Study Notes for COS332

Chapter 1 — The OSI ISO Reference Model

What is the OSI Model?

The Open System Interconnection is a framework that standardises function of
communication systems into seven layers
⤷ A set of rules for how networking protocols should interact.
⤷ By breaking down network communication into layers, we can
understand, design and troubleshoot complex network interactions one piece
at a time.

Key Concepts

Layer: modular level in the stack that performs a

specific function.
Protocol: set of rules that two parties agree on for
communication. “HELO” respond with “250 OK”
Protocol stack: combination of software and hardware that
implements protocols on multiple layers. Browsers HTTP + OS TCP +
ethernet driver
Header and Payload: each layer (except the Application layer L7)
adds its own control info (Header) to data received from layer above (Payload).
Peer-to-peer communication: the logical communication between the
same layer on two different machines. Transport layer to Transport
layer on a web server.

7 Layer-cake

Sending Data
Step 1: Data starts at Application Layer (L7)
↓
Passed down to Presentation Layer (L6) for compression or translation
↓
Session Layer (L5) manages the conversation.
↓
Encapsulation
Step 2: Transport Layer (L4) breaks down into Segment and adds a header
forming a packet (Segment + Header) forming the new payload.
↓
More Encapsulation
Step 3: Network Layer (L3) takes segment, adds header (with IP addresses),
creating a packet/datagram and passes it down.
↓
Final Encapsulation
Step 4: Data Link Layer (L2) takes the packet adds header (with MAC
address) + trailer for error checks, creating a frame. Frame is passed to
Physical Layer (L1).
↓
Transmission
Step 5: L1 sends raw bits as electrical signals across physical mediums.
↓
Receiving data
Step 6: The receiving computers L1 gets bits and passes the frame up to L2.
↓
De-capsulation
Step 7: Each layer on the receiver reads and strips corresponding header then
passes the inner payload up to the next layer.

Simple Example
A letter sent via International courier service

(YOU) Application Layer — Write the contents of the letter. “Love you”

(TRANSLATOR) Presentation Layer — Translates letter into courier’s official

language. “Je t'aime”

(NEGOTIATOR) Session Layer — Opens a dialogue with courier, sets up the

account for the shipment.

(SHIPPING DEPT) Transport Layer — Decides to send letter in one envelope (a

segment) and labels it with tracking number.

(ROUTING DEPT) Network Layer — Stamps the envelope with destination

address and figures best route.

(LOCAL MAILROOM) Data Link Layer — Puts envelope into larger bin (a frame)
labelled for next stop and checks if bin isn’t damaged.

(THE TRUCK) Physical Layer — Physically drives the bin to the airport.

Reverse happens once it arrives to destination. the truck delivers, the mailroom
opens the bin, the routing dept reads the address, etc.

Mnemonic: All People Seem To Need Data Processing (Application,

Presentation, Session, Transport, Network, Data Link, Physical)

Chapter 2: The Application Layer — User-oriented Protocols

This chapter focuses on the protocol that provides services directly useful to a
human server like in the email app, web browser and file transfer programs.
Key Concepts

Network Architecture:
● Client-server: A central server provides a service and the client
requests it. The server is always on and the client initiates contact.
○ The client request and awaits a response, the server sends a

response and awaits a request.

○ Example Web page, web server and email.
● Peer-to-peer: Nodes act as both clients and servers, sharing the
workload without a central server.
○ An architecture that enables different participants to work as

equals in a network.
○ Each peer carries some of the workload.

Key Protocols:
● X.400: Is a series of ITU-T standards for Message Handling System for
OSI/ISO Model.
○ C (Country), A or ADMD (Administration), PMRD or P (Private

Management Domain), O (Org), OU (Organisation Unit), G/I/S

(Given name/Initials/Surname).
◆ Example: I = J; S = Doe; O = acme; OU = sales; A = sapo; C = za
● SMTP (Simple Mail Transfer Protocol): The protocol for sending email
from a client to a server or between servers. (PORT 25)
○ It wasn’t developed with security in mind.
○ Refined by RFC 5321
○ It has two agents MUA (Mail User Agent) and MTA (Mail Transfer

Agent)
◆ MUA – users interact with the email system. Piece of code that

accepts a message, address of sender and some other relevant

inputs and forwards it to MTA.
◆ MTA – transfers the emails. Needs to find a route from the

sender to the agent of the recipient and forward the mail along.
○ Interaction between client and SMTP - conversation
◆ Client connects to server and server responds with a line of

text about server.

