Figure 25.

1 Example of using the DNS service

25.1
 25-1 NAME SPACE

To be unambiguous, the names assigned to machines

must be carefully selected from a name space with
complete control over the binding between the names
and IP addresses.

Topics discussed in this section:

Flat Name Space
Hierarchical Name Space

25.2
 25-2 DOMAIN NAME SPACE

To have a hierarchical name space, a domain name

space was designed. In this design the names are
defined in an inverted-tree structure with the root at
the top. The tree can have only 128 levels: level 0
(root) to level 127.

Topics discussed in this section:

Label
Domain Name
Domain

25.3
 Figure 25.2 Domain name space

25.4
 Figure 25.3 Domain names and labels

25.5
 Figure 25.4 FQDN and PQDN

25.6
 Figure 25.5 Domains

25.7
 25-3 DISTRIBUTION OF NAME SPACE

The information contained in the domain name space

must be stored. However, it is very inefficient and also
unreliable to have just one computer store such a huge
amount of information. In this section, we discuss the
distribution of the domain name space.

Topics discussed in this section:

Hierarchy of Name Servers
Zone
Root Server
Primary and Secondary Servers

25.8
 Figure 25.6 Hierarchy of name servers

25.9
 Figure 25.7 Zones and domains

25.10
 25-4 DNS IN THE INTERNET

DNS is a protocol that can be used in different

platforms. In the Internet, the domain name space
(tree) is divided into three different sections: generic
domains, country domains, and the inverse domain.

Topics discussed in this section:

Generic Domains
Country Domains
Inverse Domain

25.11
 Figure 25.8 DNS IN THE INTERNET

25.12
 Figure 25.9 Generic domains

25.13
 Table 25.1 Generic domain labels

25.14
 Figure 25.10 Country domains

25.15
 Figure 25.11 Inverse domain

25.16
 25-5 RESOLUTION

Mapping a name to an address or an address to a

name is called name-address resolution.

Topics discussed in this section:

Resolver
Mapping Names to Addresses
Mapping Addresses to Names
Recursive Resolution
Caching

25.17
 Figure 25.12 Recursive resolution

25.18
 Figure 25.13 Iterative resolution

25.19
 25-6 DNS MESSAGES

DNS has two types of messages: query and response.

Both types have the same format. The query message
consists of a header and question records; the
response message consists of a header, question
records, answer records, authoritative records, and
additional records.
Topics discussed in this section:
Header

25.20
 Figure 25.14 Query and response messages

25.21
 Figure 25.15 Header format

25.22
 25-7 TYPES OF RECORDS

As we saw in Section 25.6, two types of records are

used in DNS. The question records are used in the
question section of the query and response messages.
The resource records are used in the answer,
authoritative, and additional information sections of
the response message.

Topics discussed in this section:

Question Record
Resource Record

25.23
 25-8 REGISTRARS

How are new domains added to DNS? This is done

through a registrar, a commercial entity accredited by
ICANN. A registrar first verifies that the requested
domain name is unique and then enters it into the
DNS database. A fee is charged.

25.24
 25-9 DYNAMIC DOMAIN NAME
SYSTEM (DDNS)

The DNS master file must be updated dynamically.

The Dynamic Domain Name System (DDNS)
therefore was devised to respond to this need. In
DDNS, when a binding between a name and an
address is determined, the information is sent, usually
by DHCP to a primary DNS server. The primary server
updates the zone. The secondary servers are notified
either actively or passively.

25.25
 25-10 ENCAPSULATION

DNS can use either UDP or TCP. In both cases the

well-known port used by the server is port 53. UDP is
used when the size of the response message is less than
512 bytes because most UDP packages have a 512-byte
packet size limit. If the size of the response message is
more than 512 bytes, a TCP connection is used.

25.26
 26-1 REMOTE LOGGING

It would be impossible to write a specific client/server

program for each demand. The better solution is a
general-purpose client/server program that lets a user
access any application program on a remote computer.

