INTERNETWORKING

Until now, we have implicitly assumed that there is a single homogeneous network, with each machine
using the same protocol in each layer. Unfortunately, this assumption is wildly optimistic. Many
different networks exist, including PANs, LANs, MANs, and WANs. We have described Ethernet,
Internet over cable, the fixed and mobile telephone networks, 802.11, 802.16, and more. Numerous
protocols are in widespread use across these networks in every layer. In the following sections, we will
take a careful look at the issues that arise when two or more networks are connected to form an
internetwork, or more simply an internet. If there will always be different networks, it would be
simpler if we did not need to interconnect them. This means that large networks are much more
valuable than small networks because they allow many more connections, so there always will be an
incentive to combine smaller networks. The Internet is the prime example of this interconnection. The
purpose of joining all these networks is to allow users on any of them to communicate with users on all
the other ones. When you pay an ISP for Internet service, you may be charged depending on the
bandwidth of your line, but what you are really paying for is the ability to exchange packets with any
other host that is also connected to the Internet. After all, the Internet would not be very popular if you
could only send packets to other hosts in the same city. Since networks often differ in important ways,
getting packets from one network to another is not always so easy. We must address problems of
heterogeneity, and also problems of scale as the resulting internet grows very large. We will begin by
looking at how networks can differ to see what we are up against. Then we shall see the approach used
so successfully by IP (Internet Protocol), the network layer protocol of the Internet, including
techniques for tunneling through networks, routing in internetworks, and packet fragmentation.

Internetworking is "the concept of interconnecting different types of networks to build a large, global
network" such that any pair of connected hosts can exchange packets. To build an internetwork, the
following are needed: A standardized scheme to address packets to any host on any participating
network; a standardized protocol defining format and handling of transmitted packets; components
interconnecting the participating networks by routing packets to their destinations based on
standardized addresses.
The resulting system of interconnected networks are called an internetwork, or simply an internet.
Internetworking is a combination of the words inter ("between") and networking; not internet-working
or international-network.

 Interconnection of networks: Internetworking started as a way to connect disparate types of

networking technology, but it became widespread through the developing need to connect two or more
local area networks via some sort of wide area network. The original term for an internetwork was
catenet.
The definition of an internetwork today includes the connection of other types of computer networks
such as personal area networks. The network elements used to connect individual networks in the
ARPANET, the predecessor of the Internet, were originally called gateways. Today the
interconnecting gateways are called routers.
Another type of interconnection of networks often occurs within enterprises at the Link Layer of the
networking model, i.e. at the hardware-centric layer below the level of the TCP/IP logical interfaces.
Such interconnection is accomplished with network bridges and network switches. This is sometimes
incorrectly termed internetworking, but the resulting system is simply a larger, single subnetwork, and
no internetworking protocol, such as Internet Protocol, is required to traverse these devices. However,
a single computer network may be converted into an internetwork by dividing the network into
segments and logically dividing the segment traffic with routers. The Internet Protocol is designed to
 provide an unreliable (not guaranteed) packet service across the network. The architecture avoids
intermediate network elements maintaining any state of the network. Instead, this function is assigned
to the endpoints of each communication session. To transfer data reliably, applications must utilize an
appropriate Transport Layer protocol, such as Transmission Control Protocol (TCP), which provides a
reliable stream. Some applications use a simpler, connection-less transport protocol, User Datagram
Protocol (UDP), for tasks which do not require reliable delivery of data or that require real-time
service, such as video streaming or voice chat.

 Networking models: Two architectural models are commonly used to describe the protocols and
methods used in internetworking.
The Open System Interconnection (OSI) reference model was developed under the auspices of the
International Organization for Standardization (ISO) and provides a rigorous description for layering
protocol functions from the underlying hardware to the software interface concepts in user
applications. Internetworking is implemented in the Network Layer (Layer 3) of the model.
The Internet Protocol Suite, also called the TCP/IP model of the Internet was not designed to conform
to the OSI model and does not refer to it in any of the normative specifications in Requests for
Comment and Internet standards.

 Tunneling: Handling the general case of making two different networks interwork is exceedingly
difficult. However, there is a common special case that is manageable even for different network
protocols. This case is where the source and destination hosts are on the same type of network, but
there is a different network in between. As an example, think of an international bank with an IPv6
network in Paris, an IPv6 network in London and connectivity between the offices via the IPv4
Internet. This situation is shown in Figure. The solution to this problem is a technique called tunneling.
 PRINCIPLES OF INTERNETWORKING:
Packet-switching and packet-broadcasting networks grew out of a need to allow the computer user to
have access to resources beyond that available in a single system. In a similar fashion,the resources of
a single network are often inadequate to meet users’ [Link] the networks that might be of
interest exhibit so many differences,it is impractical to consider merging them into a single
[Link],what is needed is the ability to interconnect various networks so that any two stations
on any of the constituent networks can communicate. Table 18.2 lists some commonly used terms
relating to the interconnection of networks, or internetworking. An interconnected set of networks,
from a user’s point of view, may appear simply as a larger network. However, if each of the
constituent networks retains its identity and special mechanisms are needed for communicating across
multiple networks,then the entire configuration is often referred to as an internet. Each constituent
network in an internet supports communication among the devices attached to that network; these
devices are referred to as end systems(ESs). In addition,networks are connected by devices referred to
in the ISO documents as intermediate systems (ISs). Intermediate systems provide a communications
path and perform the necessary relaying and routing functions so that data can be exchanged between
devices attached to different networks in the internet. Two types of ISs of particular interest are bridges
and routers. The differences between them have to do with the types of protocols used for the
internetworking logic. In essence, a bridge operates at layer 2 of the open systems interconnection
(OSI) seven-layer architecture and acts as a relay of frames between similar networks; bridges are
discussed in Chapter 15.A router operates at layer 3 of the OSI architecture and routes packets between
potentially different [Link] the bridge and the router assume that the same upper-layer
protocols are in use. We begin our examination of internetworking with a discussion of the basic
principles of internetworking. We then examine the most important architectural approach to
internetworking:the connectionless router.

Table 18.2 Internetworking Terms

Communication Network: A facility that provides a data transfer service among devices attached to
the network.

Internet: A collection of communication networks interconnected by bridges and/or routers.

Intranet: An internet used by a single organization that provides the key Internet
applications,especially the World Wide [Link] intranet operates within the organization for internal
purposes and can exist as an isolated, self-contained internet,or may have links to the Internet.
Subnetwork Refers to a constituent network of an [Link] avoids ambiguity because the entire
internet,from a user’s point of view,is a single network.

End System (ES): A device attached to one of the networks of an internet that is used to support end-
user applications or services.

Intermediate System (IS): A device used to connect two networks and permit communication
between end systems attached to different networks.

Bridge: An IS used to connect two LANs that use similar LAN [Link] bridge acts as an address
filter,picking up packets from one LAN that are intended for a destination on another LAN and passing
those packets on. The bridge does not modify the contents of the packets and does not add anything to
the [Link] bridge operates at layer 2 of the OSI model.
Router: An IS used to connect two networks that may or may not be [Link] router employs an
internet protocol present in each router and each end system of the [Link] router operates at layer
3 of the OSI model.

 Requirements: The overall requirements for an internetworking facility are as follows-

1. Provide a link between networks. At minimum, a physical and link control connection is
needed.(Router J has physical links to N1 and N2,and on each link there is a data link protocol.)

2. Provide for the routing and delivery of data between processes on different networks.(Application
X on host A exchanges data with application X on host B.)

3. Provide an accounting service that keeps track of the use of the various networks and routers and
maintains status information.

4. Provide the services just listed in such a way as not to require modifications to the networking
architecture of any of the constituent [Link] means that the internetworking facility must
accommodate a number of differences among [Link] include:

• Different addressing schemes: The networks may use different endpoint names and addresses and
directory maintenance schemes. Some form of global network addressing must be provided,as well as
a directory service. (Hosts A and B and router J have globally unique IP addresses.)