◆ Client greets the server with HELO or EHLO.
◆ Client indicates who the sender is.
◆ Client needs to identify intended recipient with rcpt to:
◆ Client sends email with contents and send the email message

one line at a time.

◆ Client ends message with full stop.
◆ Client sends QUIT message to server to close connection.

● POP3 (Post Office Protocol version 3): The protocol for downloading
●

email from a server to a single client. It also deletes the email from the
server after downloading. (PORT 110)
○ Use’s SMTP to send emails in outbox.
○ Authorisation and Transaction
◆ Authorisation: User supplies username and password
◆ Transaction: Uses RETR 1 (used to retrieve first message),

DELE 1 (delete first message in queue), STAT (number of

messages waiting on server), RETR 1, X (retrieve X number of
line of message 1)

● IMAP4 (Internet Message Access Protocol version 4): A complex

protocol for managing email on the server. (PORT 143)
○ It allows you to organise mail into folders and the state (read,

deleted) is synced across all your devices.

● HTTP (Hypertext Transfer Protocol): The foundation of the web. A
client (browser) sends a request and the server sends a response.
(PORT 80)
● HTTPS (Hypertext Transfer Protocol Secure): HTTP over SSL (secure
socket layer)/TLS (transport layer security) providing encryption.
(PORT 443)
● FTP (File Transfer Protocol): Used for transferring files. (PORT 20, 21)
○ Unique because it uses two connections:
◆ One for command (control). Port 21
◆ Other for the actual file data. Port 20
○ It runs in active (server connects back to client for data) or passive

(client connects to server for both control and data) mode to work
around firewalls.
● Telnet/SSH: Protocols for remote terminal access. Telnet is old and
send everything in cleartext which is unsafe. SSH is its secure and
encrypted replacement. (PORT 23, 22)
○ SSH is more secure and encrypts all traffic, while Telnet deemed

unsafe because it uses cleartext for the username and password.

● NTP (Network Time Protocol): Used to obtain current time from some
servers, doesn’t cater for ETA so response time is always old.
● VoIP (Voice over Internet Protocol): Is intended for transmitting
telephone calls over the network. SIP (Session Initiation Protocol) used
to establish a telephone connection.
● SMB (Server Message Block): Mounts remote file systems on a local
host and is popular in Microsoft environments.
● NFS (Network File System): Mounts remote files systems on a local
host and is popular in UNIX contexts.
● RTSP (Real Time Streaming Protocol): Stream Multimedia
entertainment to users (Internet Radio).
● X Window Protocols: Enables systems to display graphical content on
remote device. Tunnelled via SSH.
Sniffing Traffic:
● WireShark is the tool used for sniffing.
● Most LANs will use Ethernet switches rather than a hub.
● Switch normally only sends traffic to one’s own computer.
● Sniffing is valuable when developing software using network protocols.

Chapter 3: The Application Layer — Network-oriented Protocols

This shift the focus to the behind-the-scenes protocols. These services are the
ones that users rarely see but are essential like naming, configuration and
routing.

Key Concepts

DNS (Domain Name System): The phonebook of the internet. It translates

names of computer into addresses. [Link] to [Link]
● There is a hierarchical Namespace that is organised like a tree. (root
-> .com -> google -> www)
○ TLD (top level domain)
◆ gTLDs (generic)
◇ .com
◇ .gov
◇ .net
◆ ccTLDs (country-code)
◇ .za (Controlled by ZADNA {za Domain Name Authority)
■ Active 2nd level domains
□ [Link]
□ [Link]
□ [Link]
□ [Link]
◇ .sa
◇ .ls
◇ .bw
◆ sTLDs (sponsored)
◇ .pro
◇ .google
◇ .apple
○ The authority at the root of DNS: IANA (Internet Assigned Numbers

