23.1 Chapter 23 Process-to-Process Delivery: UDP, TCP, and SCTP Copyright © The McGraw-Hill Companies, Inc. Permission required for reproduction or display.

23.2 Transport layer duties

PROCESS-TO-PROCESS DELIVERY Overview: The transport layer is responsible for process-to-process delivery—the delivery of a packet, part of a message, from one process to another. Two processes communicate in a client/server relationship.

23.4 The transport layer is responsible for process-to-process delivery – the delivery of a packet, part of a message, from one process to another. Note

23.5 Figure 23.1 Types of data deliveries

23.6 Client/Server Paradigm

23.7 Client/Server Paradigm If several people in the office need to communicate with remote personnel via SMS, it is not necessary to equip each computer with a GSM modem. Headwind SMS suite allows to share one GSM modem between several computers. The computer connected with a GSM modem (server) must be equipped with Headwind GSM Modem Driver, which uses DCOM (Distributed Component Object Model) technology to provide access to the SMS capabilities to other computers (clients) in the network.

23.8 Client/Server Paradigm Operating systems today support both multiuser and multiprogramming environments.

23.9 Addressing

23.10 Addressing

23.11 Addressing

23.12 Figure 23.2 Port numbers

23.13 Figure 23.3 IP addresses versus port numbers

23.14 Addressing In the Internet model, the port numbers are 16-bit integers between 0 and 65,535.

23.15 Summary In the client-server paradigm, an application program on the local host, called the client, needs services from an application program on the remote host, called a server. The server program is assigned a universal port number called a well-known port number. The client program is assigned a random port number called the ephemeral port number.

23.16 IANA* Ranges Well Known Ports: 0 to 1023 Registered Ports: 1024 to 49,151 Dynamic Ports: 49,152 to 65,535 * Internet Assigned Number Authority

23.17 Figure 23.4 IANA ranges

23.18 Socket Addresses Process to Process delivery needs two identifiers, IP address, and port number, at each end to make a connection.

23.19 Figure 23.5 Socket address

23.20 Socket Addresses A Transport Layer protocol needs a pair of socket addresses; the client socket address and the server socket address.

Review The transport layer is where data is encapsulated into segments. These segments are then sent using either TCP or UDP protocols. TCP is a connection-oriented protocol, which means the sender does not send any data to the destination node until the destination node acknowledges that it is listening to the sender

TCP Ports A port is the logical, not physical component, of a TCP connection. Every TCP connection requires a source and destination port in addition to any other addressing scheme, such as IP addressing. The port identifies the service that is running. In TCP packets, ports are identified using a 16- bit number. TCP packets have two such fields: source port and destination port

TCP Ports Ports also help network administrators to identify, stop, or disable services that are not really needed. As a network administrator or IT professional, you should be familiar with ports and control their use. Open ports are an invitation for attacks. Port numbers can go up to 65,535 but only the first 1023 ports are considered well-known. Let’s check for a list of well-known ports

State Table example 23.24

23.25 Figure 23.6 Multiplexing and demultiplexing

23.26 Figure 23.7 Error control

23.27 Figure 23.8 Position of UDP, TCP, and SCTP in TCP/IP suite

USER DATAGRAM PROTOCOL (UDP) Overview: The User Datagram Protocol (UDP) is called a connectionless, unreliable transport protocol. It does not add anything to the services of IP except to provide process-to-process communication instead of host-to-host communication.

23.29 Table 23.1 Well-known ports used with UDP

UDP - Summary UDP is a fast but unreliable protocol that also operates on the transport layer of the TCP/IP stack. UDP is unreliable because it does not verify whether the receiver is listening or ready to receive. This is the reason why UDP is also known as a connectionless protocol. Although unreliable, UDP is widely used on the Internet because of its speed. Higher layers of the TCP/IP stack are responsible for providing reliability

23.31 In UNIX, the well-known ports are stored in a file called /etc/services. Each line in this file gives the name of the server and the well-known port number. We can use the grep utility to extract the line corresponding to the desired application. The following shows the port for FTP. Note that FTP can use port 21 with either UDP or TCP. Example 23.1

