Chapter 1

👉🏻 If you want to enjoy the full experience exploring this pdf, check it out here Chapter 1

The Internet “Nuts and Bolts view”

The components of the Internet:

At the edge of the network are the devices which we use to connect to the Internet, these devices
are often called Hosts or End Systems.

Then, there are devices that build the structure of a network which are Packet Switches which
forward packets (chunks of data) between each others and between hosts and end devices
→ Packet switches are two types:
Routers & Switches

Then, there are communication links that connects all the previous

Finally, All these are assembled into networks each network is owned by some entity.

The presence of these multiple networks leads us to the definition of the internet which is the Internet
is the network of networks. (Interconnected ISPs)
→ ISP: Internet Service Provider

The sending and receiving of the data across the routers, switches and hosts is controlled by
Protocols.
(e.g., HTTP, streaming video, Skype, TCP, IP, Wi-Fi, 4G, Ethernet)

Protocols typically defines a standard way of doing things and for the internet there are standards too,
which are:

RFC: Request for Comments

IETF: Internet Engineering Task Force

The Internet “A Service View”

As a service platform, the internet provides an interface that applications can use to send and receive
information to each other

So, the definition of the internet from a service point of view: the delivery of information from one
point in a network to another

Under the hood there are some distributed applications - provided through a programming interface-
that:

contain “hooks” that allows sending an receiving data to connect

use internet transport devices

provides service options analogous(similar) to postal devices

Chapter 1 1
 What is a Protocol?
Protocols define:

the format and order of messages sent and received among network entities

actions taken on message transmission and receipt

All communication activity in Internet are governed by protocols

→ In the next sections, we are going to look more on the nuts and bolts point of view of the internet

A Closer look at Internet Structure

Network Edge: There are many devices at the network edge like computers, smart phones, cars, etc.

These edge devices are sometimes called hosts because they host or run network applications,

The host may be a client that requests/receives a service

Or a server that provides a service in data centers

Access Networks, physical media

wired, wireless communication links

Network Core:

The set of interconnected routers that form a network

The connection of these individual networks to form the Internet

Hosts: Packets of data

the host takes the data and breaks into smaller chunks of data known as packets

in addition to the data, it will add some additional information known as header

the protocol will dictate what information is added onto this header

a packet (data + header) will have a length of L bits (L typically = 1500 bytes)

Packets are transmitted into access networks at transmission rate R

R is known as link transmission rate, link capacity or link bandwidth

packet transmission delay (time needed to transmit a packet) = L/R

Access Networks and Physical Media

There are three types of access networks:

1. Residential access networks

Home WiFi networks

Cable internet connections

DSL (Digital Subscriber Line) services

Chapter 1 2
 2. Institutional access networks (operated by a company, an educational institution)

University campus networks

Corporate office networks

Hospital information systems

3. Mobile access networks (operated by cellular access carriers 4G/5G, Wi-Fi)

Public WiFi hotspots

Cellular data networks

Satellite internet connections

A Break down of some access network types

Cable based access
a physical cable connects multiple homes to a single cable headend

The signals to and from a house are sent and received on the cable at different frequencies and don’t
interfere with each other

Frequency division multiplexing FDM: different channels transmitted in different frequency based

Hybrid Fiber Coax HFC: cable access networks are typically asymmetric; designed to transmit data
faster in the downstream direction to home rather than upstream direction
→ this means we are
consumers of data more than producers of data

typical cable transmission rates are 30 Mb/s in downstream direction and 2 Mb/s in the upstream
direction

cable network is a shared network

Digital Subscriber line (DSL)

DSL use the existing telephone line (called a twisted pair) → two copper wires round around each
other and carry phone service to your home

DSL wires connect you directly to the central office DSLAM so you are not sharing transmission
capacity or bandwidth

light cable networks - DSL lines are also asymmetric with:

24-52 Mb/s downstream transmission rate

3.5-16 Mb/s upstream transmission rate

data over DSL phone line goes to the internet

voice over DSL phone line goes to telephone set

Chapter 1 3
 Home Network
there’s a dsl cable or cable link coming in from the local telco or cable network

then there’s a cable or dsl modem (modulator/demodulator) on the house-end of that link

Connected to the cable modems a router that has both wired and wireless links to devices within the
home

These links are typically wired ethernet that runs typically at 100 Mb/s or Gb/s transmission rate

And a Wi-Fi that runs at tens of hundreds megabits per second

Often all these components are all combined into one box

Wireless Access Networks

There are two types of wireless networks

1. Wireless Local area networks (WLANs) (wifi)

a. operate in around 100 meters at different speed from 11 to 54 to 450 Mbps transmission rate

b. These protocols are standardized by the IEEE not the IETF under the family of 802.11 protocols

