17
Transport Layer
Process-to-Process Delivery: UDP & TCP
Transport Layer bridges Network Layer (host-to-host) and Application Layer. Uses port numbers for process-to-process communication. Two protocols: UDP (fast, unreliable) and TCP (reliable, connection-oriented).
UDP
User Datagram Protocol
Connectionless, unreliable, minimal overhead. No ACKs, no retransmissions, no ordering guarantee.
| Field | Size | Purpose |
|---|---|---|
| Source Port | 16 bits | Sending process port |
| Destination Port | 16 bits | Receiving process port |
| Length | 16 bits | Header + data length (bytes) |
| Checksum | 16 bits | Error detection (optional IPv4, mandatory IPv6) |
Use Cases
- DNS queries (primarily)
- VoIP / real-time streaming
- Online gaming
- DHCP, SNMP, TFTP
TCP
Transmission Control Protocol
Connection-oriented, reliable, stream-oriented, full-duplex. Uses sequence numbers, ACKs, sliding window.
6 Core Services
- Process-to-process — port numbers
- Stream delivery — byte stream with send/receive buffers
- Full-duplex — bidirectional simultaneously
- Multiplexing/Demultiplexing — per connection
- Connection-oriented — 3 phases: establish → transfer → terminate
- Reliable — ACK mechanism
Three-Way Handshake
TCP Header Key Fields
| Field | Size | Purpose |
|---|---|---|
| Source/Dest Port | 16 bits each | Process identification |
| Sequence Number | 32 bits | Byte-stream position |
| Ack Number | 32 bits | Next expected byte |
| Header Length | 4 bits | TCP header size in 32-bit words |
| Flags (SYN,ACK,FIN,RST,PSH,URG) | 6 bits | Control bits |
| Window Size | 16 bits | Flow control credit |
| Checksum | 16 bits | Segment + pseudoheader (IP/Protocol/Length) |
| Urgent Pointer | 16 bits | Valid if URG flag set; offset to last urgent byte |
| Options | Up to 40 bytes | Optional info |
TCP Connection Phases
- Phase 1: Connection Establishment — 3-Way Handshake (SYN → SYN-ACK → ACK).
- Phase 2: Data Transfer — Bidirectional byte-stream exchange with sequence numbers and windowing.
- Phase 3: Connection Termination — Usually a 4-Way Handshake (FIN/ACK exchange) for graceful closure.
TCP Reliability Mechanisms
Ordering/Detection
Sequence numbers for ordering and duplicate detection.
Sequence numbers for ordering and duplicate detection.
Acknowledgments
Cumulative or selective ACKs to confirm delivery.
Cumulative or selective ACKs to confirm delivery.
Lost Segments
Retransmission timers for recovery of missing data.
Retransmission timers for recovery of missing data.
Flow & Congestion
Sliding window for flow control and algorithms for congestion.
Sliding window for flow control and algorithms for congestion.
UDP vs TCP — Quick Comparison
| Feature | UDP | TCP |
|---|---|---|
| Connection | Connectionless | Connection-oriented |
| Reliability | Unreliable | Reliable (ACKs, retrans) |
| Ordering | No guarantee | In-order delivery |
| Flow Control | None | Sliding window |
| Congestion Control | None | Yes |
| Header Size | 8 bytes | 20-60 bytes |
| Speed | Faster | Slower (overhead) |
| Use Case | Streaming, DNS, VoIP | Web, email, file transfer |
Exam tip: UDP header = 8 bytes fixed. TCP header = 20 bytes minimum (up to 60 with options). TCP 3-way handshake: SYN → SYN-ACK → ACK. Connection termination: 4-way (FIN/ACK exchange).
18
Congestion & QoS
Congestion Control & Quality of Service
Congestion = load > capacity (too many sources, router buffers overflow). Congestion Control = keep load below capacity. Two categories: Open-Loop (prevention) and Closed-Loop (removal after it happens).
