• View
• Edit
• History
• Print

Chapter 7: Transport Layer

7.0 Transportation Layer

7.0.1 Introduction >7.0.1.1 Introduction

Upon completion of this chapter you will be able to:

• Describe the purpose of the transport layer in managing the transportation of data in end-to -end communication.
• Describe the characteristics of the TCP and UDP protocols, including port numbers and their uses.
• Explain how TCP session establishment and termination processes facilitate reliable communication.
• Explain how TCP protocol data units are transmitted and acknowledged to guarantee delivery.
• Describe the UDP client processors to establish communications with a server.
• Determine whether high reliability TCP transmissions or non-guaranteed UDP transmissions are best suited for common applications.

7.0.1 Introduction >7.0.1.2 Class Activity - We need to talk - Game:

The image on this page shows a single computer that has multiple web pages open along with an instant messaging window, an e-mail application, a streaming video application and a VoIP phone application running. This represents that a computer typically has more than one process running any one time.

While completing this activity think about how:

• Network communications have different levels of importance
• Important data must be accurate when sent and received
• Timing can be a factor when choosing a data delivery method

Objectives:

7.1 Transport Layer protocols

7.1.1 Transportation of Data >7.1.1.1 Role of the Transport Layer

The figure on this page shows the four layers of the TCP/IP model and how it enables applications on devices to communicate. The figure highlights the Transport layer, which is responsible for moving data between applications on devices in the network. The transport layer on the sending device corresponds with the transport layer of the receiving device.

The Transport layer moves data between applications on devices in the network.

7.1.1 Transportation of Data >7.1.1.2 Role of the Transport Layer (Cont.)

Figure 1 on this page shows a single computer that has multiple web pages open along with an instant messaging window, an e-mail application, a streaming video application and a VoIP phone application running. This represents that a computer typically has more than one process running at any one time.

The description for this figure is, "The transport layer tracks each individual conversation flowing between a source application and a destination application separately."

Figure 2 on this page shows a series of data blocks being transmitted to the computer. The data blocks are of varying colors which correspond to different services.

The description for this figure is, "The Transport Layer divides the data into segments that are easier to manage and transport."

Figure 3 on this page shows the computer sending the packages to the proper application, the web browser, the e-mail client, the streaming video application or the VoIP phone. Each application has a specific data block color. This represents the computer sorting the data based on application.

The description for this figure is, "The Transport layer ensures that even with multiple applications running on a device, all applications receive the correct data."

7.1.1 Transportation of Data >7.1.1.3 Conversation multiplexing:

The figure on this page shows a single computer that has multiple web pages open along with an instant messaging window, an e-mail application, a streaming video application and a VoIP phone application running. There is a series of data blocks of varying colors that represent the various applications running on the computer. The series of blocks are created by the transport layer breaking the data into segments, and each block is a segment. This is multiplexing where multiple applications can use the network at the same time. Each data block can have error checking performed on it to check if the segment was changed during transmission.

The benefits of multiplexing are:

• Segmentation allows conversations multiplexing – multiple applications can use the network at the same time.
• Segmentation facilitates data transport by the lower network layers.
• Error checking can be formed on the data in the segmented to check if the segment was changed during transmission.

7.1.1 Transportation of Data >7.1.1.4 Transport layer reliability

The figure on this page shows the four layers of the TCP/IP model and lists protocols that work at each of the layers.

Application layer protocols:

• FTP, HTTP (www), SMTP (email), DNS, and TFTP

Transport layer protocols:

• TCP
• UDP

Internet layer protocols:

• IP

Network Access layer protocol:

• LAN connections
• WAN connections.

7.1.1 Transportation of Data >7.1.1.5 TCP

The animation on this page shows a computer sending a file to a server using the FTP application, which utilizes TCP at the transport layer.

A file is sent to a server using the File Transfer Protocol (FTP) application. TCP tracks the conversation and segments the data to be sent into 6 segments. The first three out of six segments are forwarded to the server. The file server acknowledges the first three segments received. The client forwards the next three segments. No segments are received, no acknowledgement is sent. The client resends the final three segments. The final three segments are received and acknowledged.