2. Wireless wide area cellular access networks (3G/4G)

a. operated by the mobile cellular operators with transmission distance 10’s of KM’s

b. have transmission rate of multiples of 10’s Mbps

For both of them there is a base station (access point) to which the end devices transmitting data and
receiving data from

Enterprise access networks (Ethernet)

have mix of ethernet, wired ethernet and wireless wifi links

the difference from home network is that enterprise network have multiple switches and routers to
handle the large number of devices that would be connected to it

Ethernet: wired access at 100 Mbps, 1 Gbps, 10 Gbps

WiFi: Wireless access points at 11, 54, 450 Mbps

Data Center Networks

Another form of enterprise networks but these connect massive number of servers to each others
and to the internet at hundreds of Gbps

Chapter 1 4
 Physical Media

Bit: propagates between transmitter and receiver pairs

Physical link lies between transmitter and receiver

Guided media: physical wire made of copper/fiber/coax

Unguided media: radio/acoustical waves

Twisted pair: 2 insulated copper wires (now referred to as ethernet or ADSL)

category 5: 100 Mbps, 1 Gbps ethernet

category 6: 100 Gbps ethernet

Coaxial cable: carry cable networks connected to home and operates it at hundreds of megabytes
per second

two concentric copper conductors

bidirectional

Fiber optic cable:

carry light pulses and operate at hundreds of gigabits per second and higher

have very low error rate (ideal for transmission but more expensive than copper)

Wireless radio:

signal carried in bands in electromagnetic spectrum

No physical wire

Transmissions tend to be broadcast (half-duplex) (sender to receiver)

→ Any device near the transmitting device may be
able to receive the transmitted signals

→ This raises eavesdropping (‫ )تصنت‬and interference concerns

Wireless transmitting have lots of cons:

Radio signals fade over distance

Signals can be reflected or blocked by objects depending on their frequency

They are subject to (‫ )عرضة لـ‬noise generated by motors or any other devices that emit RF
(radio frequency) signals

→ So, transmitting bits over wireless requires a lot of work at the physical layer

Chapter 1 5
 Radio Links Types
Wireless LAN (Local Area Network) (WiFi)

10-100’s Mbps over 10’s of meters

Wide-area WAN (4G Cellular)

10’s Mbps over 10 Km

Bluetooth (cable replacement

short distance, limited rates

Terrestrial Microwave

point-to-point; 45 Mbps channels

Satellites

up to 45 Mbps per channel

Noticeable propagation delay → 270 ms end-end delay

The Network Core

The network core consists of a set of routers that are interconnected to a set of communication links

The Internet’s core operation is based on Packet-Switching

Packet-Switching:

The end hosts receive the application layer messages and breaks it into chunks of data

then put these chunks into packets

then send those packets to the internet

those packets are then forwarded from the source to the destination across links

There are two key network-core functions:

Forwarding (Switching)

Routing

Forwarding
It is a local action about moving arriving packets from router’s input link to suitable router output link

It is controlled by forwarding table

There is a forwarding table inside each router

When a packet arrives, the router look inside the packet for a destination address

then look up the destination address in the forwarding table

then transmit this packet on the output link that leads to that destination

Chapter 1 6
 Routing
The contents of that forwarding table are created in the routing stage

Routing is the global action that determines the source-to-destination paths taken by packets

Routing algorithms compute these paths and compute the local router forwarding table needed to
realize this end-to-end forwarding path

The Transmission of Packet bits at a router in the Network Core

Packet Switching: Store-and-forward
The store-and-forward operation of a packet-switch network:

Transmitted bits are received and gathered up at the receiving end of a link until the full packet
has been received

Once the packet is fully received, it can then be forwarded to the next link

→ Entire packet must arrive at router before it can be transmitted on the next link

Packet transmission delay: takes L/R seconds to transmit (push out) the packet into the link

L → length of the packet

R → transmission rate

Now, we’ll see what happens to a packet when it arrives at a router for forwarding

Packet Switching: Queuing, Queuing Delay & Packet Loss

Packet queues are going to be formed at the router outbound link when the arrival rate on the input
link exceeds the transmission rate of the output link

When there is packet queuing, there will be queuing delays

If the capacity of queuing in this router is full, arriving packets may be lost or dropped or damaged

In Queuing delay:

a → average packet arrival rate

L → Packet length

R → Transmission rate

→ L . a ⇒ The arrival rate of bits

La
→ R ⇒ Traffic Intensity
​

Traffic intensity ~ 0 → Small queuing delay

Traffic intensity > 1 → Delay is infinite!