• Different maximum packet size: Packets from one network may have to be broken up into smaller
pieces for another. This process is referred to as fragmentation.(N1 and N2 may set different upper
limits on packet sizes.)

• Different network access mechanisms: The network access mechanism between station and
network may be different for stations on different networks.(For example,N1 may be a frame relay
network and N2 an Ethernet network.)

• Different timeouts: Typically, a connection-oriented transport service will await an

acknowledgment until a timeout expires, at which time it will retransmit its block of data. In general,
longer times are required for successful delivery across multiple networks. Internetwork timing
procedures must allow successful transmission that avoids unnecessary retransmissions.

• Error recovery: Network procedures may provide anything from no error recovery up to reliable
end-to-end (within the network) [Link] internetwork service should not depend on nor be
interfered with by the nature of the individual network’s error recovery capability.

• Status reporting: Different networks report status and performance [Link] it must be
possible for the internetworking facility to provide such information on internetworking activity to
interested and authorized processes.

• Routing techniques: Intranetwork routing may depend on fault detection and congestion control
techniques peculiar to each network. The internetworking facility must be able to coordinate these to
route data adaptively between stations on different networks.

• User access control: Each network will have its own user access control technique (authorization for
use of the network).These must be invoked by the internetwork facility as needed. Further,a separate
internetwork access control technique may be required.
• Connection, connectionless: Individual networks may provide connection oriented (e.g., virtual
circuit) or connectionless (datagram) service. It may be desirable for the internetwork service not to
depend on the nature of the connection service of the individual networks. The Internet Protocol (IP)
meets some of these requirements. Others require additional control and application software, as we
shall see in this chapter and the next.

 Connectionless Operation:
In virtually all implementation, internetworking involves connectionless operation at the level of the
Internet [Link] connection-oriented operation corresponds to the virtual circuit mechanism
of a packet-switching network (Figure 10.10), connectionless-mode operation corresponds to the
datagram mechanism of a packet-switching network (Figure 10.9). Each network protocol data unit is
treated independently and routed from source ES to destination ES through a series of routers and
[Link] each data unit transmitted by A,A makes a decision as to which router should receive the
data [Link] data unit hops across the internet from one router to the next until it reaches the
destination [Link] each router, a routing decision is made (independently for each data unit)
concerning the next [Link],different data units may travel different routes between source and
destination ES. All ESs and all routers share a common network-layer
protocol known generically as the Internet [Link] Internet Protocol (IP) was initially developed
for the DARPA internet project and published as RFC 791 and has become an Internet [Link]
this Internet Protocol,a protocol is needed to access a particular [Link],there are typically two
protocols operating in each ES and router at the network layer: an upper sublayer that provides the
internetworking function, and a lower sublayer that provides network access. Figure 18.3 shows an
example.
 INTERNET PROTOCOL
The Internet Protocol (IP) is part of the TCP/IP suite and is the most widely used internetworking
protocol. As with any protocol standard, IP is specified in two parts:

• The interface with a higher layer (e.g., TCP), specifying the services that IP provides.
• The actual protocol format and mechanisms

The services to be provided across adjacent protocol layers (e.g., between IP and TCP) are expressed
in terms of primitives and parameters. A primitive specifies the function to be performed, and the
parameters are used to pass data and control [Link] actual form of a primitive is
implementation [Link] example is a procedure call. IP provides two service primitives at the
interface to the next higher [Link] Send primitive is used to request transmission of a data [Link]
Deliver primitive is used by IP to notify a user of the arrival of a data [Link] parameters associated
with the two primitives are as follows:

• Source address: Internetwork address of sending IP entity.

• Destination address: Internetwork address of destination IP entity. • Protocol: Recipient protocol

entity (an IP user,such as TCP).

• Type-of-service indicators:Used to specify the treatment of the data unit in its transmission through
component networks.

• Identification: Used in combination with the source and destination addresses and user protocol to
identify the data unit [Link] parameter is needed for reassembly and error reporting.

• Don’t fragment identifier: Indicates whether IP can fragment data to accomplish delivery.

• Time to live: Measured in seconds.

• Data length: Length of data being transmitted.

• Option data: Options requested by the IP user.

• Data: User data to be transmitted.

The identification, don’t fragment identifier, and time to live parameters are present in the Send
primitive but not in the Deliver primitive. These three parameters provide instructions to IP that are not
of concern to the recipient IP user. The options parameter allows for future extensibility and for
inclusion of parameters that are usually not invoked. The currently defined options are as follows:

• Security: Allows a security label to be attached to a datagram.

• Source routing: A sequenced list of router addresses that specifies the route to be [Link]
may be strict (only identified routers may be visited) or loose (other intermediate routers may be
visited).

• Route recording: A field is allocated to record the sequence of routers visited by the datagram.

• Stream identification: Names reserved resources used for stream [Link] service provides
special handling for volatile periodic traffic (e.g.,voice).
 • Timestamping: The source IP entity and some or all intermediate routers add a timestamp (precision
to milliseconds) to the data unit as it goes by.

Internet Protocol: The protocol between IP entities is best described with reference to the IP
datagram format. The fields are as follows:

• Version (4 bits): Indicates version number,to allow evolution of the protocol; the value is 4.

• Internet Header Length (IHL) (4 bits): Length of header in 32-bit [Link] minimum value is
five,for a minimum header length of 20 octets.

• DS/ECN (8 bits): Prior to the introduction of differentiated services, this field was referred to as the
Type of Service field and specified reliability, precedence, delay, and throughput parameters. This
interpretation has now been [Link] first six bits of this field are now referred to as the DS
(Differentiated Services) [Link] remaining 2 bits are reserved for an ECN (Explicit Congestion
Notification) field, currently in the process of [Link] ECN field provides for explicit
signaling of congestion in a manner similar to that discussed for frame relay.

• Total Length (16 bits):Total datagram length,including header plus data,in octets.

• Identification (16 bits): A sequence number that, together with the source address,destination
address,and user protocol,is intended to identify a datagram [Link],this number should be
unique for the datagram’s source address, destination address, and user protocol for the time during
which the datagram will remain in the internet.

• Flags (3 bits): Only two of the bits are currently [Link] More bit is used for fragmentation and
reassembly, as previously explained. The Don’t Fragment bit prohibits fragmentation when [Link] bit
may be useful if it is known that the destination does not have the capability to reassemble fragments.
However, if this bit is set, the datagram will be discarded if it exceeds the maximum size of an en route
network. Therefore, if the bit is set, it may be advisable to use source routing to avoid networks with
small maximum packet size.

• Fragment Offset (13 bits): Indicates where in the original datagram this fragment belongs,
measured in 64-bit [Link] implies that fragments otherthan the last fragment must contain a data
field that is a multiple of 64 bits in length.
• Time to Live (8 bits): Specifies how long,in seconds,a datagram is allowed to remain in the
[Link] router that processes a datagram must decrease the TTL by at least one,so the TTL is
similar to a hop count.

• Protocol (8 bits): Indicates the next higher level protocol that is to receive the data field at the
destination;thus,this field identifies the type of the next header in the packet after the IP header.
Example values are A complete list is maintained at [Link] assignments/protocol-
numbers.

• Header Checksum (16 bits): An error-detecting code applied to the header [Link] some
header fields may change during transit (e.g.,Time to Live, fragmentation-related fields),this is
reverified and recomputed at each router. The checksum is formed by taking the ones complement of
the 16-bit ones complement addition of all 16-bit words in the header. For purposes of computation,the
checksum field is itself initialized to a value of zero.5

• Source Address (32 bits): Coded to allow a variable allocation of bits to specify the network and the
end system attached to the specified network, as discussed subsequently.

