Because the
largest decimal number that can be described with 16 bits is 65,535, the maximum possible size of an IP
packet is 65,535 octets.
Identifier is a 16-bit field used in conjunction with the Flags and Fragment Offset fields for fragmentation
of a packet. Packets must be fragmented into smaller packets if the original length exceeds the Maximum
Transmission Unit (MTU) of a data link through which they pass. For example, consider a 5,000-byte
packet traveling through an internetwork. It encounters a data link whose MTU is 1,500 bytes— that is,
the frame can contain a maximum packet size of 1,500 bytes. The router that places the packet onto this
data link must first fragment the packet into chunks of no more than 1,500 octets each. The router then
marks each fragment with the same number in the Identifier field so that a receiving device can identify
the fragments that go together.[1]
[1] A fragmented packet is not reassembled at the other end of the data link; the packet stays fragmented until it reaches its final destination.
NOTE
The DF bit can be used in troubleshooting to determine a path's MTU.
Flags is a three-bit field in which the first bit is unused. The second is the Don't Fragment (DF) bit. When
the DF bit is set to one, a router cannot fragment the packet. If the packet cannot be forwarded without
fragmenting, the router drops the packet and sends an error message to the source. This function enables
the testing of MTUs in an internetwork. The DF bit can be set using the Extended Ping utility on Cisco
routers, as shown in Figure 2.4.
30
IT Certification CCIE,CCNP,CCIP,CCNA,CCSP,Cisco Network Optimization and Security Tips
TCP/IP Review
The TCP/IP Protocol Layers
The IP Packet Header
IP Addresses
ARP
ICMP
The Host-to-Host Layer
The purpose of this chapter is to examine the details of the protocols that enable, control, or contribute to
the routing of TCP/IP, not to do an in-depth study of the TCP/IP protocol suite. Several books on the
recommended reading list at the end of the chapter cover the subject in depth. Read at least one.
Conceived in the early 1970s by Vint Cerf and Bob Kahn, TCP/IP and its layered protocol architecture
predates the ISO's OSI reference model. A brief review of TCP/IP's layers will be useful in understanding
how the various functions and services examined in this chapter interrelate.
The IP Packet Header
IP Addresses
ARP
ICMP
The Host-to-Host Layer
The purpose of this chapter is to examine the details of the protocols that enable, control, or contribute to
the routing of TCP/IP, not to do an in-depth study of the TCP/IP protocol suite. Several books on the
recommended reading list at the end of the chapter cover the subject in depth. Read at least one.
Conceived in the early 1970s by Vint Cerf and Bob Kahn, TCP/IP and its layered protocol architecture
predates the ISO's OSI reference model. A brief review of TCP/IP's layers will be useful in understanding
how the various functions and services examined in this chapter interrelate.
Repeaters and Bridges
The information presented so far may be distilled into a few brief statements:
A data communication network is a group of two or more devices connected by a common, shared
medium.
These devices have an agreed-upon set of rules, usually called the Media Access Control, or
MAC, that govern how the media is shared.
Each and every device has an identifier, and each identifier is unique to only one device.
Using these identifiers, the devices communicate by encapsulating the data they need to send
within a virtual envelope called a frame.
So here's this wonderful resource-sharing tool called a LAN. It's so wonderful, in fact, that everyone
wants to be connected to it. And herein is the rub. As a LAN grows, new problems present themselves.
The first problem is one of physical distance. Figure 1.4 shows that three factors can influence an
electrical signal. These factors may decrease or eliminate any intelligence the signal represents:
Figure 1.4. Attenuation, interference, and distortion prevent a signal from arriving in the same shape it was
in when it left. Attenuation (a) is a function of the resistance of the wire. A certain amount of signal energy
must be spent "pushing past" the resistance. Interference (b) is a function of outside influences—noise—
which adds characteristics to the signal that should not be there. Distortion (c) is a function of the wire
impeding different frequency components of the signal in different ways.
Attenuation
Interference
Distortion
As the distance the signal must travel down the wire increases, so do the degrading effects of these three
factors. Photonic pulses traveling along an optical fiber are much less susceptible to interference but will
still succumb to attenuation and distortion.
Repeaters are added to the wire at certain intervals to alleviate the difficulties associated with excessive
distance. A repeater is placed on the media some distance from the signal source but still near enough to
be able to correctly interpret the signal (see Figure 1.5). It then repeats the signal by producing a new,
clean copy of the old degraded signal. Hence, the name repeater.
