Cisco Routing and Transport Layer Protocols

The Fundamental Need for Routing

• Direct connection within a local network is limited; most devices require connectivity to other homes, businesses, and the internet.

• Remote hosts are defined as devices located beyond the local network segment.

• Routing and routers are essential when a source device transmits a packet to a remote destination host.

• Routing is defined as the process of identifying the best path to a destination.

• A router is a networking device that functions at Layer $3$ to connect multiple IP networks.

• At the distribution layer of the network, routers are responsible for directing traffic and performing functions critical to efficient operations.

• Like switches, routers decode and read messages; however, they differ in their forwarding criteria:

  • Switches make forwarding decisions based on Layer $2$ MAC addresses.

  • Routers make forwarding decisions based on Layer $3$ IP addresses.

• Packet formats include the source host IP address, the destination host IP address, and the message data.

• The router analyzes the network portion of the destination IP address to identify which attached network provides the optimal path for forwarding.

• A router must be used whenever the network portion of the source and destination IP addresses do not match.

• Example: If a host on network $1.1.1.0$ needs to send a message to a host on network $5.5.5.0$, the message is forwarded to the router. The router de-encapsulates the Ethernet frame, reads the destination IP address in the packet, determines the forward path, re-encapsulates the packet into a new frame, and delivers it.

The Logic and Structure of the Routing Table

• Routers maintain routing tables to store information regarding local and remote networks.

• Routing tables do not store addresses of individual hosts; instead, they contain network addresses and the best paths to reach those networks.

• There are two methods for making entries in a routing table:

  • Dynamic updates based on information received from other routers.

  • Manual entries performed by a network administrator (static routes).

• Routers use the table to determine the specific interface required to forward a message; if a destination cannot be determined, the router will drop the packet.

• To prevent packet loss for unknown destinations, network administrators configure a static default route.

• A default route is an interface through which the router forwards a packet containing an unknown destination IP network address. This typically connects to another router further along the path.

• A sample routing table entry includes:

  • Type: The connection type (e.g., $C$ stands for directly connected).

  • Network: The network address.

  • Port: The interface used for forwarding.

• Sample Table Data:

  • Type: $C$, Network: $10.0.0.0/8$, Port: $\text{FastEthernet0/0}$.

  • Type: $C$, Network: $172.16.0.0/16$, Port: $\text{FastEthernet0/1}$.

The Function of the Default Gateway

• Host communication depends on whether the destination is local or remote:

  • Local Communication: The host forwards the message directly, using Address Resolution Protocol (ARP) to discover the destination's MAC address before encapsulating the IPv4 packet into a frame.

  • Remote Communication: The host must use a router to reach the destination. The packet contains the final destination IP, but the frame uses the MAC address of the router as the destination.

• The default gateway is the IPv4 address of the router interface connected to the same local network as the source host.

• Configuration of the default gateway:

  • All hosts on a local network use this address to send messages to the router.

  • Once a host knows the default gateway IPv4 address, it uses ARP to find the router's MAC address for frame encapsulation.

  • Failure to configure a correct default gateway in TCP/IP settings results in the inability to deliver messages to remote networks.

• Sample Configuration Settings:

  • H1: IP $192.168.1.1$, Subnet Mask $255.255.255.0$, Default Gateway $192.168.1.254$.

  • H2: IP $192.168.1.2$, Subnet Mask $255.255.255.0$, Default Gateway $192.168.1.254$.

  • H3: IP $192.168.1.3$, Subnet Mask $255.255.255.0$, Default Gateway $192.168.1.254$.

Data Transportation and the Transport Layer

• The transport layer provides logical communication between applications running on different hosts.

• It serves as the link between the application layer and the lower layers responsible for network transmission.

• Key responsibilities of the transport layer include:

  • Tracking individual conversations.

  • Segmenting data and reassembling segments.

  • Adding header information.

  • Identifying, separating, and managing multiple conversations.

  • Using multiplexing to interleave different communication conversations on the same network.

• While IP handles packet delivery, transport layer protocols manage the reliability and specific transfer methods between hosts.

• The primary transport layer protocols are TCP (Transmission Control Protocol) and UDP (User Datagram Protocol).

Detailed Overview of Transmission Control Protocol (TCP)

• TCP provides reliability and flow control through several basic operations:

  • Numbering and tracking data segments sent from specific applications to specific hosts.

  • Acknowledging received data.

  • Retransmitting unacknowledged data after a set period.

  • Sequencing data that arrives out of order.

  • Adjusting data transmission rates to levels acceptable by the receiver.

