The TCP/IP Suite
TCP/IP (Transmission Control Protocol/Internet Protocol) is the basic communication
language or protocol of the Internet. It can also be used as a communications protocol
in the private networks called Intranets and in extranets. When you are set up with
direct access to the Internet, your computer is provided with a copy of the TCP/IP
program just as every other computer that you may send messages to or get
information from also has a copy of TCP/IP.
Common mistake by a lot of people is to think that TCP/IP is only one protocol. It is
important to understand that TCP/IP is not one protocol, even tho we refer to it as one,
it is a suite of protocols combined together to create one “package” of protocols which
we call for simplicity reasons, TCP/IP.
The TCP/IP Protocol is based on the 7 Layer OSI model, and all the various protocols
which TCP/IP consist of, work in different layers of this 7 Layer OSI Model. This
gives each protocol some unique characteristics and allows us to use them for
different purposes. Below is a figure demonstrating the 7 Layer OSI Model on which
we will be using to analyse the various protocols which make up TCP/IP.
Also noted are the Request For Comments numbers for each protocol standard, which
we will be associating to each protocol we analyse.
7 Layer OSI
Various TCP/IP Protocols
RFC’s
Application
Presentation
Session
Transport
Network
FTP
ARP TFTP RIP v2
TCP UDP DNS
ICMP
IP SMTP
TELNET
RFC 1782
RFC 1723
RFC 1035
RFC 1363
DataLink
Physical
In this report we will be analysing approximately 20 protocols which are based on
TCP/IP. These protocols have been chosen randomly, amongst many others.
We should note that most RFC’s become obsolete by newer ones, making it a bit
difficult to track the latest RFC for a specific protocol.
FTP is one of the most popular protocols around, it was designed, as the name
suggests, for file transfers. As a user, you can use FTP with a simple command line
interface (for example, from the Windows MS-DOS Prompt window) or with a
commercial program that offers a graphical user interface.
Your Web browser can also make FTP requests to download programs you select
from a Web page. Using FTP, you can also update (delete, rename, move, and copy)
files at a server. You need to log on to an FTP server. However, publicly available
files are easily accessed using anonymous FTP.
Protocol Name
FTP
Protocol used
TCP
Port Number
21
RFC #
959
TFTP (Trivial File Transfer Protocol) is a network application that is simpler than the
File Transfer Protocol (FTP) but less capable. It is used where user authentication and
directory visibility are not required.
Protocol Name
TFTP
Protocol used
UDP
Port Number
69
RFC #
1350
Telnet is the way you can access someone else's computer, assuming they have given
you permission. (Such a computer is frequently called a host computer.) More
technically, Telnet is a user command and an underlying TCP/IP protocol for
accessing remote computers. The Web or HTTP protocol and the FTP protocol allow
you to request specific files from remote computers, but not to actually be logged on
as a user of that computer. With Telnet, you log on as a regular user with whatever
privileges you may have been granted to the specific applications and data on that
computer.
Protocol Name
Telnet
Protocol used
TCP
Port Number
23
RFC #
854
The Hypertext Transfer Protocol (HTTP) is the set of rules for exchanging files (text,
graphic images, sound, video, and other multimedia files) on the World Wide Web.
Relative to the TCP/IP suite of protocols (which are the basis for information
exchange on the Internet), HTTP is an application protocol.
.
Protocol Name
Protocol used
Port Number
RFC #
HTTP
TCP
80
1945
The domain name system (DNS) is the way that Internet domain names are located
and translated into IP (Internet Protocol) addresses. A domain name is a meaningful
and easy-to-remember "handle" for an Internet address.
Because maintaining a central list of domain name/IP address correspondences would
be impractical, the lists of domain names and IP addresses are distributed throughout
the Internet in a hierarchy of authority. There is probably a DNS server within close
geographic proximity to your access provider that maps the domain names in your
Internet requests or forwards them to other servers in the Internet.
Protocol Name
DNS
Protocol used
TCP-UDP
Port Number
53
RFC #
1101
SMTP (Simple Mail Transfer Protocol) is a TCP/IP protocol used in sending and
receiving e-mail. However, since it's limited in its ability to queue messages at the
receiving end, it's usually used with one of two other protocols, POP3 or IMAP, that
let the user save messages in a server mailbox and download them periodically from
the server. In other words, users typically use a program that uses SMTP for sending
e-mail and either POP3 or IMAP for receiving messages that have been received for
them at their local server
Protocol Name
SMTP
Protocol used
TCP
Port Number
25
RFC #
821
POP3 (Post Office Protocol 3) is the most recent version of a standard protocol for
receiving e-mail. POP3 is a client/server protocol in which e-mail is received and held
for you by your Internet server. Periodically, you (or your client e-mail receiver)
check your mail-box on the server and download any mail. POP3 is built into the
Netmanage suite of Internet products and one of the most popular e-mail products,
Eudora. It's also built into the Netscape and Microsoft Internet Explorer browsers.
Protocol Name
POP3
Protocol used
TCP
Port Number
110
RFC #
1939
IMAP (Internet Message Access Protocol) is a standard protocol for accessing e-mail
from your local server. IMAP (the latest version is IMAP4) is a client/server protocol
in which e-mail is received and held for you by your Internet server. You (or your email client) can view just the heading and the sender of the letter and then decide
whether to download the mail.
You can also create and manipulate folders or mailboxes on the server, delete
messages, or search for certain parts or an entire note. IMAP requires continual access
to the server during the time that you are working with your mail.
Protocol Name
IMAP
Protocol used
TCP
Port Number
143
RFC #
1730
The Network File System (NFS) is a client/server application that lets a computer user
view and optionally store and update files on a remote computer as though they were
on the user's own computer. The user's system needs to have an NFS client and the
other computer needs the NFS server.
