8. ETHERNET & TCP/IP – DE FACTO STANDARDS

Introduction

As the use of TCP/IP began to grow, so more companies adopted it within their products and networks. Such growth in demand resulted in TCP/IP becoming a de facto standard within the LAN environment.

TCP/IP is not OSI compliant but the protocols do parallel the OSI model. Internet Protocol (IP) is similar to ISO Connection Less Network Service (CLNS), (ISO 8473). IP is a connectionless datagram service: that is, it divides the data into small units and puts them onto the network being used for transmission. Transmission Control Protocol (TCP) is similar to the ISO Transport Layer Class 4 (ISO 8073). TCP provides a connection oriented, error free transmission service for applications. It basically collates all the datagrams that IP puts onto the network, re-sequences the data, checks for errors and requests retransmissions for any corrupted or lost data.

The advantage of TCP/IP is its historical status as a de facto standard for LAN operation. Therefore more flexibility is offered for inter-working and compatibility than with any other non-ISO protocol.

The disadvantages are that it is not OSI conformant and was originally designed to operate on a Wide Area Network and not a LAN. WANs generally have a much higher error rate than LANs due to the lower quality of network links. Therefore TCP/IP operates a great deal of checking, which reduces performance although some of this has been overcome by better design in recent developments.

TCP/IP Architectures

Transmission Control Protocol

Transmission Control Protocol/Internet Protocol (TCP/IP) is part of the Internet Protocol Suite, a suite of software which operates across a network to enable communications. TCP/IP began as a non-commercial project in the 1970s. The Defence Advanced Research Projects Agency within the American Government began to develop a wide area network, ARPANET, to link all its research centres. From this, and experiments with packet-based radio, emerged TCP/IP which preceded OSI standards by several years even though it used a layered structure similar in principle to the OSI model.

When commercial organisations began to develop networks they encountered the same problems that ARPANET had addressed and, as the TCP/IP protocol suite was fully tested, a ready-made solution was available.

The use of TCP/IP was also promoted by its inclusion in American Government contracts and its adoption within the UNIX operating system for workstation communication. However, the main reason for its meteoric growth was the fact that TCP/IP included a number of higher level application protocols which became widely used by network developers. TCP/IP uses a layered approach and the following sections provide an overview of the layers within the TCP/IP.

Figure 5: TCP/IP Layers

Top 

Layer 1 – The Physical Layer

The physical layer refers to the physical media and this could be any of a number of physical interfaces from RS 232, to X.21 V.11 RS 449 etc. As this book is about LANs the physical media is more likely to be coax, fibre or twisted pair cable, but routers and bridges would utilise serial interfaces to connect the LANs over the Wide Area Network.

Layer 2 – The Data Link Layer

The Data Link Layer may also be any of a number of technologies from Ethernet, to Token Ring, to FDDI (described previously) to Wireless to PPP.

Layer 3 – The Network Layer

IPv4 – Internet Protocol version 4

Internet Protocol version 4, was the first version of the Internet Protocol to be widely deployed, and forms the basis for most of the current Internet (as of 2004).

It is described in IETF RFC 791, which was first published in September, 1981.

IPv4 uses 32-bit addresses, limiting it to 4,294,967,296 unique addresses, many of which are reserved for special purposes such as local networks or multicast addresses, reducing the number of addresses that can be allocated as public Internet addresses. Consequently DHCP (Dynamic Host Configuration Protocol) was introduced to loan devices IP addresses while they used the network. This is commonly used on the Internet where your assigned an IP address for the duration of your time on line, and once your off-line the same address maybe used by another user.

As the number of addresses available is consumed, an IPv4 address shortage appears to be inevitable in the long run.This limitation has helped stimulate the push towards IPv6, which is currently in the early stages of deployment, and may eventually replace IPv4.

Ipv6 – Internet Protocol version 6

Internet Protocol version 6, is a network layer standard; i.e., it governs the addressing and routing of data packets through a network. IPv6 is intended to replace the IPv4 standard, whose limits on network addresses are beginning to restrict Internet growth and use.

IPv6 supports about 3.4 × 1038 (340 undecillion ) addresses.

Adopted by the Internet Engineering Task Force in 1994 (when it was called “IP Next Generation” or IPng), IPv6 accounts so far for just a few percent of the IP networks in use.

ICMP – Internet Control Message Protocol

The Internet Control Message Protocol is one of the core protocols of the Internet Protocol suite. It is chiefly used by networked computers’ operating systems to send error messages indicating, for instance, that a requested service is not available or that a host or router could not be reached.