Authority)
◆ Operated by ICANN (Internet Corporation for Assigned Names

and Numbers)
○ WHOIS is the protocol that determines who owns/controls a

domain.
Name servers: is a server within DNS
Record Type Description Example
A Maps name to IPv4 www in A is
address [Link]
AAAA Maps name to IPv6 www in AAAA is
address fd00:1234::1
NS Delegates subdomain
to a name server
MX Mail Exchange record @ in MX 10 mail
where to send mail
CNAME Alias – maps one ftp in CNAME is www
name to another
SOA Start of Authority – Primary NS,
metadata about the responsible email,
zone serial, TTL value
PTR Reverse DNS – maps
address to name
@ Represents the
domain itself

SOA Record Fields

● Primary NS — primary DNS server for the zone
● Responsible email — email of admin (@ replaced by . in address)
● Serial — Serial number of zone file
● Refresh — how often secondary checks primary for update
● Retry — how long to wait before retrying a failed zone transfer
● Expire — how long secondary serves data if it cant reach primary
● Minimum TTL — how long clients may cache records

Name Resolution: Recursive vs Iterative

● Recursive: ask one server to fully resolve the name – it queries other
server on you behalf
● Iterative: server refers you to another server and you keep querying
until resolved

Bootstrapping: DCHP
● DCHP = Dynamic Host Configuration Protocol – assigns IP address
and config at boot time
● Provides IP address (lease), default gateway and DNS sever
addresses.
●
Chapter 4: Presentation Layer

This layer deals with encoding and decoding of information for representation
on the network and presentation at the destination.
● The encoder/decoder at the sender must encode in a format that the
receiver decoder can decode.
○ Most of the functions are embedded directly in the application

layer protocols
◆ Like HTTP content-type headers and SMTP MIME headers.

ASCII 7-bit, 128 Characters, US-centric

EBCDIC IBM Mainframe, incompatible with
ASCII
ISO-8859-1 Latin-1, 8-bit extended ASCII
Unicode Universal Standard, variable
encoding width
UTF-8 Variable 1-6 bytes. Backwards
compatible with ASCII
UTF-16 Variable 2 or 4 byte. Similar to
UTF-8
Shift_JS Japanese character encoding.

UTF-8 Byte Structure

0xxxxxxx Single byte (ASCII) -128 options
10xxxxxx Continuation byte - never starts a character
110xxxxx 10xxxxxxx 2-byte sequence - 2048 options
1110xxxx 10xxxxxxx 10xxxxxxx 3-byte sequence - 65536 options
11110xxx … 4-byte sequence
111110xx … 5-byte sequence

Markup Languages
. Agreed Character set: Use unicode or minimal shared set
. Markup: Use escape sequence - HTML: &ecirc for ê, &euml for ë.
LaTeX: \”e for ë, \^e for ê

Key Markup Languages

For Web:
● HTML: Structure + presentation.
For Data exchange:
● XML: Machine-to-machine communication.
For Styling:
● CSS: Separates style from structure in HTML.
ASN.1 (Abstract Syntax Notation One)
This is like a record/structure declaration in a programming language used to
specify syntax of messages exchanged between programs.

Courses ::= SET

{ code VisibleString,
courseName VisibleString,
mark INTEGER
}

-- Example values --
{ {code "COS332", courseName "Networks", mark 55},
{code "COS301", courseName "Project", mark 91}
}

ASN.1 Basic Types and Constructors

● Basic Types: Strings, integers, real numbers
● SEQUENCE: order collection (like struct)
● SET: unordered collection
● CHOICE: alternatives (like union)

ASN.1 Encoding Rules

Encoding Description
BER Basic Encoding Rules — type-
length-value format
CER Canonical Encoding Rules —
removes some BER alternatives
DER Distinguished Encoding Rules —
uses fixed lengths where possible
PER Packed Encoding Rules — more
compact
XER XML Encoding Rules — encodes
ASN.1 using XML (human-
readable)

Real world ASN.1 Usage

– SNMP: Messages specified ASN.1, uses BER encoding
– X.509 certificates: Defined in ASN.1

Non-Textual Data
All modern data is binary but what matters is how it is interpreted.
. Determine the media type
. Determine the encoding within that type
 . Images may contain EXIF metadata
. Container formats wrap multiple pieces without specifying individual
encoding

MIME (Multipurpose Internet Mail Exchange)

