Overview of the TCP/IP Networking Model
The TCP/IP model both defines and references a large collection of protocols that allow computers to communicate. To define a protocol, TCP/IP uses documents called Requests for Comments (RFC). (You can find these RFCs using any online search engine.) The TCP/IP model also avoids repeating work already done by some other standards body or vendor consortium by simply referring to standards or protocols created by those groups.
For example, the Institute of Electrical and Electronic Engineers (IEEE) defines Ethernet LANs; the TCP/IP model does not define Ethernet in RFCs, but refers to IEEE Ethernet as an option. An easy comparison can be made between telephones and computers that use TCP/IP. You go to the store and buy a phone from one of a dozen different vendors. When you get home and plug in the phone to the same cable in which your old phone was connected, the new phone works. The phone vendors know the standards for phones in their country and build their phones to match those standards.
Similarly, when you buy a new computer today, it implements the TCP/IP model to the point that you can usually take the computer out of the box, plug in all the right cables, turn it on, and it connects to the network. You can use a web browser to connect to your favorite website. How?
Well, the OS on the computer implements parts of the TCP/IP model. The Ethernet card, or wireless LAN card, built into the computer implements some LAN standards referenced by the TCP/IP model. In short, the vendors that created the hardware and software implemented TCP/IP.
To help people understand a networking model, each model breaks the functions into a small number of categories called layers. Each layer includes protocols and standards that relate to that category of functions. TCP/IP actually has two alternative models, as shown in Figure 1.9.
Figure 1.9 The Two TCP/IP Networking Models
The model on the left, the original TCP/IP model, breaks TCP/IP into four layers. The top layers focus more on the applications that need to send and receive data, whereas the lower layers focus more on the need to somehow transmit the bits from one device to another. The model on the right is a newer version of the model, formed by expanding the network access layer on the left into two separate layers: data link and physical. Note that the model on the right is used more often today.
Many of you will have already heard of several TCP/IP protocols, like the examples listed in
Table 1.3 TCP/IP Architectural Model and Example Protocols
TCP/IP Application Layer
TCP/IP application layer protocols provide services to the application software running on a computer. The application layer does not define the application itself, but it defines services that applications need. For example, application protocol HTTP defines how web browsers can pull the contents of a web page from a web server. In short, the application layer provides an interface between software running on a computer and the network itself.
Table 1.3 TCP/IP Architectural Model and Example Protocols Arguably, the most popular TCP/IP application today is the web browser. Many major software vendors either have already changed or are changing their application software to support access from a web browser.
OSI Layers and Their Functions
Cisco requires that CCNAs demonstrate a basic understanding of the functions defined by each OSI layer, as well as remembering the names of the layers. You understand which layers of the OSI model most closely match the functions defined by that device or protocol.
Today, because most people happen to be much more familiar with TCP/IP functions than with OSI functions, one of the best ways to learn about the function of different OSI layers is to think about the functions in the TCP/IP model, and correlate those with the OSI model.
If you use the five-layer TCP/IP model, the bottom four layers of OSI and TCP/IP map closely together. The only difference in these bottom four layers is the name of OSI Layer 3 (network)
compared to TCP/IP (Internet). The upper three layers of the OSI reference model (application, presentation, and session—Layers 7, 6, and 5) define functions that all map to the TCP/IP application layer. Table 1.4 defines the functions of the seven layers.
Table 1.4 OSI Reference Model Layer Definitions
Table 1.5 lists most of the devices and protocols covered in the CCNA exams and their comparable OSI layers. Note that many network devices must actually understand the protocols at multiple OSI layers, so the layer listed in Table 1.5 actually refers to the highest layer that the device normally thinks about when performing its core work. For example, routers need to think about Layer 3 concepts, but they must also support features at both Layers 1 and 2.
Besides remembering the basics of the features of each OSI layer (as in Table 1.4), and some example protocols and devices at each layer (as in Table 1.5), you should also Layer Functional Description 4 Layer 4 protocols provide a large number of services, “Fundamentals of TCP/IP Transport, Applications, and Security.” Although OSI Layers 5 through 7 focus on issues related to the application, Layer 4 focuses on issues related to data delivery to another computer (for instance, error recovery and flow control).
