312 Chapter 7 n Introduction to TCP/IP

deliver connectivity. Consequently, it’s the only one listed on the A+ exam objectives. In the
following sections, we’ll start with a look at its overall structure and then move into key
protocols within the suite.

TCP/IP Structure
The Transmission Control Protocol/Internet Protocol (TCP/IP) suite is the most popular
network protocol in use today, thanks mostly to the rise of the Internet. While the protocol
suite is named after two of its hardest-working protocols, Transmission Control Protocol
(TCP) and Internet Protocol (IP), TCP/IP actually contains dozens of protocols working
together to help computers communicate with one another.

TCP/IP is the protocol used on the Internet.

TCP/IP is robust and flexible. For example, if you want to ensure that the packets are
delivered from one computer to another, TCP/IP can do that. If speed is more important
than guaranteed delivery, then TCP/IP can ensure that too. The protocol can work on dis-
parate operating systems such as UNIX, Linux, and Windows. It can also support a variety
of programs, applications, and required network functions. Much of its flexibility comes
from its modular nature.
You’re familiar with the seven-layer OSI model we discussed in Chapter 6, “Networking
Fundamentals.” Every protocol that’s created needs to accomplish the tasks (or at least the key
tasks) outlined in that model. The structure of TCP/IP is based on a similar model created by
the United States Department of Defense: the Department of Defense (DOD) model. The DOD
model has four layers that map to the seven OSI layers, as shown in Figure 7.1.

F igure  7.1 The DOD and OSI models

 Understanding TCP/IP 313

The overall functionality between these two models is virtually identical; the layers
just have different names. For example, the Process/Application layer of the DOD model is
designed to combine the functionality of the top three layers of the OSI model. Therefore, any
protocol designed against the Process/Application layer would need to be able to perform all
functions associated with the Application, Presentation, and Session layers in the OSI model.
TCP/IP’s modular nature and common protocols are shown in Figure 7.2.

F igure  7. 2 TCP/IP protocol suite

DoD Model

Telnet FTP LPD SNMP

Process/
Application
TFTP SMTP NFS HTTP

Host-to-Host TCP UDP

ICMP ARP RARP

Internet
IP

Network Fast Token

Ethernet FDDI
Access Ethernet Ring

The majority of TCP/IP protocols are located at the Process/Application layer. These
include some protocols you are probably already familiar with, such as Hypertext Transfer
Protocol (HTTP), File Transfer Protocol (FTP), Simple Mail Transfer Protocol (SMTP),
Post Office Protocol (POP), and others.
At the Host-to-Host layer, there are only two protocols: TCP and User Datagram
Protocol (UDP). Most applications will use one or the other to transmit data, although
some can use both but will do so for different tasks.
The most important protocol at the Internet layer is IP. This is the backbone of TCP/IP.
Other protocols at this layer work in conjunction with IP, such as Internet Control Message
Protocol (ICMP) and Address Resolution Protocol (ARP).
You’ll notice that the Network Access layer doesn’t have any protocols per se. This layer
describes the type of network access method you are using, such as Ethernet, Token Ring,
or others.

Process/Application Layer Protocols

As we mentioned in the previous section, most of the protocols within the TCP/IP suite
are at the Process/Application layer. This is the layer of differentiation and flexibility. For
314 Chapter 7 n Introduction to TCP/IP

example, if you want to browse the Internet, the HTTP protocol is designed for that. FTP
is optimized for file downloads, and RDP allows you to connect to a remote computer and
manage programs.
Before we get into the protocols themselves, let’s take a quick look into a few key points on
the TCP/IP suite’s flexibility. There are literally dozens of protocols at the Process/Application
layer, and they have been created over time as networking needs arose. Take HTTP, for
example. The first official version was developed in 1991, nearly 20 years after TCP/IP was
first implemented. Before this protocol was created, there weren’t any effective client-server
request-response protocols at this layer. HTTP let the client (web browser) ask the web server
for a page, and the web server would return it. Going one step further, there was a need for
secure transactions over HTTP, hence the creation of HTTPS in 1994. As new applications
are developed or new networking needs are discovered, developers can build an application
or protocol that fits into this layer to provide the needed functionality. They just need to make
sure the protocol delivers what it needs to and can communicate with the layers below it. The
following sections will describe some of the more common Process/Application protocols—
and the ones listed in the A+ exam objectives.

DHCP
Dynamic Host Configuration Protocol (DHCP) dynamically assigns IP addresses and
other IP configuration information to network clients. Configuring your network clients to
receive their IP addresses from a DHCP server reduces network administration headaches.
We’ll cover the mechanics of how DHCP works later in this chapter when we talk about
IP addressing.

DNS
You probably use Domain Name System (DNS) every day whether you realize it or not.
Its purpose is to resolve hostnames to IP addresses. For example, let’s say you open your
web browser and type in a Uniform Resource Locator (URL) such as [Link]
Your computer needs to know the IP address of the server that hosts that website in order
for you to connect to it. Through a DNS server, your computer resolves the URL to an IP
address so communication can happen.