Open-Loop
Congestion Prevention (Before it happens)
| Policy | Description | Key Point |
|---|---|---|
| Retransmission | Optimize retransmission timers | TCP prevents/alleviates congestion |
| Window | Selective Repeat preferred over Go-Back-N | GBN resends already-received packets → worsens congestion |
| Acknowledgment | Send fewer ACKs (ACK every N packets or timer-based) | ACKs are part of network load |
| Discarding | Drop less sensitive packets during congestion | E.g., discard some audio packets in VoIP |
| Admission | QoS in virtual-circuit networks | Deny new VC if congestion exists/likely |
Closed-Loop
Congestion Removal (After it happens)
| Method | Description | Network Type |
|---|---|---|
| Backpressure | Congested node stops receiving from upstream node; propagates backward | Virtual circuit ONLY (knows upstream) |
| Choke Packet | Congested router sends packet directly to source | Any (goes direct to source) |
| Implicit Signalling | Source infers congestion from symptoms (no ACK, delay) | Any (no direct communication) |
| Explicit Signalling | Signal included in data packets (forward or backward) | Any |
Key distinction: Backpressure = node-to-node, opposite data flow. Choke packet = router-to-source direct. Implicit = source guesses. Explicit = signal in data packets.
QoS
Quality of Service Parameters
| Parameter | Definition | Acceptable Values |
|---|---|---|
| Bandwidth | Max transmission rate (bps) | 1080p: 3-5 Mbps; 4K: 15-25 Mbps |
| Latency | Total travel time (propagation + transmission + processing + queuing) | VoIP <150ms; Video <200ms |
| Jitter | Variation in packet arrival times | Minimize via jitter buffers |
| Packet Loss | % of packets lost | VoIP <1%; Video <0.1-0.5% |
| Reliability | Data arrives intact and ordered | TCP ensures; UDP needs QoS guarantees |
| Priority | Traffic classification (DiffServ, MPLS) | VoIP > file downloads |
QoS
Need for Quality of Service
- 1. Prevent Congestion: Stop high-bandwidth traffic from starving real-time traffic.
- 2. Predictable Performance: Ensure consistent bandwidth, low latency, and minimal jitter.
- 3. Improved UX: Avoid frozen screens, delayed audio, or dropped calls.
- 4. Multi-App Support: Allocate resources so critical apps function despite background traffic.
- 5. Differentiated Services: Prioritize premium services or critical flows (e.g., Enterprise VoIP).
QoS Mechanisms
- Traffic Shaping — controls rate to prevent bursts
- Traffic Policing — drops excess traffic beyond limits
- Resource Reservation (RSVP) — reserves bandwidth along path
- Packet Scheduling — WFQ, Priority Queuing
- DiffServ — DSCP in IP headers for classification
- IntServ — guaranteed bandwidth/latency per flow
Exam tip: Backpressure ONLY works in virtual-circuit networks (routers know upstream). In datagram networks, use choke packets or explicit/implicit signalling. QoS is essential for real-time apps (VoIP, video conferencing).
19
DNS & Email
Domain Name System, Remote Login & Email
DNS
Domain Name System
Translates human-readable domain names → IP addresses. Distributed, hierarchical database. Operates at Application Layer.
Resolution Process
- User types URL (e.g., google.com)
- Check local DNS cache
- Query DNS resolver (ISP)
- Recursive lookup: Root → TLD → Authoritative
- Authoritative server returns IP
- Client connects using IP
DNS Components
| Component | Function |
|---|---|
| DNS Resolver | Client-side intermediary; performs recursive lookups; maintains cache |
| Root Name Servers | Top-level; direct queries to appropriate TLD server (no domain IPs) |
| TLD Servers | Manage .com, .org, .net, .edu; direct to authoritative server |
| Authoritative NS | Holds definitive DNS records for a domain |
| DNS Cache | Temporary storage at resolver, ISP, OS to reduce lookup time |
| Zone Files | Contain DNS records (A, AAAA, MX, CNAME, NS, PTR) |
DNS Record Types
A → IPv4 address
AAAA → IPv6 address
MX → Mail server
CNAME → Alias
NS → Name server
PTR → Reverse DNS
Remote Login
Telnet vs SSH
| Feature | Telnet | SSH |
|---|---|---|
| Port | 23 (TCP) | 22 (TCP) |
| Security | Plaintext (INSECURE) | Encrypted |
| Authentication | Password only | Password, public-key, MFA |
| Use | Legacy/legacy systems | Modern standard |
| Additional | — | SFTP, port forwarding |
Telnet transmits credentials in plaintext — vulnerable to eavesdropping. SSH is the secure replacement.
