The Application Layer
Friday, October 2, 2009
| When the TCP/IP model was designed, the session and presentation layers from the OSI model were bundled into the application layer of the TCP model. This means that issues of representation, encoding, and dialog control are handled in the application layer rather than in separate lower layers as in the OSI model. This design assures that the TCP/IP model provides maximum flexibility at the application layer for developers of software. The TCP/IP protocols that support file transfer, e-mail, and remote login are probably the most familiar to users of the Internet.
|
The Internet is built on a hierarchical addressing scheme. This scheme allows for routing to be based on classes of addresses rather than based on individual addresses. The problem this creates for the user is associating the correct address with the Internet site. It is very easy to forget an IP address to a particular site because there is nothing to associate the contents of the site with the address. Imagine the difficulty of remembering the IP addresses of tens, hundreds, or even thousands of Internet sites.
A domain naming system was developed in order to associate the contents of the site with the address of that site. The Domain Name System (DNS) is a system used on the Internet for translating names of domains and their publicly advertised network nodes into IP addresses. A domain is a group of computers that are associated by their geographical location or their business type. A domain name is a string of characters, number, or both. Usually a name or abbreviation that represents the numeric address of an Internet site will make up the domain name. There are more than 200 top-level domains on the Internet, examples of which include the following:
.us – United States
.uk – United Kingdom
There are also generic names, which examples include the following:
.edu – educational sites
.com – commercial sites
.gov – government sites
.org – non-profit sites
.net – network service
See Figure 
for a detailed explanation of these domains.
FTP and TFTP
| FTP is a reliable, connection-oriented service that uses TCP to transfer files between systems that support FTP. The main purpose of FTP is to transfer files from one computer to another by copying and moving files from servers to clients, and from clients to servers. When files are copied from a server, FTP first establishes a control connection between the client and the server. Then a second connection is established, which is a link between the computers through which the data is transferred. Data transfer can occur in ASCII mode or in binary mode. These modes determine the encoding used for data file, which in the OSI model is a presentation layer task. After the file transfer has ended, the data connection terminates automatically. When the entire session of copying and moving files is complete, the command link is closed when the user logs off and ends the session. TFTP is a connectionless service that uses User Datagram Protocol (UDP). TFTP is used on the router to transfer configuration files and Cisco IOS images and to transfer files between systems that support TFTP. TFTP is designed to be small and easy to implement. Therefore, it lacks most of the features of FTP. TFTP can read, write, or mail files to or from a remote server but it cannot list directories and currently has no provisions for user authentication. It is useful in some LANs because it operates faster than FTP and in a stable environment it works reliably. |
HTTP
Hypertext Transfer Protocol (HTTP) works with the World Wide Web, which is the fastest growing and most used part of the Internet. One of the main reasons for the extraordinary growth of the Web is the ease with which it allows access to information. A Web browser is a client-server application, which means that it requires both a client and a server component in order to function. A Web browser presents data in multimedia formats on Web pages that use text, graphics, sound, and video. The Web pages are created with a format language called Hypertext Markup Language (HTML). HTML directs a Web browser on a particular Web page to produce the appearance of the page in a specific manner. In addition, HTML specifies locations for the placement of text, files, and objects that are to be transferred from the Web server to the Web browser.
Hyperlinks make the World Wide Web easy to navigate. A hyperlink is an object, word, phrase, or picture, on a Web page. When that hyperlink is clicked, it directs the browser to a new Web page. The Web page contains, often hidden within its HTML description, an address location known as a Uniform Resource Locator (URL).
In the URL http://www.cisco.com/edu/, the "http://" tells the browser which protocol to use. The second part, "www", is the hostname or name of a specific machine with a specific IP address. The last part, /education identifies the specific folder location on the server that contains the default web page.
A Web browser usually opens to a starting or "home" page. The URL of the home page has already been stored in the configuration area of the Web browser and can be changed at any time. From the starting page, click on one of the Web page hyperlinks, or type a URL in the address bar of the browser. The Web browser examines the protocol to determine if it needs to open another program, and then determines the IP address of the Web server using DNS. Then the transport layer, network layer, data link layer, and physical layer work together to initiate a session with the Web server. The data that is transferred to the HTTP server contains the folder name of the Web page location. The data can also contain a specific file name for an HTML page. If no name is given, then the default name as specified in the configuration on the server is used.