23.32 Example 23.1 (continued) SNMP uses two port numbers (161 and 162), each for a different purpose.

23.33 Figure 23.9 User datagram format

23.34 UDP length = IP length – IP header’s length Note

23.35 Figure Pseudoheader for checksum calculation

23.36 Figure shows the checksum calculation for a very small user datagram with only 7 bytes of data. Because the number of bytes of data is odd, padding is added for checksum calculation. The pseudoheader as well as the padding will be dropped when the user datagram is delivered to IP. Example 23.2

23.37 Figure Checksum calculation of a simple UDP user datagram

23.38 Figure Queues in UDP

TCP Overview: TCP is a connection-oriented protocol; it creates a virtual connection between two TCPs to send data. In addition, TCP uses flow and error control mechanisms at the transport level. TCP Services TCP Features Segment A TCP Connection Flow Control Error Control Topics discussed in this section:

23.40 Table 23.2 Well-known ports used by TCP

23.41 Figure Stream delivery

23.42 Figure Sending and receiving buffers

23.43 Figure TCP segments

23.44 The bytes of data being transferred in each connection are numbered by TCP. The numbering starts with a randomly generated number. Note

23.45 Example Imagine a TCP connection is transferring a file of 6000 bytes. The first byte is numbered 10,010. What are the sequence numbers for each segment if data are sent in five segments with the first four segments carrying 1000 bytes and the last segment carrying 2000 bytes? Solution The following shows the sequence number for each segment: Segment 1 ==> sequence number: 10,010 (range: 10,010 to 11,009) Segment 2 ==> sequence number: 11,010 (range: 11,010 to 12,009) Segment 3 ==> sequence number: 12,010 (range: 12,010 to 13,009) Segment 4 ==> sequence number: 13,010 (range: 13,010 to 14,009) Segment 5 ==> sequence number: 14,010 (range: 14,010 to 16,009)

23.46 The value in the sequence number field of a segment defines the number of the first data byte contained in that segment. Note

23.47 The value of the acknowledgment field in a segment defines the number of the next byte a party expects to receive. The acknowledgment number is cumulative. Note

23.48 Figure TCP segment format

23.49 Header fields  Source port address: A 16-bit value that defines the port number of the application program in the host that is sending the segment  Destination port address: A 16-bit value that defines the port number of the application program in the host that is receiving the segment  Sequence number: A 32-bit value that defines the number assigned to the first byte of data contained in this segment  Acknowledge number: A 16-bit value that defines the byte number that the sender of the segment is expecting to receive from the other party  Header length: A 4-bit value that indicates the number of 4-byte words in the TCP header  Reserved: A 6-bit field reserved for future use  Control: A 6-bit field that defines 6 different control bits or flags, as shown in figure 22.15

23.50 Header fields (cont.)  Window size: A 16-bit value in bytes that the other party must maintain  Checksum: A 16-bit checksum; its calculation follows the UDP procedure  Urgent pointer: A 16-bit value, which is valid only if the urgent flag is set, is used when the segment contains urgent data  Options: There can be up to 40 bytes of optional information in the TCP header

23.51 Figure Control field

23.52 Table 23.3 Description of flags in the control field

The TCP three-way handshake process : Host A sends a TCP packet with the SYN flag set (that is, a SYN packet) to Host B. After receiving the packet, Host B sends Host A its own SYN packet with an ACK flag (a SYN-ACK packet) set. In response to the SYN-ACK packet from Host B, Host A sends Host B a TCP packet with the ACK flag set (an ACK packet)

TCP SEGMENT HEADERS As an IT professional, it is important for you to clearly understand the critical components of a TCP header. Hackers usually try to exploit these components to discover vulnerabilities and perform attacks. Critical components include: TCP flags Initial Sequence Number (ISN) Source and destination port 23.54

Initial Sequence Number (ISN) Let’s define ISN as a 32-bit number that tracks the packets received by the node and enables the reassembly of large packets that have been broken up into smaller packets. Two hosts exchange their ISNs during steps 1 and 2 of the TCP three-way handshake

Note of Interest Kevin Mitnick, the legendary hacker, is now a security consultant to corporations worldwide and a cofounder of Defensive Thinking. Find out more about him at

23.57 Figure Connection establishment using three-way handshaking  Since steps 2 and 3 can occur at the same time, they can be combined into one step

23.58 A SYN segment cannot carry data, but it consumes one sequence number. Note

23.59 A SYN + ACK segment cannot carry data, but does consume one sequence number. Note

23.60 An ACK segment, if carrying no data, consumes no sequence number. Note

23.61 SYN Flooding The connection establishment procedure in TCP is susceptible to a serious security problem called the SYN flooding attack.