Topics discussed in this section:

TELNET

26.27
 Figure 26.1 Local and remote log-in

26.28
 Figure 26.2 Concept of NVT

26.29
 Table 26.1 Some NVT control characters

26.30
 Figure 26.3 An example of embedding

26.31
 Table 26.2 Options

26.32
 Table 26.3 NVT character set for option negotiation

26.33
 Table 26.4 Character set for suboptions

26.34
 26-2 ELECTRONIC MAIL

One of the most popular Internet services is electronic

mail (e-mail). The designers of the Internet probably
never imagined the popularity of this application
program. Its architecture consists of several
components that we discuss in this chapter.

Topics discussed in this section:

Architecture
User Agent
Message Transfer Agent: SMTP
Message Access Agent: POP and IMAP
Web-Based Mail
26.35
 Figure 26.6 First scenario in electronic mail

26.36
 Figure 26.7 Second scenario in electronic mail

26.37
 Figure 26.8 Third scenario in electronic mail

26.38
 Figure 26.9 Fourth scenario in electronic mail

26.39
 Figure 26.10 Push versus pull in electronic email

26.40
 Figure 26.11 Services of user agent

26.41
 Figure 26.12 Format of an e-mail

26.42
 Figure 26.13 E-mail address

26.43
 Figure 26.14 MIME

26.44
 Figure 26.15 MIME header

26.45
 Table 26.5 Data types and subtypes in MIME

26.46
 Table 26.6 Content-transfer-encoding

26.47
 Figure 26.16 SMTP range

26.48
 Figure 26.17 Commands and responses

26.49
 Figure 26.18 Command format

26.50
 Table 26.7 Commands

26.51
 Table 26.8 Responses

26.52
 Table 26.8 Responses (continued)

26.53
 Figure 26.19 POP3 and IMAP4

26.54
 Figure 26.20 The exchange of commands and responses in POP3

26.55
 26-3 FILE TRANSFER

Transferring files from one computer to another is one

of the most common tasks expected from a networking
or internetworking environment. As a matter of fact,
the greatest volume of data exchange in the Internet
today is due to file transfer.

Topics discussed in this section:

File Transfer Protocol (FTP)
Anonymous FTP

26.56
 Figure 26.21 FTP

26.57
 Figure 26.22 Using the control connection

26.58
 Figure 26.23 Using the data connection

26.59
 27-1 ARCHITECTURE

The WWW today is a distributed client/server service,

in which a client using a browser can access a service
using a server. However, the service provided is
distributed over many locations called sites.

Topics discussed in this section:

Client (Browser)
Server
Uniform Resource Locator
Cookies

27.60
 Figure 27.1 Architecture of WWW

27.61
 Figure 27.2 Browser

27.62
 Figure 27.3 URL

27.63
 27-2 WEB DOCUMENTS

The documents in the WWW can be grouped into three

broad categories: static, dynamic, and active. The
category is based on the time at which the contents of
the document are determined.

Topics discussed in this section:

Static Documents
Dynamic Documents
Active Documents

27.64
 Figure 27.4 Static document

27.65
 Figure 27.5 Boldface tags

27.66
 Figure 27.6 Effect of boldface tags

27.67
 Figure 27.7 Beginning and ending tags

27.68
 Figure 27.8 Dynamic document using CGI

27.69
 Figure 27.9 Dynamic document using server-site script

27.70
 Figure 27.10 Active document using Java applet

27.71
 Figure 27.11 Active document using client-site script

27.72
 27-3 HTTP

The Hypertext Transfer Protocol (HTTP) is a protocol

used mainly to access data on the World Wide Web.
HTTP functions as a combination of FTP and SMTP.

Topics discussed in this section:

HTTP Transaction
Persistent Versus Nonpersistent Connection

27.73
 Figure 27.12 HTTP transaction

27.74
 Figure 27.13 Request and response messages

27.75
 Figure 27.14 Request and status lines

27.76
 Table 27.1 Methods

27.77
 Table 27.2 Status codes

27.78
 Table 27.2 Status codes (continued)

27.79
 Figure 27.15 Header format

27.80
 Table 27.3 General headers

27.81
 Table 27.4 Request headers

27.82
 28-1 NETWORK MANAGEMENT SYSTEM

We can say that the functions performed by a network

management system can be divided into five broad
categories: configuration management, fault
management, performance management, security
management, and accounting management.
Topics discussed in this section:
Configuration Management
Fault Management
Performance Management
Security Management
Accounting Management

