TCP/IP Suite Dr. Amer ElKhairy Department of Computer Networking Princess Noura University Communications Software Communications Software Network Operating System (NOS) Provides error checking, message formatting, communications logs, data security and privacy, and translation capabilities for networks. Systems software that controls the computer systems and devices on a network and allows them to communicate with each other. Network Management Software Enables a manager on a networked desktop to monitor the use of individual computers and shared hardware, scan for viruses, and ensure compliance with software licenses. 33 Protocols Rules that ensure communications among computers of different types and from different manufacturers. Rules that determine the form of signal being transmitted, encoded, error detection and correction, etc. 5-3 Protocols TCP/IP The protocol suite for the Internet Transmission Control Protocol (TCP) Internet Protocol (IP) Provides a reliable byte-stream transfer service between two endpoints on an internet Defines a delivery mechanism for packets of data sent between all systems on an Internet Widely used by business, even for internal networks Standard originally developed by the U.S. government to link defense research agencies; it is the primary communication protocol of the Internet. 5-4 Protocol (Idea) Protocol (Idea) Host Host Application Channel Host Application Host Host Protocol (Idea) Application programs Process-to-process channels Host-to-host connectivity Hardware Protocol (Idea) Application programs Request/reply Message stream channel channel Host-to-host connectivity Hardware When and how to start a channel? When and how to close a channel? How to protect the channel against invasion? How to handle multiple applications? Applications Linking Personal Computers to Mainframe Computers Voice Mail Download and upload information. Enables users to leave, receive, and store verbal messages for and from other users. Electronic Mail (e-mail) Enables a sender to connect a computer to a network, type messages, and send it to another person on the network. 39 Applications Electronic Software Distribution Involves installing software on a file server for users to share by signing onto the network and requesting that the software be downloaded onto their computers over a network. Electronic Document Distribution Transporting documents -- such as sales reports, policy manuals, and advertising brochures -- over communications lines and networks. 40 Telecommunications Applications Videoconferencing 41 How the Internet Works Protocol Backbone A protocol that operates at the transport layer and is used in combination with IP by most Internet applications It ensures that computers in Internet can understand the message sending among each others. One of the Internet’s high-speed, long distance communications links. IP Address/Port IP address is the unique identification on a computer that is connecting to the Internet. Ports are the input/output locations of a computer where messages should send in or out. If an IP address is analogy to a country, then the Port addresses will be analogy to the ports of that country. TCP/IP PROTOCOL SUITE The layers in the TCP/IP protocol suite do not exactly match those in the OSI model. The original TCP/IP protocol suite was defined as having four layers: host-to-network, internet, transport, and application. However, when TCP/IP is compared to OSI, we can say that the TCP/IP protocol suite is made of five layers: physical, data link, network, transport, and application. TCP/IP Transmission control Protocol/Internet Protocol Developed by DARPA No official protocol standard Can identify five layers Application Host-to-Host (transport) Internet Network Access Physical OSI & TCP/IP Models TCP/IP Protocol Suite Application Presentation Session Transport TELNET FTP SMTP DNS SNMP DHCP RIP RTP RTCP Transmission Control Protocol User Datagram Protocol OSPF ICMP IGMP Internet Protocol Network ARP / RARP Data link Physical Ethernet Token Bus Token Ring FDDI The Upper Layers OSI TCP / IP Application (Layer7) Presentation (Layer6) Session (Layer 5) Session Presentation Application Application The Session Layer The Session layer permits two parties to hold ongoing communications called a session across a network. Not found in TCP/IP model In TCP/IP its characteristics are provided by the TCP protocol. (Transport Layer) The Presentation Layer The Presentation Layer handles data format information for networked communications. This is done by converting data into a generic format that could be understood by both sides. Not found in TCP/IP model In TCP/IP, this function is provided by the Application Layer. e.g. External Data Representation Standard (XDR) Multipurpose Internet Mail Extensions (MIME) The Application Layer The Application Layer is the top layer of the reference model. It provides a set of interfaces for applications to obtain access to networked services as well as access to the kinds of network services that support applications directly. OSI TCP/IP - FTAM,VT,MHS,DS,CMIP - FTP,SMTP,TELNET,DNS,SNMP