Download ch13

Chapter 13
Ethernet and TCP/IP Networking
13.1 (BL1+) Obviously there are a lot of possible answers to this question. Here are some of the most
probable student choices:
ftp: file transfer protocol; used to move files from one system to another
smtp: simple mail transfer protocol; used by mail servers to relay mail messages; by mail clients to
send mail to a mail server
pop3: post office protocol; used by a mail client to receive mail messages from a mail server
imap: internet message access protocol; used by a mail client to receive mail messages from a mail
server
ssh: secure shell; used to connect to a server securely
finger: finger user information protocol; used to retrieve information about a user from a remote
system
rtp: real-time transport protocol; used to deliver streaming audio and video over the Internet
It should be noted that ping is NOT an application level protocol; rather, it is a utility connected to
ICMP, which is an IP level protocol used for providing control information on a netowrk.
13.2 (BL2) The DNS is arranged in a hierarchy, similar to a directory tree, with a root at the top. Each
member of the tree consists of a server or cluster of servers whose contents consist of a directory of
IP addresses representing entry points for the next lower level on the hierarchy. The IP addresses
are used to access the directory servers at the next lower level. A DNS search involves working
down the tree until the entry containing the desired IP address is obtained.
13.3 (BL2) An authoritative domain server is one that holds officially registered domain names with the
corresponding addresses for the domain host and its subdomain hosts, if any. As such it represents
the last lookup required to determine the IP address for a particular domain name.
A local domain DNS server is simply a server responsible for locating a required IP address and
serving it to a DNS client, and then to the HTTP client application.
13.4 (BL1+) The DNS root server is the master directory for the entire Internet. The root server contains
IP address entries for each of the top-level domains, both generic and country-code.
13.5 (BL2-) One obtains a URL from one of a number of registrars authorized to assign domain names
by the Internet Corporation for Assigned Names and Numbers (ICANN).
13.6 (BL2) A large site will have many IP addresses associated with a single domain name. The DNS
database will maintain a list of all the IP addresses for the domain name, and will respond to a
request with the entire list. However, the list will be ordered differently for each request. Assuming
that a DNS client normally accepts the IP address at the top of the list, the IP addresses used will be
distributed approximately evenly over a large number of requests, providing load balancing.
13.7 (BL3) This problem requires external research, since it goes beyond the discussion in the text.
Data in TCP flows in both directions, therefore each TCP header has both a sequence number and
an acknowledgment number, which operate identically. Considering only one direction, the sender
generates a random 32-bit number and places it in the header of the packet that is used to establish
the connection. This number establishes a starting point for the data to follow. The connection
packet uses the first number, so the starting point number actually starts at the next larger number.
All the data that follows is numbered by byte, starting from the pre-established starting point. Each
subsequent packet contains a sequence number that corresponds to the byte number of the first byte
in the packet. Thus, the receiving TCP knows exactly how many bytes should have been received
prior to receipt of this packet, as well as the sequence order of each packet.
In acknowledgment, the receiving TCP sends the number of the last byte successfully received,
plus one. This corresponds to the next byte that it expects to receive, which allows the sender to
determine errors and missing packets, and to resend those packets.
13.8 (BL2-) The IP datagram requires separate fields for header-length and total length because both the
header and the data fields are of variable size. The header size can vary between 20 and 60 bytes,
and the data can vary between 0 and 65515 (i.e. 65535 minus the minimum header) bytes.
13.9 (BL2) IP domain addresses are assigned in batches, rather than as a single IP address. Thus, part of
a 32-bit IP address identifies the domain, the remainder of the bits in the address identify a
particular host within the domain network. An IP address mask allows separation of the domain
part of the IP address from the individual host address within the network.
The address 222.44.66.88/24 indicates that the first 24 bits of the address are the domain, the
remaining eight bits identify the host address within the network. The domain is thus 222.44.66.nn,
where nn is any address from 0 to 255. This mask indicates that the IP address supports a network
of up to 256 machines. The particular machine in this case is machine 88.
