CCNA Complete Guide

Application Application Process / Application Transport Transport Host-to-Host Network Network Internet Data Link Data Link Physical Physical Network Access OSI Reference Model TCP/IP Model DoD Model Upper Layers Presentation Session Lower Layers Figure 1-2: OSI Reference Model, TCP/IP Model, and DoD (Department of Defense) Model The upper 3 layers define the communication between applications running at different end systems and the communication between an application and its users. The lower 4 layers define how data is transmitted between end systems. Below describes the roles and functions of every layer in the OSI reference model: Application Acts as the interface between applications and the presentation layer. Applications such as web browsers are not reside in this layer. In fact they use this interface for communication with remote applications at the other end. Ex. Protocols: HTTP, FTP, SMTP, Telnet, SNMP. Presentation Defines data formats, presents data, and handles compression and encryption. As an example, the FTP ASCII and binary transfer modes define how FTP transfer data between 2 end systems. The receiving end will reassemble data according to the format used and pass them back to the application layer. Ex. Formats: ASCII, EBCDIC, JPEG, GIF, TIFF, MPEG, WAV, MIDI. Defines how to setup / establish, control / manage, and end / terminate the Session presentation layer sessions between 2 end systems. Uses port numbers to keep different application data separated from each other. Ex: SQL, NFS, RPC, X Window, NetBIOS, Winsock, BSD socket. Provides reliable (TCP) and unreliable (UDP) application data delivery Transport services, as well as segmentation and reassembly of applications data. Important concepts are connection-oriented, connectionless, error recovery, acknowledgment, flow control, and windowing. Ex. Protocols: TCP, UDP, SPX (Sequenced Packet Exchange). Defines end-to-end packet delivery and tracking of end system locations Network with logical addressing – IP addresses. Determines the best path to transfer data within an internetwork through the routes learning via routing protocols. Allows communication between end systems from different networks. There are 2 types of packets – data packets and routing update packets. Ex. Protocols: IP, IPX, AppleTalk. Defines how to transmit data over a network media (how to place network layer Data Link packets onto the network media – cable or wireless) with physical addressing. Allows communication between end systems within the same network. Ex. Protocols: LAN – Ethernet, WAN – HDLC, PPP, Frame Relay, ATM. Defines specifications for communication between end systems and the physical Physical media (how to place data link layer frames onto the media). Defines connector shapes, number of pins, pin usages or assignments, electrical current levels, and signal encoding schemes. Ex: Ethernet, RS-232, V.35. 2 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

Below lists some comparison points between common network devices: They are Network layer (L3) devices. Routers Their main concern is locating specific networks – Where is it? Which is the shortest path or best way to reach there? They create separate broadcast domains. Switches and They are Data Link layer (L2) devices. Their main role is locating specific hosts within the same network. Bridges Devices connected to a switch do not receive data that is meant only for devices connected to other ports. They create separate collision domains for devices connected to them (segmentation) but the devices are still reside in the same broadcast domain. Note: VLAN technology found in enterprise-class switches are able to create separate broadcast domains (multiple networks). They are Physical layer (L1) devices. Hubs Hubs are not smart devices. They send all the bits received from one port to all other ports; hence all devices connected via a hub receive everything the other devices send. This is like being in a room with many people – everyone hear if someone speaks. If more than one person speaks at a time, there is only noise. Repeaters also fall under the category of L1 devices. All devices connected to a hub reside in the same collision and broadcast domains. Note: A collision domain is an area of an Ethernet network where collisions can occur. If an end system can prevent another from using the network when it is using the network, these systems are considered reside in the same collision domain. Data encapsulation is the process of wrapping data from upper layer with a particular layer’s header (and trailer), which creates PDU for that particular layer (for adjacent-layer interaction). A Protocol Data Unit (PDU) consists of the layer n control information and layer n 1 encapsulated data for each layer (for same-layer interaction). Ex: L7PDU, L6PDU, L2PDU. Application Transport TCP Network Data Link Physical IP LH Data Data Data Segment Data Data 10101010101010 Packet or Datagram LT Frame Bits LH – Link Header LT – Link Trailer . Figure 1-3: Data Encapsulation Below list the 2 types of interactions between layers: Each layer uses its own header (and trailer) to communicate Same-layer interaction between the same layer on different computers. Adjacent-layer interaction A particular layer provides services to its upper layer while requests its next lower layer to perform other functions. Take place on the same computer. 3 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