23.62

23.63 SYN Flooding The TCP server then sends the SYN + ACK segments to the fake clients, which are lost. During this time, however, a lot of resources are occupied without being used. If, during this short time, the number of SYN segments is large, the server eventually runs out of resources and may crash. This SYN flooding attack belongs to a type of security attack known as a denial-of-service attack, in which an attacker monopolizes a system with so many service requests that the system collapses and denies service to every request.

23.64 SYN Flooding Some implementations of TCP have strategies to alleviate the effects of a SYN attack. Some have imposed a limit on connection requests during a specified period of time. Others filter out datagrams coming from unwanted source addresses. One recent strategy is to postpone resource allocation until the entire connection is set up, using what is called a cookie. SCTP, the new transport layer protocol that we discuss in the next section, uses this strategy.

23.65 Figure Data transfer

23.66 Figure Connection termination using three-way handshaking

23.67 The FIN segment consumes one sequence number if it does not carry data. Note

23.68 The FIN + ACK segment consumes one sequence number if it does not carry data. Note

23.69 Structure of the OSI Reference Model (continued)

23.70 Structure of the OSI Reference Model Communication between peer layers is “virtual” In reality, communications pass up and down the protocol stacks on both machines As data gets passed from layer to layer, it’s divided into data units appropriate for the layer Protocol data units (PDUs) are passed as a self-contained data structure from layer to layer Encapsulation process adds “headers” to allow successful delivery of each layer’s payload Decapsulation strips header information on way up No layer can pass information directly to its peer counterpart except for the Physical layer

23.71 Transport Layer Layer 4; PDU: segment Manages end-to-end transfer of data Segments long data streams into chunks Resequences chunks into original data on receipt Includes error checks to ensure error-free delivery Handles flow control E.g., TCP (TCP/IP) and SPX (from IPX/SPX) Layer 4 problems include a corrupt protocol stack and segments that are too large for the medium between the source and destination networks The latter forces Network layer to fragment segments, which causes performance degradation

23.72 Transport Layer (continued)

23.73 Network Layer Layer 3; PDU: packet Handles addressing messages for delivery Translates logical addresses into physical addresses Determines how to route transmissions from sender to receiver (routing process) Traffic cop for network activity and handles routing and access control (during routing process) E.g., IP (from TCP/IP) and IPX (from SPX/IPX) Possible problems: incorrect IP addresses or subnet masks, incorrect router configuration, and router operation errors

23.74 Network Layer

23.75 Understanding Types of Data Frames Unicast frame: addressed to only one computer Adapters read the frames and pass them to higher layers only if the destination address in the frame header matches their own address Broadcast frame: created for all computers on a network Destination address is a value of all binary 1s Multicast frame: created for any computers on a network that “listen” to a shared network address A special kind of address allows any interested receiver to read these data streams

23.76 Connectionless Versus Connection- Oriented Protocols Protocols that use connectionless delivery place data on the network and assume it will get through Connectionless protocols aren’t entirely reliable Are fast: little overhead, don’t waste time establishing/managing/tearing down connections Connection-oriented protocols are more reliable and, consequently, slower Two computers establish a connection before data transfer begins In a connection, data is sent in an orderly fashion Ensures that all data is received and is accurate, or that suitable error messages are generated

23.77 Protocols in a Layered Architecture

23.78 Transport Protocols Transport protocols can be connection- oriented (reliable) or connectionless (best-effort) delivery Transmission Control Protocol (TCP) Responsible for reliable data delivery in TCP/IP Sequential Packet Exchange (SPX) Novell’s connection-oriented protocol used to guarantee data delivery NetBIOS/NetBEUI NetBIOS establishes/manages communications between computers and provides naming services NetBEUI provides data transport services for these communications

23.79 TCP/IP Network Layer Protocols Internet Protocol version 4 (IPv4) is a Network layer protocol that provides source and destination addressing and routing for the TCP/IP suite Connectionless protocol; fast but unreliable Internet Control Message Protocol (ICMP) is a Network layer protocol used to send error and control messages between systems or devices The Ping utility uses ICMP to request a response from a remote host to verify availability Address Resolution Protocol (ARP) resolves logical (IP) addresses to physical (MAC) addresses