Although the notion of an application process is common to both, their approaches to constructing application entities is different. Approaches use in constructing application entities The diagram below provides an overall view on the methods use by both the OSI and TCP/IP model. ISO Approach Sometime called Horizontal Approach OSI asserts that distributed applications operate over a strict hierarchy of layers and are constructed from a common tool kit of standardized application service elements. In OSI, each distributed application service selects functions from a large common “toolbox” of application service element (ASEs) and complements these with application service elements that perform functions specific to given end-user service . TCP/IP Approach Sometime called Vertical Approach In TCP/IP, each application entity is composed of whatever set of function it needs beyond end to end transport to support a distributed communications service. Most of these application processes builds on what it needs and assumes only that an underlying transport mechanism (datagram or connection) will be provided. Transport Layer OSI TCP / IP Transport (Layer 4) Transport (TCP/UDP) The functionality of the transport layer is to provide “transparent transfer of data from a source end open system to a destination end open system” (ISO / IEC 7498: 1984). Transport Layer Transport is responsible for creating and maintaining the basic end-to-end connection between communicating open systems, ensuring that the bits delivered to the receiver are the same as the bits transmitted by the sender; in the same order and without modification, loss or duplication OSI Transport Layer It takes the information to be sent and breaks it into individual packets that are sent and reassembled into a complete message by the Transport Layer at the receiving node Also provide a signaling service for the remote node so that the sending node is notified when its data is received successfully by the receiving node Transport Layer protocols include the capability to acknowledge the receipt of a packet; if no acknowledgement is received, the Transport Layer protocol can retransmit the packet or time-out the connection and signal an error OSI Transport Layer Transport protocols can also mark packets with sequencing information so that the destination system can properly order the packets if they’re received out-of-sequence In addition, Transport protocols provide facilities for insuring the integrity of packets and requesting retransmission should the packet become garbled when routed. Transport protocols provide the capability for multiple application processes to access the network by using individual local addresses to determine the destination process for each data stream. TCP/IP Transport Layer Defines two standard transport protocols: TCP and UDP TCP implements a reliable data-stream protocol UDP implements an unreliable data-stream connectionless UDP is useful in many applications connection oriented e.g. Where data needs to be broadcasted or multicasted Primary difference is that UDP does not necessarily provide reliable data transmission TCP/IP Transport Layer Many programs will use a separate TCP connection as well as a UDP connection TCP/IP Transport Layer: UDP User Datagram Protocol. Its status is standard and almost every TCP/IP implementation intended for small data units transfer or those which can afford to lose a little amount of data (such as multimedia streaming) will include UDP. UDP is basically an application interface to IP. It adds no reliability, flow-control, or error recovery to IP. It simply serves as a multiplexer/demultiplexer for sending and receiving datagrams, using ports to direct the datagrams. TCP/IP Transport Layer: UDP TCP/IP Transport Layer: UDP UDP provides a mechanism for one application to send a datagram to another. The UDP layer can be regarded as being extremely thin and consequently has low overheads, but it requires the application to take responsibility for error recovery and so on. Applications sending datagrams to a host need to identify a target that is more specific than the IP address, since datagrams are normally directed to certain processes and not to the system as a whole. UDP provides this by using ports. UDP datagram format Each UDP datagram is sent within a single IP datagram. Although, the IP datagram may be fragmented during transmission, the receiving IP implementation will reassemble it before presenting it to the UDP layer. All IP implementations are required to accept datagrams of 576 bytes, which means that, allowing for maximumsize IP header of 60 bytes, a UDP datagram of 516 bytes is acceptable to all implementations. Many implementations will accept larger datagrams, but this is not guaranteed. The UDP datagram has a 8-byte. UDP datagram format UDP datagram format Be aware that UDP and IP do not provide guaranteed delivery, flow-control, or error recovery, so these must be provided by the application. Standard applications using UDP include: Trivial File Transfer (TFTP) Domain Name System name server (DNS) Remote Procedure Call (RPC) Network File System (NFS) Simple Network Management Protocol (SNMP TCP/IP Transport Layer: TCP Transmission Control Protocol. Its status is standard, and in practice every TCP/IP implementation that is not used exclusively for routing will include TCP. TCP provides considerably more facilities for applications than UDP. Specifically, this includes error recovery, flow control, and reliability. TCP is a connection-oriented protocol, unlike UDP, which is connectionless. Most of the user application protocols, such as Telnet and FTP, use TCP. The two processes TCP/IP Transport Layer: TCP The two processes communicate with each other over a TCP connection (Inter-Process Communication - IPC). TCP/IP Transport Layer: TCP The primary purpose of TCP is to provide a reliable logical circuit or connection service between pairs of processes. It does not assume reliability from the lower-level protocols (such as IP), so TCP must guarantee this itself. TCP can be characterized by the following facilities it provides for the applications using it: TCP/IP Transport Layer: TCP Stream Data Transfer: From the application's viewpoint, TCP transfers a contiguous stream of bytes through the network. The application does not have to bother with chopping the data into basic blocks. TCP does this by grouping the bytes into TCP segments, which are passed to the IP layer for transmission to the destination. TCP itself decides how to segment the data, and it can forward the data at its own convenience. Sometimes, an application needs to be sure that all the data passed to TCP has actually been transmitted to the destination. Byte Stream Service To the lower layers, TCP handles data in blocks, the segments. To the higher layers TCP handles data as a sequence of bytes and does not identify boundaries between bytes. 40 TCP/IP Transport Layer: TCP Reliability: TCP assigns a sequence number to each byte transmitted, and expects a positive acknowledgment (ACK) from the receiving TCP layer. If the ACK is not received within a timeout interval, the data is retransmitted. Since the data is transmitted in blocks (TCP segments), only the sequence number of the first data byte in the segment is sent to the destination host. The receiving TCP uses the sequence numbers to rearrange the segments when they arrive out of order, and to eliminate duplicate segments. TCP/IP Transport Layer: TCP Flow Control: The receiving TCP, when sending an ACK back to the sender, also indicates to the sender the number of bytes it can receive (beyond the last received TCP segment) without causing overrun and overflow in its internal buffers. This is sent in the ACK in the form of the highest sequence number it can receive without problems. This mechanism is also referred to as a windowmechanism. Multiplexing: Achieved through the use of ports, just as with UDP. TCP/IP Transport Layer: TCP Logical Connections: The reliability and flow control mechanisms require that TCP initializes and maintains certain status information for each data stream. The combination of this status, including sockets, sequence numbers and window sizes, is called a logical connection. Each connection is uniquely identified by the pair of sockets used by the sending and receiving processes. Full Duplex: TCP provides for concurrent data streams in both directions. TCP: Three-Way Handshake With reliable TCP sessions, before a host can send information to another host, a handshake process must take place to establish the connection. TCP: The window principle A simple transport protocol might use the following principle: send a packet and then wait for an acknowledgment from the receiver before sending the next packet. If the ACK is not received within a certain amount of time, retransmit the packet. TCP: The window principle Use of ACK TCP: The window principle TCP allows the regulation of the flow of segments, ensuring that one host doesn’t flood another host with too many segments, overflowing its receiving buffer. TCP uses a sliding windowing mechanism to assist with flow control. For example, if the window size is 1, a host can send only one segment and must then wait for a corresponding acknowledgment before sending the next segment. If the window size is 20, a host can send 20 segments and must wait for the single acknowledgment of the sent 20 segments before sending 20 additional segments. TCP: The window principle TCP: The window principle TCP: The window principle The window size is determined by the receiver when the connection is established and is variable during the data transfer. Each ACK message will include the window size that the receiver is ready to deal with at that particular time. Remember that TCP will block bytes into segments, and a TCP segment only carries the sequence number of the first byte in the segment. TCP: The window principle A: Bytes that are transmitted and have been acknowledged. B: Bytes that are sent but not yet acknowledged. C: Bytes that can be sent without waiting for any acknowledgment. D: Bytes that cannot be sent yet. TCP Format TCP segments have a 20 byte header