7.1.1 Transportation of Data >7.1.1.6 UDP

The animation on this page shows a computer sending a file to a server using the TFTP application, which utilizes the UDP at the transport layer.

A file is sent to a server using the Trivial File Transfer Protocol (TFTP) application. UDP segments the data to be sent and sends all data, best-effort. The file server receives all 6 segments, no acknowledgement is sent.

7.1.1 Transportation of Data >7.1.1.7 The Right Transport Layer Protocol for the Right Application

The figure on this page shows the four layers of the TCP/IP model and focuses on the transport layer. When a service is sending data it must select between UDP and TCP at the transport layer. The figure shows a list of what each protocol offers. UDP is used for IP telephony and streaming video. TCP is used for email and HTTP.

UDP should be selected when the service requires:

• Fast delivery
• Low overhead
• No acknowledgement
• No resending of data
• Data delivered as it arrives

TCP should be selected when the service requires:

• Reliable transfer of data
• Acknowledgements of receipt of data
• Resending of lost packets
• Delivery of data in the order it is sent.

The description for this figure is, "Application developers choose the appropriate Transport layer protocol based on the nature of the application."

7.1.2 Introducing TCP and UDP >7.1.2.1 Introducing TCP

The figure on this page shows a single computer that has multiple web pages open along with an instant messaging window and an e-mail application running.

Four core services provided by TCP are:

• Establishing a session ensures the application is ready to receive the data.
• Same order delivery ensures that the segments are reassembled into the proper order.
• Reliable delivery means lost segments are resent so the data is received complete.
• Flow control manages data delivery if there is congestion on the host.

7.1.2 Introducing TCP and UDP >7.1.2.2 Role of TCP

The figure on this page shows a TCP segment and all of the overhead data it carries. This includes:

7.1.2 Introducing TCP and UDP >7.1.2.3 Introducing UDP

The figure on this page shows characteristics of UDP. These include:

• No Ordered Data Reconstruction; Data is reconstructed in the order that it is received.
• Connectionless; No session establishment.
• No Flow Control; No congestion management.
• Unreliable Delivery; Any segments lost are not resent.

7.1.2 Introducing TCP and UDP >7.1.2.4 Role of UDP

The figure on this page shows a UDP datagram and the limited data that it carries. The only data in the datagram are:

7.1.2 Introducing TCP and UDP >7.1.2.5 Separating Multiple Communications

The figure on this page shows a computer with three different applications open and the port number associated with each:

7.1.2 Introducing TCP and UDP >7.1.2.6 TCP and UDP Port Addressing

The figure on this page shows a computer with three different applications open and the port number associated with each. Below each application is the specific protocol in use and the transport layer adds the proper port number to form the segment:

The description for this figure is, "Data for different applications is directed to the correct application because each application has a unique port number.".

7.1.2 Introducing TCP and UDP >7.1.2.7 TCP and UDP Port Addressing (Cont.)

The figure on this page shows the location of the source and destination port numbers within a segment. The figure is showing a computer that has both an active FTP session and a web session. When data is meant for the FTP server the computer selects a random source port value above 1023 and assigns 21 to the destination port. In the figure the source port used is 1305. The IP address and the port number create the socket and this allows the computer to keep track of the FTP data.

FTP connection IP packet:

The web traffic also uses a random source port above 1023, and in the figure it is using port 1099. The data destined for the web server is assigned a destination port of 80, which is the port used by web servers. The IP address and the port number create the socket and this allows the computer to keep track of the web server connection.

Web connection IP packet:

7.1.2 Introducing TCP and UDP >7.1.2.8 TCP and UDP Port Addressing (Cont.)

Figure 1 on this page shows the three ranges used for port numbers:

Figure 2 on this page lists some common well known ports and their services.

Figure 3 lists two common well known UDP ports and three registered UDP ports.

Figure 4 lists three services that use both TCP and UDP in the well-known port range.

