1. Overview of TCP/IP Protocols
Computer Network Programming

2. 32 bit destination IP address
IP Protocol Header
Version
Hdr
length
Type of service
Total length
identification
flags
Fragment offset
20 byte
Header
Time to leave
protocol
Header checksum
32 bit source IP address
32 bit destination IP address
Options (if any)
Data

3. Header length is the number of 32 bits in the header
Version is 4 (IPv4)
Header length is the number of 32 bits in the header
Type of service field is used to assign priorities to the packets
Total length field is the total length of an IP packet (max 65535).
Identification field identifies each IP packet sent. It is used in fragmentation.
Time-to-live field limits the lifetime of an IP packet
Each router decrements it.

4. Protocol field is used to demultiplex the incoming packet to the appropriate upper layer: TCP, UDP.
Header checksum is calculated over the header to check the integrity of the header.
Source IP address is the IP address of the sending machine.
Destination IP address is the IP address of the receiving machine.
Options field can keep additional information. It is optional.

5. IPv6
IPv4 address space is limited and can not support the ever increasing number of hosts in the Internet in the future.
IPv4 does not support Quality of Service
Ipv6 has more clean and efficient header
IETF developed IPv6 to address these problems
IPv6 is not globally operational. IPv4 is used in most places. But islands of IPv6 networks exists.

6. 128 bit Destination Address
IPv6 Header
Version
Traffic
Class
Flow Label
Payload length
Next Header
Hop Limit
128 bit Source Address
128 bit Destination Address

7. Version: 6 for IPv6.
Traffic Class: identifies different classes and priorities
Flow Label: used by the source to label the packets that makes a stream from source to destination
Payload Length: the length of the data portion.
Next Header: identifies the type of the header that is immediately used after the IPv6 header: TCP, UDP..
Hop Limit: decremented by 1 by each router that forwards the packet. If reaches to zero, then the packet is discarded.

8. Other Protocols API TCP UDP IP IGMP ICMP ARP RARP Application layer
User
level
Processes
User
process
User
process
User
process
User
process
API
Transport
layer
TCP
UDP
Network
layer IP
IGMP
ICMP
Kernel
Link
layer
ARP
Hardware
İnterface
Ethernet/PPP/...
RARP
Physical Media (Ethernet cable, serial line, ….)

9. Operating System Kernel
Applications
(User level
Processes)
Process 1
Process 2
Process N
Operating System Kernel
TCP/IP protocols are implemented inside
the kernel HW

10. Demultiplexing Appl. Appl. Appl. Appl. TCP UDP ICMP IGMP IP ARP RARP
Demultiplexing based on port
number in TCP/UDP header
TCP
UDP
ICMP
IGMP
Demultiplexing based
on protocol number in IP header IP
ARP
RARP
Demultiplexing based on
frametype in the ethernet
header
Ethernet
Driver
Incoming frame

11. Link Layer Two examples of different link layer protocols Ethernet PPP
protocol that is used in local area networks (for example in the network in dormitories and departments
shared pysical link
responsible from framing.
implements a MAC protocol
PPP
the protocol that is used over telephone lines/serial lines at your home while getting connected to Internet from home
dedicated physical link
no MAC protocol is needed.
Responsible from framing of IP datagrams (packets) over byte stream oriented serial lines.

12. IP Internet TCP IP IP Telephone network TCP IP Ethernet Ethernet PPP
Bilkent Web Server
at the University
Web Server
Bilkent Campus
Router
TCP
Your computer
at home IP IP
Ethernet
Ethernet
Web Browser
Wide area
connectivity
Local Area Network at School
Internet
TCP
ISP router IP IP
PPP
PPP
Serial line
Telephone
network
modem
modem
Wide area
connectivity
Telephone lines
ISP: Internet service provider

13. Ethernet 6 bytes 6 2 46-1500 bytes 4 0800 IP datagram 0806 ARP packet
bytes 4
dst
address
src
address
type
data
CRC
IP datagram
ARP packet
RARP packet
Dst and Src addresses are 6 bytes MAC addresses. They are
globally unique.
Example: 00:0e:63:93:2e:86
MTU (maximum tranferable unit) is 1500 bytes.
IP packet should be fragmented to that size if they
are larger than 1500 bytes.