3 The network layer defines three main features: logical addressing, routing (forwarding), and path determination. Routing defines how devices (typically routers) forward packets to their final destination. Logical addressing defines how each device can have an address that can be used by the routing process. Path determination refers to the work done by routing protocols to learn all possible routes, and choose the best route.
2 The data link layer defines the rules that determine when a device can send data over a particular medium. Data link protocols also define the format of a header and trailer that allows devices attached to the medium to successfully send and receive data.
1 This layer typically refers to standards from other organizations. These standards deal with the physical characteristics of the transmission medium, including connectors, pins, use of pins, electrical currents, encoding, light modulation, and the rules for how to activate and deactivate the use of the physical medium.
Table 1.5 OSI Reference Model—Example Devices and Protocols
Memorize the names of the layers. You can simply memorize them, but some people like to use a mnemonic phrase to make memorization easier. In the following three phrases, the first letter of each word is the same as the first letter of an OSI layer name, in the order specified in parentheses:
- All People Seem To Need Data Processing (Layers 7 to 1)
- Please Do Not Take Sausage Pizzas Away (Layers 1 to 7)
- Pew! Dead Ninja Turtles Smell Particularly Awful (Layers 1 to 7)
Predict the data flow between two hosts across a network
Determine the path between two hosts across a network
Once you create an internetwork by connecting your WANs and LANs to a router, you’ll need to configure logical network addresses, such as IP addresses, to all hosts on the internetwork so that they can communicate across that internetwork.
The term routing is used for taking a packet from one device and sending it through the network to another device on a different network. Routers don’t really care about hosts—they only care about networks and the best path to each network. The logical network address of the destination host is used to get packets to a network through a routed network, and then the hardware address of the host is used to deliver the packet from a router to the correct destination host.
If your network has no routers, then it should be apparent that you are not routing. Routers route traffic to all the networks in your internetwork. To be able to route packets, a router must know, at a minimum, the following:
- Destination address
- Neighbor routers from which it can learn about remote networks
- Possible routes to all remote networks
- The best route to each remote network
- How to maintain and verify routing information
The router learns about remote networks from neighbor routers or from an administrator. The router then builds a routing table (a map of the internetwork) that describes how to find the remote networks. If a network is directly connected, then the router already knows how to get to it.
If a network isn’t directly connected to the router, the router must use one of two ways to learn how to get to the remote network: static routing, meaning that someone must hand-type all network locations into the routing table, or something called dynamic routing. In dynamic routing, a protocol on one router communicates with the same protocol running on neighbor routers. The routers then update each other about all the networks they know about and place this information into the routing table. If a change occurs in the network, the dynamic routing protocols automatically inform all routers about the event. If static routing is used, the administrator is responsible for updating all changes by hand into all routers. Typically, in a large network, a combination of both dynamic and static routing is used.
Figure 1.10 shows a simple two-router network. Lab_A has one serial interface and three LAN interfaces.
Looking at Figure 1.10, can you see which interface Lab_A will use to forward an IP datagram to a host with an IP address of 10.10.10.10?
FIGURE 1.10 A simple routing example
By using the command show ip route, we can see the routing table (map of the internetwork) that Lab_A uses to make forwarding decisions:
The C in the routing table output means that the networks listed are “directly connected,” and until we add a routing protocol—something like RIP, EIGRP, or the like—to the routers in our internetwork (or use static routes), we’ll have only directly connected networks in our routing table.
So let’s get back to the original question: By looking at the figure and the output of the routing table, can you tell what IP will do with a received packet that has a destination IP address of 10.10.10.10? The router will packet-switch the packet to interface FastEthernet 0/0, and this interface will frame the packet and then send it out on the network segment.
Because we can, let’s do another example: Based on the output of the next routing table, which interface will a packet with a destination address of 10.10.10.14 be forwarded from?
First, you can see that the network is sub-netted and each interface has a different mask. And I have to tell you—you just can’t answer this question if you can’t subnet! 10.10.10.14 would be a host in the 10.10.10.8/29 subnet connected to the FastEthernet0/1 interface.
Figure 1.11 shows a LAN connected to Router A, which is, in turn, connected via a WAN link to RouterB. RouterB has a LAN connected with an HTTP server attached.