7.1.2 Introducing TCP and UDP >7.1.2.9 TCP and UDP port addressing (Cont.)

The four figures on this page show the following output from the command-line utility netstat with the last row of each column highlighted in each figure:

C:\> netstat

Active Connections

C:\>

• Figure 1 shows the first column highlighted and listing the protocol in use during the current connection to the local machine, in the example it is TCP.
• Figure 2 shows the second column highlighted and listing the source port used for the current connections, and in the example port 3166 has a current connection running.
• Figure 3 shows the first part of the third column highlighted and listing the foreign address used for the connection, and in the example the foreign address is www.cisco.com.
• Figure 4 shows the second part of the third column highlighted and listing the destination port. In the example, it is listed as http.
• Figure 5 shows the fourth column highlighted and listing the state of the connection. In the example the connection is in the ESTABLISHED state.

7.1.2 Introducing TCP and UDP >7.1.2.10 TCP and UDP segmentation

The figure on this page shows a large amount of data being segmented into 3 separate segments, and it shows the difference between a TCP segment and a UDP segment:

UDP Datagram:

UDP header provides for:

• Source and destination (ports)

TCP header provides for:

• Source and destination (ports)
• Sequencing for same order delivery
• Acknowledgement of received segments
• Flow control and congestion management

The description for this figure is, "The transport layer divides the data into pieces and adds a header for delivery over the network.".

7.1.2 Introducing TCP and UDP >7.1.2.11 Activity compare TCP and UDP characteristics

The interactive activity on this page has the learner classify a list of characteristics as either being a TCP delivery method or a UDP delivery method.

The list of characteristics is:

• Less Overhead
• Fast Transmission Requirements
• No Acknowledgement of Receipt
• Guaranteed Delivery
• Ordered Delivery
• Connectionless
• Sequenced Message Segments
• No Ordered Delivery
• Flow Control
• Session Establishment

The figure also has the following 2 buttons:

• Check
• Reset

7.2 TCP and UDP

7.2.1 TCP Communication >7.2.1.1 TCP Reliable Delivery

The animation on this page shows a computer connected to a router, which connects to the Internet and has a web server in the cloud. The animation shows the computer using TCP to send a connection request to the server at the transport layer of the TCP/IP model. The server accepts the connection, also at the transport layer, which then completes the connection set-up process.

7.2.1 TCP Communication >7.2.1.2 TCP Server Processes

Figure 1 on this page shows a server running both an HTTP server on port 80 and SMTP server running on port 25. The figure has two clients accessing the server.

This demonstrates how port numbers are used to differentiate between multiple services running on one server.

Figure 2 on this page highlights the use of the well-known port numbers as the destination port.

Figure 3 on this page highlights the use of random port numbers as the source port.

Figure 4 on this page highlights the response from the server to each of the two requests and the fact that the server uses the source port from the request packet as the destination port.

Figure 5 on this page highlights the fact that the server uses the destination port from the request packet as the source port.

7.2.1 TCP Communication >7.2.1.3 Connection Establishment and Termination

The figure on this page shows the steps involved in the three-way handshake during a TCP connection establishment.

Step 1 shows the initiating client, Client A forming a SYN packet with a sequence number of 100 and sends the SYN request to Client B.

CTL = Which control bits in the TCP header are set to 1. A sends SYN to B.

Step 2 shows Client B receiving the SYN and setting the sequence number to 300 and sending the SYN along with an ACK packet back to Client A.

B sends ACK response and SYN request to A.

Step 3 shows Client A receiving the SYN and ACK sent by Client B, this establishes the connection.

A sends ACK response to B.

7.2.1 TCP Communication >7.2.1.4 TCP Three way Handshake Analysis - Step 1

The figure on this page shows step one of the three-way handshake process. Here a P-CAP file output from the protocol analyzer Wireshark is shown. This figure highlights the formation of the SYN packet because the SYN flag is set. The source port is a random number and is 1061 and the destination port is 80, an HTTP server.