Figure 1.5. By placing a repeater in the link at a distance where the original signal can still be recognized,
despite the effects of attenuation, interference, and distortion, a fresh signal can be generated and the
length of the wire extended.
A repeater may be thought of as part of the physical medium. It has no real intelligence, but merely
regenerates a signal; a digital repeater is sometimes facetiously called a "bit spitter" for this reason.
The second problem associated with growing LANs is congestion. Repeaters are added to extend the
distance of the wire and to add devices; however, the fundamental reason for having a LAN is to share
resources. When a too-large population tries to share limited resources, the rules of polite behavior begin
to be violated and conflicts erupt. Among humans, poverty, crime, and warfare may result. On Ethernet
networks, collisions deplete the available bandwidth. On Token Ring and FDDI networks, the token
rotation time and timing jitter may become prohibitively high.
Drawing boundaries between populations of LAN devices is a solution to overcrowding. This task is
accomplished by the use of bridges.[6]
[6] If you cut through the marketing hype surrounding modern Ethernet and Token Ring switches, you'll find that these very useful tools are
merely high-performance bridges.
Figure 1.6 shows the most common type of bridge: a transparent bridge. It performs three simple
functions: learning, forwarding, and filtering. It is transparent in that end stations have no knowledge of
the bridge.
Figure 1.6. The transparent bridge segments network devices into manageable populations. A bridging
table tracks the members of each population and manages communication between the populations.
The bridge learns by listening promiscuously on all its ports. That is, every time a station transmits a
frame, the bridge examines the source identifier of the frame. It then records the identifier in a bridging
table, along with the port on which it was heard. The bridge therefore learns which stations are out port 1,
which are out port 2, and so on.
In Figure 1.6, the bridge uses the information in its bridging table to forward frames when a member of
one population—say, a station out port 1—wants to send a frame to a member of another population: a
station out port 2.
A bridge that only learns and forwards would have no use. The real utility of a bridge is in the third
function, filtering. Figure 1.6 shows that if a station out port 2 sends a frame to another station out port 2,
the bridge will examine the frame. The bridge consults its bridging table and sees that the destination
device is out the same port on which the frame was received and will not forward the frame. The frame is
filtered.
Bridges enable the addition of far more devices to a network than would be possible if all the devices
were in a single population, contending for the same bandwidth. Filtering means that only frames that 20
A data communication network is a group of two or more devices connected by a common, shared
medium.
These devices have an agreed-upon set of rules, usually called the Media Access Control, or
MAC, that govern how the media is shared.
Each and every device has an identifier, and each identifier is unique to only one device.
Using these identifiers, the devices communicate by encapsulating the data they need to send
within a virtual envelope called a frame.
So here's this wonderful resource-sharing tool called a LAN. It's so wonderful, in fact, that everyone
wants to be connected to it. And herein is the rub. As a LAN grows, new problems present themselves.
The first problem is one of physical distance. Figure 1.4 shows that three factors can influence an
electrical signal. These factors may decrease or eliminate any intelligence the signal represents:
Figure 1.4. Attenuation, interference, and distortion prevent a signal from arriving in the same shape it was
in when it left. Attenuation (a) is a function of the resistance of the wire. A certain amount of signal energy
must be spent "pushing past" the resistance. Interference (b) is a function of outside influences—noise—
which adds characteristics to the signal that should not be there. Distortion (c) is a function of the wire
impeding different frequency components of the signal in different ways.
Attenuation
Interference
Distortion
As the distance the signal must travel down the wire increases, so do the degrading effects of these three
factors. Photonic pulses traveling along an optical fiber are much less susceptible to interference but will
still succumb to attenuation and distortion.
Repeaters are added to the wire at certain intervals to alleviate the difficulties associated with excessive
distance. A repeater is placed on the media some distance from the signal source but still near enough to
be able to correctly interpret the signal (see Figure 1.5). It then repeats the signal by producing a new,
clean copy of the old degraded signal. Hence, the name repeater.
Figure 1.5. By placing a repeater in the link at a distance where the original signal can still be recognized,
despite the effects of attenuation, interference, and distortion, a fresh signal can be generated and the
length of the wire extended.
A repeater may be thought of as part of the physical medium. It has no real intelligence, but merely
regenerates a signal; a digital repeater is sometimes facetiously called a "bit spitter" for this reason.