FTP
The File Transfer Protocol (FTP) is optimized to do what it says it does—transfer files. This
includes both uploading and downloading files from one host to another. FTP is both a pro-
tocol and an application. Specifically, FTP lets you copy files, list and manipulate directories,
and view file contents. You can’t use it to remotely execute applications.
Whenever a user attempts to access an FTP site they will be asked for a login. If it’s a public
site, you can often just use the login name anonymous and then provide your email address as
the password. Of course, there’s no rule saying you have to give your real email address if you
don’t want to. If the FTP site is secured, you will need a legitimate login name and password to
access it. If you are using a browser such as Internet Explorer to connect via FTP, the correct
syntax in the address window is [Link]
 Understanding TCP/IP 315

In Windows XP and later, you can type a URL such as the one in the FTP
example into the Run box to connect as well.

HTTP
The most commonly used Process/Application layer protocol is HTTP. It manages the
communication between a web server and client and lets you connect to and view all of
the content you enjoy on the Internet.

HTTPS
The protocol used for most Internet traffic, HTTP, is not secure. To securely encrypt traffic
between a web server and client, Hypertext Transfer Protocol Secure (HTTPS) can be used.
HTTPS connections are secured using either Secure Sockets Layer (SSL) or Transport Layer
Security (TLS).
From the client side, the most common issue you will encounter when HTTPS is in
use on a website is that users may not know what the proper context is. To access most
websites, you use http:// in the address bar. To get to a site using HTTPS, you need to
use https:// instead.

How Secure Is It?

You have probably heard before that you should not enter personal information (such
as a credit card number) into an unsecure website. But what does that really mean?

First, know what to look for. If you are entering information into a website form and the
address of the site begins with just [Link] you’re just asking for someone to steal
the information! The HTTP protocol transmits data in plain text, meaning that there is
no encryption at all between your computer and the server. On the other hand, HTTPS
encrypts the data transmissions as they cross the wire.

To use HTTPS, the website needs to obtain a SSL certificate from a reputable web host,
which verifies the identity of the website. So the good news is that if you are accessing
a site with https:// in the header, you know that the site is what it says it is (and not a
Trojan horse) and that transmissions between your computer and that site are encrypted.
Once the data is on the website’s server though, HTTPS is no longer relevant and other
protection methods are needed to keep your data secure.

Occasionally, you might visit a website that uses HTTPS and get a pop-up
error message saying that the certificate has expired or could not be vali-
dated. This is most likely a case of the certificate legitimately expiring, but
it could be that it’s a Trojan horse website. Proceed with caution!
316 Chapter 7 n Introduction to TCP/IP

IMAP
Internet Message Access Protocol (IMAP) is a secure protocol designed to download email.
Its current version is version 4, or IMAP4. It’s becoming more and more common as the
client-side email management protocol of choice, replacing the unsecure POP3. Most cur-
rent email clients, such as Microsoft Outlook and Gmail, are configured to be able to use
either IMAP4 or POP3.
IMAP4 has some definite advantages over POP3. First, IMAP4 works in connected and
disconnected modes. With POP3, the client makes a connection to the email server, down-
loads the email, and then terminates the connection. IMAP4 allows the client to remain
connected to the email server after the download, meaning that as soon as another email
enters the inbox, IMAP4 notifies the email client and is ready to download it. Second, it also
lets you store the email on the server, as opposed to POP3, which requires you to download
it. Third, IMAP4 allows multiple clients to be simultaneously connected to the same inbox.
This can be useful for BlackBerry users who have both Outlook and their BlackBerry opera-
tional at the same time or for cases where multiple users monitor the same mailbox, such as
on a customer service account. IMAP4 allows each connected user or client to see changes
made to messages on the server in real time.

LDAP
The Lightweight Directory Access Protocol (LDAP) is a directory services protocol based
on the X.500 standard. LDAP is designed to access information stored in an information
directory typically known as an LDAP directory or LDAP database.
On your network you probably have a lot of information such as employee phone books
and email addresses, client contact lists, and infrastructure and configuration data for the
network and network applications. This information might not get updated frequently, but
you might need to access it from anywhere on the network, or you might have a network
application that needs access to this data. LDAP provides you with the access, regardless
of the client platform you’re working from. You can also use access control lists (ACLs) to
set up who can read and change entries in the database using LDAP. A common analogy is
that LDAP provides access to and the structure behind your network’s phone book.

POP3
For a long time now, Post Office Protocol 3 (POP3) has been the preferred protocol for
downloading email. It’s being replaced by IMAP4 because IMAP4 includes security and
more features than POP3.

