1. Transport Layer: TCP and UDP
Overview of TCP/IP protocols
Comparing TCP and UDP
TCP connection: establishment, data transfer, and termination
Allocation of port numbers
Size matters: MTU, datagram, MSS, buffer
Standard Internet services and applications
Debugging techniques and tools

2. Overview of TCP/IP Protocols
tcpdump mrouted ping traceroute applications
IGMP ICMP TCP UDP ICMPv6
ARP/RARP IPv IPv6
BPF/DLPI
datalink

3. Comparing TCP and UDP

4. TCP Connection: Establishment
Three-way handshake
client server
socket,bind,listen
LISTEN(passive open)
accept (blocks)
socket
connect (blocks)
(active open) SYN_SENT
SYN j
SYN_RCVD
SYN k, ack j+1
ESTABLISHED
connect returns
ack k+1
ESTABLISHED
accept returns
read (blocks)
TCP options (in SYN): MSS (maximum segment size) option,
window scale option (advertized window up to 65535x2^14, 1GB),
timestamp option (the latter two: long fat pipe options)

5. TCP Connection: Data Transfer
client server
write
read(blocks)
request
read returns
(server processes request)
reply
ack of request
write
read(blocks)
read returns
ack of reply

6. TCP Connection: Termination
Four-way handshake
client server
close
(active close) FIN_WAIT_1
FIN m
CLOSE_WAIT (passive close)
read returns 0
ack m+1
FIN_WAIT_2
close
LAST_ACK
FIN n
TIME_WAIT
1~4 mins
ack n+1
CLOSED
CLOSED
TIME_WAIT to allow old duplicate segment to expire for reliable termination
(the end performing active close might have to retx the final ACK)

7. TCP State Transition Diagram
CLOSED
appl:passive open
send:<nothing>
appl:active open
send:SYN
LISTEN
recv:SYN,send:SYN,ACK
appl:close
or timeout
recv:RST
recv:SYN
SYN_SENT
SYN_RSVD
send:SYN,ACK
(simultaneous open)
recv:SYN,ACK
send:ACK
passive
close
recv:ACK
send:<nothing>
ESTABLISHED
CLOSE_WAIT
recv:FIN
send:ACK
appl:close
send:FIN
(data transfer state)
appl:close
send:FIN
active
close
recv:FIN
send:ACK
(simultaneous close)
LAST_ACK
FIN_WAIT_1
CLOSING
recv:ACK
send:<nothing>
recv:FIN,ACK
send:ACK
recv:ACK
send:<nothing>
recv:ACK
send:<nothing>
2MSL timeout
FIN_WAIT_2
TIME_WAIT
recv:FIN
send:ACK

8. Allocation of Port Numbers
IANA
well-known ports
IANA
registered ports
IANA
dynamic or private ports
IANA
(Internet Assigned
Numbers Authority)
BSD
reserved ports
BSD
ephemeral ports
BSD
nonprivileged servers
BSD
Solaris
ephemeral ports
rrsevport
Solaris

9. Multiple Sockets with the Same Port (in Concurrent Server)
listening socket
server
(*.21,*.*)
client1
( , )
connected socket
server
(child1)
( , )
client2
( , )
connected socket
server
(child2)
( , )
All TCP segments destined for port 21, with socket pairs different from ( , ) and ( , ), are delivered to the original server with the listening socket.

10. Size Matters: MTU, datagram, TCP MSS, buffer
Link MTU (maximum transmission unit): Ethernet MTU: 1500 bytes, PPP MTU: configurable
Path MTU: the smallest link MTU in the path, can be discovered by IP DF (don’t fragment) bit
Maximum IP datagram: (IPv4), (IPv6) (IPv6 has 32-bit jumbo payload option), minimum IP reassembly buffer size
TCP MSS (maximum segment size): actual value of reassembly buffer size, often the link MTU minus IP and TCP headers, to avoid fragmentation

11. TCP Output and UDP Output
application
application buffer
application
application buffer
write
sendto
user process
kernel
no buffering
but SO_SNDBUF
exists
socket send buffer
(SO_SNDBUF)
TCP
UDP
MSS-sized TCP
segment
UDP datagram IP IP
MTU-sized packet
MTU-sized packet
output queue
datalink
output queue
datalink

12. Standard Internet Services and Applications
Standard services provided by inetd daemon: echo/port7/RFC862, discard/port9/RFC863, daytime/port13/RFC867, chargen/port19/RFC864, time/port37/RFC868
tested by “telnet machine service”, service mapped by /etc/services
Common application types: diagnostic, routing protocol, datagram, virtual circuit, etc.

13. Protocol Usage of Various Common Applications
Application IP ICMP UDP TCP
Ping x
Traceroute x x
OSPF x
RIP x
BGP x
BOOTP x
DHCP x
NTP x
TFTP x
SNMP x
SMTP x
Telnet x
FTP x
HTTP x
NNTP x
DNS x x
NFS x x
RPC x x

14. Debugging Techniques and Tools
System call tracing: truss (in SVR4), ktrace & kdump (in BSD) (Note that socket is a system call in BSD, while putmsg and getmsg are the actual system calls in SVR4)
sock developed by W.R. Stevens: used to generate special case conditions, as stdin/stdout client, stdin/stdout server, source client, sink server
tcpdump: dump packets matching some criteria
netstat: status of interfaces, multicast groups, per-protocol statistics, routing table, etc.
lsof (list open files): which process has a socket open on a specified IP address or port