• Destination Address (32 bits): Same characteristics as source address.

• Options (variable): Encodes the options requested by the sending user.

• Padding (variable): Used to ensure that the datagram header is a multiple of 32 bits in length.

• Data (variable): The data field must be an integer multiple of 8 bits in length. The maximum length
of the datagram (data field plus header) is 65,535 octets. It should be clear how the IP services
specified in the Send and Deliver primitives map into the fields of the IP datagram.

 IP Addresses:
The source and destination address fields in the IP header each contain a 32-bit global internet
address,generally consisting of a network identifier and a host identifier. Network Classes The
address is coded to allow a variable allocation of bits to specify network and host, as depicted in
Figure 18.7. This encoding provides flexibility in assigning addresses to hosts and allows a mix of
network sizes on an internet. The three principal network classes are best suited to the following
conditions:

• Class A: Few networks,each with many hosts

• Class B: Medium number of networks, each with a medium number of hosts

• Class C: Many networks,each with a few hosts.

IP addresses are usually written in dotted decimal notation, with a decimal number representing each
of the octets of the 32-bit address. For example, the IP address 11000000 11100100 00010001
00111001 is written as [Link].

 Subnets and Subnet Masks:

concept of subnet was introduced to address the following requirement. Consider an internet that
includes one or more WANs and a number of sites,each of which has a number of [Link] would
 like to allow arbitrary complexity of interconnected LAN structures within an organization while
insulating the overall internet against explosive growth in network numbers and routing
[Link] approach to this problem is to assign a single network number to all of the LANs at
a [Link] the point of view of the rest of the internet,there is a single network at that site,which
simplifies addressing and [Link] allow the routers within the site to function properly,each
LAN is assigned a subnet [Link] hostportion of the internet address is partitioned into a
subnet number and a host number to accommodate this new level of addressing. Within the
subnetted network, the local routers must route on the basis of an extended network number
consisting of the network portion of the IP address and the subnet [Link] bit positions
containing this extended network number are indicated by the address [Link] use of the address
mask allows the host to determine whether an outgoing datagram is destined for a host on the same
LAN (send directly) or another LAN (send datagram to router).It is assumed that some other means
(e.g., manual configuration) are used to create address masks and make them known to the local
routers.

Internet Protocol Version 6 (IPv6):

The Internet Protocol (IP) has been the foundation of the Internet and virtually all multivendor private
[Link] protocol is reaching the end of its useful life and a new protocol, known as IPv6 (IP
version 6), has been defined to ultimately replace IP.

IP Next Generation: The driving motivation for the adoption of a new version of IP was the limitation
imposed by the 32-bit address field in [Link] a 32-bit address field,it is possible in principle to
assign different addresses, which is over 4 billion possible addresses. One might think that this number
of addresses was more than adequate to meet addressing needs on the [Link],in the late
1980s it was perceived that there would be a problem, and this problem began to manifest itself in the
early 1990s. Reasons for the inadequacy of 32-bit addresses include the following:

• The two-level structure of the IP address (network number, host number) is convenient but wasteful
of the address space. Once a network number is assigned to a network, all of the host-number
addresses for that network number are assigned to that [Link] address space for that network
maybe sparsely used,but as far as the effective IP address space is concerned,if a network number is
used,then all addresses within the network are used.

• The IP addressing model generally requires that a unique network number be assigned to each IP
network whether or not it is actually connected to the Internet.

• Networks are proliferating rapidly. Most organizations boast multiple LANs, not just a single LAN
[Link] networks have rapidly assumed a major [Link] Internet itself has grown explosively
for years.

• Growth of TCP/IP usage into new areas will result in a rapid growth in the demand for unique IP
[Link] include using TCP/IP to interconnect electronic point-of-sale terminals and for
cable television receivers.

• Typically,a single IP address is assigned to each host.A more flexible arrangement is to allow
multiple IP addresses per [Link], of course, increases the demand for IP addresses.
 So the need for an increased address space dictated that a new version of IP was needed. In
addition, IP is a very old protocol, and new requirements in the areas of address configuration, routing
flexibility, and traffic support had been defined. In response to these needs,the Internet Engineering
Task Force (IETF) issued a call for proposals for a next generation IP (IPng) in July of 1992. A
number of proposals were received, and by 1994 the final design for IPng emerged.A major milestone
was reached with the publication of RFC 1752, ―The Recommendation for the IP Next Generation
Protocol,‖issued in January 1995. IPv6 includes the following enhancements over IPv4:

• Expanded address space: IPv6 uses 128-bit addresses instead of the 32-bit addresses of [Link]
is an increase of address space by a factor of It has been pointed out [HIND95] that this allows on the
order of unique addresses per square meter of the surface of the earth. Even if addresses are very
inefficiently allocated, this address space seems inexhaustible.

• Improved option mechanism: IPv6 options are placed in separate optional headers that are located
between the IPv6 header and the transport-layer [Link] of these optional headers are not
examined or processed by any router on the packet’s [Link] simplifies and speeds up router
processing of IPv6 packets compared to IPv4 datagrams.7 It also makes it easier to add additional
options.

• Address autoconfiguration: This capability provides for dynamic assignment of IPv6 addresses.

• Increased addressing flexibility: IPv6 includes the concept of an anycast address,for which a packet
is delivered to just one of a set of [Link] scalability of multicast routing is improved by adding a
scope field to multicast addresses.

• Support for resource allocation: IPv6 enables the labeling of packets belonging to a particular
traffic flow for which the sender requests special handling. This aids in the support of specialized
traffic such as real-time video. All of these features are explored in the remainder of this section.

 IPv6 Structure: An IPv6 protocol data unit (known as a packet) has the following general
form:

The only header that is required is referred to simply as the IPv6 [Link] is of fixed size with a
length of 40 octets,compared to 20 octets for the mandatory portion of the IPv4 header. The following
extension headers have been defined:

• Hop-by-Hop Options header:Defines special options that require hop-by-hop processing

• Routing header: Provides extended routing,similar to IPv4 source routing

• Fragment header: Contains fragmentation and reassembly information

• Authentication header: Provides packet integrity and authentication

• Encapsulating Security Payload header: Provides privacy

• Destination Options header: Contains optional information to be examined by the destination

node.

 IPv6 Header:
The IPv6 header has a fixed length of 40 octets, consisting of the following fields:

• Version (4 bits): Internet protocol version number;the value is 6.

• DS/ECN (8 bits): Available for use by originating nodes and/or forwarding routers for differentiated
services and congestion functions, as described for the IPv4 DS/ECN field.

• Flow Label (20 bits):May be used by a host to label those packets for which it is requesting special
handling by routers within a network;discussed subsequently.

• Payload Length (16 bits): Length of the remainder of the IPv6 packet following the header, in
octets. In other words, this is the total length of all of the extension headers plus the transport-level
PDU.

• Next Header (8 bits): Identifies the type of header immediately following the IPv6 header; this will
either be an IPv6 extension header or a higher-layer header,such as TCP or UDP.

• Hop Limit (8 bits):The remaining number of allowable hops for this [Link] hop limit is set to
some desired maximum value by the source and decremented by 1 by each node that forwards the
[Link] packet is discarded if Hop Limit is decremented to [Link] is a simplification over the
processing required for the Time to Live field of [Link] consensus was that the extra effort in
accounting for time intervals in IPv4 added no significant value to the [Link] fact, IPv4 routers,as
a general rule,treat the Time to Live field as a hop limit field.

• Source Address (128 bits): The address of the originator of the packet.

• Destination Address (128 bits): The address of the intended recipient of the [Link] may not in
fact be the intended ultimate destination if a Routing header is present,as explained subsequently.

Although the IPv6 header is longer than the mandatory portion of the IPv4 header (40 octets
versus 20 octets), it contains fewer fields (8 versus 12). Thus, routers have less processing to do per
header,which should speed up routing.