Flags: 0x02 (SYN)
.... .... ..1. = Syn: Set

The description for this figure is:

7.2.1 TCP Communication >7.2.1.5 TCP Three way Handshake Analysis - Step 2

The figure on this page shows step two of the three-way handshake process, and is another P-CAP file. This is the packet being sent from the server back to the requesting client. In this packet the ACK flag is set indicating that the acknowledgement number is significant. The SYN flag is set to indicate the Initial Sequence Number for the server to the client session. The destination port is set to 1061, which corresponds to the random port set by the client and the source port is set to 80 indicating the web server service.

Flags: 0x12 (SYN, ACK)
.... .... ..1. = Syn: Set

The description for this figure is:

7.2.1 TCP Communication >7.2.1.6 TCP Three way Handshake Analysis - Step 3

Figure shows step three of the three-way handshake process, and is another P-CAP file. The file shown is the client response to the server. The T.C.P. segment in this frame has the sequence number set to one and the ACK flag set to indicate a valid Acknowledgement number. The source port is 1061, as originally selected by the client, and the destination port is 80 for the H.T.T.P. service.

Sequence number: 1 (relative sequence number)
Acknowledgement number: 1 (relative ack number)
.... ...1 .... = Acknowledgement: set

The description for this figure is:

7.2.1 TCP Communication >7.2.1.7 TCP Session Termination Analysis

Figure 1 on this page on this page shows the four exchanges required to close a connection.

Step 1 shows that when Client A is ready to close the connection therefore it sends a segment with the FIN flag set and it is received by Client B.

A sends FIN request to B.

Step 2 has client B sending an ACK to client A.

Step 3 is also from client B and it sends a FIN to client A to terminate the server to client session and the client receives the FIN.

Step 4 is when client A responds to client B by sending an ACK to client B.

A sends ACK to B.

Figure 2 on this page uses a P-CAP file output from the protocol analyzer Wireshark to show the TCP FIN termination. In the output the server is responding to a FIN sent by a client by returning a segment with both the FIN and the ACK bits set.

Flags: 0x11 (FIN, ACK)
.... .... ...1 = Fin: set

The description for this figure is, "A protocol analyzer shows details of frame 16, TCP FIN request.".

Figure 3 on this page uses a P-CAP file to show the ACK sent by the client that fully terminates a communication session.

Flags: 0x10 (ACK)
.... ...1 .... = Acknowledgement: Set

The description for this figure is, "A protocol analyzer shows details of frame 17, TCP ACK response.".

7.2.1 TCP Communication >7.2.1.8 Lab - Using Wireshank to Observe the TCP 3-Way Handshake

See Lab Descriptions.

7.2.1 TCP Communication >7.2.1.9 Activity TCP connection and termination process

Figure 1 on this page is an interactive activity that has the learner place components of the three-way handshake in the proper order.

The available components are:

• 601
• SYN, ACK
• ACK
• SYN
• 400

The figure also has the following 2 buttons:

• Check
• Reset

TCP Connection Process (enter the components in the space marked Blank):

• Client A, Send SYN
  SEQ = 600
  CTL = SYN. Client B, Blank Received
• Client B, Send Blank, SEQ = Blank . Client A, SYN Received
• Client A, Established, SEQ = 601, ACK = 401. Client B, ASCK = Blank, CTL = Blank

Figure 2 on this page is an interactive activity that has the learner place components of the four-step process of TCP termination session in the proper order.

The available components are:

• FIN
• FIN
• ACK
• ACK

The figure also has the following 2 buttons:

• Check
• Reset

TCP Termination Process (enter the components in the space marked Blank):

• Client A, Send FIN
  CTL = SYN. Client B, Blank Received
• Client B, Send Blank. Client A, ACK Received
• Client B, Send Blank. Client A, FIN Received
• Client A, Send ACK. Client B, Blank Received

7.2.2 Reliability and Flow Control >7.2.2.1 TCP Reliability - Ordered Delivery

The figure on this page shows data being divided into 6 segments, which are each labeled with a sequence number 1 through 6 and sent to remote host. There are five routers connected with redundant links, thereby allowing multiple paths for the segments to follow. The segments do not arrive at the destination in same order they were sent. TCP uses the sequence numbers to re-order the segments back to their original order.