Generic solution for representing heterogeneous data in protocols.
There are two types of header:
. Content-Type: type/subtype; parameters
MIME TYPE Meaning
Text/plain Plain unformatted text
Text/html HTML-formattted text
Text/xml XML-formatted text
Image/jpeg JPEG image
Image/png PNG image
Audio/mpeg MP3 audio
Application/msword Microsoft Word document
Multipart/mixed Multiple parts of different types
Multipart/alternative Multiple equivalent representations
(plain + HTML email)
. Content-Transfer-Encoding: Additional Encoding applied to make
content compatible with transport mechanism
Encoding Description
7bit/8bit/binary No additional encoding (identity).
Warns lower layers about format
base64 Encodes binary data as 7-bit ASCII.
Length increases
quoted-printable Keeps printable ASCII; encodes
non-printable as hex
gzip Compressed binary data

Example:

MIME-Version: 1.0
Content-Type: multipart/mixed; boundary="----Part_000"

------Part_000
Content-Type: multipart/alternative; boundary="----Part_001"

------Part_001
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
[plain text body]
 ------Part_001
Content-Type: text/html; charset="us-ascii"
Content-Transfer-Encoding: quoted-printable
[HTML body — same content, different format]

------Part_000
Content-Type: application/msword; name="[Link]"
Content-Transfer-Encoding: base64
Content-Disposition: attachment; filename="[Link]"
[base64 encoded Word document]

Chapter 5: Session Layer

The session layer manages sessions, which are connections that last longer
than a single client/server interaction
– Longer than a single SMTP send or POP3 retrieve operation

Chapter 6: Transport Layer

Known as the pipe between processes communicating across the network.
– It hides network details from application layers above and hides
application details from layers below.

● Process Identification: how end points processes identified? Through

ports using 16 bit numbers
● Reliability level: How reliable should the pipe be? Spectrum from UDP

(unreliable) to TCP, QUIC (fully reliable)

TCP (transport control protocol)

UDP (

Reliability Defined
. Communication should not fail
– TCP: for financial transactions, emails, file transfer — places where
data loss cannot be tolerated
– UDP: VoIP, Video streaming — fraction of a second loss acceptable.
. If it does fail, communicating parties should know it failed.

● Communication failures include:

○ Data may change before arriving
○ Data may never arrive
○ Data may arrive too fast overwhelming receivers
○ Data may arrive out of sequence
○ Data may arrive multiple times duplicates

Connection-oriented (reliable)
– Establishes connection
– Uses connection to communicate
– Terminates connection
– Like a telephone system
– Protocols like TCP and QUIC

Connectionless (unreliable)
– No connection is established
– Sends messages independently
– No delivery is guaranteed
– Like a postal system
– Protocols like UDP

Connection Establishment and Termination

Three-way Handshake (Establishment)

A ⸺> B: A sends SYN

B ⸺> A: B sends SYN+ACK
A ⸺> B: A sends ACK

Three-way Handshake (Termination)

A ⸺> B: A sends FIN

B ⸺> A: B sends FIN+ACK
A ⸺> B: A sends ACK

Flow Control Algorithm

ARQ (Automatic Repeat reQuest) takes flow control algorithms using timers and
add retransmission.
– Stop and Wait
. Send message, stop, wait for acknowledgement
. If ACK received, send next message
. If timeout is hit without ACK received, resend message and restart
timer
○ Problem with this is that its inefficient because both sender and

receiver idle during waits

– Sliding Window
– Window: sequence of sent-but-not-yet-acknowledged messages
– Example: Send msgs 1–8. Msgs 1–4 acknowledged. Window =
{5,6,7,8}
– A limit on window size prevents flooding of the receivers buffer
– Messages are numbered to prevent duplication
– Variants:
◆ GO-BACK-N
◇ If message 5 is lost, resend all subsequent messages (6, 7,
 ◇

8…)
◇ Receiver discards out-of-order messages
◇ Used by older protocols
◆ Selective Repeat
◇ If message 5 is lost, resend only message 5
◇ Receiver buffers out-of-order messages
◇ Modern protocols like TCP

Chapter 7: Network Layer

The network layer routes packets from a source node to a destination node
The Internet Protocol (IP) is an example of a network layer protocol