14. PPP 1 1 1 2 <= 1500 2 1 data 0021 IP datagram
Flag
0x7E
Addr
0xFF
control
0x03
Protocol
data
CRC
Flag
0x7E
IP datagram
C Link control packet
Network control packet
All occurances of 0x7E is byte stuffed: replaced with 0x7d 0x5e
0x7d is transmitted as 2 byte sequence 0x7d 0x5d.
MTU is 1500, but can be negotiated
Connection oriented protocol: a PPP connection is established before
you send data. That is why you are waiting for some time when
connecting from home. Dialing time + PPP connection time

15. Loopback Interface
There is an other interface on every computer which is loopback. Its IP address is always
It does not have any hardware attached to it.
If you send data to this address, data comes back to your computer: so it is loopback. IP
loopback
ethernet /8

16. Network interfaces
You can have multiple network interfaces in your computer: loopback, ethernet interface, token ring interface….
You will have an IP address and subnet mask configured for each interface.
Those machines that have more than one physical network interface are called multihomed machines.

17. ifconfig commad
You can use ifconfig command to see the configured interfaces
in a UNIX machine (ipconfig for WINDOWS). You use the same
command to configure/modify the properties of an interface (assign
IP address/subnet mask etc.)
ifconfig -a gives all the configured interfaces
example: lo0: flags=849<UP,LOOPBACK,RUNNING,MULTICAST> mtu 8232
inet netmask ff000000
le0: flags=863<UP,BROADCAST,NOTRAILERS,RUNNING,MULTICAST> mtu 1500
inet netmask ffffff00 broadcast
Two interfaces are configures for this machine: loopback and an ethernet interface.
ifconfig le0 gives information only on interface le0.

18. netstat command
netstat command gives information about the network connections that the machine has currently, the routing table content etc. It is a command that displays the content of various network related data structures in the kernel.
netstat -nr shows the content of the routing table on that machine
Example:
aspendos{korpe}:> netstat -nr
Routing Table:
Destination Gateway Flags Ref Use Interface
U le0
U le0
default UG
UH lo0

19. Delivery of IP datagrams at the Link layer
Internet S
The frames in a LAN
are sent to each other
using MAC addresses as
the identities of the hosts.
Packets are coming for C (dst IP
address = ) c
Router R
IP address of R
00:0e:63:93:2e:86 MAC address of R
LAN(Ethernet)
00:00:20:79:04:14 A B C D

20. Use of MAC (link layer) addresses
When stations in a shared LAN send frames(packets) to eachother, they use the MAC addresses (link layer addresses) as the destination address of the frames
For example, route R will put the IP packet inside an ethernet frame while sending the packet to host C. the ethernet frame will contain the MAC address of C as in its dst address field
When host A (or B etc.) want to send an IP packet to C, it does the same thing.
All stations in a LAN talk to eachother using their MAC addresses.

21. The IP packets that is send from Router R to C will be (assume
the packets are originated at computer S) like the following:
IP packet will be put into an Ethernet frame:
Ethernet frame that is originated at router R and destined to C
Src addr
Type
Dst addr
00:00:20:79:04:14
00:0e:63:93:2e:86
0x800
IP datagram
CRC
Src address
Dst address
data
Other
fields of IP
hdr

22. Address resolution
Assume in a LAN a host want to send a frame to the other host on the same LAN.
How does the sender host knows the Ethernet address of the receiving host?
We need an address resolution protocol

23. A C B R D E F
A wants to send a frame to E (it can also be router R)
A will build an ethernet frame but it does not know the MAC
addres of E.
Address Resolution Protocol (ARP):
provides mapping from IP addresses to MAC addresses.