The second problem associated with growing LANs is congestion. Repeaters are added to extend the
distance of the wire and to add devices; however, the fundamental reason for having a LAN is to share
resources. When a too-large population tries to share limited resources, the rules of polite behavior begin
to be violated and conflicts erupt. Among humans, poverty, crime, and warfare may result. On Ethernet
networks, collisions deplete the available bandwidth. On Token Ring and FDDI networks, the token
rotation time and timing jitter may become prohibitively high.
Drawing boundaries between populations of LAN devices is a solution to overcrowding. This task is
accomplished by the use of bridges.[6]
[6] If you cut through the marketing hype surrounding modern Ethernet and Token Ring switches, you'll find that these very useful tools are
merely high-performance bridges.
Figure 1.6 shows the most common type of bridge: a transparent bridge. It performs three simple
functions: learning, forwarding, and filtering. It is transparent in that end stations have no knowledge of
the bridge.
Figure 1.6. The transparent bridge segments network devices into manageable populations. A bridging
table tracks the members of each population and manages communication between the populations.
The bridge learns by listening promiscuously on all its ports. That is, every time a station transmits a
frame, the bridge examines the source identifier of the frame. It then records the identifier in a bridging
table, along with the port on which it was heard. The bridge therefore learns which stations are out port 1,
which are out port 2, and so on.
In Figure 1.6, the bridge uses the information in its bridging table to forward frames when a member of
one population—say, a station out port 1—wants to send a frame to a member of another population: a
station out port 2.
A bridge that only learns and forwards would have no use. The real utility of a bridge is in the third
function, filtering. Figure 1.6 shows that if a station out port 2 sends a frame to another station out port 2,
the bridge will examine the frame. The bridge consults its bridging table and sees that the destination
device is out the same port on which the frame was received and will not forward the frame. The frame is
filtered.
Bridges enable the addition of far more devices to a network than would be possible if all the devices
were in a single population, contending for the same bandwidth. Filtering means that only frames that 20
Data Link Addresses
In a certain community in Colorado, two individuals are named Jeff Doyle. One Jeff Doyle frequently
receives telephone calls for the person with whom he shares a name—so much so that his clever wife has
posted the correct number next to the phone to redirect errant callers to their desired destination. In other
words, because two individuals cannot be uniquely identified, data is occasionally delivered incorrectly
and a process must be implemented to correct the error.
Among family, friends, and associates, a given name is usually sufficient for accurately distinguishing
individuals. However, as this example shows, most names become inaccurate over a larger population. A
more unique identifier, such as a United States Social Security number, is needed to distinguish one
person from every other.
NOTE
Frame
Devices on a LAN must also be uniquely and individually identified or they, like humans sharing the
same name, will receive data not intended for them. When data is to be delivered on aLAN , it is
encapsulated within an entity called a frame, a kind of binary envelope. Think of data encapsulation as
being the digital equivalent of placing a letter inside an envelope, as in Figure 1.1[1] . A destination address
and a return (source) address are written on the outside of the envelope. Without a destination address, the
postal service would have no idea where to deliver the letter. Likewise, when a frame is placed on a data
link, all devices attached to the link "see" the frame; therefore, some mechanism must indicate which
device should pick up the frame and read the enclosed data.
receives telephone calls for the person with whom he shares a name—so much so that his clever wife has
posted the correct number next to the phone to redirect errant callers to their desired destination. In other
words, because two individuals cannot be uniquely identified, data is occasionally delivered incorrectly
and a process must be implemented to correct the error.
Among family, friends, and associates, a given name is usually sufficient for accurately distinguishing
individuals. However, as this example shows, most names become inaccurate over a larger population. A
more unique identifier, such as a United States Social Security number, is needed to distinguish one
person from every other.
NOTE
Frame
Devices on a LAN must also be uniquely and individually identified or they, like humans sharing the
same name, will receive data not intended for them. When data is to be delivered on aLAN , it is
encapsulated within an entity called a frame, a kind of binary envelope. Think of data encapsulation as
being the digital equivalent of placing a letter inside an envelope, as in Figure 1.1[1] . A destination address
and a return (source) address are written on the outside of the envelope. Without a destination address, the
postal service would have no idea where to deliver the letter. Likewise, when a frame is placed on a data
link, all devices attached to the link "see" the frame; therefore, some mechanism must indicate which
device should pick up the frame and read the enclosed data.