The server responds to the request by sending to the Web client all of the text, audio, video, and graphic files specified in the HTML instructions. The client browser reassembles all the files to create a view of the Web page, and then terminates the session. If another page that is located on the same or a different server is clicked, the whole process begins again.
SMTP
| Email servers communicate with each other using the Simple Mail Transfer Protocol (SMTP) to send and receive mail. The SMTP protocol transports email messages in ASCII format using TCP. When a mail server receives a message destined for a local client, it stores that message and waits for the client to collect the mail. When checking the configuration of a mail client, verify that the SMTP and POP or IMAP settings are correctly configured. A good way to test if a mail server is reachable is to Telnet to the SMTP port (25) or to the POP3 port (110). The following command format is used at the Windows command line to test the ability to reach the SMTP service on the mail server at IP address 192.168.10.5:
The SMTP protocol does not offer much in the way of security and does not require any authentication. Administrators often do not allow hosts that are not part of their network to use their SMTP server to send or relay mail. This is to prevent unauthorized users from using their servers as mail relays. |
SNMP.
| The Simple Network Management Protocol (SNMP) is an application layer protocol that facilitates the exchange of management information between network devices. SNMP enables network administrators to manage network performance, find and solve network problems, and plan for network growth. SNMP uses UDP as its transport layer protocol. An SNMP managed network consists of the following three key components:
|
| Telnet client software provides the ability to login to a remote Internet host that is running a Telnet server application and then to execute commands from the command line. A Telnet client is referred to as a local host. Telnet server, which uses special software called a daemon, is referred to as a remote host. To make a connection from a Telnet client, the connection option must be selected. A dialog box typically prompts for a host name and terminal type. The host name is the IP address or DNS name of the remote computer. The terminal type describes the type of terminal emulation that the Telnet client should perform. The Telnet operation uses none of the processing power from the transmitting computer. Instead, it transmits the keystrokes to the remote host and sends the resulting screen output back to the local monitor. All processing and storage take place on the remote computer. Telnet works at the application layer of the TCP/IP model. Therefore, Telnet works at the top three layers of the OSI model. The application layer deals with commands. The presentation layer handles formatting, usually ASCII. The session layer transmits. In the TCP/IP model, all of these functions are considered to be part of the application layer.\ Cisco Systems, Inc. |
TCP/IP Transport Layer
| The primary duties of the transport layer, Layer 4 of the OSI model, are to transport and regulate the flow of information from the source to the destination, reliably and accurately. End-to-end control and reliability are provided by sliding windows, sequencing numbers, and acknowledgments. To understand reliability and flow control, think of someone who studies a foreign language for one year and then they visit the country where that language is used. In conversation, words must be repeated for reliability and to speak slowly so that the meaning of the conversation is not lost, this is flow control. The transport layer provides transport services from the source host to the destination host. It establishes a logical connection between the endpoints of the network. Transport services segment and reassemble several upper-layer applications onto the same transport layer data stream. This transport layer data stream provides end-to-end transport services. The transport layer data stream is a logical connection between the endpoints of a network. Its primary duties are to transport and regulate the flow of information from source to destination reliably and accurately. The primary duty of Layer 4 is to provide end-to-end control using sliding windows and to provide reliability in sequencing numbers and acknowledgments. The transport layer defines end-to-end connectivity between host applications. Transport services include the following basic services:
TCP/IP is a combination of two individual protocols. IP operates at Layer 3, and is a connectionless protocol that provides best-effort delivery across a network. TCP operates at Layer 4, and is a connection-oriented service that provides flow control as well as reliability. By pairing these protocols, a wider range of services is provided. Together, they are the basis for an entire suite of protocols called the TCP/IP protocol suite. The Internet is built upon this TCP/IP protocol suite. |
| As the transport layer sends data segments, it tries to ensure that data is not lost. A receiving host that is unable to process data as quickly as it arrives could be a cause of data loss. The receiving host is then forced to discard it. Flow control avoids the problem of a transmitting host overflowing the buffers in the receiving host. TCP provides the mechanism for flow control by allowing the sending and receiving host to communicate. The two hosts then establish a data-transfer rate that is agreeable to both |
Multiple applications can share the same transport connection in the OSI reference model.