FIGURE 1.11 IP routing example 1
The critical information you need to glean from this figure is exactly how IP routing will occur in this example. Okay—we’ll cheat a bit. I’ll give you the answer, but then you should go back over the figure and see if you can answer example 2 without looking at my answers.
1. The destination address of a frame, from HostA, will be the MAC address of the F0/0 interface of the RouterA router.
2. The destination address of a packet will be the IP address of the network interface card (NIC) of the HTTP server.
3. The destination port number in the segment header will have a value of 80.
That example was a pretty simple one, and it was also very to the point. One thing to remember is that if multiple hosts are communicating to the server using HTTP, they must all use a different source port number. That is how the server keeps the data separated at the Transport layer.
Let’s mix it up a little and add another internetworking device into the network and then see if you can find the answers. Figure 1.12 shows a network with only one router but two switches
FIGURE 1.12 IP routing example 2.
What you want to understand about the IP routing process here is what happens when HostA sends data to the HTTPS server:
1. The destination address of a frame, from HostA, will be the MAC address of the F0/0 interface of the RouterA router.
2. The destination address of a packet will be the IP address of the network interface card (NIC) of the HTTPS server.
3. The destination port number in the segment header will have a value of 443.
Notice that the switches weren’t used as either a default gateway or another destination. That’s because switches have nothing to do with routing. I wonder how many of you chose the switch as the default gateway (destination) MAC address for HostA? If you did, don’t feel bad—just take another look with that fact in mind. It’s very important to remember that the destination MAC address will always be the router’s interface—if your packets are destined for outside the LAN, as they were in these last two examples.
Before we move into some of the more advanced aspects of IP routing, let’s discuss ICMP in more detail, as well as how ICMP is used in an internetwork. Take a look at the network shown in Figure 1.13. Ask yourself what will happen if the LAN interface of Lab_C goes down.
Lab_C will use ICMP to inform Host A that Host B can’t be reached, and it will do this by sending an ICMP destination unreachable message. Lots of people think that the Lab_A router would be sending this message, but they would be wrong because the router that sends the message is the one with that interface that’s down is located.
FIGURE 1.13 ICMP error example
Let’s look at another problem: Look at the output of a corporate router’s routing table:
What do we see here? If I were to tell you that the corporate router received an IP packet with a source IP address of 192.168.214.20 and a destination address of 192.168.22.3, what do you think the Corp router will do with this packet?
If you said, “The packet came in on the FastEthernet 0/0 interface, but since the routing table doesn’t show a route to network 192.168.22.0 (or a default route), the router will discard the packet and send an ICMP destination unreachable message back out interface FastEthernet 0/0,” you’re a genius! The reason it does this is because that’s the source LAN where the packet originated from.
Identify the appropriate media, cables, ports, and connectors to connect Cisco network devices to other network devices and hosts in a LAN
Select the appropriate media, cables, ports, and connectors to connect switches to other network devices and hosts
Ethernet cabling is an important discussion, especially if you are planning on taking the Cisco exams.
Three types of Ethernet cables are available:
- Straight-through cable
- Crossover cable
- Rolled cable
Straight-Through Cable
- The straight-through cable is used to connect
- Host to switch or hub
- Router to switch or hub
Four wires are used in straight-through cable to connect Ethernet devices. It is relatively simple to create this type; Figure 1.12 shows the four wires used in a straight-through Ethernet cable.
FIGURE 1.12 Straight-through Ethernet cable
Notice that only pins 1, 2, 3, and 6 are used. Just connect 1 to 1, 2 to 2, 3 to 3, and 6 to 6, and you’ll be up and networking in no time. However, remember that this would be an Ethernet-only cable and wouldn’t work with voice, Token Ring, ISDN, and so on.
Crossover Cable
The crossover cable can be used to connect
- Switch to switch
- Hub to hub
- Host to host
- Hub to switch
- Router direct to host
The same four wires are used in this cable as in the straight-through cable; we just connect different pins together. Figure 1.13 shows how the four wires are used in a crossover Ethernet cable.
Notice that instead of connecting 1 to 1, 2 to 2, and so on, here we connect pins 1 to 3 and 2 to 6 on each side of the cable.