ICMP differs in purpose from TCP and UDP in that it is usually not used directly by user network applications. One exception is the ping tool, which sends ICMP Echo Request messages (and receives Echo Response messages) to determine whether a host is reachable and how long packets take to get to and from that host.

ARP – Address Resolution Protocol

The Address Resolution Protocol is a method for finding a host’s Ethernet (MAC) address from its IP address. The sender broadcasts an ARP packet containing the Internet address of another host and waits for it (or some other host) to send back its Ethernet address. Each host maintains a cache of address translations to reduce delay and loading. ARP allows the Internet address to be independent of the Ethernet address but it only works if all hosts support it.

IGMP – Internet Group Management Protocol

The Internet Group Management Protocol is a communication protocol used to manage the membership of Internet Protocol multicast groups. IGMP is used by IP hosts and adjacent multicast routers to establish multicast group memberships. It is an integral part of the IP multicast specification, like ICMP for unicast connections.

Top 

Layer 4 – Transport Layer

TCP – Transmission Control Programme

The Transmission Control Protocol is one of the core protocols of the Internet protocol suite. Using TCP, programs on networked computers can create connections to one another, over which they can send data. The protocol guarantees that data sent by one endpoint will be received in the same order by the other, and without any pieces missing. It also distinguishes data for different applications (such as a Web server and an email server) on the same computer.

TCP supports many of the Internet’s most popular applications, including HTTP, SMTP, and SSH.

TCP ports

TCP uses the notion of port numbers to identify sending and receiving applications. Each side of a TCP connection has an associated 16-bit unsigned port number assigned to the sending or receiving application. Ports are categorized into three basic categories:

Well Known Ports

The well known ports are assigned by the Internet Assigned Numbers Authority (IANA) and are typically used by system-level or root processes. Well known applications running as servers and passively listening for connections typically use these ports. Some examples include: FTP (21), TELNET (23), SMTP (25) and HTTP (80).

Registered

Registered ports are typically used by end user applications as ephemeral source ports when contacting servers, but they can also identify named services that have been registered by a third party.

Dynamic/private

Dynamic/private ports can also be used by end user applications, but are less commonly so. They do not contain any meaning outside of any particular TCP connection. There are 65535 possible ports officially recognised

UDP – User Datagram Protocol

The User Datagram Protocol is one of the core protocols of the Internet protocol suite. Using UDP, programs on networked computers can send short messages known as datagrams to one another. UDP does not provide the reliability and ordering guarantees that TCP does; datagrams may arrive out of order or go missing without notice. However, as a result, UDP is faster and more efficient for many lightweight or time-sensitive purposes.Common network applications that use UDP include the Domain Name System (DNS), streaming media applications, Voice Over IP, and online games.

SCTP – Stream Control Transmission Protocol

The Stream Control Transmission Protocol is a transport layer protocol defined in 2000 by the IETF Signalling Transport (SIGTRAN) working group. The protocol is defined in RFC 2960, and an introductory text is provided by RFC 3286.As a transport protocol, SCTP is equivalent in a sense to TCP or UDP. Indeed it provides some similar services as TCP, ensuring reliable, in-sequence transport of messages with congestion control. While TCP is byte-oriented, SCTP deals with framed messages.

DCCP – Datagram Congestion Protocol

The Datagram Congestion Control Protocol is a message-oriented transport layer protocol that is currently (2005) under development in the IETF. Applications that might make use of DCCP include those with timing constraints on the delivery of data such that reliable in-order delivery, when combined with congestion control, is likely to result in some information arriving at the receiver after it is no longer of use. Such applications might include streaming media and Internet telephony. Congestion control is the way that a network protocol discovers the available network capacity on a particular path. The primary motivation for the development of DCCP is to provide a way for such applications to gain access to standard congestion control mechanisms without having to implement them at the application layer.

Top 

Layer 7 – Application layer

HTTP – HyperText Transfer Protocol – Port 80

HTTP is the primary method used to convey information on the World Wide Web. The original purpose was to provide a way to publish and receive HTML pages.

HTTPS – HyperText Transfer Protocol Secure – Default Port 443

HTTPS is the secure version of HTTP, the communication protocol of the World Wide Web. It was invented by Netscape Communications Corporation to provide authentication and encrypted communication and is used in electronic commerce. Instead of using plain text socket communication, HTTPS encrypts the session data using either a version of the SSL (Secure Socket Layer) protocol or the TLS (Transport Layer Security) protocol, thus ensuring reasonable protection from eavesdroppers, and man in the middle attacks.