TCP segments are reordered at the destination:

1. Data is divided into segments
2. Different segments may take different routes
3. Having taken different routes to the destination, segments arrive out of order
4. TCP reorders the segments to the original order

7.2.2 Reliability and Flow Control >7.2.2.2 Reliability- Acknowledgement and Windows Size

The figure on this page shows the acknowledgement of TCP packets process. One computer is sending data to another through a WAN link. In the figure, the sending computer sets the sequence number to 1, sets the acknowledgement number to 1, and then sends 10 bytes of data:

The sending computer has a callout saying, "Start with byte #1, I am sending 10 bytes.".

The receiving computer indicates that it received 10 bytes of data by sending an acknowledgement back to the sending computer that has the sequence set to 1 and the acknowledgement number set to 11:

The receiving computer has a callout saying, "I received 10 bytesb starting with byte #1. I expect byte #11 next.".

The sending computer recognizes that the 10 bytes have been received so it begins to transmit more data starting with a sequence number of 11 and the acknowledgement set to 2:

7.2.2 Reliability and Flow Control >7.2.2.3 TCP Reliability- Data Loss and Retransmission

The animation on this page shows an example of how TCP handles data loss and retransmission:

1. The source computer sends segment 1 and starts a timer.
2. The destination computer receives segment one, then forms acknowledgement 1 and request 2 and transmits that back to the source.
3. The source computer receives the acknowledgement and the time ends before it times out.
4. The source computer then sends segment 2 and sets the timer again for segment 2.
5. Segment 2 is sent, but it is never received by the destination computer. Timer 2 expires on the source computer, which causes the source to retransmit segment 2 and start a new timer.
6. The destination computer receives segment two, then forms acknowledgement two and request three, and transmits that back to the source.
7. The source computer receives the acknowledegment and the process repeats for segment three.

7.2.2 Reliability and Flow Control >7.2.2.4 TCP Flow Control - Window Size and Acknowledgements

The figure on this page shows the TCP segment acknowledgement and window size. The figure has a sending computer and a receiving computer. The window size is set to 3,000:

1. The sending computer sends 1,500 bytes of data along with a sequence number of one.
2. The sending computer sends another 1,500 bytes with a sequence number of 1,501.
3. The receiving computer receives bytes 1 through 1,500 and bytes 1,501 through 3,000.
4. Now that the window\s size has been met the receiving computer sends acknowledgement number 3,001 to the sending computer. This signifies that it has received the expected amount of data and it is ready for more.
5. The sending computer sends another 1,500 bytes of data along with sequence number of 3,001.
6. The sending computer sends another 1,500 bytes with a sequence number of 4,501.
7. The receiving computer receives bytes 3,001 through 4,500 and bytes 4,501 through 6,000. This signifies that it has received the expected amount of data and it is ready for more.

The window size determines the number of bytes sent before an acknowledgment is expected.

The acknowledgement number is the number of the next expected byte.

7.2.2 Reliability and Flow Control >7.2.2.5 TCP Flow Control - Congestion Avoidance

THe figure on this page shows the TCP congestion and flow control process. The figure has a sending computer and a receiving computer. The window size is set to 3,000:

1. The sending computer sends 1,500 bytes of data along with a sequence number of one.
2. The sending computer sends another 1,500 bytes with a sequence number of 1,501.
3. The receiving computer receives bytes 1 through 1,500 and bytes 1,501 through 3,000.
4. Now that the window size has been met the receiving computer sends acknowledgement number 3,001 to the sender. This signifies that it has received the expected amount of data and it is ready for more.
5. The sending computer sends another 1,500 bytes of data along with a sequence number of 3,001. # The sending computer sends another 1,500 bytes with a sequence number of 4,501.
6. The receiving computer receives bytes 4,501 through 6,000, but not bytes 3,001 through 4,500 due to congestion at the router.
7. The receiving computer sends acknowledgement number 3,001 again to the sender. This signifies that it has not received the next expected segment and in its transmission it reduces the window size to 1,500 because of the lost segment.

If segments are lost because of congestion, the receiver will acknowledge the last received sequential segment and reply with a reduced window size.