FIGURE 1.13 Crossover Ethernet cable
Rolled Cable
Although rolled cable isn’t used to connect any Ethernet connections, you can use a rolled Ethernet cable to connect a host to a router console serial communication (com) port. If you have a Cisco router or switch, you would use this cable to connect your PC running HyperTerminal to the Cisco hardware. Eight wires are used in this cable to connect serial devices, although not all eight are used to send information, just as in Ethernet networking. Figure 1.14 shows the eight wires used in a rolled cable.
These are probably the easiest cables to make because you just cut the end off on one side of a straight-through cable, turn it over, and put it back on (with a new connector, of course).
FIGURE 1.14 Rolled Ethernet cable
Once you have the correct cable connected from your PC to the Cisco router or switch, you can start HyperTerminal to create a console connection and configure the device. Set the configuration as follows:
1. Open HyperTerminal and enter a name for the connection. It is irrelevant what you name it, but I always just use Cisco. Then click OK.
2. Choose the communications port—either COM1 or COM2, whichever is open on your PC.
3. Now set the port settings. The default values (2400bps and no flow control hardware) will not work; you must set the port settings as shown in Figure 1.14.
FIGURE 1.14 Port settings for a rolled cable connection
Notice that the bit rate is now set to 9600 and the flow control is set to None. At this point, you can click OK and press the Enter key and you should be connected to your Cisco device console port.
We’ve taken a look at the various RJ45 unshielded twisted pair (UTP) cables. Keeping this in mind, what cable is used between the switches in Figure 1.15?
FIGURE 1.15 RJ45 cable questions #1
In order for host A to ping host B, you need a crossover cable to connect the two switches. But what types of cables are used in the network shown in Figure 1.16?
FIGURE 1.16 RJ45 cable questions #2
The trouble is, we have a console connection that uses a rolled cable. Plus, the connection from the router to the switch is a straight-through cable, as is true for the hosts to the switches. Keep in mind that if we had a serial connection (which we don’t); it would be a V.35 that we’d use to connect us to a WAN.
Recognize the purpose and functions of various network devices such as Routers, Switches, Bridges and Hubs
Repeaters
Repeaters are Layer 1 devices utilizing the Physical Layer and are considered as outdated technology today. They have been replaced by Hubs and Switches. But for the purposes of understanding; a repeater consists of a transmitter and a receiver. The function of a repeater is to receive the signal, amplify it and retransmit it enabling the signal to be transmitted over a longer distance.
Repeaters are essential to maintain the quality of signals as they degrade over a distance. Repeaters regenerate and retime the signal, helping it travel a longer distance. Repeaters may be single port or multi port. The figure given below illustrates a repeater.
Figure 1: A Repeater
Hubs
A Multiple Port Repeater is termed as a Hub. It is also a Layer 1 device utilizing the Physical Layer. It can comprise of ports varying from 2 to 24 in number and may also be known as a workgroup hub. Its main job is cleaning up signals. By isolating the end points, Hubs increase the network reliability. A hub retransmits data on all the other ports. A twisted pair cable is used for achieving physical connectivity. The figure given below illustrates a HUB
Figure 2: A Hub
Types of Hubs
Hubs can be of two types; Active and Passive hubs. The difference between the two is that Active Hubs regenerate the incoming signal, whereas the Passive Hubs do not do so. Active Hubs need individual power supply to help with the gain of signal before the data is forwarded to all ports. Gain is an electrical term, representing the ratio of signal output to signal input of a system.
The advantage of Hubs is that they are inexpensive. If more efficient use of bandwidth and its distribution among the ports is required, hubs may not be the best option. Traffic congestion because of collisions on the network is indispensable while using hubs. The best solution in this case is to use a switch.
Network Interfaces:
Network interfaces provide connectivity between an end-user computer to the public network. Depending on the interface that is being used, up to three light-emitting diodes (LEDs) may appear. These diodes help to determine the status of the connection.
The Link Light LED: It lights up when the connectivity is there;
The Activity Light LED: It flickers if some activity is taking place on the line;
The Speed Light LED: This light indicates the connection speed. It may be there on the interface, it may not be there.
Blinking lights and colors other than green are indicative of error conditions.