Bicycles with Motors
One of the difficulties of decentralized computing is that it isolates users from one another and from the
data and applications they may need to use in common. When a file is created, how is it shared with Tom,
Dick, and Harriet down the hall? The early solution to this was the storied SneakerNet: Put the file on
floppy disks and hand carry them to the necessary destinations. But what happens when Tom, Dick, and
Harriet modify their copies of the file? How does one ensure that all information in all versions are
synchronized? What if those three coworkers are on different floors or in different buildings or cities?
What if the file needs to be updated several times a day? What if there are not three coworkers, but 300
people? What if all 300 people occasionally need to print a hard copy of some modification they have
made to the file?
The local-area network, or LAN, is a small step back to centralization. LANs are a means of pooling and
sharing resources. Servers enable everyone to access a common copy of a file or a common database; no
more "walkabouts" with floppies, no more worries about inconsistent information. E-mail furnishes a
compromise between phone calls, which require the presence of the recipient, and physical mail service,
which is called snail mail for a good reason. The sharing of printers and modem pools eliminates the need
for expensive, periodically used services on every desk.
Of course, in their infancy, LANs met with more than a little derision from the mainframe manufacturers.
A commonly heard jibe during the early years was, "A LAN is like a bike with a motor, and we don't
make Mopeds!" What a difference a few years and a few billion dollars would make.
Physically, a LAN accomplishes resource pooling among a group of devices by connecting them to a
common, shared medium, or datalink. This medium may be twisted-pair wires (shielded or unshielded),
coaxial cable, optical fiber, infrared light, or whatever. What matters is that all devices attach commonly
to the data link through some sort of network interface.
A shared physical medium is not enough. Rules must govern how the data link is shared. As in any
community, a set of rules is necessary to keep life orderly, to ensure that all parties behave themselves,
and to guarantee that everyone gets a fair share of the available resources. For a local-area network, this
set of rules, or protocol, is generally called a Media Access Control (MAC). The MAC, as the name
implies, dictates how each machine will access and share a given medium.
So far, a LAN has been defined as being a community of devices such as PCs, printers, and servers
coexisting on a common communications medium and following a common protocol that regulates how
they access the medium. But there is one last requirement: As in any community, each individual must be
uniquely identifiable.
data and applications they may need to use in common. When a file is created, how is it shared with Tom,
Dick, and Harriet down the hall? The early solution to this was the storied SneakerNet: Put the file on
floppy disks and hand carry them to the necessary destinations. But what happens when Tom, Dick, and
Harriet modify their copies of the file? How does one ensure that all information in all versions are
synchronized? What if those three coworkers are on different floors or in different buildings or cities?
What if the file needs to be updated several times a day? What if there are not three coworkers, but 300
people? What if all 300 people occasionally need to print a hard copy of some modification they have
made to the file?
The local-area network, or LAN, is a small step back to centralization. LANs are a means of pooling and
sharing resources. Servers enable everyone to access a common copy of a file or a common database; no
more "walkabouts" with floppies, no more worries about inconsistent information. E-mail furnishes a
compromise between phone calls, which require the presence of the recipient, and physical mail service,
which is called snail mail for a good reason. The sharing of printers and modem pools eliminates the need
for expensive, periodically used services on every desk.
Of course, in their infancy, LANs met with more than a little derision from the mainframe manufacturers.
A commonly heard jibe during the early years was, "A LAN is like a bike with a motor, and we don't
make Mopeds!" What a difference a few years and a few billion dollars would make.
Physically, a LAN accomplishes resource pooling among a group of devices by connecting them to a
common, shared medium, or datalink. This medium may be twisted-pair wires (shielded or unshielded),
coaxial cable, optical fiber, infrared light, or whatever. What matters is that all devices attach commonly
to the data link through some sort of network interface.
A shared physical medium is not enough. Rules must govern how the data link is shared. As in any
community, a set of rules is necessary to keep life orderly, to ensure that all parties behave themselves,
and to guarantee that everyone gets a fair share of the available resources. For a local-area network, this
set of rules, or protocol, is generally called a Media Access Control (MAC). The MAC, as the name
implies, dictates how each machine will access and share a given medium.
So far, a LAN has been defined as being a community of devices such as PCs, printers, and servers
coexisting on a common communications medium and following a common protocol that regulates how
they access the medium. But there is one last requirement: As in any community, each individual must be
uniquely identifiable.
Subscribe to:
Posts (Atom)