Email
Email Protocols: SMTP, POP3, IMAP, MIME
| Protocol | Port(s) | Purpose |
|---|---|---|
| SMTP | 25 (server), 587 (client), 465 (SSL) | Sending emails |
| POP3 | 110 (standard), 995 (SSL) | Receiving — download to client, usually delete from server |
| IMAP | 143 (standard), 993 (SSL) | Receiving — manage on server, sync across devices |
| MIME | — | Multimedia attachments, non-ASCII text |
SMTP Operation
- Client connects to SMTP server (port 587)
- Sender provides credentials and message
- SMTP sends to recipient's SMTP server via TCP (port 25)
- Recipient server delivers to mailbox
POP3 vs IMAP
POP3
✓ Works offline
✓ Simple, minimal server load
✗ No multi-device sync
✗ Limited folder management
✓ Works offline
✓ Simple, minimal server load
✗ No multi-device sync
✗ Limited folder management
IMAP
✓ Centralized server storage
✓ Multi-device sync
✓ Folder management, flags, search
✗ Requires internet connection
✓ Centralized server storage
✓ Multi-device sync
✓ Folder management, flags, search
✗ Requires internet connection
MIME (Multipurpose Internet Mail Extensions)
| Component | Function |
|---|---|
| Content-Type | Specifies type of content (text, image, audio, video) |
| Content-Transfer-Encoding | Specifies encoding for safe transmission |
| Multipart | Allows sending multiple parts (text + attachments) in one email |
Exam tip: DNS is application layer. Telnet=23 (insecure), SSH=22 (secure). SMTP sends; POP3/IMAP receive. MIME enables attachments. IMAP keeps mail on server; POP3 downloads and removes.
20
Web & File Transfer
FTP, WWW & HTTP/HTTPS
FTP
File Transfer Protocol
Reliable file transfer between client and server over TCP. Uses two ports.
| Feature | Detail |
|---|---|
| Control Connection | Port 21 — commands (GET, PUT, LIST, DELETE, RENAME) |
| Data Connection | Port 20 — actual file transfer |
| Active Mode | Server connects to client for data |
| Passive Mode | Client initiates both connections (firewall-friendly) |
| Security | Plaintext credentials — use SFTP/FTPS instead |
HTTP
Hypertext Transfer Protocol
HTTP
- Port 80
- Request-Response model
- Stateless (no session memory)
- Methods: GET, POST, PUT, DELETE
HTTPS
- Port 443
- SSL/TLS encryption
- Confidentiality + Integrity + Authentication
- Prevents MITM, eavesdropping
WWW
World Wide Web
| Component | Description |
|---|---|
| Web Browser | Client app (Chrome, Firefox) — requests and renders content |
| Web Server | Hosts content, responds to HTTP/HTTPS requests |
| URL | Address: protocol://domain/path |
| HTML | Markup language for web pages |
| Hyperlinks | Navigation between pages/sites |
Operation Flow
- User enters URL; Browser sends HTTP/HTTPS request.
- Server responds with page (HTML, CSS, JS, multimedia).
- Browser renders content and displays it.
- Additional resources (images/scripts) are requested separately.
Exam tip: FTP uses port 20 (data) + 21 (control). HTTP=80, HTTPS=443. WWW is a system of interlinked hypertext documents accessed via browsers. Stateless means each request is independent.
21
Network Mgmt
SNMP & Network Management
SNMP (Simple Network Management Protocol) = application-layer protocol to monitor, manage, and configure network devices (routers, switches, servers, printers).
SNMP Components
| Component | Description |
|---|---|
| Managed Devices | Network elements with SNMP agents (routers, switches, servers) |
| SNMP Agent | Software on managed device that collects/stores management info |
| NMS | Network Management Station — central system monitoring all devices |
SNMP Operations
GET
Retrieve information from managed device
Retrieve information from managed device
SET
Modify configuration parameter
Modify configuration parameter
TRAP
Unsolicited notification from agent to NMS when significant event occurs (device failure, link down)
Unsolicited notification from agent to NMS when significant event occurs (device failure, link down)
MIB
Management Information Base
- Database of managed objects maintained by each device.
- Each object = parameter/statistic (interface status, traffic counters).
- Objects identified by Object Identifiers (OIDs).
SNMP Advantages
Centralized management, real-time monitoring/alerts, automated data collection.
Centralized management, real-time monitoring/alerts, automated data collection.
SNMP Disadvantages
Plaintext in v1/2c (insecure), overhead from frequent polling, NMS resource intensive.