Bridges:
Bridges were used as a solution for issues relating to network congestion. Hubs and Repeaters were longer proving sufficient to meet the challenges provided by systems growing complex. In comparison to Repeaters and Hubs and Bridges used the concept of segmentation. Repeaters and Hubs which do not use segmentation, share the same bandwidth and hence the traffic congestion on a network. When the other device on the network is not aware of the existence of a Bridge, it is called a Transparent Bridge. Figure 3 given below illustrates a Bridge.
Figure 3: A Bridge
Switches:
Switches are very smart Bridges with the characteristics of being multi port and high speed. The differ bridges from the point that bridges process frames in software whereas switches process frames in hardware. Switches do so by using application integrated circuits (ASIC’s). Figure 4 given below illustrates a Switch
Figure 4: A Switch.
In addition to the above mentioned Switches have the following features:
- Speed Back Plane: this function increases the speed of the network; it allows monitoring of multiple conversations.
- Data Buffering: This function allows storage of frames and later forwarding the frame to the right port.
- High Port Density: Switches can support multiple ports at one time.
- High Port Speed: Switches can support high speeds varying from speeds from 10 Mbps to 10Gbps.
- Lower Latency: Latency is a term that is used to measure the time it takes an incoming frame to come back out of a switch. In the case of switches latency is low.
- VLAN’s: This feature allows segmentation of networks into separate broadcast domains.
These features permit micro segmentation.
Micro segmentation:
Micro segmentation means that a dedicated switch ports are created for every end station; meaning that dedicated paths for sending and receiving transmission with each connected hosts are created. These reduce traffic congestion to a great extent for the reason that separate collision domain and individual bandwidth is available for every host. But faster computers, broadcasts and multicasts can still cause congestion.
Bridges and Switches perform the following tasks:
- Ascertainment of MAC Address: Examine the source MAC address of every inbound frame to ascertain its MAC address;
- Filtration/Forwarding: Depending on the destination of the MAC address, filtration or forwarding of frames as the case may demand;
- Elimination: Eliminating loops caused by superfluous connections.
Select the components required to meet a given network specification
Select the components required to meet a network specification
As mentioned in the previous objectives, we use routers, bridges, and switches in an internetwork. Figure 1.5 shows how a network would look with all these internetwork devices in place. Remember that the router will not only break up broadcast domains for every LAN interface, it will break up collision domains as well.
When you looked at Figure 1.5, did you notice that the router is found at center stage and that it connects each physical network together? We have to use this layout because of the older technologies involved—bridges and hubs.
On the top internetwork in Figure 1.5, you’ll notice that a bridge was used to connect the hubs to a router. The bridge breaks up collision domains, but all the hosts connected to both hubs are still crammed into the same broadcast domain. Also, the bridge only created two collision domains, so each device connected to a hub is in the same collision domain as every other device connected to that same hub. This is actually pretty lame, but it’s still better than having one collision domain for all hosts.
Notice something else: The three hubs at the bottom that are connected also connect to the router, creating one collision domain and one broadcast domain. This makes the bridged network look much better indeed!
The best network connected to the router is the LAN switch network on the left. Why? Because each port on that switch breaks up collision domains. But it’s not all good—all devices are still in the same broadcast domain. Do you remember why this can be a really bad thing? Because all devices must listen to all broadcasts transmitted, that’s why. And if your broadcast domains are too large, the users have less bandwidth and are required to process more broadcasts, and network response time will slow to a level that could cause office riots.
Once we have only switches in our network, things change a lot! Figure 1.6 shows the network that is typically found today.
FIGURE 1. 5 Internetworking devices
FIGURE 1. 6 Switched networks creating an internetwork
Here, I’ve placed the LAN switches at the center of the network world so that the routers are connecting only logical networks together. If I implemented this kind of setup, I’ve created virtual LANs (VLANs). But it is really important to understand that even though you have a switched network, you still need a router to provide your inter-VLAN communication, or internetworking.
Obviously, the best network is one that’s correctly configured to meet the business requirements of the company it serves. LAN switches with routers, correctly placed in the network, are the best network design.
Let’s go back to Figure 1.6. Looking at the figure, how many collision domains and broadcast domains are in this internetwork? Hopefully, you answered nine collision domains and three broadcast domains! The broadcast domains are definitely the easiest to see because only routers break up broadcast domains by default. And since there are three connections, that gives you three broadcast domains. But do you see the nine collision domains? Just in case that’s a no, I’ll explain. The all-hub network is one collision domain; the bridge network equals three collision domains. Add in the switch network of five collision domains—one for each switch port—and you’ve got a total of nine.