with >= 0 bytes of data. IP header TCP header 20 bytes TCP data 20 bytes 0 15 16 Source Port Number 31 Destination Port Number Sequence number (32 bits) header length 0 Flags window size TCP checksum urgent pointer Options (if any) DATA 52 20 bytes Acknowledgement number (32 bits) TCP segment format Source Port: The 16-bit source port number, used by the receiver to reply. Destination Port: The 16-bit destination port number. Sequence Number: The sequence number of the first data byte in this segment. If SYN bit is set, this is the initial sequence number (ISN) and the first data byte is ISN+1. Acknowledgment Number: If the ACK control bit is set, this field contains the value of the next sequence number that the receiver is expecting to receive. Data Offset: The number of 32-bit words in the TCP header. It indicates where the data begins. TCP segment format Reserved: Six bits reserved for future use; must be zero. URG: Indicates that the urgent pointer field is significant in this segment. ACK: Indicates that the acknowledgment field is significant in this segment. PSH: tells the receiver to pass this data to the application as soon as possible (Flush). RST: Resets the connection. SYN: synchronize sequence number to initiate a connection . FIN: No more data from sender (Final). TCP segment format Window: Used in ACK segments. It specifies the number of data bytes, beginning with the one indicated in the acknowledgment number field that the receiver is willing to accept. Checksum: The 16-bit one's complement of the one's complement sum of all 16-bit words in a pseudo-header, the TCP header, and the TCP data. While computing the checksum, the checksum field itself is considered zero. Urgent Pointer: Points to the first data octet following the urgent data. Only significant when the URG control bit is set. TCP segment format Options: Just as in the case of IP datagram options, options can be either: – A single byte containing the option number – A variable length option in the following TCP header fields Options: End of Options kind=0 1 byte NOP (no operation) kind=1 1 byte Maximum Segment Size Window Scale Factor Timestamp kind=2 len=4 maximum segment size 1 byte 1 byte 2 bytes kind=3 len=3 shift count 1 byte 1 byte 1 byte kind=8 len=10 timestamp value timestamp echo reply 1 byte 1 byte 4 bytes 4 bytes 57 TCP header fields Options: NOP is used to pad TCP header to multiples of 4 bytes Maximum Segment Size Window Scale Options Increases the TCP window from 16 to 32 bits, I.e., the window size is interpreted differently This option can only be used in the SYN segment (first segment) during connection establishment time Timestamp Option Can be used for roundtrip measurements 58 TCP/IP Transport Layer: Ports & Sockets TCP and UDP introduce the concepts of ports and sockets. The concepts of the port and socket are needed to determine which local process at a given host actually communicates with which process, at which remote host, using which protocol. Each process that wants to communicate with another process identifies itself to the TCP/IP protocol suite by one or more ports. TCP/IP Transport Layer: Ports A port is a 16-bit number, used by the host-to-host protocol to identify to which higher level protocol or application program (process) it must deliver incoming messages. Port numbers fall under three types: Well-known Registered Dynamically assigned TCP/IP Transport Layer: Ports Well-known: These port numbers range from 0 to 1023 and are assigned by the Internet Assigned Number Authority (IANA) to applications commonly used on the Internet. Registered: These port numbers range from 1024 to 49,151 and are assigned by IANA for proprietary applications, such as Microsoft SQL Server, Oracle, and many others. Dynamically assigned: These port numbers range from 49,152 to 65,535 and are dynamically assigned by the operating system to use for a session. TCP/IP Transport Layer: Ports A few examples of applications (and their ports) that use TCP: HTTP (80), FTP (21), SMTP (25), and telnet (23). A few examples of UDP applications, along with their assigned port numbers: DNS queries (53), SNMP (161), and TFTP (69). TCP/IP Transport Layer: Sockets The socket interface is one of several application programming (API) interfaces to the communication protocols. Designed to be a generic communication programming interface, socket APIs were first introduced by 4.2 Berkeley Software Distribution (BSD). Although it has not been standardized, Berkeley socket API has become a de facto industry standard abstraction for network TCP/IP socket implementation. Consider the following terminologies: A socket address is the triple: <protocol, local-address, local port> TCP/IP Transport Layer: Sockets For example, in the TCP/IP (version 4) suite: <TCP, 192.168.14.234, 8080> A conversation is the communication link between two processes. An association is the 5-tuple that completely specifies the two processes that comprise a connection: <protocol, local-address, local-port, foreign-address, foreign-port> In the TCP/IP (version 4) suite, the following could be a valid