23.80 IP, ICMP, and ARP in Action

23.81 TCP/IP Transport Layer Protocols Transmission Control Protocol (TCP) is the primary Internet transport protocol Connection oriented using a three-way handshake Message fragmentation and reassembly Uses acknowledgements to ensure that all data was received and to provide flow control User Datagram Protocol (UDP) is connectionless Generally faster, although less reliable, than TCP Doesn’t segment data or resequence packets Doesn’t use acknowledgements for reliability Used by NFS and DNS

23.82 TCP/IP Application Layer Protocols Domain Name System (DNS) Session layer name-to-address resolution protocol Hypertext Transport Protocol (HTTP) To transfer Web pages from Web server to browser File Transfer Protocol (FTP) For file transfer and directory and file manipulation Telnet Remote terminal emulation; operates at layers 7-5 Simple Mail Transport Protocol (SMTP) Operates at layers 7-5; provides messaging services

23.83 Flow Control TCP uses a sliding window, as discussed in Chapter 11, to handle flow control.

23.84 Figure Sliding window

23.85 A sliding window is used to make transmission more efficient as well as to control the flow of data so that the destination does not become overwhelmed with data. TCP sliding windows are byte-oriented. Note

23.86 Note: The size of the window at one end is determined by the lesser of two values: receiver window (rwnd) or congestion window (cwnd). The receiver window is the value advertised by the opposite end in a segment containing acknowledgement.

23.87 Sender buffer  The buffer contains bytes that a host can send before worrying about acknowledgement from the other host

23.88 Receiver window  The receiver window establishes how many bytes the receiver can store

23.89 Sender buffer and sender window  We have flow control if the sender creates a window –the sender window- with a size less than or equal to the size of the receiver window

23.90 Sliding the sender window  Messages from the receiver change the position of the sender window.

23.91 Expanding the sender window  If the receiving process consumes data faster than it receives, the size of the receiver window expands

23.92 Shrinking the sender window  If the receiving process consumes data more slowly than it receives data, the size of the receiver window decreases

23.93 What is the value of the receiver window (rwnd) for host A if the receiver, host B, has a buffer size of 5000 bytes and 1000 bytes of received and unprocessed data? Example 23.4 Solution The value of rwnd = 5000 − 1000 = Host B can receive only 4000 bytes of data before overflowing its buffer. Host B advertises this value in its next segment to A.

23.94 What is the size of the window for host A if the value of rwnd is 3000 bytes and the value of cwnd is 3500 bytes? Example 23.5 Solution The size of the window is the smaller of rwnd and cwnd, which is 3000 bytes.

23.95 Figure (next slide) shows an unrealistic example of a sliding window. The sender has sent bytes up to 202. We assume that cwnd is 20 (in reality this value is thousands of bytes). The receiver has sent an acknowledgment number of 200 with an rwnd of 9 bytes (in reality this value is thousands of bytes). The size of the sender window is the minimum of rwnd and cwnd, or 9 bytes. Bytes 200 to 202 are sent, but not acknowledged. Bytes 203 to 208 can be sent without worrying about acknowledgment. Bytes 209 and above cannot be sent. Example 23.6

23.96 Figure Example 23.6

23.97 Some points about TCP sliding windows: ❏ The size of the window is the lesser of rwnd and cwnd. ❏ The source does not have to send a full window’s worth of data. ❏ The window can be opened or closed by the receiver, but should not be shrunk. ❏ The destination can send an acknowledgment at any time as long as it does not result in a shrinking window. ❏ The receiver can temporarily shut down the window; the sender, however, can always send a segment of 1 byte after the window is shut down. Note

23.98 Error Control TCP is a reliable transport layer protocol. This means that an application program that delivers a stream of data to TCP relies on TCP to deliver the entire stream to the application program on the other end in order, without error, and without any part lost or duplicated

23.99 ACK segments do not consume sequence numbers and are not acknowledged. Note TCP uses acknowledgements to conform the receipt of data segments. Control segments that carry no data but consume a sequence number are also acknowledged.

In modern implementations, a retransmission occurs if the retransmission timer expires or three duplicate ACK segments have arrived. Note The heart of the error control mechanism is the retransmission of segments. When a segment is corrupted, lost, or delayed, it is retransmitted.

No retransmission timer is set for an ACK segment. Note Note that no retransmission occurs of segments that do not consume sequence numbers. In particular, there is no transmission for an ACK segment.