SMTP – Simple Mail Transfer Protocol – Port 25

SMTP is the de facto standard for email transmission across the Internet. SMTP is a relatively simple, text-based protocol, where one or more recipients of a message are specified (and in most cases verified to exist) and then the message text is transferred. It is quite easy to test a SMTP server using the telnet program. To determine the SMTP server for a given domain name, use the MX (Mail eXchange) DNS record.

FTP – File Transfer Protocol – Port 21

FTP allows the transfer of files either in ASCII (American Standard Code for Information Interchange) or Binary form. It should be noted that ASCII defines a standard set of codes used to represent alphanumeric characters. Therefore a file could be transferred from a machine using Extended Binary Coded Decimal Interchange Code (EBCDIC) to an ASCII-based machine or vice versa.

TELNET – Port 23

Telnet which provides an ASCII Virtual Terminal Interface. For a terminal it allows logon to remote hosts from another host or terminal server. To the host it simulates a directly connected terminal, such as a VT 100.

UUCP – Unix to Unix Copy Protocol – If port not defined default Port 540

UUCP is a computer program and protocol allowing remote execution of commands and transfer of files, email and netnews between Unix computers not connected to the Internet proper. The UUCP package consists of several programs including uucp, uuxqt (front ends for remote copy and execution), uucico (communication program), uustat, and uuname. Nowadays it is rarely used for Modem communications, but is still used sometimes over TCP/IP.

NNTP – Network News Transfer Protocol – TCP port 119 is reserved for NNTP

NNTP is an Internet application protocol used primarily for reading and posting Usenet articles, and transferring news among servers.

Usenet was originally designed around the UUCP network, with most article transfers taking place over direct computer-to-computer telephone links. Readers and posters would log into the same computers that hosted the servers, reading the articles directly from the local disk.

As local area networks and the Internet became more commonly used, it became desirable to allow newsreaders to be run on personal computers, and a means of employing the Internet to handle article transfers was desired. Because networked Internet-compatible filesystems were not yet widely available, it was decided to develop a new protocol that resembled SMTP, but was tailored for reading newsgroups.

TCP port 119 is reserved for NNTP. When clients connect to a news server with SSL, TCP port 563 is used. This is sometimes referred to as NNTPS.

SSH – Secure Shell Port 22

SSH is both a computer program and an associated network protocol designed for logging into and executing commands on a networked computer. The designers of SSH aimed to replace the earlier rlogin, telnet and rsh protocols, and the resultant protocol provides secure encrypted communications between two untrusted hosts over an insecure network. Users of SSH can also use it for tunnelling, forwarding X11 connections and arbitrary TCP ports over the resultant secure channel; and can transfer files using the associated scp or sftp programs. An ssh server, by default, listens on the standard TCP port 22.

A later version of the protocol appeared under the name SSH-2. The IETF "secsh" working group has started to standardise SSH-2, which features both security and feature improvements over SSH-1. Better security, for example, comes through Diffie-Hellman key exchange and strong integrity checking via MACs. New features of SSH-2 include the ability to run any number of shell sessions over a single SSH connection.

Top 

IRC – Internet Relay Chat

IRC is a form of instant communication over the Internet. It is mainly designed for group (many-to-many) communication in discussion forums called channels, but also allows one-to-one communication. IRC is an open protocol that uses TCP and optionally SSL. An IRC server can connect to other IRC servers to expand the IRC network. Users access IRC networks by connecting a client to a server. There are many client and server implementations. Most IRC servers do not require users to log in, but a user will have to set a nickname before being connected.

IRC is a plaintext protocol, which means that it is fully possible (though quite inconvenient) to use IRC via a basic byte-stream client such as netcat or telnet. However, the protocol only uses a slightly modified version of ASCII, and does not originally provide any support for non-ASCII characters in text, with the result that many different, incompatible character encodings (such as ISO 8859-1 and UTF-8) are used.

SNMP – Simple Network Management Protocol

SNMP is a standard set of rules, which allow devices supporting this protocol to be managed from a common device, usually a network management system. At the time of writing there are three versions of SNMP, these are.

SNMP V1

The first RFC for SNMP version 1, appeared in 1988 and has been criticized for its poor security. Authentication of clients is performed only by a “community string”, in effect a type of password, which is transmitted in clear text.