Cisco Hierarchical Model Defined by Cisco to simplify the design, implementation, and maintenance of responsive, scalable, reliable, and cost-effective networks. The 3 layers are logical and not physical – there may be many devices in a single layer, or a single device may perform the functions of 2 layers, eg: core and distribution. Core layer (Backbone) Distribution layer (Routing) Access layer (Switching) Figure 1-4: The Cisco Hierarchical Model Below are the 3 layers in the Cisco Hierarchical Model: Also referred to as the backbone layer. It is responsible for transferring large Core layer amounts of traffic reliably and quickly – switches traffic as fast as possible. A failure in the core can affect many users; hence fault tolerance is the main concern in this layer. The core layer should be designed for high reliability, high availability, high redundancy, high speed, and low convergence. Do not support workgroup access, implement access lists, VLAN routing, and packet filtering which can introduce latency to this layer. Also referred to as the workgroup layer. Its primary functions are routing, Distribution Inter-VLAN routing, defining or segmenting broadcast and multicast domains, layer network security and filtering with firewalls and access lists, WAN access, and determining (or filtering) how packets access across the core layer. Also referred to as the desktop layer. Here is where end systems gain access to Access layer the network. The access layer (switches) handles traffic for local services (within a network) whereas the distribution layer (routers) handles traffic for remote services. It mainly creates separate collision domains. It also defines the access control policies for accessing the access and distribution layers. In a hierarchical network, traffic on a lower layer is only allowed to be forwarded to the upper layer after it meets some clearly defined criteria. Filtering rules and operations restrict unnecessary traffic from traversing the entire network, which results in a more responsive (lower network congestion), scalable (easy to grow), and reliable (higher availability) network. A clear understanding of the traffic flow patterns of an organization helps to ensure the placement of network devices and end systems within the organization. 4 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

Application Layer Telnet is a TCP-based text-based terminal emulation application that allows a user to remote access a machine through a Telnet session using a Telnet client which login into a Telnet server. A user may execute applications and issue commands on the server via Telnet. HyperText Transfer Protocol (HTTP) is a TCP-based application protocol that is widely used on the World Wide Web to publish and retrieve HTML (HyperText Markup Language) pages. File Transfer Protocol (FTP) is a TCP-based application protocol that allows users to perform listing of files and directories, as well as transferring files between hosts. It cannot be used to execute remote applications as with Telnet. FTP server authentication is normally implemented by system administrators to restrict user access. Anonymous FTP is a common facility offered by many FTP servers, where users do not require an account on the server. Trivial File Transfer Protocol (TFTP) is the stripped-down version of FTP (UDP-based). It does not support directory browsing, and mainly used to send and receive files. It sends much smaller block of data compared to FTP, and does not support authentication as in FTP (insecure). Network File System (NFS) is a UDP-based network file sharing protocol. It allows interoperability between 2 different types of file systems or platforms, eg: UNIX and Windows. Simple Mail Transfer Protocol (SMTP) is a TCP-based protocol that provides email delivery services. SMTP is used to send mails between SMTP mail servers; while Post Office Protocol 3 (POP3) is used to retrieve mails in the SMTP mail servers. X Window is a popular UNIX display protocol which has been designed for client-server operations. It allows an X-based GUI application called an X client which running on one computer to display its graphical screen output on an X server running on another computer. Simple Network Management Protocol (SNMP) is the de facto protocol used for network management – fault, performance, security, configuration, and account management. It gathers data by polling SNMP devices from a management station at defined intervals. SNMP agents can also be configured to send SNMP Traps to the management station upon errors. Domain Name System (DNS) makes our life easier by providing name resolution services – resolving hostnames into IP addresses. It is used to resolve Fully Qualified Domain Names (FQDNs) into IP addresses. In DNS zone files, a FQDN is specified with a trailing dot, eg: server.test.com., specifies an absolute domain name ends with an empty top level domain label. What is a Protocol? The dictionary defines it as a standard procedure for regulating data transmission between networking devices. 5 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

This page is intentionally left blank 6 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