 IPv6 Addresses: IPv6 addresses are 128 bits in [Link] are assigned to
individual interfaces on nodes,not to the nodes themselves.8A single interface may have multiple
unique unicast addresses. Any of the unicast addresses associated with a node’s interface may be
used to uniquely identify that node. The combination of long addresses and multiple addresses per
interface enables improved routing efficiency over IPv4. In IPv4, addresses generally do not have a
structure that assists routing, and therefore a router may need to maintain huge table of routing paths.
Longer internet addresses allow for aggregating addresses by hierarchies of network,access
 provider,geography,corporation,and so on. Such aggregation should make for smaller routing tables
and faster table lookups. The allowance for multiple addresses per interface would allow a subscriber
that uses multiple access providers across the same interface to have separate addresses aggregated
under each provider’s address space. IPv6 allows three types of addresses:

• Unicast: An identifier for a single interface.A packet sent to a unicast address is delivered to the
interface identified by that address.

• Anycast: An identifier for a set of interfaces (typically belonging to different nodes).A packet sent to
an anycast address is delivered to one of the interfaces identified by that address (the ―nearest‖ one,
according to the routing protocols’ measure of distance).

• Multicast: An identifier for a set of interfaces (typically belonging to different nodes).A packet sent
to a multicast address is delivered to all interfaces identified by that address.

TRANSMISSION CONTROL PROTOCOL:

The transmission Control Protocol (TCP) is one of the most important protocols of Internet
Protocols suite. It is most widely used protocol for data transmission in communication
network such as internet.

 Features
 TCP is reliable protocol. That is, the receiver always sends either positive or negative
acknowledgement about the data packet to the sender, so that the sender always has bright clue
about whether the data packet is reached the destination or it needs to resend it.
 TCP ensures that the data reaches intended destination in the same order it was sent.
 TCP is connection oriented. TCP requires that connection between two remote points be
established before sending actual data.
 TCP provides error-checking and recovery mechanism.
 TCP provides end-to-end communication.
 TCP provides flow control and quality of service.
 TCP operates in Client/Server point-to-point mode.
 TCP provides full duplex server, i.e. it can perform roles of both receiver and sender.

 Header
The length of TCP header is minimum 20 bytes and maximum 60 bytes.

 Source Port (16-bits): It identifies source port of the application process on the sending
device.
 Destination Port (16-bits): It identifies destination port of the application process on the
receiving device.
 Sequence Number (32-bits): Sequence number of data bytes of a segment in a session.
 Acknowledgement Number (32-bits): When ACK flag is set, this number contains the next
sequence number of the data byte expected and works as acknowledgement of the previous
data received.
 Data Offset (4-bits): This field implies both, the size of TCP header (32-bit words) and the
-bits): Reserved for
future use and all are set zero by default.
 Flags (1-bit each):
o NS: Nonce Sum bit is used by Explicit Congestion Notification signaling process.
o CWR: When a host receives packet with ECE bit set, it sets Congestion Windows Reduced
to acknowledge that ECE received.
o ECE: It has two meanings:
i. If SYN bit is clear to 0, then ECE means that the IP packet has its CE (congestion
experience) bit set.
ii. If SYN bit is set to 1, ECE means that the device is ECT capable.

o URG: It indicates that Urgent Pointer field has significant data and should be processed.
o ACK: It indicates that Acknowledgement field has significance. If ACK is cleared to 0, it
indicates that packet does not contain any acknowledgement.
o PSH: When set, it is a request to the receiving station to PUSH data as soon as it comes to
the receiving application without buffering it.
o RST: Reset flag has the following features:
i. It is used to refuse an incoming connection.
ii. It is used to reject a segment.
iii. It is used to restart a connection.
o SYN: This flag is used to set up a connection between hosts.
o FIN: This flag is used to release a connection and no more data is exchanged thereafter.
Because packets with SYN and FIN flags have sequence numbers, they are processed in
correct order.
 Windows Size: This field is used for flow control between two stations and indicates the
amount of buffer (in bytes) the receiver has allocated for a segment, i.e. how much data is the
receiver expecting.
 Checksum: This field contains the checksum of Header, Data, and Pseudo Headers.
 Urgent Pointer: It points to the urgent data byte if URG flag is set to 1.
 Options: It facilitates additional options which are not covered by the regular header. Option
field is always described in 32-bit words. If this field contains data less than 32-bit, padding is
used to cover the remaining bits to reach 32bit boundary.
 Addressing:
TCP communication between two remote hosts is done by means of port numbers (TSAPs).
Ports numbers can range from 0 – 65535 which are divided as:
 System Ports (0 – 1023)
 User Ports ( 1024 – 49151)
 Private/Dynamic Ports (49152 – 65535)

 Connection Management:TCP communication works in Server/Client model. The client

initiates the connection and the server either accepts or rejects it. Three-way handshaking is
used for connection management.
 Establishment Client initiates the connection and sends the segment with a Sequence
number. Server acknowledges it back with its own Sequence number and ACK of
client’s segment which is one more than client’s Sequence number. Client after
receiving ACK of its segment sends an acknowledgement of Server’s response.
 Release Either of server and client can send TCP segment with FIN flag set to 1.
When the receiving end responds it back by ACKnowledging FIN, that direction of
TCP communication is closed and connection is released.

 Bandwidth Management: TCP uses the concept of window size to accommodate the need of
Bandwidth management. Window size tells the sender at the remote end the number of data
byte segments the receiver at this end can receive. TCP uses slow start phase by using window
size 1 and increases the window size exponentially after each successful communication. For
example, the client uses windows size 2 and sends 2 bytes of data. When the
acknowledgement of this segment received the windows size is doubled to 4 and next the
segment sent will be 4 data bytes long. When the acknowledgement of 4-byte data segment is
received, the client sets windows size to 8 and so on. If an acknowledgement is missed, i.e.
data lost in transit network or it received NACK, then the window size is reduced to half and
slow start phase starts again.

 Error Control and Flow Control: TCP uses port numbers to know what application process
it needs to handover the data segment. Along with that, it uses sequence numbers to
synchronize itself with the remote host. All data segments are sent and received with sequence
 numbers. The Sender knows which last data segment was received by the Receiver when it
gets ACK. The Receiver knows about the last segment sent by the Sender by referring to the
sequence number of recently received packet. If the sequence number of a segment recently
received does not match with the sequence number the receiver was expecting, then it is
discarded and NACK is sent back. If two segments arrive with the same sequence number, the
TCP timestamp value is compared to make a decision.

 Multiplexing: The technique to combine two or more data streams in one session is called
Multiplexing. When a TCP client initializes a connection with Server, it always refers to a
well-defined port number which indicates the application process. The client itself uses a
randomly generated port number from private port number pools. Using TCP Multiplexing, a
client can communicate with a number of different application process in a single session. For
example, a client requests a web page which in turn contains different types of data (HTTP,
SMTP, FTP etc.) the TCP session timeout is increased and the session is kept open for longer
time so that the threeway handshake overhead can be avoided. This enables the client system
to receive multiple connection over single virtual connection. These virtual connections are not
good for Servers if the timeout is too long.

 Congestion Control: When large amount of data is fed to system which is not capable of
handling it, congestion occurs. TCP controls congestion by means of Window mechanism.
TCP sets a window size telling the other end how much data segment to send. TCP may use

 Timer Management: TCP uses different types of timers to control and management various
tasks:
 Keep-alive timer:
-alive time expires, the host sends a probe to check if the
connection still exists.
 Retransmission timer
acknowledgement of sent data does not receive within the Retransmission time, the
data segment is sent again.
 Timed-Wait: of the hosts waits for a Timed-

the other end has received the acknowledgement of its connection termination request.
-out can be a maximum of 240 seconds (4 minutes).