7.2.3 UDP Communication >7.2.3.1 UDP Low Overhead versus Reliability

The figure on this page shows two network segments connected through a network. In one network segment there is a computer sending data, an VoIP phone, and a computer running an online video game. On the other segment there is a computer receiving the data sent by the sending computer from the VoIP phone, and the computer running the online video game. These are two examples of applications that utilize UDP due to its low overhead data transport method.

UDP provides this low overhead data transport because it has a small datagram header and no network management traffic.

7.2.3 UDP Communication >7.2.3.2 UDP Datagram Reassembly

The figure on this page shows data being divided into six datagrams, which are then sent through a network of five routers that are connected with redundant links thereby allowing multiple paths for the datagrams to follow. They do not arrive at the destination in same order they were sent. Since these are datagrams utilizing UDP, any out of order datagrams delivered will not be reordered and any lost datagrams will not be re-sent.

UDP: Connectionless and unreliable:

1. Data is divided into segments
2. Different datagrams may take different routes
3. Having taken different routes to the destination, datagrams arrive out of order
4. Out of order datagrams are not reordered
5. Lost datagrams are not resent

7.2.3 UDP Communication >7.2.3.3 UDP Server Processes and Requests

The figure on this page shows a server receiving a request from a DNS client and a request from a RADIUS client. These two protocols utilize UDP. The DNS request is received on port 53 and the RADIUS request is received on port 1812.

7.2.3 UDP Communication >7.2.3.4 UDP Client Processors

The 5 figures on this page show clients sending UDP requests.

Figure 1 shows a server running a DNS server on port 53 and a RADIUS server on port 1812. The figure has two clients accessing the server:

This demonstrates how port numbers are used to differentiate between multiple services running on one server.

Figure 2 highlights that the client requests to UDP server use well known port numbers as the destination port.

Figure 3 highlights the use of random port numbers as the source ports.

Figure 4 highlights that the server response to UDP client uses the source port from the request packet as the destination port.

Figure 5 highlights that the server response to UDP client uses well known port numbers as the source port.

7.2.3 UDP Communication >7.2.3.5 Lab - Using wirehsark to examine a UDP DNS capture

See Lab Descriptions

7.2.4 TCP or UDP, that is the question >7.2.4.1 Applications that use TCP

The figure on this page shows common applications that use TCP.

These are:

• HTTP
• FTP
• SMTP
• Telnet

7.2.4 TCP or UDP, that is the question >7.2.4.2 Applications that use UDP

The figure on this page shows common applications that use U.D.P.

These are:

• DHCP
• DNS
• SNMP
• TFTP
• VoIP
• IPTV

7.2.4 TCP or UDP, that is the question >7.2.4.3: Lab - Using Wireshark to Examine FTP and TFTP Captures

See Lab Descriptions

7.2.4 TCP or UDP, that is the question >7.2.4.4: Activity-TCP,UDP or both

The interactive activity on this page has the learner categorize a list of application layer protocols using TCP, UDP or both.

The Application layer protocols are:

• HTTP
• FTP
• SMTP
• DNS
• TFTP
• Telnet
• DHCP
• SNMP
• VoIP
• IPTV

The figure also has the following 2 buttons:

• Check
• Reset

7.3.1 Summary >7.3.1.1: Class Activity-We Need to Talk, Again - Game

The image on this page shows different aspects of network communications

TCP and UDP are transport layer protocols that are instrumental in ensuring that:

• Network communications with different levels of importance are sent and received according to their levels of importance
• The type of data will affect whether TCP or UDP will be used as the method of delivery
• Timing is a factor and will affect how long it takes to send and receive TCP and UDP data transmissions.

Objectives

7.3.1 Summary >7.3.1.2: Packet Tracer Simulation-TCP and UDP Communications

Objectives:

7.3.1 Summary >7.3.1.3 Summary

The figure on this page shows the seven layers of the OSI model and highlights the transport layer.

This Transport layer prepares application data for transport over the network and processes network data for use by applications.

End of Chapter 7: Transport Layer.

Next - Chapter 8: IP Addressing.