28.83
 Figure 28.1 Functions of a network management system

28.84
 28-2 SIMPLE NETWORK MANAGEMENT
PROTOCOL (SNMP)

The Simple Network Management Protocol (SNMP) is a

framework for managing devices in an internet using
the TCP/IP protocol suite. It provides a set of
fundamental operations for monitoring and maintaining
an internet.
Topics discussed in this section:
Concept
Management Components
Structure of Management Information (SMI)
Management Information Base (MIB)
SNMP

28.85
 Figure 28.2 SNMP concept

28.86
 Figure 28.3 Components of network management on the Internet

28.87
 Figure 28.4 Management overview

28.88
 Figure 28.5 Object attributes

28.89
 Figure 28.6 Object identifier

28.90
 Figure 28.7 Data type

28.91
 Table 28.1 Data types

28.92
 Figure 28.8 Conceptual data types

28.93
 Figure 28.9 Encoding format

28.94
 Table 28.2 Codes for data types

28.95
 Figure 28.10 Length format

28.96
 Example 28.1

Figure 28.11 shows how to define INTEGER 14.

Figure 28.11 Example 28.1, INTEGER 14

28.97
 Example 28.2

Figure 28.12 shows how to define the OCTET STRING

“HI”.

Figure 28.12 Example 28.2, OCTET STRING “HI”

28.98
 Example 28.3

Figure 28.13 shows how to define ObjectIdentifier

[Link] ([Link]).

Figure 28.13 Example 28.3, ObjectIdentifier [Link]

28.99
 Example 28.4

Figure 28.14 shows how to define IPAddress [Link]..

Figure 28.14 Example 28.4, IPAddress [Link].

28.100
 Figure 28.15 mib-2

28.101
 Figure 28.16 udp group

28.102
 Figure 28.17 udp variables and tables

28.103
 Figure 28.18 Indexes for udpTable

28.104
 Figure 28.19 Lexicographic ordering

28.105
 Figure 28.20 SNMP PDUs

28.106
 Figure 28.21 SNMP PDU format

28.107
 Table 28.3 Types of errors

28.108
 Figure 28.22 SNMP message

28.109
 Table 28.4 Codes for SNMP messages

28.110
 Figure 28.24 GetRequest message

28.111
 Figure 28.25 Port numbers for SNMP

28.112
 Figure 29.1 Internet audio/video

29.113
 29-1 DIGITIZING AUDIO AND VIDEO

Before audio or video signals can be sent on the

Internet, they need to be digitized. We discuss audio
and video separately.

Topics discussed in this section:

Digitizing Audio
Digitizing Video

29.114
 29-2 AUDIO AND VIDEO COMPRESSION

To send audio or video over the Internet requires

compression. In this section, we discuss audio
compression first and then video compression.

Topics discussed in this section:

Audio Compression
Video Compression

29.115
 Figure 29.2 JPEG gray scale

29.116
 Figure 29.3 JPEG process

29.117
 Figure 29.4 Case 1: uniform gray scale

29.118
 Figure 29.5 Case 2: two sections

29.119
 Figure 29.6 Case 3: gradient gray scale

29.120
 Figure 29.7 Reading the table

29.121
 Figure 29.8 MPEG frames

29.122
 Figure 29.9 MPEG frame construction

29.123
 29-3 STREAMING STORED AUDIO/VIDEO

Now that we have discussed digitizing and

compressing audio/video, we turn our attention to
specific applications. The first is streaming stored
audio and video.

Topics discussed in this section:

First Approach: Using a Web Server
Second Approach: Using a Web Server with a Metafile
Third Approach: Using a Media Server
Fourth Approach: Using a Media Server and RTSP

29.124
 Figure 29.10 Using a Web server

29.125
 Figure 29.11 Using a Web server with a metafile

29.126
 Figure 29.12 Using a media server

29.127
 Figure 29.13 Using a media server and RTSP

29.128
 29-4 STREAMING LIVE AUDIO/VIDEO

Streaming live audio/video is similar to the

broadcasting of audio and video by radio and TV
stations. Instead of broadcasting to the air, the stations
broadcast through the Internet. There are several
similarities between streaming stored audio/video and
streaming live audio/video. They are both sensitive to
delay; neither can accept retransmission. However,
there is a difference. In the first application, the
communication is unicast and on-demand. In the
second, the communication is multicast and live.