So now that you’ve gotten an introduction to internetworking and the various devices that live in an internetwork, it’s time to head into internetworking models.
Identify common applications and their impact on the network
Describe the impact of applications (Voice over IP and Video over IP) on a network The main purpose of the Host-to-Host layer is to shield the upper-layer applications from the complexities of the network. This layer says to the upper layer, “Just give me your data stream, with any instructions, and I’ll begin the process of getting your information ready to send.”
- Transmission Control Protocol (TCP)
- User Datagram Protocol (UDP)
By understanding how TCP and UDP work, you can interpret the impact of applications on networks when using Voice and Video over IP.
Transmission Control Protocol (TCP)
Transmission Control Protocol (TCP) takes large blocks of information from an application and breaks them into segments. It numbers and sequences each segment so that the destination’s TCP stack can put the segments back into the order the application intended. After these segments are sent, TCP (on the transmitting host) waits for an acknowledgment of the receiving end’s TCP virtual circuit session, retransmitting those that aren’t acknowledged.
Before a transmitting host starts to send segments down the model, the sender’s TCP stack contacts the destination’s TCP stack to establish a connection. What is created is known as a virtual circuit. This type of communication is called connection-oriented. During this initial handshake, the two TCP layers also agree on the amount of information that’s going to be sent before the recipient’s TCP sends back an acknowledgment. With everything agreed upon in advance, the path is paved for reliable communication to take place.
TCP is a full-duplex, connection-oriented, reliable, and accurate protocol, but establishing all these terms and conditions, in addition to error checking, is no small task. TCP is very complicated and, not surprisingly, costly in terms of network overhead. And since today’s networks are much more reliable than those of yore, this added reliability is often unnecessary.
TCP Segment Format
Since the upper layers just send a data stream to the protocols in the Transport layers, I’ll demonstrate how TCP segments a data stream and prepares it for the Internet layer. When the Internet layer receives the data stream, it routes the segments as packets through an internetwork. The segments are handed to the receiving host’s Host-to-Host layer protocol, which rebuilds the data stream to hand to the upper-layer applications or protocols.
Figure 1.7 shows the TCP segment format. The figure shows the different fields within the TCPheader
FIGURE 1.7 TCP segment format
The TCP header is 20 bytes long, or up to 24 bytes with options. You need to understand what each field in the TCP segment is:
Source port the port number of the application on the host sending the data.
- Destination port The port number of the application requested on the destination host. Sequence number A number used by TCP that puts the data back in the correct order or retransmits missing or damaged data, a process called sequencing.
- Acknowledgment number The TCP octet that is expected next.
- Header length The number of 32-bit words in the TCP header. This indicates where the data begins. The TCP header (even one including options) is an integral number of 32 bits in length. Reserved Always set to zero.
- Code bits Control functions used to set up and terminate a session.
- Window The window size the sender is willing to accept, in octets.
- Checksum The cyclic redundancy check (CRC), because TCP doesn’t trust the lower layers and checks everything. The CRC checks the header and data fields.
- Urgent A valid field only if the Urgent pointer in the code bits is set. If so, this value indicates the offset from the current sequence number, in octets, where the first segment of non-urgent data begins.
- Options May be 0 or a multiple of 32 bits, if any. What this means is that no options have to be present (option size of 0). However, if any options are used that do not cause the option field to total a multiple of 32 bits, padding of 0s must be used to make sure the data begins on a 32-bit boundary.
Data Handed down to the TCP protocol at the Transport layer, which includes the upperlayer headers.
Let’s take a look at a TCP segment copied from a network analyzer:
Did you notice that everything I talked about earlier is in the segment? As you can see from the number of fields in the header, TCP creates a lot of overhead. Application developers may opt for efficiency over reliability to save overhead, so the User Datagram Protocol was also defined at the Transport layer as an alternative.
User Datagram Protocol (UDP)
If you were to compare the User Datagram Protocol (UDP) with TCP, the former is basically the scaled-down economy model that’s sometimes referred to as a thin protocol. Like a thin person on a park bench, a thin protocol doesn’t take up a lot of room—or in this case, much bandwidth on a network.