 Crash Recovery: TCP is very reliable protocol. It provides sequence number to each of byte
sent in segment. It provides the feedback mechanism i.e. when a host receives a packet, it is
bound to ACK that packet having the next sequence number expected (if it is not the last
segment). When a TCP Server crashes mid-way communication and re-starts its process, it
sends TPDU broadcast to all its hosts. The hosts can then send the last data segment which
was never unacknowledged and carry onwards.
 USER DATAGRAM PROTOCOL:
The User Datagram Protocol (UDP) is simplest Transport Layer communication protocol available of
the TCP/IP protocol suite. It involves minimum amount of communication mechanism. UDP is said to
be an unreliable transport protocol but it uses IP services which provides best effort delivery
mechanism. In UDP, the receiver does not generate an acknowledgement of packet received and in
turn, the sender does not wait for any acknowledgement of packet sent. This shortcoming makes this
protocol unreliable as well as easier on processing.

 Requirement of UDP: A question may arise, why do we need an unreliable protocol to

transport the data? We deploy UDP where the acknowledgement packets share significant
amount of bandwidth along with the actual data. For example, in case of video streaming,
thousands of packets are forwarded towards its users. Acknowledging all the packets is
troublesome and may contain huge amount of bandwidth wastage. The best delivery
mechanism of underlying IP protocol ensures best efforts to deliver its packets, but even if
some packets in video streaming get lost, the impact is not calamitous and can be ignored
easily. Loss of few packets in video and voice traffic sometimes goes unnoticed.

 Features:
 UDP is used when acknowledgement of data does not hold any significance.
 UDP is good protocol for data flowing in one direction.
 UDP is simple and suitable for query based communications.
 UDP is not connection oriented.
 UDP does not provide congestion control mechanism.
 UDP does not guarantee ordered delivery of data.
 UDP is stateless.
 UDP is suitable protocol for streaming applications such as VoIP, multimedia
streaming.

 UDP Header: UDP header is as simple as its function. UDP header contains four main
parameters:
1. Source Port: This 16 bits information is used to identify the source port of the packet.
2. Destination Port: This 16 bits information is used identify application level service on
destination machine.
3. Length: Length field specifies the entire length of UDP packet (including header). It is 16-
bits field and minimum value is 8-byte, i.e. the size of UDP header itself. 4. Checksum: This
field stores the checksum value generated by the sender before sending. IPv4 has this field as
optional so when checksum field does not contain any value, it is made 0 and all its bits are set
to zero.
  UDP application: Here are few applications where UDP is used to transmit data:
 Domain Name Services
 Simple Network Management Protocol
 Trivial File Transfer Protocol
 Routing Information Protocol
 Kerberos

Simple Mail Transfer Protocol (SMTP):

Simple Mail Transfer Protocol (SMTP) is an Internet standard for email transmission. First defined
by RFC 821 in 1982, it was updated in 2008 with Extended SMTP additions by RFC 5321; which is
the protocol in widespread use today.
Mail servers and other mail transfer agents use SMTP to send and receive mail messages on TCP port
25. Although proprietary systems such as Microsoft Exchange and IBM Notes and webmail systems
such as [Link], Gmail and Yahoo! Mail may use their own non-standard protocols internally, all
use SMTP when sending or receiving email from outside their own systems.
User-level client mail applications typically use SMTP only for sending messages to a mail server for
relaying. For this, mail clients typically submit their outgoing emails to a mail server on port 587 or
465 as per RFC 8314. For retrieving messages, IMAP and POP3 are standard, but proprietary servers
also often prefer their own protocols, such as Exchange ActiveSync.
 Mail processing model:
Email is submitted by a mail client (mail user agent, MUA) to a mail server (mail submission agent,
MSA) using SMTP on TCP port 587. Most mailbox providers still allow submission on traditional port
25. The MSA delivers the mail to its mail transfer agent (mail transfer agent, MTA). Often, these two
agents are instances of the same software launched with different options on the same machine. Local
processing can be done either on a single machine, or split among multiple machines; mail agent
processes on one machine can share files, but if processing is on multiple machines, they transfer
messages between each other using SMTP, where each machine is configured to use the next machine
as a smart host. Each process is an MTA (an SMTP server) in its own right.

The boundary MTA uses the Domain name system (DNS) to look up the mail exchanger record (MX
record) for the recipient's domain (the part of the email address on the right of @). The MX record
contains the name of the target host. Based on the target host and other factors, the MTA selects an
exchange server: see the article MX record. The MTA connects to the exchange server as an SMTP
client.
Message transfer can occur in a single connection between two MTAs, or in a series of hops through
intermediary systems. A receiving SMTP server may be the ultimate destination, an intermediate
"relay" (that is, it stores and forwards the message) or a "gateway" (that is, it may forward the message
using some protocol other than SMTP). Each hop is a formal handoff of responsibility for the message,
whereby the receiving server must either deliver the message or properly report the failure to do so.
Once the final hop accepts the incoming message, it hands it to a mail delivery agent (MDA) for local
delivery. An MDA saves messages in the relevant mailbox format. As with sending, this reception can
be done using one or multiple computers, but in the diagram above the MDA is depicted as one box
near the mail exchanger box. An MDA may deliver messages directly to storage, or forward them over
a network using SMTP or other protocol such as Local Mail Transfer Protocol (LMTP), a derivative of
SMTP designed for this purpose.
Once delivered to the local mail server, the mail is stored for batch retrieval by authenticated mail
clients (MUAs). Mail is retrieved by end-user applications, called email clients, using Internet
Message Access Protocol (IMAP), a protocol that both facilitates access to mail and manages stored
mail, or the Post Office Protocol (POP) which typically uses the traditional mbox mail file format or a
proprietary system such as Microsoft Exchange/Outlook or Lotus Notes/Domino. Webmail clients may
use either method, but the retrieval protocol is often not a formal standard.
SMTP defines message transport, not the message content. Thus, it defines the mail envelope and its
parameters, such as the envelope sender, but not the header (except trace information) nor the body of
the message itself. STD 10 and RFC 5321 define SMTP (the envelope), while STD 11 and RFC 5322
define the message (header and body), formally referred to as the Internet Message Format.
 Protocol overview:

SMTP is a connection-oriented, protocol in which a mail sender communicates with a mail receiver by
issuing command strings and supplying necessary data over a reliable ordered data stream channel,
typically a Transmission Control Protocol (TCP) connection. An SMTP session consists of commands
originated by an SMTP client (the initiating agent, sender, or transmitter) and corresponding responses
from the SMTP server (the listening agent, or receiver) so that the session is opened, and session
parameters are exchanged. A session may include zero or more SMTP transactions. An SMTP
transaction consists of three command/reply sequences:

1. MAIL command, to establish the return address, also called return-path, reverse-path, bounce
address, mfrom, or envelope sender.
2. RCPT command, to establish a recipient of the message. This command can be issued multiple
times, one for each recipient. These addresses are also part of the envelope.
3. DATA to signal the beginning of the message text; the content of the message, as opposed to its
envelope. It consists of a message header and a message body separated by an empty line. DATA
is actually a group of commands, and the server replies twice: once to the DATA command itself,
to acknowledge that it is ready to receive the text, and the second time after the end-of-data
sequence, to either accept or reject the entire message.
Besides the intermediate reply for DATA, each server's reply can be either positive (2xx reply codes)
or negative. Negative replies can be permanent (5xx codes) or transient (4xx codes). A reject is a
permanent failure and the client should send a bounce message to the server it received it from. A drop
is a positive response followed by message discard rather than delivery.
The initiating host, the SMTP client, can be either an end-user's email client, functionally identified as
a mail user agent (MUA), or a relay server's mail transfer agent (MTA), that is an SMTP server acting
as an SMTP client, in the relevant session, in order to relay mail. Fully capable SMTP servers maintain
queues of messages for retrying message transmissions that resulted in transient failures.