SNMP V2

Version 2 was not widely adopted due to serious disagreements over the security framework in the standard. SNMP v2 or SNMP v2p, revises version 1 and includes improvements in the areas of performance, security, confidentiality, and manager-to-manager communications. It introduced GETBULK, an alternative to iterative GETNEXTs for retrieving large amounts of management data in a single request. However, the new party-based security system in SNMP v2, viewed by many as overly complex, was not widely accepted.

SNMP v2u, is defined in RFC 1909-RFC 1910. This is a compromise that attempts to offer greater security than SNMP v1, but without incurring the high complexity of SNMP v2. A variant of this was commercialised as SNMP v2*, and the mechanism was eventually adopted as one of two security frameworks in SNMP v3.

SNMP V3

As of 2004 the Internet Engineering Task Force recognised Simple Network Management Protocol version 3 as defined by RFC 3411-RFC 3418 (also known as STD0062) as the current standard version of SNMP. The IETF considers earlier versions as “Obsolete” or “Historical”.

In practice, SNMP implementations often support multiple versions: typically SNMPv1, SNMPv2c, and SNMPv3.

H.323

H.323 is an umbrella recommendation from the ITU-T, that defines the protocols to provide audio-visual communication sessions on any packet network. It is currently implemented by various Internet real-time applications as NetMeeting and GnomeMeeting (the latter using the OpenH323 implementation). It is a part of the H.32x series of protocols which also address communications over ISDN, PSTN or SS7. Challengers to H.323 are SIP, a standard from the IETF and the new Skype protocol. All these are used in Voice over IP (VoIP, Internet Telephony, or IP Telephony). One strength of H.323 was the relatively early availability of a set of standards, not only defining the basic call model, but in addition the supplementary services, needed to address business communication expectations. H.323 was the first VoIP standard to adopt the IETF standard RTP to transport audio and video over IP networks.

H.323 is based on the ISDN Q.931 protocol and is suited for interworking scenarios between IP and ISDN, respectively between IP and QSIG. A call model, similar to the ISDN call model, eases the introduction of IP Telephony into existing networks of ISDN based PBX systems. A smooth migration towards IP based PBX systems becomes plannable.

Top 

SIP – ‘Session Initiation Protocol’

SIP is a protocol developed by the IETF MMUSIC Working Group and proposed standard for setting up sessions between one or more clients. It is currently (2005) the leading signaling protocol for VOIP (Voice over IP), gradually replacing H.323 in this role.

A goal for SIP was to provide a superset of the call processing functions and features present in the public switched telephone network (PSTN). As such, features that permit familiar telephone-like operations are present: dialing a number, causing a phone to ring, hearing ringback tones or a busy signal. Implementation and terminology are different.

Although many other VoIP signaling protocols exist, SIP is characterized by its roots in the IP community rather than the telecom industry. SIP is being standardized and governed by the IETF while older, more complex VoIP protocols were proposed by the ITU.

SIP works in concert with several other protocols and is only involved in the signaling portion of a communication session. SIP acts as a carrier for the Session Description Protocol (SDP), which describes the media content of the session, e.g. what IP ports to use, the codec being used etc. In typical use, SIP "sessions" are simply packet streams of the Real Time Transport Protocol (RTP). RTP is the carrier for the actual voice or video content itself.

RTP – Real-time Transport Protocol

RTP defines a standardized packet format for delivering audio and video over the Internet. It was developed by the Audio-Video Transport Working Group of the IETF and first published in 1996 as RFC 1889. It was originally designed as a multicast protocol, but has since been applied in many unicast applications. It is frequently used in streaming media systems (in conjunction with RTSP) as well as videoconferencing and push to talk systems (in conjunction with H.323 or SIP), making it the technical foundation of the Voice over IP industry. It goes along with the RTP Control Protocol (RTCP) and it’s built on top of User Datagram RTP ensures consistent delivery order of voice packets in an IP internetwork.

RTCP – Real Time Control Protocol

RTCP is a sister protocol of the Real-time Transport Protocol (RTP). It is defined in RFC 3550 (which obsoletes RFC 1889).

RTCP, which stands for Real-time Transport Control Protocol, provides out-of-band control information for an RTP flow. It partners RTP in the delivery and packaging of multimedia data, but does not transport any data itself. It is used periodically to transmit control packets to participants in a streaming multimedia session. The primary function of RTCP is to provide feedback on the quality of service being provided by RTP.

It gathers statistics on a media connection and information such as bytes sent, packets sent, lost packets, jitter, feedback and round trip delay. An application may use this information to increase the quality of service perhaps by limiting flow, or maybe using a low compression codec instead of a high compression codec. RTCP is used for QoS reporting

Top