Transport functionality is accomplished on a segment-by-segment basis. In other words, different applications can send data segments on a first-come, first-served basis. The segments that arrive first will be taken care of first. These segments can be routed to the same or different destinations. This is referred to as the multiplexing of upper-layer conversations. One function of the transport layer is to establish a connection-oriented session between similar devices at the application layer. For data transfer to begin, both the sending and receiving applications inform the respective operating systems that a connection will be initiated. One node initiates a connection that must be accepted by the other. Protocol software modules in the two operating systems communicate with each other by sending messages across the network to verify that the transfer is authorized and that both sides are ready.
The connection is established and the transfer of data begins after all synchronization has occurred. During transfer, the two machines continue to communicate with their protocol software to verify that data is received correctly.
Figure 
shows a typical connection between the sending and receiving systems. The first handshake requests synchronization. The second and third handshakes acknowledge the initial synchronization request, as well as synchronizing connection parameters in the opposite direction. The final handshake segment is an acknowledgment used to inform the destination that both sides agree that a connection has been established. After the connection has been established, data transfer begins.
Congestion can occur during data transfer for two reasons. First, a high-speed computer might be capable of generating traffic faster than a network can transfer it. Second, if many computers simultaneously need to send datagrams to a single destination, that destination can experience congestion, although no single source caused the problem.
When datagrams arrive too quickly for a host or gateway to process, they are temporarily stored in memory. If the traffic continues, the host or gateway eventually exhausts its memory and must discard additional datagrams that arrive.
Instead of allowing data to be lost, the transport function can issue a “not ready” indicator to the sender. Acting like a stop sign, this indicator signals the sender to stop sending data. When the receiver can handle additional data, the receiver sends a “ready” transport indicator. When this indicator is received, the sender can resume the segment transmission.
At the end of data transfer, the sending host sends a signal that indicates the end of the transmission. The receiving host at the end of the data sequence acknowledges the end of transmission and the connection is terminated.
Three-way handshake
| TCP is a connection-oriented protocol. TCP requires connection establishment before data transfer begins. For a connection to be established or initialized, the two hosts must synchronize their Initial Sequence Numbers (ISNs). Synchronization is done through an exchange of connection establishing segments that carry a control bit called SYN, for synchronize, and the ISNs. Segments that carry the SYN bit are also called “SYNs". This solution requires a suitable mechanism for picking an initial sequence number and a slightly involved handshake to exchange the ISNs. The synchronization requires each side to send its own initial sequence number and to receive a confirmation of exchange in an acknowledgment (ACK) from the other side. Each side must also receive the INS from the other side and send a confirming ACK. The sequence is as follows:
This exchange is called the three-way handshake. A three-way handshake is necessary because sequence numbers are not tied to a global clock in the network and TCP protocols may have different mechanisms for picking the ISN. The receiver of the first SYN has no way of knowing whether the segment was an old delayed one, unless it remembers the last sequence number used on the connection. Recalling that number is not always possible Therefore, the receiver must ask the sender to verify this SYN. |
Windowing
Data packets must be delivered to the recipient in the same order in which they were transmitted to have a reliable, connection-oriented data transfer. The protocol fails if any data packets are lost, damaged, duplicated, or received in a different order. An easy solution is to have a recipient acknowledge the receipt of each packet before the next packet is sent.
If the sender must wait for an acknowledgment after sending each packet, throughput would be low. Therefore, most connection-oriented, reliable protocols allow more than one packet to be outstanding on the network at one time. Because time is available after the sender finishes transmitting the data packet and before the sender finishes processing any received acknowledgment, this interval is used for transmitting more data. The number of data packets the sender is allowed to have outstanding without having received an acknowledgment is known as the window size, or window.
