End-to-End Protocols

CS158a

Chris Pollett

Apr. 27, 2009

Outline

We next want to turn host-to-host communication of packets into a process-to-process communication channel between two hosts.
This is the role of the transport layer.
The transport layer should:
- Guarantee message delivery
- Deliver messages in the same order they are sent
- Deliver at most one copy of each message
- Support arbitrary large messages
- Support synchronization between sender and receiver
- Allow the receiver to apply flow control to the sender
- Support multiple application process on each host.

The simplest possible transport protocol is one that extends host-to-host delivery to process-to-process communication.
There are likely to be many processes running on a given host; so this extension involves support for demultiplexing packets arriving at a host and sending them to a particular process.
This is essentially what the User Datagram Protocol (UDP) does.
Processes on a given machine are identified by a port number, which is a two-byte number.
Thus, the UDP header structure is relatively simple:

160 31

Source Port Destination Port

Length Checksum

Data

There are different ways that the port might be mapped to a particular process.
The easiest is that certain well-known services live at well-known port numbers.
So the Domain Name Service (DNS) usually receives messages on port 53.
Sometimes communication starts on a well-known port and then the two communicating processes agree on some less frequented port to begin communicating.
This can be generalized by having a group of services for whom clients all initially come to a common port number when starting communication. Then using a single service called a port mapper they agree on a less common port for the rest of communication.
It should be noted port numbers don't depend on the OS.
The checksum is computed over the UDP header, the datagram data, and a pseudoheader -- the protocol number, and source and destination IP.

It is common to want to know what ports are in use on a given machine.
You might want to do this to find out what kind of traffic is coming into or out of your machine that you are not aware of.
If you see that there seems to be an unknown service before on your machine then you could analyze the traffic with tcpdump or Wireshark.
Bad guys might want to know which services are available on a machine in order to decide how to attack your system.
One common tool for checking what ports are in use is nmap http://nmap.org/.

This can be run from the command line with a line like:

nmap IP_address_or_hostname #or
nmap -v -A IP_address_or_hostname #verbose and enable OS detection

nmap supports lots of options to prevent the site you are looking at from detecting the scan as well.

Which of the following protocols makes use of rendezvous points?

A more sophisticated process-process protocol than UDP needs to support connections as well as reliable, in-order transport of bytes.
The Internet's Transmission Control Protocol (TCP) is the most commonly used protocol of this type.

TCP, just like point-to-point links, makes use of the sliding window algorithm.
There are some important differences, however.
TCP is not over a dedicated link, but over a network, and there is no dedicated connection between the two hosts.
This means we have to take a telephone-like approach of make a logical connection between the two machines first. Then send data over that connection and finally tear it down.
Another important difference, is that there is more variability in the RTT of packets going between the two hosts than in the point-to-point situation where you have a dedicated line.
This means that the timeout mechanism of the sliding window algorithm needs to be adaptive.
At the transport layer packets are more likely to be out of order than in a point-to-point line.
The maximum time-to-live of a TCP packet is 120 seconds. So TCP needs to be able to handle very late arrive packets.
TCP supports many more kinds of hosts, each with the ability to talk at different rates, so it must support flow control so a fast host can talk to a slow one.
Finally, TCP needs to support many connections from different hosts all using the same network. So it needs to be able to handle congestion of links on the network.

TCP packets are called segments.
Source and Destination Ports are as in UDP.
The Acknowledgement, SequenceNum, and AdvertisedWindows fields are all used for the sliding window algorithm.
The 6-bit Flags field is used to relay control information. The flag bits are SYN, FIN, RESET, PUSH, URG, ACK.
The first two are for starting/closing a connection
URG signifies that the segment contains urgent data. If it is set, then UrgPtr point to the first non-urgent data in he segment.
PUSH indicates that the receiving side of a TCP connection should notify the receiving process that a PUSH was done.
RESET indicates that the receiver wants to abort the connection.

Before any data is sent a connection between the client (caller) and a server (callee) needs to be established.
This is done by an algorithm known as a three-way handshake.
1. To begin a client send a SYN segment to the server stating the initial sequence number it plans to use. (Flags=SYN, SequenceNum = x)
2. The server responds with a single segment that both acknowledges the client's sequence number and the states its own beginning sequence number. So it says (Flags =ACK, ACK=x+1) (Flags=SYN, SequenceNum = y). This is called a SYN+ACK.
3. Finally, the client acknowledges the servers sequence number (Flags=ACK, Ack=y+1).
The sequence number+1 is used above to indicate the next sequence number expected. All earlier numbers are implicitly acknowledged.
Sequence numbers on each side of a connection are selected at random to protect against two incarnations (between same hosts and processes) of the same connection reusing the same sequence number too soon.

Both client and servers make use of timers on each of these messages in figuring out whether or now to start over.
If a client sees a SYN+ACK it assumes the connection is ESTABLISHED.
If the client's final ACK is lost, subsequently sent segments of the client will each still have the same ACK sequence number, and so can serve as the ACK, at which point the server views the connection as ESTABLISHED.
The next image illustrates how the set-up can guard against stray segments:

For connection teardown both sides of the connection must independently close their half of the connection.
If only one side closes the connection, then this means it has no data to send, but it is still available to receive data.
In usual way to close a connection: The client or servers closes first and sends a FIN, the other side sends an ACK, and the client or server replies with a FIN/ACK.
It can also happen that you send a FIN and receive a FIN, in which case you can send both an ACK and a FIN/ACK to close the connection.
The book describes these processes in terms of the transition diagrams of the client and server. You should try to work out how the messages sent maps to state transitions.