 SMTP vs mail retrieval:

SMTP is a delivery protocol only. In normal use, mail is "pushed" to a destination mail server (or next-
hop mail server) as it arrives. Mail is routed based on the destination server, not the individual user(s)
to which it is addressed. Other protocols, such as the Post Office Protocol (POP) and the Internet
Message Access Protocol (IMAP) are specifically designed for use by individual users retrieving
messages and managing mail boxes. To permit an intermittently-connected mail server to pull
messages from a remote server on demand, SMTP has a feature to initiate mail queue processing on a
remote server (see Remote Message Queue Starting below). POP and IMAP are unsuitable protocols
for relaying mail by intermittently-connected machines; they are designed to operate after final
delivery, when information critical to the correct operation of mail relay (the "mail envelope") has
been removed.

 Outgoing mail SMTP server:

An email client needs to know the IP address of its initial SMTP server and this has to be given as part
of its configuration (usually given as a DNS name). This server will deliver outgoing messages on
behalf of the user.
 Outgoing mail server access restrictions
Server administrators need to impose some control on which clients can use the server. This enables
them to deal with abuse, for example spam. Two solutions have been in common use:
 In the past, many systems imposed usage restrictions by the location of the client, only permitting
usage by clients whose IP address is one that the server administrators control. Usage from any other
client IP address is disallowed.
 Modern SMTP servers typically offer an alternative system that requires authentication of clients by
credentials before allowing access.


 Spoofing and spamming

The original design of SMTP had no facility to authenticate senders, or check that servers were
authorized to send on their behalf, with the result that email spoofing is possible, and commonly used
in email spam and phishing.
Occasional proposals are made to modify SMTP extensively or replace it completely. One example of
this is Internet Mail 2000, but neither it, nor any other has made much headway in the face of the
network effect of the huge installed base of classic SMTP. Instead, mail servers now use a range of
techniques, including DomainKeys Identified Mail, Sender Policy Framework and DMARC, DNSBLs
and greylisting to reject or quarantine suspicious emails.

MIME (Multipurpose Internet Mail Extensions)

MIME stands for (Multipurpose Internet Mail Extensions). It is widely used internet standard for
coding binary files to send them as e-mail attachments over the internet. MIME allows an E-mail
message to contain a non-ASCII file such as a video image or a sound and it provides a mechanism to
transfer a non text characters to text characters.

• MIME was invented to overcome the following limitations of SMTP:

1. SMTP cannot transfer executable files and binary objects.
2. SMTP cannot transmit text data of other language, e.g. French, Japanese, Chinese etc, as these
are represented in 8-bit codes.
[Link] services may reject mails having size greater than a certain size.
4. SMTP cannot handle non-textual data such as pictures, images, and video/audio content.

• The MIME specification includes the following elements:

1. Message header fields. Five message header fields are defined. These fields provide information
about the body of the message.
2. Content formats. A number of content formats are defined, thus standardizing representations
that support multimedia electronic mail.
3. Transfer encoding. Transfer encoding are defined that enable the conversion of any content
format into a form that is protected from alteration by the mail system.
Traditional e-mail sent over the Internet using Simple Mail Transfer Protocol (SMTP) as specified by
Request for Comments (The IETF standards documents are called RFC) 822 defines messages as
consisting of a header and a body part, both of which are encoded using 7-bit ASCII text encoding.
The header of an SMTP message consists of a series of field/value pairs that are structured so that the
message can be delivered to its intended recipient. The body is unstructured text and contains the
actual message.

Multipurpose Internet Mail Extensions (MIME) five additional extensions to SMTP message .ers,
supports multipart messages with more two parts, and allows the encoding of 8-bit binary data such as
image files so that they can be using SMTP. The encoding method for translation binary information
used by MIME, Base64 Encoding, essentially provides a mechanism for translating non text
information into text characters. The MIME extensions are implemented as fields in the e-mail
message header. These fields are the following: Content type, Content transfer encoding method,
MME version number Content ID (optional), Content description (optional).

 MIME Header
The five header fields defined in MIME are as follows:
1. MIME-version. It indicates the MIME version being used. The current version is 1.1. It is
represented as : MIME-version: 1.1.
2. Content-type. It describes the type and subtype of the data in the body of the message. The content
type and content subtype are separated by slash. This field describes how the object in the body is to be
interpreted. The default value is plaintext in US ASCII. Content type field is represented as:
3. Content-transfer encoding. It describes how the object within the body has been encoded to US
ASCII to make it acceptable for mail transfer. Thus it specifies the method used to encode the message
into 0s and 1s for transport.
4. Content-Id. It is used to uniquely identify the MIME entities in multiple contexts i.e. it uniquely
identifies the whole message in a multiple message environment.
5. Content-description. It is a plaintext description of the object within the body; It specifies whether
the body is image, audio or video.
 Hypertext Transfer Protocol (HTTP)

The Hypertext Transfer Protocol (HTTP) is an application protocol for distributed, collaborative,
hypermedia information systems. HTTP is the foundation of data communication for the World Wide
Web, where hypertext documents include hyperlinks to other resources that the user can easily access,
for example by a mouse click or by tapping the screen. HTTP was developed to facilitate hypertext and
the World Wide Web.
Development of HTTP was initiated by Tim Berners-Lee at CERN in 1989. Development of HTTP
standards was coordinated by the Internet Engineering Task Force (IETF) and the World Wide Web
Consortium (W3C), culminating in the publication of a series of Requests for Comments (RFCs). The
first definition of HTTP/1.1, the version of HTTP in common use, occurred in RFC 2068 in 1997,
although this was made obsolete by RFC 2616 in 1999 and then again by the RFC 7230 family of
RFCs in 2014.
A later version, the successor HTTP/2, was standardized in 2015 (and HTTP/3 is its proposed
successor (Internet Draft), that builds on HTTP/2), and is now supported by major web servers and
browsers.

 Technical overview
HTTP functions as a request–response protocol in the client–server computing model. A web browser,
for example, may be the client and an application running on a computer hosting a website may be the
server. The client submits an HTTP request message to the server. The server, which provides
resources such as HTML files and other content, or performs other functions on behalf of the client,
returns a response message to the client. The response contains completion status information about
the request and may also contain requested content in its message body. HTTP is designed to permit
intermediate network elements to improve or enable communications between clients and servers.
High-traffic websites often benefit from web cache servers that deliver content on behalf of upstream
servers to improve response time. Web browsers cache previously accessed web resources and reuse
them, when possible, to reduce network traffic. HTTP proxy servers at private network boundaries can
facilitate communication for clients without a globally routable address, by relaying messages with
external servers.
HTTP is an application layer protocol designed within the framework of the Internet protocol suite. Its
definition presumes an underlying and reliable transport layer protocol,[6] and Transmission Control
Protocol (TCP) is commonly used. However, HTTP can be adapted to use unreliable protocols such as
the User Datagram Protocol (UDP), for example in HTTPU and Simple Service Discovery Protocol
(SSDP).
HTTP resources are identified and located on the network by Uniform Resource Locators (URLs),
using the Uniform Resource Identifiers (URI's) schemes http and https. URIs and hyperlinks in HTML
documents form interlinked hypertext documents.
HTTP/1.1 is a revision of the original HTTP (HTTP/1.0). In HTTP/1.0 a separate connection to the
same server is made for every resource request. HTTP/1.1 can reuse a connection multiple times to
download images, scripts, stylesheets, etc after the page has been delivered. HTTP/1.1
communications therefore experience less latency as the establishment of TCP connections presents
considerable overhead. HTTP/2 was published as RFC 7540 in May 2015.
 Year HTTP Version
1991 0.9
1996 1.0
1997 1.1
2015 2.0