Chapter 2 Transport and Network Layers Transport Layer Transport layer protocols provide reliable and unreliable application data delivery services. The Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are the most common transport layer protocols. There are many differences between them. Web Browser 1 SYN, SEQ 0 SPORT 1024, DPORT 80 2 SYN, ACK, SEQ 0, ACK 1 SPORT 80, DPORT 1024 3 ACK, SEQ 1, ACK 1 SPORT 1024, DPORT 80 4 Connection established. Data transfer allowed. Web Server Notes: Source port numbers are greater than 1023 and dynamically allocated by the operating system on the client side. Figure 2-1: Connection-Oriented Session Establishment Connection-oriented communication is used in reliable transport service – TCP. Figure 2-1 shows the TCP connection establishment sequence (also known as three-way handshake) which allows the systems to exchange information such as initial sequence number, window size, and other parameters for reliable data transfer between a web browser (client) and a web server. These steps must be completed prior to data transmission in connection-oriented communication. The SYN and ACK flags are very important for the connection-oriented session establishment. When SYN bit is set, it means synchronize the sequence numbers (during connection setup), while ACK bit is used to indicate that the value in the acknowledgment field is valid. In step 2, the ACK replied by the web server acknowledges the receipt of the web browser’s SYN message. Figure 2-2 shows the TCP connection termination sequence to gracefully shutdown a connection. An additional flag – FIN flag, is being used in the four-way connection termination sequence. Firstly, the web server sends a segment with the FIN bit set to 1 when the server application decided to gracefully close the connection after finished sending data (Step 1). The client would then reply with an ACK reply, which means it notices the connection termination request (Step 2). After that, the server will still wait for FIN segment from the client (Step 3). Finally, the server acknowledges the client’s FIN segment (Step 4). Web Browser 1 FIN, ACK 2 ACK 3 Client closing Server closing FIN, ACK Web Server ACK 4 Figure 2-2: TCP Connection Termination 7 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

32 bits Source Port (16) Destination Port (16) Sequence Number (32) Acknowledgment Number (32) Header Length (4) Unused (6) U R G A C K P S H R S T S Y N F I N 20 Bytes Receive Window (16) Checksum (16) Urgent Data Pointer (16) Options and Padding (0 or 32 if any) Application Layer Data Figure 2-3: TCP Segment Structure Sequence Number is used by TCP to segment large application layer data into smaller pieces. Every TCP segment sent over a TCP connection has a sequence number, which represents the byte-stream number relative to the 1st byte of the application layer data. Acknowledgment Number is the sequence number of the next expected bytes. It is used by the receiver to tell the sender the next byte to send (or resend). The acknowledgment mechanism is accumulative – a packet with the ACK bit set and an acknowledgment number of x indicates that all bytes up to x – 1 have been received. Error Recovery is another important feature provided by TCP for reliable data transfer. SYN and ACK bits are also being used for this purpose. Figure 2-4 shows 2 TCP error recovery scenarios – TCP Acknowledgment without Error and TCP Acknowledgment with Error. 100 Bytes of Data, Seq 0 100 Bytes of Data, Seq 100 100 Bytes of Data, Seq 200 Web Browser ACK 300 Web Server Figure 2-4A: TCP Acknowledgment without Error 100 Bytes of Data, Seq 0 100 Bytes of Data, Seq 100 100 Bytes of Data, Seq 200 Web Browser ACK 100 Web Server 100 Bytes of Data, Seq 100 ACK 300 Figure 2-4B: TCP Acknowledgment with Error Figure 2-4: TCP Error Recovery 8 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