association: <TCP, 192.168.14.234, 1500, 192.168.44, 22> TCP/IP Transport Layer: Sockets A half-association is either: <protocol, local-address, local-process> or <protocol, foreign-address, foreign-process> which each specify half of a connection. The half-association is also called a socket or a transport address. That is, a socket is an endpoint for communication that can be named and addressed in a network. Addresses, Ports and Sockets • Like apartments and mailboxes – – – – – You are the application Your apartment building address is the address Your mailbox is the port The post-office is the network The socket is the key that gives you access to the right mailbox Types of Sockets • Two different types of sockets : stream vs. datagram • Stream socket :( a. k. a. connection- oriented socket) It provides reliable, connected networking service Error free; no out- of- order packets (uses TCP) applications: telnet, http, … • Datagram socket :( a. k. a. connectionless socket) It provides unreliable, best- effort networking service Packets may be lost; may arrive out of order (uses UDP) applications: streaming audio/ video (Realplayer), … Client – high level view Create a socket Setup the server address Connect to the server Read/write data Shutdown connection Server – high level view Create a socket Bind the socket Listen for connections Accept new client connections Read/write to client connections Shutdown connection structurestructure Ipv4Hostent socket address struct hostent{ { struct socketaddr_in char /*official name of host*/ uint8_t * h_name sin_len; /*length of the structure (16)*/ char ** h_aliases; /* pointer ot array of\ int connect_ socket( char *hostname, int port) { sa_falimily_t sin_family /* AF_INT*/ pointers aliasport name*/ in_port_t sin_port /* 16 bit TCP ortoUDP number*/ int sock; int h_addrtype /* host address type*/ struct in_addr sin_addr /* 32 bit Ipv4 address */ struct sockaddr_in sin; h_length /* length of address */ charint sin_zero(8)/* unused*/ char ** h_addr_list /*prt to array of ptrs with \ struct hostent *host; } IPv4 or IPv6 address*/ sock = socket( AF_ INET, SOCK_ STREAM, 0); } if (sock == -1) return sock; host = gethostbyname( hostname); if (host == NULL) { close( sock); return -1; } Socket(int family , int type, in t protocol); return nonnegative value for OK, -1 for error Resolve the host struct hostent *gethostbyname( const char *hostname); /*Return nonnull pointer if OK, NULL on error */ connect(int socketfd, const struct sockaddr * servaddr, memset (& sin, 0, sizeof( sin)); socket_t addrlen) sin. sin_ family = AF_ INET; /*Perform the TCP three way handshaking*/ sin. sin_ port = htons( port); sin. sin_ addr. s_ addr = *( unsigned long *) host-> h_ addr_ list[ 0]; unit16_t htons(unit16_t host16bitvaule) /*Change the port number from host byte if (connect( sock, (struct sockaddr *) &sin, sizeof( sin)) != 0) { network byte order */ close (sock); return -1; } return sock; } Listening on a port (TCP) int make_ listen_ socket (int port) { struct sockaddr_ in sin; int sock; sock = socket( AF_ INET, SOCK_ STREAM, 0); Make the socket if (sock < 0) return -1; memset(& sin, 0, sizeof(sin)); sin. sin_family = AF_ INET; Setup up the struct sin. sin_addr. s_addr = htonl(INADDR_ANY); sin. sin_port = htons( port); if (bind( sock, (struct sockaddr *) &sin, sizeof( sin)) < 0) Bind return -1; return sock; bind(int sockfd, const struct sockaddr * myaddr, socklen_t addrlen); /* return 0 if OK, -1 on error } assigns a local protocol adress to a socket*/ Accepting a client connection (TCP) int get_ client_ socket( int listen_socket) { struct sockaddr_ in sin; int sock; int sin_ len; memset(&sin, 0, sizeof(sin)); Setup up the struct sin_ len = sizeof(sin); sock = accept(listen_socket, (struct sockaddr *) &sin, &sin_ len); Accept the client connection return sock; } accept(int sockefd, struct sockaddr * claddr, socklen_t * addrlen) /* return nonnegative descriptor if OK, -1 on error return the next completed connection from the front of the completed connection queue. if the queue is empty, the process is put to sleep(assuming blocking socket)*/ Sending / Receiving Data With a connection (SOCK_STREAM): int count = send(sock, &buf, len, flags); int count = recv(sock, &buf, len, flags); count: # bytes transmitted (-1 if error) buf: char[], buffer to be transmitted len: integer, length of buffer (in bytes) to transmit flags: integer, special options, usually just 0 count: # bytes received (-1 if error) buf: void[], stores received bytes len: # bytes received flags: integer, special options, usually just 0 Calls are blocking [returns only after data is sent (to socket buf) / received] socket() bind() TCP Client Socket() connect() Connection establishment write() TCP Server Well-known port listen() accept() blocks until connection from client read() process request read() close() write() read() close() Comparing Transport for both Models The features of UDP and TCP defined at TCP/IP Transport Layer correspond to many of the requirements of the OSI Transport Layer. There is a bit of bleed over for requirements in the session layer of OSI