IPv4

– This is the most widely deployed version of IP

– It is meant to be succeeded by IPv6
– IP provides an unreliable, best effort connectionless service
– It packets are known as datagrams
– These datagrams are share many characteristics with UDP packets
– UDP adds layer 4 functionality to IP
– IP routing algorithm works as:
– If source and destination on the same network, direct delivery
– Consults the routing table for next hop to destination network
– If there is no match, datagram is forwarded to default gateway
– If there is no specified default gateway, datagram is discarded
(That is why IP is unreliable)
– TTL (time-to-live) field prevents routing loops (TTL indicates the
number of hops that the packet has before being discarded)
– Every router subtracts 1 from TTL
– When TTL becomes 0, datagram is discarded

IPv4 addresses

– They are 32-bits, written in dotted-decimal notation

– Like [Link])
– An address has two parts, which are delimited by a subnet mask
– Network portion
– Host portion
– Classful addressing:
○ Class A (8-bit network)
◆ Leading bit is 0
◆ The initial byte, the 0 and seven other bits, identifies the

network
 ◆ Remaining three bytes identifies the host on the network
○ Class B (16-bit network)
◆ If leading bits are 10, it is class B
◆ Initial two bytes identify the network
◆ The final two bytes identify the host on the network
○ Class C (24-bit network)
◆ If leading bits are 110, it is class C
◆ Initial three bytes identify the network
◆ One bytes identifies the host on the network
○ Class D (multicast)
◆ If leading bits are 1110, it is class D
◆ For multicast addressing
◆ No network or host portion exists in this class
○ Class E (reserved)
◆ If leading bits are 1111, it is class E
◆ It is a class reserved for future use
◆ Not currently in use

– Two host numbers do not denote a specific node

– Number of 0
◆ The address [Link]
◆ It is class A because high byte (10) identifies the network
◆ Three lower bytes (0.0.0) identifies the host
◇ Because they are 0’s no host is identified

– Sequence of 1’s in binary

◆ This address indicates that a packet sent to it should be

broadcast to all host on the network

◆ For network [Link], the broadcast address is [Link]

– Because these two address cant be assigned to any host

– A network field of n bit may be used to address 2n-2 hosts
– Class A max of 28-1 = 128 may exist
– Class B max of 216-2 may exist
– Class C max of 2 24-3 may exist

– Netmask is used to indicate which bits in an address form the network

portion and the host portion
– It places a 1 in each network bit and a 0 in each host bit
– Since left part of address is the network part and right is the host
part
– Netmask will always be a sequence of 1’s followed by 0’s
– It is also represented by dotted decimal notation
– For Class A address [Link], class B would be [Link],
class C would be [Link]

– CIDR (ClassLess Inter-Domain Routing) — subnet masks of any length

○ Number of bits of network portion separates by /prefix
◆ [Link]/8, 8 bits is the network portion, 24 bits is the host

portion
○ Subnetting can be used to separate a network into subnetworks
◆ For example when an organisation divides its network based on

the different departments

◆ [Link] is for sales
◆ [Link] is for production
◆ [Link] is for HR
◆ Leaving 16 bits for the hosts
◆ The netmask they now use is [Link]

– Supernetting is used where a number of network addresses are

combined to form a bigger network

Special IPv4 Addresses

Address/Range Purpose
[Link] This host on this network DHCP
[Link]/8 Loopback ([Link] = localhost)
[Link]/8, [Link]/12, Private (RFC 1918)
[Link]/16
[Link]/16 Link-local / APIPA
[Link]/4 Multicast
[Link] Limited broadcast

Fragmentation

– If a datagram is larger than the MTU (Maximum Transmission Unit) of a

link, the router fragments it
– The destination reassembles fragments using:
– Identification field
– Flags field
– Fragments Offset field
– Path MTU Discovery avoid fragmentation by finding the smallest MTU
on the path

Obtaining IP Addresses

– IP addresses are obtained from an ISP

– AfriNIC is the Regional Internet Registry for Africa
– It allocates IPv4/IPv6 blocks to ISPs
– Their static assignment are manually configured

Support Protocols
 ICMP — Internet Control Message Protocol
– It carried error messages (sends control and status messages) and
operational information for IP
– Encapsulated in IP datagrams
– Example of ICMP is echo, the command requests the node at the
destination to echo the included data in the payload.
– Used by ping
– If the destination is unreachable, the router cannot deliver the packet
so TTL will eventually reach 0
– Used by traceroute
– Redirected tells a host a better route exists