• Core Features of TCP:

  • Session Establishment: TCP is connection-oriented; it negotiates a permanent connection (session) before forwarding traffic.

  • Reliable Delivery: It ensures every sent segment reaches the destination, even if segments are lost or corrupted during transit.

  • Same-Order Delivery: It utilizes sequence numbers to reorder data that may arrive via different network routes at different rates.

  • Flow Control: If host resources (memory or processing power) are overtaxed, TCP requests the sending application to reduce the rate of data flow.

• TCP is used for applications where all data must arrive and be processed in the correct sequence.

Detailed Overview of User Datagram Protocol (UDP)

• UDP provides basic datagram delivery with minimal overhead and no data checking.

• Core Features of UDP:

  • Connectionless: No session establishment is required.

  • Best-Effort Delivery: There is no acknowledgment of received data (unreliable delivery).

  • Reconstruction: Data is reconstructed simply in the order it is received, with no mechanism to reorder out-of-sequence datagrams.

  • No Retransmission: Lost segments are not resent.

  • Resource Blind: The sender is not informed about receiver resource availability.

• UDP is ideal for:

  • Live video and multimedia (e.g., VoIP, streaming) that can tolerate minor data loss but requires low delay.

  • Simple request-and-reply applications (e.g., DNS, DHCP).

  • Applications that manage their own reliability (e.g., SNMP, TFTP).

Port Numbers and Socket Communication

• Port numbers are used by both TCP and UDP to manage multiple simultaneous conversations.

• Source Port: Associated with the originating application on the local host.

• Destination Port: Associated with the application on the remote host.

• A Socket is the combination of an IP address and a port number (e.g., Source IP + Source Port).

• Sockets allow multiple processes on a client or multiple connections to a server to remain distinct.

• Port Number Groups:

  • Well-known Ports ($0$ to $1,023$): Reserved for common services like web browsers and email (e.g., HTTP, FTP).

  • Registered Ports ($1,024$ to $49,151$): Assigned by IANA for specific applications (e.g., Cisco RADIUS uses port $1812$).

  • Private and/or Dynamic Ports ($49,152$ to $65,535$): Also known as ephemeral ports, usually assigned dynamically by the client OS to identify the client application during a session.

• Common Well-Known Port Assignments:

  • $20$: FTP (Data) - TCP

  • $21$: FTP (Control) - TCP

  • $22$: SSH - TCP

  • $23$: Telnet - TCP

  • $25$: SMTP - TCP

  • $53$: DNS - UDP/TCP

  • $67$: DHCP (Server) - UDP

  • $68$: DHCP (Client) - UDP

  • $69$: TFTP - UDP

  • $80$: HTTP - TCP

  • $110$: POP3 - TCP

  • $143$: IMAP - TCP

  • $161$: SNMP - UDP

  • $443$: HTTPS - TCP

TCP and UDP Communication Processes

• TCP Server Processes:

  • Server applications are assigned specific port numbers. A server cannot assign two services to the same port within the same transport service.

  • An assigned port is considered "open," meaning the transport layer will accept and pass segments to the application.

• TCP Three-Way Handshake (Connection Establishment):

  • Step $1$: The client sends a request for a session to the server.

  • Step $2$: The server acknowledges the request and sends its own request for a return session.

  • Step $3$: The client acknowledges the server's session request.

• TCP Session Termination:

  • Step $1$: Client sends a FIN flag indicating no more data remains.

  • Step $2$: Server sends an ACK to acknowledge the FIN.

  • Step $3$: Server sends its own FIN to the client.

  • Step $4$: Client responds with an ACK.

• TCP Reliability Mechanisms:

  • Sequence numbers are assigned to reassemble data in order.

  • Selective Acknowledgment (SACK): An optional feature negotiated during the handshake allowing a receiver to acknowledge specific discontinuous blocks of received bytes.

• UDP Processes:

  • UDP Server: Listens on well-known or registered ports and forwards datagrams to the correct application based on the destination port.

  • UDP Client: Dynamically selects a source port and uses the server's well-known port as the destination. The same port pair is used for all datagrams in that transaction.

Connection Verification with netstat

• Unexplained TCP connections can indicate security threats.

• The netstat command is a tool used to verify active connections.

• Example netstat output columns:

  • Proto (Protocol): e.g., TCP

  • Local Address: e.g., $192.168.1.124:3126$

  • Foreign Address: e.g., $192.168.0.2:\text{netbios-ssn}$

  • State: e.g., ESTABLISHED