Protocols

TCP (Transmission Control Protocol)

  • Layer: 4 (Transport)
  • Purpose: Ensures reliable, ordered data delivery.
  • Mechanism:
    • Connection setup: Uses 3-way handshake (SYN, SYN-ACK, ACK).
    • Sequence numbers: Assigns a number to each packet for tracking.
    • Acknowledgments (ACKs): Confirms receipt of packets.
    • Retransmissions: Resends lost packets.

UDP (User Datagram Protocol)

  • Layer: 4 (Transport)
  • Purpose: Fast, connectionless data transfer.
  • Characteristics:
    • No error correction or retransmission.
    • Ideal for speed-critical applications (e.g., VoIP, streaming).
    • Typically operates on ports like 12345 or 27015.

DHCP (Dynamic Host Configuration Protocol)

  • Layer: 7 (Application)
  • Purpose: Automates IP address assignment.
  • Mechanism:
    • Uses UDP ports 67 (server) and 68 (client).
    • Process: DORA (Discover, Offer, Request, ACK).

DNS (Domain Name System)

  • Layer: 7 (Application)
  • Purpose: Resolves domain names to IP addresses.
  • Characteristics:
    • Example: Resolves www.example.com to 93.184.216.34.
    • By default uses UDP port 53; can use TCP for large responses.

Transport Layer (OSI Layer 4)

  • Responsible for data transfer between devices.
  • Protocols: TCP (reliable) and UDP (fast).
  • Port numbers: Direct data to applications (e.g., TCP 80 for HTTP, UDP 53 for DNS).

Port Number

  • A 16-bit identifier in TCP/UDP headers directing data to applications.
  • Examples:
    • 443 for HTTPS.
    • 53 for DNS.
    • 27015 for gaming.
  • Note: Firewalls may block specific ports (e.g., UDP 12345).

3-Way Handshake

  • TCP connection setup process:
    1. Client sends SYN.
    2. Server replies with SYN-ACK.
    3. Client sends ACK.
  • Failure to receive SYN-ACK indicates potential network issues (e.g., firewall blocking port).

Sequence Numbers

  • Used in TCP to order packets and detect loss.
  • Each packet is numbered, and ACKs confirm receipt.
  • Retransmission occurs if packets are missing (e.g., stalls from congestion or window size mismatch).

Retransmission

  • TCP resends lost packets detected through missing ACKs.
  • Excessive retransmissions can indicate congestion—requires analysis of bandwidth or window size settings.

Window Size

  • Flow control mechanism in TCP:
    • Determines how many bytes a receiver can accept before sending an ACK.
    • Small window sizes can cause stalls (especially in WAN transfers).
    • Adjust settings on server/client configurations to optimize performance.

APIPA (Automatic Private IP Addressing)

  • IPv4 range: 169.254.0.0 to 169.254.255.255.
  • Automatically assigned when DHCP fails (scope full, server unreachable).
  • Indicates configuration or network problems.

DHCP Scope

  • The range of IPs a DHCP server can assign (e.g., 192.168.1.100 to 192.168.1.200).
  • Conflicts can arise from exhaustion or overlaps with static IPs (e.g., static IP 192.168.10.125); ensure static IPs are excluded from DHCP assignments.

DORA Process

  • Steps in DHCP IP assignment:
    1. Discover: Client broadcasts request.
    2. Offer: Server replies with available IP.
    3. Request: Client accepts the offer.
    4. ACK: Server confirms allocation.
  • Failure during Offer/ACK indicates potential server or relay issues.

DHCP Relay

  • Function: Forwards DHCP requests across subnets (like VLANs).
  • Configuration errors can prevent clients from reaching the server (post-outage issues showing IPs like 169.254.x.x).

DNS Query

  • Request to resolve a domain to an IP (e.g., mail.company.com to its corresponding IP).
  • Sent via UDP port 53; timeouts can signal port blocks or server availability issues.

Quality of Service (QoS)

  • Prioritizes traffic types, particularly UDP for VoIP services.
  • Mitigates packet loss and jitter in busy networks to ensure smooth communication (e.g., prevents call drops or gaming lag).

Packet Loss

  • Refers to dropped packets during transmission.
  • UDP tolerates some packet loss (e.g., minor VoIP glitches), while TCP employs retransmission strategies to recover lost data.
  • Troubleshoot packets based on protocol: QoS for UDP loss and congestion checks for TCP losses (analyzing bandwidth usage).

Firewall Rules

  • Rules set to filter traffic based on port/protocol specifications (e.g., blocking TCP 443 or UDP 53).
  • Check rules when facing DNS or HTTPS failures which involve SYNs not receiving ACKs or query timeouts—often indicative of firewall-related issues.

Congestion

  • Occurs when the network is overloaded, leading to delays or packet loss.
  • TCP will slow down retrials during congestion (e.g., file transfer stalls), while UDP may drop packets, resulting in issues like choppy audio.
  • Analyze bandwidth usage and consider traffic prioritization techniques.

Jitter

  • The fluctuation in packet arrival times.
  • Particularly affects UDP applications (e.g., gaming lag or streaming issues).
  • Can be mitigated through WAN Quality of Service (QoS) or traffic shaping approaches; TCP mechanisms will not solve jitter issues.

ARP Conflict

  • Duplicate IP address issue detected via ARP (Address Resolution Protocol).
  • Typically occurs when DHCP assigns a static IP (e.g., 192.168.10.125) leading to MAC address clashes.
  • Always ensure static IPs are excluded from the DHCP scope to prevent conflicts.

TCP Reset (RST)

  • Function: Abruptly ends a TCP connection.
  • Commonly seen post-handshake if there’s an application failure; indicates potential app timeouts or port configuration mismatches, requiring a check of the application settings rather than assuming a network loss.

Flow Control

  • TCP manages the data transmission rate through window size adjustments, avoiding data congestion.
  • UDP lacks this feature, increasing the risk of packet loss in congested environments, like with VoIP communications.
  • Implement QoS for UDP traffic management, while adjusting TCP window size can also help manage flow control efficiently.

Troubleshooting Steps

  • Diagnosis process for network issues:
    1. Ping: Test reachability of devices or endpoints.
    2. Check Ports: Verify specific port configurations to ensure proper communication (e.g., UDP 53).
    3. Verify DHCP Scope/Relay: Ensure proper configurations for IP distribution.
    4. Analyze Packets: Focus on retransmissions and dropped packets for both TCP and UDP traffic.
    5. Adjust Firewall/QoS Settings: Modify any filtering or quality settings as necessary.

Packet Capture

  • Tool for network analysis; identifies various transport issues:
    • TCP retransmissions indicating congestion.
    • UDP drops showing jitter impact.
    • DNS timeouts through blocked UDP 53 traffic.
    • RSTs indicating application issues—provides guidance for targeted fixes.