29.129
 29-5 REAL-TIME INTERACTIVE
AUDIO/VIDEO
In real-time interactive audio/video, people
communicate with one another in real time. The
Internet phone or voice over IP is an example of this
type of application. Video conferencing is another
example that allows people to communicate visually
and orally.

Topics discussed in this section:

Characteristics

29.130
 Figure 29.14 Time relationship

29.131
 Figure 29.15 Jitter

29.132
 Figure 29.16 Timestamp

29.133
 Figure 29.17 Playback buffer

29.134
 29-6 RTP

Real-time Transport Protocol (RTP) is the protocol

designed to handle real-time traffic on the Internet.
RTP does not have a delivery mechanism; it must be
used with UDP. RTP stands between UDP and the
application program. The main contributions of RTP
are time-stamping, sequencing, and mixing facilities.

Topics discussed in this section:

RTP Packet Format
UDP Port

29.135
 Figure 29.18 RTP

29.136
 Figure 29.19 RTP packet header format

29.137
 Table 20.1 Payload types

29.138
 29-7 RTCP

RTP allows only one type of message, one that carries

data from the source to the destination. In many cases,
there is a need for other messages in a session. These
messages control the flow and quality of data and
allow the recipient to send feedback to the source
or sources. Real-time Transport Control Protocol
(RTCP) is a protocol designed for this purpose.
Topics discussed in this section:
Sender Report and Receiver Report
Messages
UDP Port

29.139
 Figure 29.20 RTCP message types

29.140
 29-8 VOICE OVER IP

Let us concentrate on one real-time interactive

audio/video application: voice over IP, or Internet
telephony. The idea is to use the Internet as a
telephone network with some additional capabilities.
Two protocols have been designed to handle this type
of communication: SIP and H.323.

Topics discussed in this section:

SIP
H.323

29.141
 Figure 29.21 SIP messages

29.142
 Figure 29.22 SIP formats

29.143
 Figure 29.23 SIP simple session

29.144
 Figure 29.24 Tracking the callee

29.145
 Figure 29.25 H.323 architecture

29.146
 Figure 29.26 H.323 protocols

29.147
 Figure 29.27 H.323 example

29.148
 Figure 30.1 Cryptography components

30.149
 Figure 30.2 Categories of cryptography

30.150
 Figure 30.3 Symmetric-key cryptography

30.151
 Figure 30.4 Asymmetric-key cryptography

30.152
 Figure 30.5 Keys used in cryptography

30.153
 Figure 30.6 Comparison between two categories of cryptography

30.154
 30-2 SYMMETRIC-KEY CRYPTOGRAPHY

Symmetric-key cryptography started thousands of years

ago when people needed to exchange secrets (for
example, in a war). We still mainly use symmetric-key
cryptography in our network security.

Topics discussed in this section:

Traditional Ciphers
Simple Modern Ciphers
Modern Round Ciphers
Mode of Operation

30.155
 Figure 30.7 Traditional ciphers

30.156
 Example 30.1

The following shows a plaintext and its corresponding

ciphertext. Is the cipher monoalphabetic?

Solution
The cipher is probably monoalphabetic because both
occurrences of L’s are encrypted as O’s.

30.157
 Figure 30.8 Transposition cipher

30.158
 Example 30.5

Encrypt the message “HELLO MY DEAR,” using the key

shown in Figure 30.8.

Solution
We first remove the spaces in the message. We then divide
the text into blocks of four characters. We add a bogus
character Z at the end of the third block. The result is
HELL OMYD EARZ. We create a three-block ciphertext
ELHLMDOYAZER.