 HTTP session:
An HTTP session is a sequence of network request-response transactions. An HTTP client initiates a
request by establishing a Transmission Control Protocol (TCP) connection to a particular port on a
server (typically port 80, occasionally port 8080. An HTTP server listening on that port waits for a
client's request message. Upon receiving the request, the server sends back a status line, such as
"HTTP/1.1 200 OK", and a message of its own. The body of this message is typically the requested
resource, although an error message or other information may also be returned

 Persistent connections: HTTP/0.9 and 1.0, the connection is closed after a single
request/response pair. In HTTP/1.1 a keep-alive-mechanism was introduced, where a
connection could be reused for more than one request. Such persistent connections reduce
request latency perceptibly, because the client does not need to re-negotiate the TCP 3-Way-
Handshake connection after the first request has been sent. Another positive side effect is that,
in general, the connection becomes faster with time due to TCP's slow-start-mechanism.
Version 1.1 of the protocol also made bandwidth optimization improvements to HTTP/1.0. For
example, HTTP/1.1 introduced chunked transfer encoding to allow content on persistent
connections to be streamed rather than buffered. HTTP pipelining further reduces lag time,
allowing clients to send multiple requests before waiting for each response. Another addition
to the protocol was byte serving, where a server transmits just the portion of a resource
explicitly requested by a client.
 HTTP session state: HTTP is a stateless protocol. A stateless protocol does not require the
HTTP server to retain information or status about each user for the duration of multiple
requests. However, some web applications implement states or server side sessions using for
instance HTTP cookies or hidden variables within web forms.

 Message format: The client and server communicate by sending plain-text (ASCII) messages.
The client sends requests to the server and the server sends responses.

1. Request message.
The request message consists of the following:

 a request line request header fields (e.g., Accept-Language: en).

 an empty line
 an optional message body

 Request methods: HTTP defines methods to indicate the desired action to be performed on
the identified resource. Method names are case sensitive:

GET:The GET method requests a representation of the specified resource.

 HEAD:The HEAD method asks for a response identical to that of a GET request, but without the
response body. This is useful for retrieving meta-information written in response headers, without
having to transport the entire content.
POST:The POST method requests that the server accept the entity enclosed in the request as a new
subordinate of the web resource identified by the URI.
PUT:The PUT method requests that the enclosed entity be stored under the supplied URI. If the URI
refers to an already existing resource, it is modified; if the URI does not point to an existing resource,
then the server can create the resource with that URI.
DELETE:The DELETE method deletes the specified resource.
TRACE:The TRACE method echoes the received request so that a client can see what (if any)
changes or additions have been made by intermediate servers.
OPTIONS:The OPTIONS method returns the HTTP methods that the server supports for the specified
URL.
CONNECT: The CONNECT method converts the request connection to a transparent TCP/IP tunnel,
usually to facilitate SSL-encrypted communication (HTTPS) through an unencrypted HTTP proxy.
See HTTP CONNECT method.
PATCH:The PATCH method applies partial modifications to a resource.

2. Response message:
The response message consists of the following:

 a status line which includes the status code and reason message (e.g., HTTP/1.1 200 OK, which
indicates that the client's request succeeded.)
 response header fields (e.g., Content-Type: text/html)
 an empty line
 an optional message body

 Encrypted connections:
The most popular way of establishing an encrypted HTTP connection is HTTPS. [35] Two other
methods for establishing an encrypted HTTP connection also exist: Secure Hypertext Transfer
Protocol, and using the HTTP/1.1 Upgrade header to specify an upgrade to TLS. Browser support for
these two is, however, nearly non-existent.
 Network Management : (Question can be asked-What is N/W Management, in answer
describe SNMP)
Simple Network Management Protocol (SNMP):

Simple Network Management Protocol (SNMP) is an Internet Standard protocol for collecting and
organizing information about managed devices on IP networks and for modifying that information to
change device behavior. Devices that typically support SNMP include cable modems, routers,
switches, servers, workstations, printers, and more.
SNMP is widely used in network management for network monitoring. SNMP exposes management
data in the form of variables on the managed systems organized in a management information base
(MIB) which describe the system status and configuration. These variables can then be remotely
queried (and, in some circumstances, manipulated) by managing applications.
Three significant versions of SNMP have been developed and deployed. SNMPv1 is the original
version of the protocol. More recent versions, SNMPv2c and SNMPv3, feature improvements in
performance, flexibility and security.
SNMP is a component of the Internet Protocol Suite as defined by the Internet Engineering Task Force
(IETF). It consists of a set of standards for network management, including an application layer
protocol, a database schema, and a set of data objects.

 Overview and basic concepts

In typical uses of SNMP, one or more administrative computers called managers have the task of
monitoring or managing a group of hosts or devices on a computer network. Each managed system
executes a software component called an agent which reports information via SNMP to the manager.
An SNMP-managed network consists of three key components:

 Managed devices
 Agent – software which runs on managed devices
 Network management station (NMS) – software which runs on the manager
A managed device is a network node that implements an SNMP interface that allows unidirectional
(read-only) or bidirectional (read and write) access to node-specific information. Managed devices
exchange node-specific information with the NMSs. Sometimes called network elements, the managed
devices can be any type of device, including, but not limited to, routers, access servers, switches, cable
modems, bridges, hubs, IP telephones, IP video cameras, computer hosts, and printers.
An agent is a network-management software module that resides on a managed device. An agent has
local knowledge of management information and translates that information to or from an SNMP-
specific form.
A network management station executes applications that monitor and control managed devices.
NMSs provide the bulk of the processing and memory resources required for network management.
One or more NMSs may exist on any managed network.
  Protocol details:
SNMP operates in the application layer of the Internet protocol suite. All SNMP messages are
transported via User Datagram Protocol (UDP). The SNMP agent receives requests on UDP port 161.
The manager may send requests from any available source port to port 161 in the agent. The agent
response is sent back to the source port on the manager. The manager receives notifications (Traps and
InformRequests) on port 162. The agent may generate notifications from any available port. When
used with Transport Layer Security or Datagram Transport Layer Security, requests are received on
port 10161 and notifications are sent to port 10162.
SNMPv1 specifies five core protocol data units (PDUs). Two other PDUs, GetBulkRequest and
InformRequest were added in SNMPv2 and the Report PDU was added in SNMPv3. All SNMP PDUs
are constructed as follows:

IP UDP PDU- request- error- error- variable

version community
header header type id status index bindings

The seven SNMP PDU types as identified by the PDU-type field are as follows:

GetRequest: A manager-to-agent request to retrieve the value of a variable or list of variables. Desired
variables are specified in variable bindings. Retrieval of the specified variable values is to be done as
an atomic operation by the agent. A Response with current values is returned.

SetRequest: A manager-to-agent request to change the value of a variable or list of variables.

Variable bindings are specified in the body of the request. Changes to all specified variables are to
be made as an atomic operation by the agent. A Response with (current) new values for the variables
is returned.

GetNextRequest: A manager-to-agent request to discover available variables and their values. Returns
a Response with variable binding for the next variable in the MIB.

GetBulkRequest: A manager-to-agent request for multiple iterations of GetNextRequest. An

optimized version of GetNextRequest. Returns a Response with multiple variable bindings walked
from the variable binding or bindings in the request. PDU specific non-repeaters and max-repetitions
fields are used to control response behavior. GetBulkRequest was introduced in SNMPv2.
Response: Returns variable bindings and acknowledgement from agent to manager for GetRequest,
SetRequest, GetNextRequest, GetBulkRequest and InformRequest. Error reporting is provided by
error-status and error-index fields. Although it was used as a response to both gets and sets, this PDU
was called GetResponse in SNMPv1.

