Basic concepts of networks

Basic concepts of networks

Devices

In order to understand the explanation of protocols and ports, it is necessary for you to

become familiar with the icons that represent the most common devices that are seen in the

basic schemes. These are:

Topologies

With these devices, local area networks (or LANs) can be created. In a LAN, computers can

share resources, such as hard drives, printers and internet connections, and an administrator

can control how these resources are shared. When a LAN is being designed, it is possible to

choose any of the following physical topologies:

In a bus topology, all the computers are connected to a single means of transmission, and

each computer can communicate directly with any of the others. In the ring configuration,

each computer is connected to the following one, and the last one to the first, and each

computer can only communicate directly with the two adjacent computers. In the star

topology, none of the computers are directly connected with others. Instead they are

connected through a central point and the device at that central point is responsible for

relaying information from computer to computer. If several central points are connected to

each other, an extended star topology is obtained. In a star or extended star topology, all the

central points are peers, that is, each exchanges information on an equal basis. However, if

you connect two star or extended star networks together using a central point which controls

or limits the exchange of information between the two networks, then you have created a

single, hierarchical network topology.

TCP/IP model

Introduction

TCP/IP was developed by the DoD (Department of Defense) of the United States and DARPA

(Defense Advanced Research Project Agency) in the 1970s. TCP/IP was designed to be an

open standard that anyone could use to connect computers together and exchange

information between them. Ultimately, it became the basis for the Internet.

Layers

The TCP/IP model defines four totally independent layers into which it divides the process of

communication between two devices. The layers through which it passes information

between two devices are:

Application

The application layer is the layer nearest the end user. This is the layer that is in charge of

translating data from applications into information that can be sent through the network.

The basic functions of this layer are:

- Representation

- Codification

- Dialog Control

- Application Management

Transport

The transport layer establishes, maintains and finishes virtual circuits for information transfer. It

provides control mechanisms for data flow and allows broadcasting, and it provides

mechanisms for the detection and correction of errors. The information that arrives at this

layer from the application layer is divided into different segments. Information that comes to

the transport layer from the internet layer is delivered back to the application layer through

ports.

3 – PORTS AND PROTOCOLS

The basic functions of this layer are:

- Reliability

- Flow Control

- Error Correction

- Broadcasting

Internet

This layer divides the segments of the transport layer into packets and sends the packets

across the networks that make up the Internet. It uses IP, or internet protocol addresses to

determine the location of the recipient device. It does not ensure reliability in the

connections, because this is already taken care of by the transport layer, but it is responsible

for selecting the best route between the originating device and the recipient device.

Network Access

This layer is in charge of sending information at both the LAN level and the physical level. It

transforms all the information that arrives from the superior layers into basic information (bits)

and directs it to the proper location. At this level, the destination of the information is

determined by the MAC, or media access control, address of the recipient device.

Protocols

To be able to send information between two devices, both must speak the same language.

This language is called the protocol.

The protocols that appear in the application layer of the TCP/IP model are:

- File Transfer Protocol (FTP)

- Hypertext Transfer Protocol (HTTP)

- Simple Mail Transfer Protocol (smtp)

- Domain Name Service (DNS)

- Trivial File Transfer Protocol (TFTP)

The protocols of the transport layer are:

- Transport Control Protocol (TCP)

- User Datagram Protocol (UDP)

The protocols of the internet layer are:

- Internet Protocol (IP)

The protocol most often used in the network access layer is:

- Ethernet

The protocols listed above and their associated ports will be described in the following

sections.

LESSON 3 – PORTS AND PROTOCOLS

Application layer protocols

FTP or file transfer protocol is used for the transmission of files between two devices. It uses TCP

to create a virtual connection for the control of information, then creates another connection

to be used for the delivery of data. The most commonly used ports are 20 and 21.

HTTP or hypertext transfer protocol is used to translate information into web pages. This

information is distributed in a manner similar to that used for electronic mail. The most

commonly used port is 80.

SMTP or simple mail transfer protocol is a mail service that is based on the FTP model. It

transfers electronic mail between two systems and provides notifications of incoming mail. The

most commonly used port is 25.

DNS or domain name service provides a means to associate a domain name with an ip

address. The most commonly used port is 53.

TFTP or trivial file transfer protocol has the same functions as FTP but uses UDP instead of TCP.

This gives it more speed, but less security and trustworthiness. The most commonly used port is 69.

Transport layer Protocols

There are two protocols which can be used by the transport layer to deliver information

segments.

TCP or transmission control protocol establishes a logical connection between the final points

of the network. It synchronizes and regulates the traffic with what is known as the "Three Way

Handshake". In the “Three Way Handshake,” the originating device sends an initial packet

called a SYN to the recipient device. The recipient device sends an acknowledgment

packet, called a SYN/ACK. The originating device then sends a packet called an ACK, which

is an acknowledgment of the acknowledgment. At this point, both the originating device

and the recipient device have established that there is a connection between the two and

both are ready to send and receive data to and from each other.

UDP or user datagram protocol is a transport protocol which is not based on a connection. In

this case, the originating device sends packets without warning the recipient device to

expect these packets. It is then up to the recipient device to determine whether or not those

packets will be accepted. As a result, UDP is faster that TCP, but it cannot guarantee that a

packet will be accepted.

Internet layer Protocols

IP or internet protocol serves as a universal protocol to allow any two computers to

communicate through any network at any time. Like UDP, it is connectionless, because it does

not establish a connection with the remote computer. Instead, it is what is known as a best

effort service, in that it will do whatever is possible to ensure that it works correctly, but its

reliability is not guaranteed. The Internet Protocol determines the format for the packet

headers, including the IP addresses of both the originating and the recipient devices.