Data may arrive out of order and be temporarily stored by the receiving TCP, but TCP guarantees that no out-of-order segment is delivered to the process. Note Out-of-order segments:

Key Terms ACK —A TCP flag that acknowledges a TCP packet with SYN-ACK flags set. connection-oriented —A method of transferring data over a network that requires a session connection before data is sent. With TCP/IP, this step is accomplished by sending a SYN packet. connectionless — With a connectionless protocol, no session connection is required before data is transmitted. UDP and IP are examples of connectionless protocols. initial sequence number (ISN) —A number that keeps track of what packets a node has received. Internet Assigned Numbers Authority (IANA) — The organization responsible for assigning IP addresses

Key Terms Internet Control Message Protocol (ICMP) —The protocol used to send informational messages and test network connectivity. port —The logical component of a connection that identifies the service running on a network device. For example, port 110 is the POP3 mail service. protocol —A language used to transmit data across a network infrastructure

Key Terms session hijacking—An attack on a network that requires guessing ISNs. See also initial sequence number (ISN). SYN —A TCP flag that signifies the beginning of a session. SYN-ACK —A reply to a SYN packet sent by a host

Key Terms TCP flag —The six flags in a TCP header are switches that can be set to on or off to indicate the status of a port or service. three-way handshake —The method the transport layer uses to create a connection-oriented session

Key Terms Transmission Control Protocol/Internet Protocol (TCP/IP) —The main protocol used to connect computers over the Internet. User Datagram Protocol (UDP) —A fast, unreliable transport layer protocol that is connectionless

SCTP Overview: Stream Control Transmission Protocol (SCTP) is a new reliable, message-oriented transport layer protocol. SCTP, however, is mostly designed for Internet applications that have recently been introduced. These new applications need a more sophisticated service than TCP can provide. SCTP Services and Features Packet Format An SCTP Association Flow Control and Error Control Topics discussed in this section:

UDP UDP is a message-oriented protocol. A process delivers a message to UDP, which is encapsulated in a user datagram and sent over the network. UDP conserves the message boundaries; each message is independent of any other message.

TCP TCP is a byte-oriented protocol. It receives a message or messages from a process, stores them as a stream of bytes, and sends them in segments.

SCTP SCTP combines the best features of UDP and TCP. SCTP is a reliable message- oriented protocol

Table 23.4 Some SCTP applications

An association in SCTP can involve multiple streams. Note

Figure Multiple-stream concept

Figure Multihoming concept

SCTP “Packets” Data are carried as data chunks, control information is carried as control chunks.

Figure Comparison between a TCP segment and an SCTP packet

SCTP “Packets” Steps 1 through 8 – p

SCTP “Packets” Steps 1 through 8 – p

SCTP “Packets” Steps 1 through 8 – p

SCTP association allows multiple IP addresses for each end. Note

In SCTP, a data chunk is numbered using a TSN (Transmission Sequence Number). Note

To distinguish between different streams, SCTP uses an SI (Stream Identifier). Note

To distinguish between different data chunks belonging to the same stream, SCTP uses SSNs (Stream Sequence Numbers). Note

TCP has segments; SCTP has packets. Note

In SCTP, control information and data information are carried in separate chunks. Note

Figure Packet, data chunks, and streams

Data chunks are identified by three items: TSN, SI, and SSN. TSN is a cumulative number identifying the association; SI defines the stream; SSN defines the chunk in a stream. Note TSN = Transmission Sequence Number SI = Stream Identifier SSN = Stream Sequence Number

In SCTP, acknowledgment numbers are used to acknowledge only data chunks; control chunks are acknowledged by other control chunks if necessary. Note

Figure SCTP packet format

In an SCTP packet, control chunks come before data chunks. Note

Figure General header

Table 23.5 Chunks

A connection in SCTP is called an association. Note

No other chunk is allowed in a packet carrying an INIT or INIT ACK chunk. A COOKIE ECHO or a COOKIE ACK chunk can carry data chunks. Note

Figure Four-way handshaking

In SCTP, only DATA chunks consume TSNs; DATA chunks are the only chunks that are acknowledged. Note

Figure Simple data transfer

The acknowledgment in SCTP defines the cumulative TSN, the TSN of the last data chunk received in order. Note

Figure Association termination

Figure Flow control, receiver site

Figure Flow control, sender site

Figure Flow control scenario

Figure Error control, receiver site

Figure Error control, sender site