Both of them require that you also have TCP/IP installed since the NFS server and
client use TCP/IP as the program that sends the files and updates back and forth
Protocol Name
NFS
Protocol used
UDP & TCP
Port Number
111
RFC #
1094
Socks (or "SOCKS") is a protocol that a proxy server can use to accept requests from
client users in a company's network so that it can forward them across the Internet.
Socks uses sockets to represent and keep track of individual connections. The client
side of Socks is built into certain Web browsers and the server side can be added to a
proxy server.
A socks server handles requests from clients inside a company's firewall and either
allows or rejects connection requests, based on the requested Internet destination or
user identification. Once a connection and a subsequent "bind" request have been set
up, the flow of information exchange follows the usual protocol (for example, the
Web's HTTP protocol).
Protocol Name
SOCKS v5
Protocol used
TCP
Port Number
1080
RFC #
1928
ICMP is a message control and error-reporting protocol between a host server and a
gateway to the Internet. ICMP uses Internet Protocol (IP) datagrams, but the messages
are processed by the IP software and are not directly apparent to the application user.
Protocol Name
ICMP
Protocol used
ICMP
Port Number
N/A
RFC #
792
The Internet Protocol (IP) is the method or protocol by which data is sent from one
computer to another on the Internet. Each computer (known as a host) on the Internet
has at least one address that uniquely identifies it from all other computers on the
Internet. When you send or receive data (for example, an e-mail note or a Web page),
the message gets divided into little chunks called packets. Each of these packets
contains both the sender's Internet address and the receiver's address. Any packet is
sent first to a gateway computer that understands a small part of the Internet.
That gateway then forwards the packet directly to the computer whose address is
specified.
Protocol Name
IP
Protocol used
N/A
Port Number
N/A
RFC #
791
OSPF (Open Shortest Path First) is a routing protocol used within larger autonomous
networks in preference to the Routing Information Protocol (RIP), an older routing
protocol that is installed in many of today's corporate networks. Like RIP, OSPF is
designated by the Internet Engineering Task Force (IETF) as one of several Interior
Gateway Protocols (IGPs).
Using OSPF, a host that obtains a change to a routing table or detects a change in the
network immediately multicasts the information to all other hosts in the network so
that all will have the same routing table information. Unlike the RIP in which the
entire routing table is sent, the host using OSPF sends only the part that has changed.
With RIP, the routing table is sent to a neighbor host every 30 seconds. OSPF
multicasts the updated information only when a change has taken place.
Protocol Name
OSPF
Protocol used
IP
Port Number
N/A
RFC #
2328
SNMP is the protocol governing network management and the monitoring of network
devices and their functions. It is not necessarily limited to TCP/IP networks
Protocol Name
SNMP
Protocol used
UDP
Port Number
161
RFC #
1161
ARP (Address Resolution Protocol) is a protocol for mapping an Internet Protocol
address (IP address) to a physical machine address that is recognized in the local
network. For example, in IP Version 4, the most common level of IP in use today, an
address is 32 bits long. In an Ethernet local area network, however, addresses for
attached devices are 48 bits long. A table, ARP cache, is used to maintain a
correlation between each MAC address and its corresponding IP address. ARP
provides the protocol rules for making this correlation and providing address
conversion in both directions
Protocol Name
Protocol used
Port Number
RFC #
ARP
IP
N/A
826
RARP (Reverse Address Resolution Protocol) is a protocol by which a physical
machine in a local area network can request to learn its IP address from a gateway
server's Address Resolution Protocol (ARP) table or cache.
Protocol Name
RARP
Protocol used
IP
Port Number
N/A
RFC #
903
NNTP (Network News Transfer Protocol) is the predominant protocol used by
computers (servers and clients) for managing the notes posted on Usenet newsgroups.
NNTP replaced the original Usenet protocol, UNIX-to-UNIX Copy Protocol (UUCP)
some time ago. NNTP servers manage the global network of collected Usenet
newsgroups and include the server at your Internet access provider. An NNTP client
is included as part of a Netscape, Internet Explorer, Opera, or other Web browser or
you may use a separate client program called a newsreader.
Protocol Name
NNTP
Protocol used
TCP
Port Number
119
RFC #
997
UUCP (UNIX-to-UNIX Copy Protocol) is a set of UNIX programs for copying
(sending) files between different UNIX systems and for sending commands to be
executed on another system.
Protocol Name
UUCP
Protocol used
TCP
Port Number
540
RFC #
976
DHCP (Dynamic Host Configuration Protocol) is a protocol that lets network
administrators manage centrally and automate the assignment of Internet Protocol (IP)
addresses in an organization's network. Using the Internet's set of protocols (TCP/IP),
each machine that can connect to the Internet needs a unique IP address.
When an organization sets up its computer users with a connection to the Internet, an
IP address must be assigned to each machine. Without DHCP, the IP address must be
entered manually at each computer and, if computers move to another location in
another part of the network, a new IP address must be entered. DHCP lets a network
administrator supervise and distribute IP addresses from a central point and
automatically sends a new IP address when a computer is plugged into a different
place in the network.
Protocol Name
DHCP
Protocol used
UDP
Port Number
67(Sever) & 68(Client)
RFC #
1541
BOOTP (Bootstrap Protocol) is a protocol that lets a network user be automatically
configured (receive an IP address) and have an operating system booted or initiated
without user involvement. The BOOTP server, managed by a network administrator,
automatically assigns the IP address from a pool of addresses for a certain duration of
time. BOOTP is the basis for a more advanced network manager protocol, the
Dynamic Host Configuration Protocol (DHCP).
Protocol Name
BOOTP
Protocol used
UDP
Port Number
67(Sever) & 68(Client)
The End
RFC #
951