RDP
Developed by Microsoft, the Remote Desktop Protocol (RDP) allows users to connect to
remote computers and run programs on them. When you use RDP, you see the desktop of
the computer you’ve logged in to on your screen. It’s like you’re really there, even though
you’re not.
When you use RDP, the computer that you are sitting at is the client, and the computer
you’re logging in to is the server. The server uses its own video driver to create video output
and sends the output to the client using RDP. Conversely, all keyboard and mouse input
 Understanding TCP/IP 317

from the client is encrypted and sent to the server for processing. RDP also supports sound,
drive, port, and network printer redirection. In a nutshell, this means that if you could see,
hear, or do it if you were sitting at the remote computer, you could see, hear, or do it at the
RDP client too.
Services using this protocol can be great for telecommuters. It’s also very handy for tech-
nical support folks, who can log in and assume control over a remote computer. It’s a lot
easier to troubleshoot and fix problems when you can see what’s going on and “drive”!

SFTP
The Secure File Transfer Protocol (SFTP) is used when you need to transfer files over a
secure, encrypted connection.

SMB
Server Message Block (SMB) is another Microsoft-developed protocol. It’s used to provide
shared access to files, printers, and other network resources. In a way, it functions a bit like
FTP only with a few more options.

SMTP
We’ve already looked at a few protocols that are for downloading or receiving email. Simple
Mail Transfer Protocol (SMTP) is the protocol most commonly used to send email messages.
Because it’s designed to send only, it’s referred to as a push protocol. An email client locates
its email server by querying the DNS server for a mail exchange (MX) record. After the server
is located, SMTP is used to push the message to the email server, which will then process the
message for delivery.

SNMP
Simple Network Management Protocol (SNMP) gathers and manages network performance
information.
On your network, you might have several connectivity devices such as routers and
switches. A management device called an SNMP server can be set up to collect data from
these devices (called agents) and ensure that your network is operating properly. Although
it’s mostly used to monitor connectivity devices, many other network devices are SNMP
compatible as well. The most current version is SNMPv3.

SSH
Secure Shell (SSH) can be used to set up a secure Telnet session for remote logins or for
remotely executing programs and transferring files. Because it’s secure, it was originally
designed to be a replacement for the unsecure telnet command. A common client interface
using SSH is called OpenSSH ([Link]).
318 Chapter 7 n Introduction to TCP/IP

Telnet
It seems as though Telnet has been around since the beginning of time as a terminal emula-
tion protocol. Someone using Telnet can log into another machine and “see” the remote
computer in a window on their screen. Although this vision is text only, the user can man-
age files on that remote machine just as if they were logged in locally.
The problem with telnet and other unsecure remote management interfaces (such as rcp
and ftp) is that the data they transmit, including passwords, is sent in plain text. Anyone
eavesdropping on the line can intercept the packets and thus obtain usernames and passwords.
SSH overcomes this by encrypting the traffic, including usernames and passwords.

Host-to-Host Layer Protocols

After the myriad protocols at the Process/Application layer, the simplicity of the Host-to-Host
layer is welcome. At this layer there are two alternatives within the TCP/IP suite: TCP and
UDP. The major difference between the two is that TCP guarantees packet delivery through
the use of a virtual circuit and data acknowledgements and UDP does not. Because of this,
TCP is often referred to as connection oriented, whereas UDP is connectionless. Because UDP
is connectionless, it does tend to be somewhat faster, but we’re talking about milliseconds here.
Another key concept to understand about TCP and UDP is the use of port numbers.
Imagine a web server that is managing connections from incoming users who are view-
ing web content and others who are downloading files. TCP and UDP use port numbers
to keep track of these conversations and make sure the data gets to the right application
and right end user. Conversely, when a client makes a request of a server, it needs to do so
on a specific port to make sure the right application on the server hears the request. For
example, web servers are listening for HTTP requests on port 80, so web browsers need
to make their requests on that port.
A good analogy for understanding port numbers is to think of cable or satellite television.
In this analogy, the IP address is your house. The cable company needs to know where to
send the data. But once the data is in your house, which channel are you going to receive it
on? If you want sports, that might be on one channel, but weather is on a different channel,
and the cooking show is on yet another. Those channels are analogous to ports. You know
that if you want a cooking show, you need to turn to channel 923 (or whatever). Similarly, the
client computer on a network knows that if it needs to ask a question in HTTP, it needs to do
it on port 80.
There are 65,536 ports numbered from 0 to 65535. Ports 0 through 1023 are called the
well-known ports and are assigned to commonly used services, and 1024 through 49151
are called the registered ports. Anything from 49152 to 65535 is free to be used by applica-
tion vendors. Fortunately, you don’t need to memorize them all.

TCP/IP applications combine the host’s IP address with the port number in
order to communicate. This combination is known as a socket.
 Understanding TCP/IP 319

Table 7.1 shows the ports used by some of the more common protocols. You should
know each of these for the A+ exam.

Table  7.1 Common port numbers

Service Protocol Port

FTP TCP 20, 21

SSH TCP 22

Telnet TCP 23

SMTP TCP 25

DNS TCP/UDP 53

HTTP TCP 80

DHCP UDP 67, 68

POP3 TCP 110

IMAP4 TCP 143

SNMP UDP 161

LDAP TCP 389

HTTPS TCP 443

SMB TCP 445

RDP TCP 3389

A complete list of registered port numbers can be found at [Link].