Plaintext in v1/2c (insecure), overhead from frequent polling, NMS resource intensive.
Exam tip: SNMP is application layer. Uses UDP ports 161 (agent) and 162 (traps). v1 and 2c lack strong security (plaintext). Trap = unsolicited alert from agent to manager.
22
Mail Transfer
SMTP — Detailed
SMTP = Simple Mail Transfer Protocol. Core protocol for mail transfer (client→server and server→server). TCP-based, store-and-forward model.
SMTP Ports
25 Server-to-server relay
587 Client submission (with auth)
465 SMTP over SSL (secure)
Mail Transfer Flow
- Sender's MUA submits to local MTA via SMTP (port 587)
- Local MTA looks up recipient domain's MX record via DNS
- MTA establishes SMTP connection to recipient's MTA (port 25)
- Recipient MTA places message in user's mailbox
- Recipient retrieves using POP3 or IMAP
SMTP + Complementary Protocols
| Protocol | Role | Port |
|---|---|---|
| SMTP | Send mail (MTA→MTA, MUA→MTA) | 25, 587, 465 |
| POP3 | Retrieve mail (download) | 110, 995 |
| IMAP | Retrieve mail (server sync) | 143, 993 |
| MIME | Encode multimedia content | — |
Exam tip: SMTP uses DNS MX records to find recipient mail servers. Store-and-forward: if recipient server unavailable, message is queued and retried. MIME extends SMTP for non-text content.
P
Quick Ref
Protocol Port Reference
| Protocol | Port(s) | Layer | TCP/UDP |
|---|---|---|---|
| DNS | 53 | Application | UDP/TCP |
| Telnet | 23 | Application | TCP |
| SSH | 22 | Application | TCP |
| SMTP | 25 587 465 | Application | TCP |
| POP3 | 110 995 | Application | TCP |
| IMAP | 143 993 | Application | TCP |
| FTP | 20 21 | Application | TCP |
| HTTP | 80 | Application | TCP |
| HTTPS | 443 | Application | TCP |
| SNMP | 161 162 | Application | UDP |
| UDP | — | Transport | Transport |
| TCP | — | Transport | Transport |
FC
Study Mode
Flashcards
Tap card to flip
∑
Master Ref
Complete Cheatsheet
Every Key Fact in One Table
| Topic | Key Rule / Fact |
|---|---|
| Transport Layer | Process-to-process via port numbers. Bridges network and application layers. |
| UDP | Connectionless, unreliable, 8-byte header, no congestion control. DNS, VoIP, gaming. |
| TCP | Connection-oriented, reliable, 20-60 byte header, 3-way handshake, full-duplex. |
| 3-Way Handshake | SYN → SYN-ACK → ACK |
| Congestion | Load > capacity. Open-loop = prevention. Closed-loop = removal. |
| Backpressure | Node-to-node, opposite data flow. Virtual circuit networks ONLY. |
| Choke Packet | Router sends directly to source. Works in any network. |
| QoS Parameters | Bandwidth, Latency, Jitter, Packet Loss, Reliability, Priority |
| DNS | Application layer. Distributed hierarchical database. A=IPv4, AAAA=IPv6, MX=mail, CNAME=alias. |
| DNS Resolution | Client → Cache → Resolver → Root → TLD → Authoritative → IP |
| Telnet | Port 23. Plaintext. Insecure. Replaced by SSH. |
| SSH | Port 22. Encrypted. Supports SFTP and port forwarding. |
| SMTP | Port 25/587/465. Sends mail. Store-and-forward. Uses MX records. |
| POP3 | Port 110/995. Downloads mail, usually deletes from server. |
| IMAP | Port 143/993. Manages mail on server. Multi-device sync. |
| MIME | Extends email for attachments and non-ASCII text. |
| FTP | Port 20 (data) + 21 (control). Active vs Passive mode. |
| HTTP | Port 80. Stateless request-response. |
| HTTPS | Port 443. SSL/TLS encrypted. |
| SNMP | Port 161 (agent) / 162 (traps). Application layer. GET, SET, TRAP. |
| MIB | Management Information Base. Objects identified by OIDs. |
| Selective Repeat vs GBN | SR better for congestion — only resends lost packets. GBN resends window. |
| Implicit vs Explicit Signalling | Implicit = source guesses congestion. Explicit = signal in data packets. |