TCP uses expectational acknowledgments. Expectational acknowledgements mean that the acknowledgment number refers to the packet that is next expected. Windowing refers to the fact that the window size is negotiated dynamically during the TCP session. Windowing is a flow-control mechanism. Windowing requires that the source device receive an acknowledgment from the destination after transmitting a certain amount of data. The receiving TCP process reports a “window” to the sending TCP. This window specifies the number of packets, starting with the acknowledgment number, that the receiving TCP process is currently prepared to receive.
With a window size of three, the source device can send three packets to the destination. The source device must then wait for an acknowledgment. If the destination receives the three packets, it sends an acknowledgment to the source device, which can now transmit three more packets. If the destination does not receive the three packets, because of overflowing buffers, it does not send an acknowledgment. Because the source does not receive an acknowledgment, it knows that the packets should be retransmitted, and that the transmission rate should be slowed.
TCP window sizes are variable during the lifetime of a connection. Each acknowledgement contains a window advertisement that indicates the number of bytes the receiver can accept. TCP also maintains a congestion-control window. This window is normally the same size as the window of the receiver. However, this window is cut in half when a packet is lost, perhaps as a result of network congestion. This approach permits the window to be expanded or contracted as necessary to manage buffer space and processing. A larger window size allows more data to be processed.
As shown in Figure , the sender sends three packets before expecting an ACK. If the receiver can handle a window size of only two packets, the window drops packet three, specifies three as the next packet, and specifies a new window size of two. The sender sends the next two packets, but still specifies a window size of three. This means that the sender will still expect a three packet acknowledgement from the receiver. The receiver replies by requesting packet five and again specifying a window size of two.
Acknowledgment
| Reliable delivery guarantees that a stream of data sent from one device is delivered through a data link to another device without duplication or data loss. Positive acknowledgment with retransmission is one technique that guarantees reliable delivery of data. Positive acknowledgment requires a recipient to communicate with the source and send back an acknowledgment message when the data is received. The sender keeps a record of each data packet (TCP segment), that it sends and expects an acknowledgment. The sender also starts a timer when it sends a segment and will retransmit a segment if the timer expires before an acknowledgment arrives. Figure TCP provides sequencing of segments with a forward reference acknowledgment. Each datagram is numbered before transmission. |
Transmission Control Protocol (TCP)
| Transmission Control Protocol (TCP) is a connection-oriented Layer 4 protocol that provides reliable full-duplex data transmission. TCP is part of the TCP/IP protocol stack. In a connection-oriented environment, a connection is established between both ends before the transfer of information can begin. TCP is responsible for breaking messages into segments, reassembling them at the destination station, resending anything that is not received, and reassembling messages from the segments. TCP supplies a virtual circuit between end-user applications. The protocols that use TCP include:
The following are the definitions of the fields in the TCP segment:
|
User Datagram Protocol (UDP) is the connectionless transport protocol in the TCP/IP protocol stack. UDP is a simple protocol that exchanges datagrams, without acknowledgments or guaranteed delivery. Error processing and retransmission must be handled by higher layer protocols.
UDP uses no windowing or acknowledgments so reliability, if needed, is provided by application layer protocols. UDP is designed for applications that do not need to put sequences of segments together.
The protocols that use UDP include:
- TFTP (Trivial File Transfer Protocol)
- SNMP (Simple Network Management Protocol)
- DHCP (Dynamic Host Control Protocol)
- DNS (Domain Name System)
The following are the definitions of the fields in the UDP segment:
- Source port – Number of the calling port
- Destination port – Number of the called port
- Length – Number of bytes including header and data
- Checksum – Calculated checksum of the header and data fields
- Data – Upper-layer protocol data
| Both TCP and UDP use port (socket) numbers to pass information to the upper layers. Port numbers are used to keep track of different conversations crossing the network at the same time. Application software developers agree to use well-known port numbers that are issued by the Internet Assigned Numbers Authority (IANA).
End systems use port numbers to select the proper application. The source host dynamically assigns originating source port numbers. These numbers are always greater than 1023 Cisco Systems, Inc. |