Arriving work is more than work that can be served

Traffic intensity → 1 (tends/ approaches to 1): Delay is large

Packet loss:

Packet loss occur when router buffers are fill up and an arriving packet has no place to be stored

In high congestion scenarios losses can be high

Packet arriving to full queue is dropped or lost

Lost packet may be retransmitted by previous node, source or system or not be retransmitted at
all

Chapter 1 7
 Alternative to packet switching: Circuit Switching
Data here is transmitted by calls not packets

Before a call starts, all the resources within the network that are going to be needed for that call are
allocated to that call from source to destination (‫يعني بيتحجزو للداتا دي مينفعش حاجة تاني تتنقل معاهم‬
‫)من اول ما الداتا تخرج لحد ما توصل‬

Once the call begins, it will have reserved enough transmission capacity for itself to ensure queuing
will never occur, there’s no delay other than propagation delay and no loss of data within the network

Circuit switching is done in two ways

1. Frequency Division Multiplexing (FDM)

- In FDM, the electromagnetic or optical spectrum is divided into
narrow frequency bands and each call is allocated one of those narrow bands
- Each call can transmit at the
full rate allowed by that band

2. Time Division Multiplexing (TDM)

- In TDM, time is divided into
slots and each call is allocated a periodic set of slots
- A source can transmit
only during its allocated time slots but can transmit at the higher maximum rate of that wider
frequency band

Packet Switching Vs. Circuit Switching

Packet switching is great for bursty data
→ When the source has only
occasionally data to send

it is simple

no call reservation

host just sends data that it has to send

Congestion possible: Packet delay and loss can happen due to buffer overflow

→ Protocols are needed for reliable data transfer and congestion control

It is complicated to provide circuit-like behavior with packet-switching

Chapter 1 8
 Internet Structure: Network of Networks
At the center: there is a number of well-connected large networks:

“Tier 1” commercial ISPs (Internet Service Providers ) that have national and international
coverage

→ Ex. Level 3, Sprint, AT&T, NTT

content provider networks which are private networks that connects its data centers to the
internet and sometimes bypassing (‫ )تتجاوز‬tier-1 and regional ISPs and connects directly to access
network ISPs

→ Ex. Google, Facebook

The locations at which multiple networks can peer with each other are called Internet Exchange
Points (IXP) or peering points and they connect via peering links

Moving closer to the edge, there are regional ISPs that connect access nets to ISPs

At the very edge of the network, there are the access network ISPs which connect end systems to
internet via ISPs

Chapter 1 9
 Performance
Packet Delay: Four Sources
There are four components of delay that can happen at a router

1. Processing Delay(Nodal Processing) ( dproc ):​

This is the delay associated with:

a. forwarding table lookup

b. forwarding a packet through the switch

c. determining output link

2. Queuing Delay ( dqueue ):

​

This is the amount of time that the packet

has to wait to queue at an output link for transmission and this depends on the congestion level of the
router

3. Transmission Delay ( dtrans ): ​

Once a packet of length L begins transmission, it’s being sent to the link at the transmission rate R, it
takes a certain amount of time for all the bits in those packets to be pushed into that outgoing link
→ The packets are put
on the beginning of the output link to be propagated

a. The transmission delay is calculated from: L/R

i. L → Length of the packet

ii. R → Link transmission rate

4. Propagation Delay ( dprop ):​

The amount of time it takes from when a bit

enters the sending side of the link until it pops out at the receiving side of the link

a. The propagation delay is calculated from: d/s

i. d → length of physical link

ii. s → propagation speed (usually close to speed of light 2 × 108 m/sec

Chapter 1 10
 Throughput
Throughput is the rate at which bits are being sent from sender to receiver

Throughput could be: (according to an interval of time)

instantaneous: given at a point in time

average: over longer period of time

Let’s look at some throughput examples: (s → server, c → client)

Rs < Rc ⇒ Throughput will be limited to the capacity of the server

​ ​

Rs > Rc ⇒ Throughput will be limited to the capacity of the client

​ ​

→ Generally, the throughput that a source-to-destination path can receive is limited by the capacity of
the thinnest pipe, the pipe with the smallest capacity and it is known as the bottleneck link

Bottleneck link: link on end-end path that constraints end-end throughput

Bottleneck links tend to be at the edge of the network

Real Internet Delays and Routes

Traceroute
Traceroute is a program that runs on laptops or computers and provides live measurement of packet
delay from the sender to routers along end-end internet path towards destination

Traceroute works as follows:

For all i:

First sends three packets that will reach router i on path towards destination

Router i sends a reply message in response to each of these packets

The Traceroute sender measures the round trip time (RTT) (the interval between the transmission
and reply)

Then displays those three RTT measurements

Chapter 1 11
 Layering
Why Layering?
There are two advantages of layering:

The explicit structure shows the different pieces of the system and relationship between them
which allows identification

→ This provides a clear layered reference model for discussions about the system

From the implementation model of view, layering modularizes the system which eases the
maintenance and updating of the system

→ Changes done to any layer are transparent to the rest of the system but doesn’t affect it