30.159
 Figure 30.9 XOR cipher

30.160
 Figure 30.10 Rotation cipher

30.161
 Figure 30.11 S-box

30.162
 Figure 30.12 P-boxes: straight, expansion, and compression

30.163
 Figure 30.13 DES

30.164
 Figure 30.14 One round in DES ciphers

30.165
 Figure 30.15 DES function

30.166
 Figure 30.16 Triple DES

30.167
 Table 30.1 AES configuration

30.168
 Figure 30.17 AES

30.169
 Figure 30.18 Structure of each round

30.170
 Figure 30.19 Modes of operation for block ciphers

30.171
 Figure 30.20 ECB mode

30.172
 Figure 30.21 CBC mode

30.173
 Figure 30.22 CFB mode

30.174
 Figure 30.23 OFB mode

30.175
 30-3 ASYMMETRIC-KEY CRYPTOGRAPHY

An asymmetric-key (or public-key) cipher uses two

keys: one private and one public. We discuss two
algorithms: RSA and Diffie-Hellman.

Topics discussed in this section:

RSA
Diffie-Hellman

30.176
 Figure 30.24 RSA

30.177
 Example 30.7

Bob chooses 7 and 11 as p and q and calculates

n = 7 · 11 = 77. The value of F = (7 − 1) (11 − 1) or 60.
Now he chooses two keys, e and d. If he chooses e to be
13, then d is 37. Now imagine Alice sends the plaintext 5
to Bob. She uses the public key 13 to encrypt 5.

30.178
 Figure 30.27 Diffie-Hellman idea

30.179
 Figure 30.28 Man-in-the-middle attack

30.180
 31-1 SECURITY SERVICES

Network security can provide five services. Four

of these services are related to the message
exchanged using the network. The fifth service
provides entity authentication or identification.

Topics discussed in this section:

Message Confidentiality
Message Integrity
Message Authentication
Message Nonrepudiation
Entity Authentication

31.181
 Figure 31.1 Security services related to the message or entity

31.182
 31-2 MESSAGE CONFIDENTIALITY
The concept of how to achieve message
confidentiality or privacy has not changed for
thousands of years. The message must be
encrypted at the sender site and decrypted at the
receiver site. This can be done using either
symmetric-key cryptography or asymmetric-key
cryptography.
Topics discussed in this section:
Confidentiality with Symmetric-Key Cryptography
Confidentiality with Asymmetric-Key Cryptography

31.183
 Figure 31.2 Message confidentiality using symmetric keys in two directions

31.184
 Figure 31.3 Message confidentiality using asymmetric keys

31.185
 31-3 MESSAGE INTEGRITY

Encryption and decryption provide secrecy, or

confidentiality, but not integrity. However, on
occasion we may not even need secrecy, but
instead must have integrity.
Topics discussed in this section:
Document and Fingerprint
Message and Message Digest
Creating and Checking the Digest
Hash Function Criteria
Hash Algorithms: SHA-1

31.186
 Figure 31.4 Message and message digest

31.187
 Figure 31.5 Checking integrity

31.188
 Figure 31.6 Criteria of a hash function

31.189
 Figure 31.7 Message digest creation

31.190
 Figure 31.8 Processing of one block in SHA-1

31.191
 31-4 MESSAGE AUTHENTICATION

A hash function per se cannot provide

authentication. The digest created by a hash
function can detect any modification in the
message, but not authentication.

Topics discussed in this section:

MAC

31.192
 Figure 31.9 MAC, created by Alice and checked by Bob

31.193
 Figure 31.10 HMAC

31.194
 31-5 DIGITAL SIGNATURE
When Alice sends a message to Bob, Bob needs
to check the authenticity of the sender; he
needs to be sure that the message comes from
Alice and not Eve. Bob can ask Alice to sign the
message electronically. In other words, an
electronic signature can prove the authenticity
of Alice as the sender of the message. We refer
to this type of signature as a digital signature.
Topics discussed in this section:
Comparison
Need for Keys
Process
31.195
 Figure 31.11 Signing the message itself in digital signature

31.196
 Figure 31.12 Signing the digest in a digital signature

31.197
 Figure 31.13 Using a trusted center for nonrepudiation

31.198
 31-6 ENTITY AUTHENTICATION
Entity authentication is a technique designed to
let one party prove the identity of another party.
An entity can be a person, a process, a client, or
a server. The entity whose identity needs to be
proved is called the claimant; the party that tries
to prove the identity of the claimant is called the
verifier.
Topics discussed in this section:
Passwords
Challenge-Response