Similarly, the address 200.40.60.80/26 indicates that the domain is 26 bits long; the domain
identifier is thus 200.40.60.[the first two bits of the last octet]. Since the given address is 80, the
host address must begin with 01, (i.e. 0 x 128 + 1 x 64) and therefore the domain address is
200.40.60.64. The remaining six bits support 64 addressable hosts, with IP addresses ranging from
200.40.60.64 to 200.40.60.127.
13.10 (BL2) A DHCP lease is an agreement in which a network node, or client, negotiates and accepts an
IP address from a DHCP server for a fixed period of time. The DHCP server contains a pool of IP
addresses for this purpose. When the lease expires, the client must either negotiate for extension or
renewal of the lease or must stop using the leased IP address. This process is known as dynamic
address allocation.
13.11 (BL2+) The purpose of the Address Resolution Protocol is to establish a match between an IP
address and a MAC address. Communication at the data link layer requires the use of physical
addresses. To obtain the physical address corresponding to an IP address, the sender broadcasts an
ARP request packet to all the nodes on the network. The ARP request packet contains the sending
node's IP address and physical address, plus the IP address for which the physical address is
requested. All nodes receive the request, but the node with the corresponding IP address is the only
one to respond. It sends an ARP response packet with its MAC address directly to the sender's
physical address. The sending node will cache the matching pair of addresses for a period of time
to eliminate the need to repeat the ARP request for subsequent packets with the same destination
address.
13.12 (BL3) Note: this is a difficult problem. The successful transmission of data requires that any
combination of bits be transmittable as data. If a particular sequence of bits is used as a
synchronization sequence, then there must be a way to distinguish the synchronization sequence
from an identical bit pattern within the data. This concept is called transparency. The usual way is
to have the sending system modify the pattern when it is seen in the data sequence by augmenting a
subset of the sequence with a bit that makes the pattern different. This technique is called bit
stuffing. (Neither transparency nor bit stuffing are defined in the book.) For example, the data
pattern 11001001 could be changed to 110010010 every time it occurs. This guarantees that the
pattern 110010011 can never occur in the transmitted data. The actual data pattern 110010011
would be transmitted as 1100100101. At the receiving end, the extra bit is removed, and the
original data is restored. There are other subsets that could be used. Bit stuffing and unstuffing take
place at the data link layer, since these processes are directly concerned with the physical
transmission of data between the nodes.
13.13(BL2+) The fundamental concepts incorporated in ALOHANet are very similar to those of
Ethernet. Each allows a station to initiate a request at any time the channel is open. Each requires
the transmitting station to listen to the channel for collisions. When a collision occurs, each
requires a station to cease transmission and to wait a random amount of time before attempting
transmission again. The primary differences between ALOHANet and Ethernet are in the medium,
in the signaling method, and in the distances between stations. Ethernet is multidrop bus based,
using digital signaling. ALOHANet is radio based, using analog signaling. This difference is not
important operationally. The distance between stations is a more serious consideration. Because
the distances are large, there is a considerable length of time during which a collision is possible.
This means that collisions are more likely, lowering performance capability. ALOHANet could be
expected to perform satisfactorily under light traffic conditions, but unsatisfactorily when traffic is
heavy.
13.14 (BL2) The primary use for bus-based Ethernet operation is in wireless networking, where the
nature of the medium makes this methodology necessary. Bus-based Ethernet is also occasionally
used for short term temporary networking when a network switch is not readily available. In older
systems, bus-based Ethernet is occasionally seen because the cost of a hub used to be much less
expensive than the cost of a switch, but this is no longer the case.
Bus-based Ethernet requires that all nodes share the bus; thus the speed of the bus is, at best,
inversely proportional to the number of nodes. With collisions, the actual speed may be somewhat
less; in the worst case, traffic can make the network essentially unavailable. There is also an
inherent6 security issue, since all traffic on the bus is available throughout the bus, making packet
sniffing easy.
