UNIT name: TCP and UDP protocols
o AIM of the unit
The Student understands of TCP and UDP differences and …..
o What are the PRIOR knowledge for unit – concepts what must be covered
before
ISO/OSI model
IP protocol
o Theory (HTML text - possible with links to outside material and simple
flash)
1. Standard
The Transport layer provides transparent transfer of data between end users
(applications) as data flow. This protocol is dealing with sessions, data fragmentation
into packets, error and flow control etc
(http://en.wikipedia.org/wiki/OSI_model#Layer_4:_Transport_Layer).
TCP and UDP are Transport Layer protocols from TCP/IP protocol family
(http://en.wikipedia.org/wiki/TCP/IP_reference_model).
TCP is defined in
- RFC 0793 - http://www.graphcomp.com/info/rfc/rfc0793.html
UDP is defined in
- RFC 0768 - http://www.graphcomp.com/info/rfc/rfc0768.html
2. TCP
The Transmission Control Protocol (TCP) is intended for use as a highly reliable hostto-host (process-to-process) protocol between hosts in packet-switched computer
communication networks, and in interconnected systems of such networks (RFC
0793). TCP is making a reliable connection, dealing with data transfer, flow control
and multiplexing.
Data transfer means, it takes data from one application, makes packets and giving it
to next layer (IP) for routing thorough network to another application (host). Packets
are numbered, so in the destination host TCP collects packets back together and gives
data flow back to destination application.
TCP data transfer is full duplex within one connection and applications can open
multiple connections between each other served by TCP. Connection is initiated from
client side and acknowledged by server, using different ports to identify applications.
Reliability is ensured by giving sequence numbers to packets and by feedback
(acknowledgements) of receiving each portion (window) of data within timeout. If
there is no feedback of receiving any portion of data, corresponding packets will be
sent again, or application is noticed about connection lost. To assure correctness a
checksum field is included in the TCP packets.
TCP uses a number of mechanisms, called flow control, to achieve high performance
and avoiding 'congestion collapse'. These mechanisms control the rate of data entering
the network, keeping the data flow below a rate that would trigger collapse.
Sessions between applications can be in different states
(http://en.wikipedia.org/wiki/Transmission_Control_Protocol#Protocol_operation) as
it will be controlled like follows:
CLIENT
SERVER
SYN
SYN ACK
ACK
-- Session is established -Data
Ack
Data
Ack
Data
Ack
-- Data exchange in Full Duplex mode is happening --- If hosts are not using a session -FIN
ACK
FIN
ACK
-- Session is closed --
If there is no Acknowledgement received, host is trying to retransmit data. If there is
no data transmission happening any more, session is closed by TCP after some time
or as applications finishing themselves. If applications need to keep session alive, they
need to notice TCP. If connection is lost, both hosts are keeping session in idle status
for some time.
Examples of timeout in different situations:
Timeout timer
UNIX BSD values in seconds
Retransmission timer dynamic
Persistence timer
5
Quiet timer
30
Keep-alive timer
45
Idle timer
360
Additional material:
- http://hhi.corecom.com/tcp-ftpsession.htm
- http://en.wikipedia.org/wiki/Path_MTU_discovery
3. UDP
User Datagram Protocol (UDP) is not making a session as TCP for data transmission,
but it is used by applications to send short messages sometimes known as datagrams
(using Datagram Sockets) to one another, not data streams. As there is no sessions in
UDP, there is no sequence numbers of packets and also acknowledgements to ensure
reliability.
UDP is useful for servers that answer small queries from huge numbers of clients, like
DNS service. Compared to TCP, UDP is required also for broadcast (send to all on
local network) and multicast (send to all subscribers), like VoIP, IPTV etc.
Read more: http://en.wikipedia.org/wiki/User_Datagram_Protocol
4. Packet headers
TCP Header:
Field
Size
Source port
16b
Destination port
16b
Sequence number
32b
Ack number
32b
Offset
4b
Reserved
6b
Flags
6b
Window
16b
Checksum
16b
Urgent Pointer
16b
Opt
…
DATA
...
Source:
http://en.wikipedia.org/wiki/Transmission_Control_Protocol#TCP_segment_structure
Source port - This field identifies the sending port.