UDP doesn’t offer all the bells and whistles of TCP either, but it does do a fabulous job of transporting information that doesn’t require reliable delivery—and it does so using far fewer network resources. (UDP is covered thoroughly in Request for Comments 768.)
There are some situations in which it would definitely be wise for developers to opt for UDP rather than TCP. Remember the watchdog SNMP up there at the Process/Application layer?
SNMP monitors the network, sending intermittent messages and a fairly steady flow of status updates and alerts, especially when running on a large network. The cost in overhead to establish, maintain, and close a TCP connection for each one of those little messages would reduce what would be an otherwise healthy, efficient network to a dammed-up bog in no time! Another circumstance calling for UDP over TCP is when reliability is already handled at the Process/Application layer. Network File System (NFS) handles its own reliability issues, making the use of TCP both impractical and redundant. But ultimately, it’s up to the application developer to decide whether to use UDP or TCP, not the user who wants to transfer data faster.
UDP does not sequence the segments and does not care in which order the segments arrive at the destination. But after that, UDP sends the segments off and forgets about them. It doesn’t follow through, check up on them, or even allow for an acknowledgment of safe arrival—complete abandonment. Because of this, it’s referred to as an unreliable protocol.
This does not mean that UDP is ineffective, only that it doesn’t handle issues of reliability. Further, UDP doesn’t create a virtual circuit, nor does it contact the destination before delivering information to it. Because of this, it’s also considered a connectionless protocol.
Since UDP assumes that the application will use its own reliability method, it doesn’t use any. This gives an application developer a choice when running the Internet Protocol stack: TCP for reliability or UDP for faster transfers.
So if you’re using Voice over IP (VoIP), for example, you really don’t want to use UDP, because if the segments arrive out of order (very common in IP networks), they’ll just be passed up to the next OSI (DoD) layer in whatever order they’re received, resulting in some seriously garbled data. On the other hand, TCP sequences the segments so they get put back together in exactly the right order—something that UDP just can’t do.
UDP Segment Format
Figure 1.8 clearly illustrates UDP’s markedly low overhead as compared to TCP’s hungry usage. Look at the figure carefully—can you see that UDP doesn’t use windowing or provide for acknowledgments in the UDP header?
It’s important for you to understand what each field in the UDP segment is: Source port Port number of the application on the host sending the data Destination port Port number of the application requested on the destination host Length Length of UDP header and UDP data Checksum Checksum of both the UDP header and UDP data fields Data Upper-layer data
FIGURE 1.8 UDP segment
UDP, like TCP, doesn’t trust the lower layers and runs its own CRC. Remember that the Frame Check Sequence (FCS) is the field that houses the CRC, which is why you can see the FCS information. The following shows a UDP segment caught on a network analyzer:
UDP - User Datagram Protocol
Frame Check Sequence: 0x00000000
Notice that low overhead! Try to find the sequence number, ack number, and window size in the UDP segment. You can’t because they just aren’t there!
Key Concepts of Host-to-Host Protocols
Since you’ve seen both a connection-oriented (TCP) and connectionless (UDP) protocol in action, it would be good to summarize the two here. Table 1. 2 highlight some of the key concepts that you should keep in mind regarding these two protocols. You should memorize this table.
TABLE 1.2 Key Features of TCP and UDP
A telephone analogy could really help you understand how TCP works. Most of us know that before you speak to someone on a phone, you must first establish a connection with that other person—wherever they are. This is like a virtual circuit with the TCP protocol. If you were giving someone important information during your conversation, you might say, “You know?” or ask, “Did you get that?” Saying something like this is a lot like a TCP acknowledgment— it’s designed to get you verification. From time to time (especially on cell phones), people also ask, “Are you still there?” They end their conversations with a “Goodbye” of some kind, putting closure on the phone call. TCP also performs these types of functions.
Alternately, using UDP is like sending a postcard. To do that, you don’t need to contact the other party first. You simply write your message, address the postcard, and mail it. This is analogous to UDP’s connectionless orientation. Since the message on the postcard is probably not a matter of life or death, you don’t need an acknowledgment of its receipt. Similarly, UDP does not involve acknowledgments.