ARP — Address Resolution Protocol

– Translates an IP address to a MAC (Media Access Control) address on
the same local network
– Without a MAC address, a frame can’t be addressed to correct the
node on the LAN
– ARP Request: broadcast – “Who has IP address X? Tell IP Y.”
– ARP Reply: unicast – “IP address X is at MAC address M.”
– ARP cache: stores recent mappings and the entries time out

Unicast, Multicasting and broadcasting

– Unicast: One sender, one receiver
– Broadcast: One sender, all nodes on the network segment
– Multicast: One sender, a group of subscribers
– IGMP manages group membership
– Efficient for streaming

Network Address Translation

– NAT allows many private-addressed hosts to share one or a few public
IP addresses
– A NAT router rewrites IP addresses (and port numbers) in packets
crossing the boundary
– This solves IPv4 address exhaustion (the reason why IPv4 has lasted
so long
– Breaks end-to-end principle
– Complicates some protocols like FTP, SIP and IPsec
– PAT/NAPT (Port Address Translation) (also ramps port numbers to
distinguish connections

IPv6

– Uses 128-bit addresses

– Written as 8 groups of 4 hex digits separated by colons)
 – 1111:2222:3333:4444:5555:6666:7777:8888
– Sequence of zeros can be suppressed into
– 2001:0db8:0000:0000:0000:0000:0000:0123 —>
2001:db8::123
– Divided into two parts, network and host fields
– Routing prefix (first part of address) is comparable to network
portion of IPv4
– Initial bits of address indicates the type routable address
– Few bits may also indicate the address is a multicast address
– Interface identifier (final part in address) identifies which node
the address belongs to
– If it has an interface then it probably has a IPv6 address
– It solves exhaustion and add improvements over IPv4
– Address space: it has 3.4*10^38 addresses
– No broadcast
– Uses multicast and anycast instead
– No fragmentation by routers
– Source does Path Maximum Transmission Unit Discovery (PMTUD)
– Header simplified (fixed 40 byte base header)
– Extension headers for options
– Built-in IPsec support

IPv6 Address Types

Prefix Types Equivalent IPv4
::/128 Unspecified [Link]
::1/128 Loopback [Link]
fe80::/10 Link-local (automatic) [Link]/16
fc00::/7 Unique local (private) [Link]/8,
[Link]/16
2000::/3 Global unicast All public IPv4
ff00::/8 Multicast [Link]/4
– Transition mechanism: dual stack (run both), tunnelling (encapsulated
IPv6 in IPv4

Chapter 8: Data Link Layer

The data link layer gets a frame from one directly connected node to the next
Key responsibilities: Media access control (MAC), Data lineation and error
detection

Media Access Control (MAC)

– This deals with the question of whether a node is allowed to transmit
data on the medium that connects it to another node
– All depends on whose turn it is to transmit
– Whether the target node is ready to receive the data
– When multiple nodes share the same physical medium collision occur
– MAC protocols coordinate access

Master/Slave (Polling)

● A master node pulls slaves in turn, asking if they have data to send
● Deterministic but polling overhead may be significant
● Master is a single point of failure

Token Passing

● A token circulates the network and only the node holding the token
can transmit
● Token Ring (IEEE 802.5): ring topology
○ Deterministic
○ Bounded latency
● Token Bus (IEEE 802.4): logical token on a bus topology

Multiple Access (Contention-based)

● ALOHA protocol: transmit whenever ready

○ Retransmit after random backoff on collision
● Slotted ALOHA: transmit only at slot boundaries
● Carrier Sense Multiple Access: listens before transmitting
○ Reduces collisions
● Collision Detection: (CSMA): also detects collision while transmitting
○ Stop and retransmit if collision happens
○ Used by Ethernet on wired networks
● Collision Avoidance (CSMA/CA): sense channel, then waits a random

backoff before retransmitting

○ Used by 802.11 (WiFi)
○ Cannot detect collisions over radio

Data Delineation (Framing)

– The receiver must know where each frame starts and ends in the bit
stream
–
Chapter 9: Physical Layer

Chapter 10: Security