Therefore, except for wireless networking, most modern systems use switched Ethernet. Switched
Ethernet provides full connection speed to every pair of communicating nodes, eliminates collision
and traffic issues, and makes packet sniffing more difficult.
13.15. This is a project exercise.
13.16 (BL2+) Since only the token holder may place a message on the bus, the possibility of a collision is
eliminated. Furthermore, an NIU is guaranteed access to the bus to transmit a message regardless
of the level of traffic and the maximum delay before access is granted can be calculated. Every
NIU must be able to access the bus before any other NIU gets repeat access. In contrast,
performance of a CSMA/CD-based Ethernet bus deteriorates rapidly with increasing traffic,
because the probability of collisions increases as more NIUs attempt to access the bus and fail,
causing multiple retries. Therefore, under heavy network loads, the token bus approach is
preferable because it provides an orderly approach to the use of the bus.
Under light load, the 5token bus introduces unnecessary delays because of the overhead. To access
the bus, an NIU has to wait for the token to be passed around, even if no other NIU is attempting to
access the bus. Thus, CSMA/CD is preferable under light loads.
13.17 (BL3) This is a research exercise, with a number of possible solutions. One viable solution is to
use the Internet as a wide area network, with each branch and the headquarters connected to the
Internet through an appropriately sized connection to an ISP. It is also possible to use one of the
alternative technologies presented in Chapter 12 illustrated in the discussion of MANs and WANs,
and revisited in Section 13.8 of the text.
13.19 (BL2) TCP offers a reliable connection for the transmission of messages. Messages are transmitted
as virtual byte streams, in both directions. UDP transmits packets independently, with no guarantee
of delivery and minimal error checking. UDP also limits packet size to the size of a UDP packet,
since each packet is independent with no method for sequencing multiple packets that fcontain an
extended message. As such, TCP is strongly preferred for this type of communication.
11.20 (BL3) QoS is concerned primarily with the consistent and smooth transmission of streaming data
requiring high bandwidth, such as video or high quality audio. The necessary "qualities" for this
capability are sufficient bandwidth, preferential treatment for the packets that make up the stream,
and consistent time delay from packet to packet.
One approach is to transmit the packets over virtual circuits, with priorities built in to the circuits
that allow streaming packets first access to the circuits. This approach is utilized in such protocols
as ATM. It is not suitable for normal Internet use, because the Internet is based on packet
switching, and there are limited means for controlling priorities at the various routers. An
alternative approach is to use the upgraded facilities offered by some Internet services, and known
as differentiated service. In DS, an application establishes a class of service, and routes packets
through routers that are designed to prioritize packet transmission on the basis of a DS field set by
the application.
These methods may be categorized as similar attempts to reserve and prioritize channel capacity
for packets requiring QoS. In addition, contracts with carrier services may be designed to include
guarantees of throughput, delay, and jitter.
13.21 (BL3) In network security, nonrepudiation is defined as the ability of the receiver of a message to
prove that the sender did, indeed, send the message, so that a sender cannot deny that (s)he actually
sent a message. To establish nonrepudiation, it is necessary to establish both message
authentication and message integrity. Authentication verifies the identities of both sender and
recipient; message integrity assures that the message received is the same as the message sent, i.e.
the message has not been tampered with or altered during transmission through the network.
In a typical business scenario, authentication verifies the identity of someone making an online
purchase of a product from a seller. Nonrepudiation makes it possible for the seller to verify that
the buyer actually ordered the product; this prevents the buyer from making a claim later that (s)he
did not actually order the product, and refusing to pay for the product.
13.22 (BL2+) This is a laboratory project. Among other features that a student should note about ,
WireShark are the following:
WireShark can distinguish and sort packets from different sources, from different network
applications.
WireShark can reassemble packets into messages.
WireShark can decrypt a substantial percentage of packets that are not well encrypted.
These capabilities and others make it possible to read a sender's messages. The security
implications are obvious: stolen passwords that allow access to supposedly secure systems, stolen
identities that can be used to undermine a person's financial stability and privacy, stolen trade
secrets and work, and much more.