24. ARP and RARP IP Address MAC Address ARP RARP
RARP: reverse address resolution protocols.

25. How does ARP work
Host that want to send a frame, broadcasts an ARP request packet on the LAN
The broadcast address is ff:ff:ff:ff:ff:ff (this will be the dst address field in ethernet frame)
The ARP packet contains the IP address that host wants the MAC address for.
All hosts on the LAN receive the ARP request packet.

26. ARP
The destination host that has the IP address matching the IP address in the ARP request packet, replies back to the sending host with a ARP replay packet and includes its MAC address in the packet.
The sending host takes the unicast reply and learns the MAC address of the destination
Note that the ARP reply is not broadcasted but directly sent to the sender of the ARP request packet.

27. ARP Cache
When the sender host learns the MAC address of the receiver host, it stores this mapping in its cache (ARP table).
All subsequent frames that are destined to this host use this MAC address (without invoking the ARP protocol)
The mapping is stored for some period of time (like 20 minutes) and then deleted.

28. arp command
arp allows you to display and modify (if you are a superuser in UNIX) the ARP table
arp -a shows the content of the table
aspendos{korpe}:> arp -a
Net to Media Table
Device IP Address Mask Flags Phys Addr
le0 hitit :40:61:00:3e:2a
le0 cisco :e0:63:93:2e:86
le0 gordion :00:20:79:04:14
le0 pcmfbe.ef.bilkent.edu.tr :05:1c:01:d1:28
le :e0:63:93:2e:86
le0 best.ee.bilkent.edu.tr :40:61:00:0d:c2
le0 didim.ee.bilkent.edu.tr :00:20:73:99:b6
le0 ph-mali.bcc.bilkent.edu.tr :e0:63:93:2e:86
le :e0:63:93:2e:86
le0 pcscanner :80:ad:b7:c3:34

29. Sender Sender IP address
ARP Packet format
Ether dst addess
6 bytes
Ethernet
Header
Ether src addess 6
Ether frame type 2
Hw type 2
Prot Type 2
ARP
request/reply
packet format
Hw Size 1
Proto Size 1 6
Sender Ether address 4
Sender Sender IP address
Target Ether address 6
Target IP address 4

30. Example - ARP request Host 139.179.137.84 wants to learn the MAC
Frame 5 (42 on wire, 42 captured)
Arrival Time: Feb 19, :48:
Time delta from previous packet: seconds
Time relative to first packet: seconds
Frame Number: 5
Packet Length: 42 bytes
Capture Length: 42 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 08:00:46:48:43:9f
Type: ARP (0x0806)
Address Resolution Protocol (request)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: request (0x0001)
Sender hardware address: 08:00:46:48:43:9f
Sender protocol address:
Target hardware address: 00:00:00:00:00:00
Target protocol address:
Host
wants to learn the MAC
address of the router whose
IP address is

31. Example continued - ARP reply
Frame 6 (60 on wire, 60 captured)
Arrival Time: Feb 19, :48:
Time delta from previous packet: seconds
Time relative to first packet: seconds
Frame Number: 6
Packet Length: 60 bytes
Capture Length: 60 bytes
Ethernet II
Destination: 08:00:46:48:43:9f
Source: 00:e0:63:90:b7:9a (CABLETRO_90:b7:9a)
Type: ARP (0x0806)
Trailer:
Address Resolution Protocol (reply)
Hardware type: Ethernet (0x0001)
Protocol type: IP (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (0x0002)
Sender hardware address: 00:e0:63:90:b7:9a
Sender protocol address:
Target hardware address: 08:00:46:48:43:9f
Target protocol address:
Answer comes
here

32. RARP protocol
A diskless system like an X-terminal want to learn its IP address automatically when booted.
It sends an RARP request, requesting the IP address corresponding to its MAC address.
A RARP server that keeps all the mapping of MAC addresses to IP addresses replies back with the corresponding IP address for the diskless system

33. RARP
The diskless system sends the RARP request to the broadcast address. ff:ff:ff:ff:ff:ff
Only the RARP server replies back and it replies back directly to the diskless system.