since sequence numbers, and port values can help to allow the Operating System to keep track of sessions, but most of the TCP and UDP functions and specifications map to the OSI Transport Layer. Comparing Transport for both Models The TCP/IP and OSI architecture models both employ all connection and connectionless models at transport layer. However, the internet architecture refers to the two models in TCP/IP as simply “connections” and “datagrams.” But the OSI reference model, with its penchant for “precise” terminology, uses the terms connection-mode and connection-oriented for the connection model and the term connectionless-mode for the connectionless model. Network vs. Internet OSI TCP / IP Network (Layer 3) Internet TCP/IP Internet Layer An Internet is an interconnection of two or more networks Internet layer handles tasks similar to network access layer, but between networks rather than between nodes on a network Uses IP for addressing and routing across networks Implemented in workstations and routers Internet Layer TCP/IP supports the Internetworking Protocol. IP uses four supporting protocols : ARP, RARP, ICMP, and IGMP. IP (Internetworking Protocol) ARP (Address Resolution Protocol) RARP (Reverse Address Resolution Protocol) ICMP (Internet Control Message Protocol) IGMP (Internet Group Message Protocol) Network vs. Internet Internet (IP) Addresses The internet network address is more commonly called the “IP address.” It consists of 32 bits, some of which are allocated to a high-order network-number part and the remainder of which are allocated to a low-order host-number part. The distribution of bits - how many form the network number, and how many are therefore left for the host number - can be done in one of three different ways, giving three different classes of IP address Internetworking Interconnected networks, usually implies TCP/IP Can appear to users as a single large network The global Internet is the largest example, but intranets and extranets are also examples Internetworking Addresses Addresses Figure 2.18 Relationship of layers and addresses in TCP/IP Physical and Data Link Layers At the physical and data link layers, TCP/IP does not define any specific protocol. It supports all the standard and proprietary protocols. A network in a TCP/IP internetwork can be a localarea network or a wide-area network. De-jure vs. De-facto (OSI) OSI Standard legislated by official recognized body. (ISO) The OSI reference model was devised before the protocols were invented. This ordering means that the model was not biased toward one particular set of protocols, which made it quite general. The down side of this ordering is that the designers did not have much experience with the subject and did not have a good idea of which functionality to put in which layer. Being general, the protocols in the OSI model are better hidden than in the TCP/IP model and can be replaced relatively easily as the technology changes. Not so widespread as compared with TCP/IP. (complex , costly) More commonly used as teaching aids. De-jure vs. De-facto (TCP/IP) TCP/IP Standards adopted due to widespread use. (Internet) The protocols came first, and the model was really just a description of the existing protocols. There was no problem with the protocols fitting the model, but it is hardly possible to be use to describe other models. “Get the job done" orientation. Over the years it has handled most challenges by growing to meet the needs. More popular standard for internetworking for several reasons : relatively simple and robust compared to alternatives such as OSI available on virtually every hardware and operating system platform (often free) the protocol suite on which the Internet depends. Getting the Data Through the Internet Layer 3 protocols are primarily designed to move data from one local network to another local network within an internetwork. Layer 3 addresses must include identifiers that enable intermediary network devices to locate hosts on different networks At the boundary of each local network, an intermediary network device, usually a router, decapsulates the frame to read the destination host address contained in the header of the packet, the Layer 3 PDU Routers use the network identifier portion of this address to determine which path to use to reach the destination host. 88 Getting Data to the End Device The host physical address, is contained in the header of the Layer 2 PDU, called a frame. Layer 2 is concerned with the delivery of messages on a single local network. The Layer 2 address is unique on the local network and represents the address of the end device on the physical media. In a LAN using Ethernet, this address is called the Media Access Control (MAC) address. When two end devices communicate on the local Ethernet network, the frames that are exchanged between them contain the destination and source MAC addresses. 89 Getting Data to the End Device Once a frame is successfully received by the destination host, the Layer 2 address information is removed as the data is decapsulated and moved up the protocol stack to Layer 3. 90