Chapter #9 - Transport Layer : Internet Porotocols

What does the transport layer connect?

End processes (applications) on different hosts — end-to-end communication, above the network layer.

What does TSAP stand for, and what are TSAPs called in the Internet?

Transport Service Access Point(Transport Layer Address). In the Internet they are called ports.

Three ways to find a service provider's TSAP?

1) Well-known ports (standardized), 2) Portmapper/directory service, 3) Initial connection protocol (handler process).

Name 5 core functions of a transport protocol.

Multiplexing/demultiplexing (ports), connection establishment, error control, flow control, congestion control.

Why are ports used instead of process IDs?

1) PIDs change on every restart — ports remain stable.

2) Multiple processes can share a port via sockets; port is an OS-independent abstraction.

UDP in one sentence.

Connectionless, unreliable, message-oriented transport(isolated unit data transfer) — essentially IP with port numbers and an optional checksum.

UDP header fields (4 fields)?

Source port (16 bit, optional), Destination port (16 bit), Length (min 8, header + data), Checksum (optional).

Why does UDP exist instead of letting apps send raw IP packets?

UDP adds port-based multiplexing/demultiplexing and a checksum — raw IP offers neither, so apps couldn't distinguish which process a packet belongs to.

TCP service model in one sentence.

Reliable, ordered, bidirectional, unstructured byte stream between two endpoints over an unreliable internetwork.

Differences between TCP and UDP?

TCP: reliable, connection-oriented, ordered, flow + congestion control.

UDP: unreliable, connectionless, unordered, no flow/congestion control.

Similarities between TCP and UDP?

Both use port numbers, both compute a checksum, both run over IP.

How does TCP number data?

Every byte has a unique 32-bit sequence number; each segment carries the sequence number of its first byte.

Typical max TCP segment data size and why?

≤1460 bytes (1500 B Ethernet MTU − 20 B IP header − 20 B TCP header).

What reliability mechanism does TCP use?

Sliding window with cumulative ACKs and retransmission on timer expiry.

Worst-case overhead ratio for TCP (1 byte payload, ACK not piggybackable)?

Data segment: 1 B data + 20 B IP + 20 B TCP = 41 B. ACK: 40 B. Total 81 B for 1 B useful data.

Worst-case overhead ratio for UDP (1 byte payload)?

1 B data + 20 B IP + 8 B UDP = 29 B total.

What does the Acknowledgement Number field mean? TCP

The next byte the receiver expects — confirms all bytes up to (AckNo − 1) received.

What does the Window field do? TCP

Controls Senders Sliding Window by advertising the receivers Buffer size in Bytes.
Window = 0 means pause sending

What is the Pseudoheader and why is it used? TCP

To detect misdelivered Packets - this violates layering principle.

It is a conceptual Header only used in checksum calculation.

What does Header Length (HL) indicate? - in TCP

Length of the TCP header including options, in 32-bit words — marks where data begins.

Explain SYN, ACK, FIN. - TCP Flags

SYN — synchronize sequence numbers / initiate connection (SYN=1 ACK=0: request; SYN=1 ACK=1: accept).

ACK — Ack Number is valid.

FIN — sender has no more data; releases this direction.

What do RST, PSH, URG do? Topic: TCP Flags

RST: abort/reset connection immediately.

PSH: deliver buffered data to app right away.

URG: urgent data present at offset given by Urgent Pointer.

Topic: TCP Flags What do CWR and ECE do?

ECE: receiver signals network congestion to sender.

CWR: sender confirms it reduced its congestion window.

Why is a two-way handshake insufficient?

An old duplicate SYN can arrive and open a stale connection. The third leg (ACK) lets the initiator confirm the SYN-ACK matches the current attempt.

TCP three-way handshake steps.

1) Client → SYN (seq=x).

2) Server → SYN+ACK (seq=y, ack=x+1).

3) Client → ACK (ack=y+1). Connection established after step 3.

Why is the initial sequence number random, not 0?

To reduce the chance that old connection's sequence numbers overlap with a new connection on the same socket pair.

Security problem with the three-way handshake?

SYN flood attack — attacker sends many SYNs without completing handshakes, exhausting server's half-open connection table.

How is a TCP connection released reliably?

Each direction is closed independently with a FIN + ACK. Full release requires both directions shut down (typically four segments).

Two types of TCP connection release?

1) Graceful (FIN-based) — drains data, closes each direction independently. 2) Abrupt (RST) — immediate teardown, data may be lost.

What is the 2-Armies Problem and how does TCP handle it?

No protocol over an unreliable channel can guarantee both sides agree to close simultaneously.

→TCP uses TIME-WAIT (waits 2×MSL) so delayed segments expire before the port is reused.

Why must RTO(Retransmission Timeout) > RTT(Round Trip Timet)? What if it's too short or too long? TCP Timer & RTT

Must exceed one round trip to distinguish loss from a slow ACK.

RTO must be set slightly above RTT

Too short → unnecessary retransmissions.

Too long → unnecessary latency on loss.

RTT smoothing formula - TCP Timer & RTT

what is the typical value for α?

new_RTT = α × old_RTT + (1−α) × sample. Typical α = 7/8. Higher α = more weight on history.

Topic: TCP Timer & RTT

How is deviation D used to set RTO?

D = α×D + (1−α)×|RTT − sample|. RTO = RTT + 4×D. Adapts to high variance under congestion.

Topic: TCP Congestion Control

What does TCP use as a congestion signal?

Packet loss (timeout or duplicate ACKs).

Topic: TCP Congestion Control

Slow start: how does cwnd grow?

Phase 1 — Slow Start

cwnd starts at 1; increments by 1 per ACK → doubles each RTT (exponential) until ss_thresh or loss.

Topic: TCP Congestion Control

Congestion avoidance: how does cwnd grow?

Phase 2 — Congestion Avoidance (what kicks in after ss_thresh)

No more exponential increase since cwnd>=ss_thresh now:

Additive increase — cwnd += 1/cwnd per ACK → grows by ~1 segment per RTT (linear).

Topic: TCP Congestion Control

cwnd

What happens on timeout (loss)?

TCP panics , assumes network=congested, does either 1 or 2:

ss_thresh = cwnd / 2;

cwnd = 1; restart slow start.

Topic: TCP Congestion Control

Name four TCP variants.

Tahoe (basic + fast retransmit), Reno (+ fast recovery), CUBIC (Linux default), Vegas (RTT-based window).