In Figure 2-4B, the 2nd segment is lost. In order to recover the lost segment, the web client replies a segment with acknowledge number equals to 100, which means it expecting byte number 100 from the web server. The server then resends the data to the client (retransmission). Since the client has already received bytes 200-299 without error, it is not necessary to request again. Data is then reassembled back in order at the client end and passed to the application layer. Finally, the client continues to request data from the web server by sending an ACK 300. Positive Acknowledgment and Retransmission (PAR) uses a timer that is set to the retransmission timeout interval and is being activated every time a sender sends a segment and waiting for the ACK reply. The sender will resend all segments once the timer expired. This provides a reliability mechanism that intends to overcome the following 2 problem scenarios: i) The transmitted segment is lost or dropped. ii) The ACK segment is failed to arrive at the sender. TCP segments may arrive out of order because routers can send data across different links to a destination host. Hence the TCP stack running at the receiving end must reorder the out of order segments before passing the data to the application layer. TCP Flow Control or Congestion Control provides a mechanism for the receiver to control the sending rate of the sender with a windowing mechanism. It is achieved via SEQ, ACK and Window fields in the TCP header. The receiver defines the Window size to tell the sender how many bytes are allowed to send without waiting for an acknowledgement. It represents the receiver’s available buffer. Buffer is used to temporarily store the received bytes before the receiving application is free to process the received bytes. The sender will not send when the receiver’s window is full. Increased Window size may result in increased throughput. The window size normally starts with small value and keeps on increment until an error occurs. The window size is negotiated dynamically throughout a TCP session and it may slide up and down, hence it is often being referred to as sliding window. Multiplexing allows multiple connections to be established between processes in 2 end systems. Multiplexing is a feature that allows the transport layer at the receiving end to differentiate between the various connections and decide the appropriate application layer applications to hand over the received and reassembled data (similar to the concept of forming virtual circuits). The source and destination port number fields in the TCP and UDP headers and a concept called socket are being used for this purpose. Below lists some popular applications and their associated well-known port numbers: Application Protocol Port Number 80 HTTP TCP FTP TCP 20 (data) and 21 (control) 23 Telnet TCP 69 TFTP UDP 53 DNS TCP, UDP 67, 68 DHCP UDP 25 SMTP TCP 110 POP3 TCP 161 SNMP UDP Port numbers 0 – 1023 are well-known ports, port numbers 1024 – 49151 are registered ports, and port numbers 49152 – 65535 are private vendor assigned and dynamic ports. 9 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

Socket is a communication channel between 2 TCP processes. A client socket is created by specifying the IP address and the destination port to connect to the server; whereas a server socket binds to a specified port number and listens for incoming connections upon started a server application. User Datagram Protocol (UDP) is a connectionless (does not contact the destination before data transmission) and unreliable data delivery service, which also known as best effort service. No sequencing. No reordering. No acknowledgment. No error recovery. No congestion control. Applications uses UDP are either tolerant to data lost, or perform error recovery themselves (perform error recovery in application layer instead of transport layer). i) Tolerant to data lost: video streaming. ii) Handles its own reliability issues: NFS and TFTP (hence the use of TCP is unnecessary). Figure 2-5 shows the UDP segment structure. It does not contain SEQ, ACK and other fields as in TCP header. Even there are many disadvantages as mentioned above, UDP advantages over TCP are it is faster (no ACK process) and uses less network bandwidth and processing resources. 32 bits Source Port (16) Destination Port (16) Length (16) Checksum (16) 8 Bytes Application Layer Data Figure 2-5: UDP Segment Structure In network programming, a socket would fail to bind to specified port if the port is already in use by another socket. However, a host is allowed to bind a TCP socket and a UDP socket to the same port number at the same time, and waiting for incoming connections, as they are treated as 2 different type of service – a host can provide TCP and UDP Echo services at the same time. Do not make false assumption that connection-oriented reliable! A connection-oriented protocol does not mean it also performs error recovery, and vice-versa. Connection Type Reliable Example Protocol Connection-oriented Yes TCP Connection-oriented No TP0 and TP2 Connectionless Yes TFTP and NFS Connectionless No UDP Note: TPx isTransport Protocol Class x in ISO-TP (OSI Transport Layer Protocols). Below shows the TCP and UDP comparison chart: Feature TCP UDP Connection-oriented Yes No Reliable data transfer Yes No Ordered data transfer Yes No Flow control Yes No Multiplexing Yes Yes 10 Copyright 2008 Yap Chin Hoong www.yapchinhoong.com

Network Layer The main functions performed by network layer (L3) protocols are routing and addressing.

CCNA Complete Guide 2nd Edition will provide you with an excellent baseline on how well you are progressing, and fill all the gaps in your knowledge holes. CCNA Complete Guide 2nd Edition includes all the lab setups built using the Dynamips, the Cisco router emulation software. Practical knowledge is vital for a CCNA candidate and