Trap: Asynchronous notification from agent to manager. While in other SNMP communication, the
manager actively requests information from the agent, these are PDUs that are sent from the agent to
the manager without being explicitly requested. SNMP traps enable an agent to notify the management
station of significant events by way of an unsolicited SNMP message. Trap PDUs include current
sysUpTime value, an OID identifying the type of trap and optional variable bindings. Destination
addressing for traps is determined in an application-specific manner typically through trap
configuration variables in the MIB. The format of the trap message was changed in SNMPv2 and the
PDU was renamed SNMPv2-Trap.

InformRequest: Acknowledged asynchronous notification. This PDU was introduced in SNMPv2 and
was originally defined as manager to manager communication. Later implementations have loosened
the original definition to allow agent to manager communications. Manager-to-manager notifications
were already possible in SNMPv1 using a Trap, but as SNMP commonly runs over UDP where
delivery is not assured and dropped packets are not reported, delivery of a Trap was not guaranteed.
InformRequest fixes this as an acknowledgement is returned on receipt.
 NETWORK ROUTING

When a device has multiple paths to reach a destination, it always selects one path by preferring it over
others. This selection process is termed as Routing. Routing is done by special network devices called
routers or it can be done by means of software processes. The software based routers have limited
functionality and limited scope. A router is always configured with some default route. A default route
tells the router where to forward a packet if there is no route found for specific destination. In case
there are multiple path existing to reach the same destination, router can make decision based on the
following information:

 Hop Count
 Bandwidth
 Metric
 Prefix-length
 Delay

Routes can be statically configured or dynamically learnt. One route can be configured to be preferred
over others.

1. Unicast routing: Most of the traffic on the internet and intranets known as unicast data or unicast
traffic is sent with specified destination. Routing unicast data over the internet is called unicast
routing. It is the simplest form of routing because the destination is already known. Hence the
router just has to look up the routing table and forward the packet to next hop.

2. Broadcast routing: By default, the broadcast packets are not routed and forwarded by the routers
on any network. Routers create broadcast domains. But it can be configured to forward broadcasts
in some special cases. A broadcast message is destined to all network devices. Broadcast routing
can be done in two ways (algorithm):
 A router creates a data packet and then sends it to each host one by one. In this case, the
router creates multiple copies of single data packet with different destination addresses. All
packets are sent as unicast but because they are sent to all, it simulates as if router is
broadcasting.
 This method consumes lots of bandwidth and router must destination address of each node.
  Secondly, when router receives a packet that is to be broadcasted, it simply floods those
packets out of all interfaces. All routers are configured in the same way.
 This method is easy on router’s CPU but may cause the problem of duplicate packets
received from peer routers.
 Reverse path forwarding is a technique, in which router knows in advance about its
predecessor from where it should receive broadcast. This technique is used to detect and
discard duplicates.

3. Multicast Routing: Multicast routing is special case of broadcast routing with significance
difference and challenges. In broadcast routing, packets are sent to all nodes even if they do not
want it. But in Multicast routing, the data is sent to only nodes which wants to receive the packets.
The router must know that there are nodes, which wish to receive multicast packets (or stream) then
only it should forward. Multicast routing works spanning tree protocol to avoid looping. Multicast
routing also uses reverse path Forwarding technique, to detect and discard duplicates and loops.

4. Anycast Routing: Anycast packet forwarding is a mechanism where multiple hosts can have same
logical address. When a packet destined to this logical address is received, it is sent to the host
which is nearest in routing topology. Anycast routing is done with help of DNS server. Whenever
 an Anycast packet is received it is enquired with DNS to where to send it. DNS provides the IP
address which is the nearest IP configured on it.

 Routing Protocol:
Distance Vector: Routing Protocol Distance Vector is simple routing protocol which takes routing
decision on the number of hops between source and destination. A route with less number of hops is
considered as the best route. Every router advertises its set best routes to other routers. Ultimately, all
routers build up their network topology based on the advertisements of their peer routers, for example,
Routing Information Protocol (RIP).

Link State: Routing Protocol Link State protocol is slightly complicated protocol than Distance
Vector. It takes into account the states of links of all the routers in a network. This technique helps
routes build a common graph of the entire network. All routers then calculate their best path for
routing purposes, for example, Open Shortest Path First (OSPF) and Intermediate System to
Intermediate System (ISIS).

 Routing Algorithms:
The routing algorithms are as follows:

Flooding: Flooding is simplest method packet forwarding. When a packet is received, the routers send
it to all the interfaces except the one on which it was received. This creates too much burden on the
network and lots of duplicate packets wandering in the network. Time to Live (TTL) can be used to
avoid infinite looping of packets. There exists another approach for flooding, which is called Selective
Flooding to reduce the overhead on the network. In this method, the router does not flood out on all the
interfaces, but selective ones.

Shortest Path: Routing decision in networks, are mostly taken on the basis of cost between source and
destination. Hop count plays major role here. Shortest path is a technique which uses various
algorithms to decide a path with minimum number of hops.
 IP multicast
IP multicast is a method of sending Internet Protocol (IP) datagrams to a group of interested receivers
in a single transmission. It is the IP-specific form of multicast and is used for streaming media and
other network applications. It uses specially reserved multicast address blocks in IPv4 and IPv6.
Protocols associated with IP multicast include Internet Group Management Protocol, Protocol
Independent Multicast and Multicast VLAN Registration. IGMP snooping is used to manage IP
multicast traffic on layer-2 networks.
IP multicast is described in RFC 1112. IP multicast was first standardized in 1986. Its specifications
have been augmented in RFC 4604 to include group management and in RFC 5771 to include
administratively scoped addresses.

 Technical description
 Overview: IP multicast is a technique for one-to-many and many-to-many real-time communication over an IP
infrastructure in a network. It scales to a larger receiver population by requiring neither prior knowledge of a receiver's
identity nor prior knowledge of the number of receivers. Multicast uses network infrastructure efficiently by requiring
the source to send a packet only once, even if it needs to be delivered to a large number of receivers. The nodes in the
network (typically network switches and routers) take care of replicating the packet to reach multiple receivers such
that messages are sent over each link of the network only once.

The most common transport layer protocol to use multicast addressing is User Datagram Protocol (UDP). By its nature,
UDP is not reliable—messages may be lost or delivered out of order. Reliable multicast protocols such as Pragmatic
General Multicast (PGM) have been developed to add loss detection and retransmission on top of IP multicast.

Key concepts in IP multicast include an IP multicast group address, [2] a multicast distribution tree and receiver driven
tree creation.

An IP multicast group address is used by sources and the receivers to send and receive multicast messages. Sources use
the group address as the IP destination address in their data packets. Receivers use this group address to inform the
network that they are interested in receiving packets sent to that group. he protocol typically used by receivers to
join a group is called the Internet Group Management Protocol (IGMP).

 Routing: Each host (and in fact each application on the host) that wants to be a receiving member of a
multicast group (i.e. receive data corresponding to a particular multicast address) must use the Internet
Group Management Protocol (IGMP) to join. Adjacent routers also use this protocol to communicate.
In unicast routing, each router examines the destination address of an incoming packet and looks up
the destination in a table to determine which interface to use in order for that packet to get closer to its
destination. The source address is irrelevant to the router. However, in multicast routing, the source
address (which is a simple unicast address) is used to determine data stream direction. The source of
the multicast traffic is considered upstream. The router determines which downstream interfaces are
destinations for this multicast group (the destination address), and sends the packet out through the
appropriate interfaces.
The following are some common delivery and routing protocols used for multicast distribution:

 Internet Group Management Protocol (IGMP)

 Protocol Independent Multicast (PIM)
 Distance Vector Multicast Routing Protocol (DVMRP)
 Multicast Open Shortest Path First (MOSPF)
 Multicast BGP (MBGP)
 Multicast Source Discovery Protocol (MSDP)
 Multicast Listener Discovery (MLD)
 GARP Multicast Registration Protocol (GMRP)
 Shortest Path Bridging (SPB)