The Internet Protocol Stack

The Internet architecture has five layers

1. The Application Layer

a. It includes the application layer protocols that control the sending and receiving of messages
among the distributed pieces of the application

b. Supporting network applications

Ex. HTTP, IMAP, SMTP, DNS

2. The Transport Layer

a. It transports application layer messages from one process to another

b. process-process data transfer

Ex. TCP, UDP

3. The Network Layer

a. It transports data from one end device or host to another depending on the service model

b. The network layer doesn’t provide reliable transport host-to-host service

→ its service model is called
best-effort service (we’ll do our best)

c. Routing of datagrams from source to destination

Ex. IP, routing protocols

4. The Link Layer

a. It transfers data between two network devices that are at either ends of the same communication
link

b. Data transfer between neighboring network elements

Ex. Ethernet, Wifi, PPP

5. The Physical Layer

a. Controls the sending of bits into links

Chapter 1 12
 ISO/OSI Reference Model
The OSI Model is a seven-layer conceptual framework, expanding the Internet Protocol Stack with two
additional layers:

1. Presentation Layer

Purpose: Interprets the meaning of data, performing tasks such as encryption, compression, and
machine-specific conventions.

2. Session Layer

Purpose: Synchronizes, checkpoints, and manages recovery during data exchange.

Internet Stack Model Vs. OSI Model

Simplification in the Internet Stack: The Internet stack does not explicitly implement the Presentation
and Session layers.

If these services are needed (e.g., encryption or session management), they must be implemented
at the Application Layer.

Examples: HTTPS (encryption), application-level protocols handling data formatting or

synchronization.

Are these layers needed?

Presentation Layer: Often required for specific use cases (SSL/TLS for encryption, JSON or XML
for data formatting).

Session Layer: Useful in applications requiring session tracking or recovery (remote login, video
conferencing).

By delegating these responsibilities to applications, the Internet stack remains lightweight and
flexible.

Encapsulation
Encapsulation is the process of adding new information to a data unit to produce new data unit

→ Here we will see the journey of the unit of data (protocol data unit) across the layers of the internet

At the Application Layer, the unit of data that entities exchange is known as a message

At the Transport Layer, these messages are exchanged from one part of the network to the other

The transport layer will take that message and add some information to it (transport layer header)
and encapsulates them together to form a new data unit called transport-layer segment

This header is used by the transport layer to implement its service

The segment then is exchanged by entities in the transport layer

→ All these steps applies to all layers after

At Network Layer, the segment is taken and then encapsulated with the network layer header to
create network-layer datagram

At the Link Layer, the datagram is taken and encapsulated with the link layer header to create link-
layer frame

⇒ message → segment → datagram → frame

Chapter 1 13
 Network Under Attack
The original network architecture was NOT originally designed with much security in mind

The original vision was that it was a group of mutually trusted users attached to a transparent
network

But some people played around! which lead to implementing security in all layers

Some behaviors of bad actors!

Packet interception “Sniffing”
In shared networks (Wi-Fi), attackers can use software to intercept and read data packets traveling
through the network. If data isn't encrypted, attackers could see sensitive information, like passwords.

Wireshark is a free tool used to analyze network traffic and often demonstrates packet-sniffing for
educational purposes

IP Spoofing
The creation or injection of Internet Protocol (IP) packets with a false or fake source IP address to
impersonate another computer system (like emails claiming to be from Google or Microsoft just to
gather data or send you a hacking link or whatever)

Denial of Service attacks (DoS)

Overwhelm a server or network resource, making it unavailable for legitimate users.

Process:

The attacker chooses a target.

Compromises multiple computers to act as “zombies” in a botnet.

Sends a flood of data (packets) to the target, overwhelming its capacity

How Attackers Compromise Computers and Networks

Malware: Malicious software that can infect computers in different ways:

Virus:

Spreads by attaching itself to files like email attachments.

The virus replicates when a user opens the infected file.

Worm:

Similar to a virus but spreads on its own without user action

Spyware: A type of malware that secretly records information, like keystrokes or visited websites,
and sends it to the attacker.

Botnets: A network of compromised computers (infected by malware) that attackers control

remotely.

Attackers can use botnets to send spam or launch large-scale attacks, like DDoS

Chapter 1 14
 Lines of Defense
Authentication: can be used to protect against spoofing

prove who you are before you’re able to get some network service

Confidentiality: can be used to protect against sniffing

by encrypting packets content

Integrity Checks: can be used to protect against tampering (‫)التالعب‬

by using digital signatures

Access Restrictions: protect against unauthorized use of network resources

by adding access controls like password-protected VPNs

Firewalls: Specialized pieces of hardware that are programmed to detect attacks

They are set in both edge and core networks

filter incoming packets to restrict senders, receivers, applications

Hardware like Firewall is so called middlebox

By: Malak Amr

Chapter 1 15