Destination port - This field identifies the receiving port.
Sequence number - The sequence number has a dual role. If the SYN flag is present
then this is the initial sequence number and the first data byte gets the presented
sequence number plus 1. Otherwise if the SYN flag is not present then the first data
byte is the sequence number.???
Acknowledgement number - If the ACK flag is set then the value of this field is the
sequence number that the sender of the acknowledgement expects next.
Data offset - This 4-bit field specifies the size of the TCP header in 32-bit words.
The minimum size header is 5 words and the maximum is 15 words thus giving the
minimum size of 20 bytes and maximum of 60 bytes. This field gets its name from the
fact that it is also the offset from the start of the TCP packet to the data.
Reserved - 4-bit reserved field for future use and should be set to zero.
Flags (aka Control bits)
CWR - Congestion Window Reduced (CWR) flag is set by the sending host to
indicate that it received a TCP segment with the ECE flag set
ECE - tcp peer is ECN capable during 3-way handshake
URG - Urgent pointer field is significant
ACK - Acknowledgement field is significant
PSH - Push function
RST - Reset the connection
SYN - Synchronize sequence numbers
FIN - No more data from sender
Window - The number of bytes the sender is willing to receive starting from the
acknowledgement field value
Checksum - The 16-bit checksum field is used for error-checking of the header and
data.
UDP header
Field
Size
Source port
16b
Destination port
16b
Length
16b
Checksum
16b
DATA
...
Source: http://en.wikipedia.org/wiki/User_Datagram_Protocol#Packet_structure
Source port - This field identifies the sending port when meaningful and should be
assumed to be the port to reply to if needed. If not used, then it should be zero.
Destination port - This field identifies the destination port and is required.
Length - A 16-bit field that specifies the length in bytes of the entire datagram:
header and data. The minimum length is 8 bytes since that's the length of the header.
The field size sets a theoretical limit of 65,527 bytes for the data carried by a single
UDP datagram.
Checksum - The 16-bit checksum field is used for error-checking of the header and
data.
5. Ports
There are well known (common), registered and free ports. But actually there is not a
problem, if any application is identifying itself with some other port number as long
as clients are aware of that. So if there is HTTP server (www.some.host) identified
with port 8080, clients should initiate a connection thorough address
http://www.some.host:8080.
Most known applications (services) and port numbers:
Port
Service
23
Telnet
25
SMTP
53
DNS
80
HTTP
110
POP3
137-139
Netbios
143
IMAP
443
HTTPS
445
SMB
993
IMAP over SSL
995
POP3 over SSL
Source: http://en.wikipedia.org/wiki/TCP_and_UDP_port_numbers
Ports are identifying different applications in one host. There can be opened different
sessions thorough one port of the host (like web server is connected to multiple clients
at the same time), but there must be one (and only one) application which is using one
port and operating with the data going thorough it.
There are utilities for investigating opened ports of node in the network and also what
applications are using them. Such as NETSTAT, TCPVIEW for internal investigation
and different PORT SCANNERS for investigating thorough network.
o Attachments (Videos, Simulations etc – describe!!!)
NO
o Quiz (best is 1…x right answers of 3…6 choices, may be different quizzes –
for self-learning and grading)
1. UDP packet header has in it:
a. IP numbers
b. MAC addressess
c. data
d. port number (x)
e. checksum (x)
2. TCP packets belong to ... layer
a. data link
b. network
c. transport (x)
d. application
3. TCP protocol is
a. addressing network packets
b. addressing transmission frames
c. addressing applications (x)
4. UDP protocol is
5.
6.
7.
8.
25
53
80
110
143
443
...
a. reliable
b. session oriented
c. datagram oriented (x)
In the windows host you can check opened ports and sessions with command
a. ping
b. tracert
c. netstat (x)
d. arp
TCP protocol is
a. reliable (x)
b. session oriented (x)
c. half-duplex
TCP provides
a. one connection per port
b. multiple applications per port
c. one application per port (x)
d. multiple connections per port (x)
Connect common ports and services
a. IMAP
b. HTTP
c. POP3
d. SMTP
e. HTTPS
f. DNS
SMTP
DNS
HTTP
POP3
IMAP
HTTPS