IP Addresses

A domain name is the web address that you normally type into a web browser. That name

identifies one or more IP addresses. For example, the domain name microsoft.com represents

about a dozen IP addresses. Domain names are used in URLs to identify particular Web pages.

For example, in the URL http://www.google.com, the domain name is

google.com.

Every domain name has a suffix that indicates which top level domain (TLD) it belongs to.

There are only a limited number of such domains. For example:

.gov - Government agencies

.edu - Educational institutions

.org - Organizations (nonprofit)

.com - Commercial Business

.net - Network organizations

Because the Internet is based on IP addresses, not domain names, every Web server requires

a Domain Name System (DNS) server to translate domain names into IP addresses.

IP Addresses are the identifiers that are used to differentiate between computers and other

devices that are connected to a network. Each device must have a different IP address, so

that there are no problems of mistaken identity within the network. IP addresses consist of 32

bits that are divided in four 8 bit octets which are separated by dots. Part of the IP address

identifies the network, and the remainder of the IP address identifies the individual computers

on the network.

There are both public and private IP addresses. Private IP addresses are used by private

networks that have no connection with outside networks. IP addresses within a private

network should not be duplicated within that network, but computers on two different – but

unconnected – private networks could have duplicated IP addresses. The IP addresses that

are defined by IANA, the Internet Assigned Numbers Authority, as being available for private

networks are:

10.0.0.0 through 10.255.255.255

172.16.0.0 through 172.31.255.255

192.168.0.0. through 192.168.255.255

IP addresses are divided into classes based on what portion of the address is used to identify

the network and what portion is used to identify the individual computers.

Depending on the size assigned to each part, more devices will be allowed within the

network, or more networks will be allowed. The existing classes are:

- Class A: The first bit is always zero, so this class includes the addresses between 0.0.0.0

and 126.255.255.255. Note: the addresses of 127.x.x.x are reserved for the services of

loopback or localhost.

- Class B: The first two bits of the first octet are '10', so this class includes the addresses

between 128.0.0.0 and 191.255.255.255.

- Class C: The first three bits of the first octet are '110', so this class includes the

addresses between 192.0.0.0 and 223.255.255.255.

- Class D: The first four bits of the first octet are '1110', so this class includes the

addresses between 224.0.0.0 and 239.255.255.255. These addresses are reserved for

group multicast implementations.

- The remaining addresses are used for experimentation or for possible future

allocations.

At this time, the classes are not used to differentiate between the part of the address used to

identify the network and the part used to identify the individual devices. Instead, a mask is

used. In the mask, a '1' binary bit represents the part containing the network identification and

a '0' binary bit represents the part that identifies the individual devices. Therefore, to identify a

device, in addition to the IP address, it is necessary to specify a network mask:

IP: 172.16.1.20

Mask: 255.255.255.0

IP addresses 127.x.x.x are reserved to be used as loopback or local host addresses, that is,

they refer directly back to the local computer. Every computer has a local host address of

127.0.0.1, therefore that address cannot be used to identify different devices. There are also

other addresses that cannot be used. These are the network address and the broadcast

address.

The network address is an address in which the part of the address which normally identifies

the device is all zeros. This address cannot be used, because it identifies a network and can

never be used to identify a specific device.

IP: 172.16.1.0

Mask: 255.255.255.0

The broadcast address is an address in which the part of the address which normally identifies

the device is all ones. This address cannot be used to identify a specific device, because it is

the address that is used to send information to all of the computers that belong to the

specified network.

IP: 172.16.1.255

Mask: 255.255.255.0

Ports

Both TCP and UDP use ports to exchange information with applications. A port is an extension

of an address, similar to adding an apartment or room number to a street address. A letter

with a street address will arrive at the correct apartment building, but without the apartment

number, it will not be delivered to the correct recipient. Ports work in much the same way. A

packet can be delivered to the correct IP address, but without the associated port, there is

no way to determine which application should act on the packet.

Once the ports have been defined, it is possible for the different types of information that are

sent to one IP address to then be sent to the appropriate applications. By using ports, a

service running on a remote computer can determine what type of information a local client

is requesting, can determine the protocol needed to send that information, and maintain

simultaneous communication with a number of different clients.

For example, if a local computer attempts to connect to the website www.osstmm.org,

whose IP address is 62.80.122.203, with a web server running on port 80, the local computer

would connect to the remote computer using the socket address :

62.80.122.203:80

In order to maintain a level of standardization among the most commonly used ports, IANA

has established that the ports numbered from 0 to 1024 are to be used for common services.

The remaining ports – up through 65535 – are used for dynamic allocations or particular

services.

Encapsulation

When a piece of information – an e-mail message, for example – is sent from one computer to

another, it is subject to a series of transformations. The application layer generates the data,

which is then sent to the transport layer. The transport layer takes this information and adds a

header to it. This header contains information, such as the IP addresses of the originating and

recipient computers, that explains what must be done to the data in order to get it to the

appropriate destination. The next layer adds yet another header, and so on. This recursive

procedure is known as encapsulation.

Each layer after the first makes its data an encapsulation of the previous layer's data, until you

arrive at the final layer, in which the actual transmission of data occurs. The following figure

explains encapsulation in a graphic form:

When the encapsulated information arrives at its destination, it must then be deencapsulated.

As each layer receives information from the previous layer, it removes the

unneeded information contained in the header placed there by the previous layer.