31.199
 Figure 31.14 Challenge/response authentication using a nonce

31.200
 Figure 31.15 Challenge-response authentication using a timestamp

31.201
 Figure 31.16 Challenge-response authentication using a keyed-hash function

31.202
 Figure 31.17 Authentication, asymmetric-key

31.203
 Figure 31.18 Authentication, using digital signature

31.204
 31-7 KEY MANAGEMENT

We never discussed how secret keys in

symmetric-key cryptography and how public
keys in asymmetric-key cryptography are
distributed and maintained. In this section, we
touch on these two issues. We first discuss the
distribution of symmetric keys; we then discuss
the distribution of asymmetric keys.
Topics discussed in this section:
Symmetric-Key Distribution
Public-Key Distribution

31.205
 Figure 31.19 KDC

31.206
 Figure 31.30 Creating a session key between Alice and Bob using KDC

31.207
 Figure 31.21 Kerberos servers

31.208
 Figure 31.22 Kerberos example

31.209
 Figure 31.23 Announcing a public key

31.210
 Figure 31.24 Trusted center

31.211
 Figure 31.25 Controlled trusted center

31.212
 Figure 31.26 Certification authority

31.213
 Figure 31.27 PKI hierarchy

31.214
 32-1 IPSecurity (IPSec)

IPSecurity (IPSec) is a collection of protocols designed

by the Internet Engineering Task Force (IETF) to
provide security for a packet at the network level.

Topics discussed in this section:

Two Modes
Two Security Protocols
Security Association
Internet Key Exchange (IKE)
Virtual Private Network

32.215
 Figure 32.2 TCP/IP protocol suite and IPSec

32.216
 Figure 32.3 Transport mode and tunnel modes of IPSec protocol

32.217
 Figure 32.4 Transport mode in action

32.218
 Figure 32.5 Tunnel mode in action

32.219
 Figure 32.6 Authentication Header (AH) Protocol in transport mode

32.220
 Figure 32.7 Encapsulating Security Payload (ESP) Protocol in transport mode

32.221
 Table 32.1 IPSec services

32.222
 Figure 32.8 Simple inbound and outbound security associations

32.223
 Figure 32.9 IKE components

32.224
 Table 32.2 Addresses for private networks

32.225
 Figure 32.10 Private network

32.226
 Figure 32.11 Hybrid network

32.227
 Figure 32.12 Virtual private network

32.228
 Figure 32.13 Addressing in a VPN

32.229
 32-2 SSL/TLS

Two protocols are dominant today for providing

security at the transport layer: the Secure Sockets
Layer (SSL) Protocol and the Transport Layer
Security (TLS) Protocol. The latter is actually an
IETF version of the former.
Topics discussed in this section:
SSL Services
Security Parameters
Sessions and Connections
Four Protocols
Transport Layer Security

32.230
 Figure 32.14 Location of SSL and TLS in the Internet model

32.231
 Table 32.3 SSL cipher suite list

32.232
 Table 32.3 SSL cipher suite list (continued)

32.233
 Figure 32.15 Creation of cryptographic secrets in SSL

32.234
 Figure 32.16 Four SSL protocols

32.235
 Figure 32.17 Handshake Protocol

32.236
 Figure 32.18 Processing done by the Record Protocol

32.237
 32-3 PGP

One of the protocols to provide security at the

application layer is Pretty Good Privacy (PGP). PGP is
designed to create authenticated and confidential
e-mails.

Topics discussed in this section:

Security Parameters
Services
A Scenario
PGP Algorithms
Key Rings
PGP Certificates
32.238
 Figure 32.19 Position of PGP in the TCP/IP protocol suite

32.239
 Figure 32.20 A scenario in which an e-mail message is
authenticated and encrypted

32.240
 Table 32.4 PGP Algorithms

32.241
 Figure 32.21 Rings

32.242
 32-4 FIREWALLS

All previous security measures cannot prevent Eve

from sending a harmful message to a system. To
control access to a system, we need firewalls. A firewall
is a device installed between the internal network of an
organization and the rest of the Internet. It is designed
to forward some packets and filter (not forward)
others.

Topics discussed in this section:

Packet-Filter Firewall
Proxy Firewall

32.243
 Figure 32.22 Firewall

32.244
 Figure 32.23 Packet-filter firewall

32.245
 Figure 32.24 Proxy firewall

32.246