All about Networking

What is WINS?

2010-12-23T16:38:00.000+07:00

Not satisfied with DNS, Microsoft invented another naming service for Windows, called WINS (Windows Internet Name Service). WINS is a Windows-specific name service for TCP/IP and is meant for networking geographically distant Windows computers (it typically isn’t used on a local area network). WINS not only maps names of servers but also maps names of workgroups and NT domains.
It’s unlikely that WINS will be around in the next generation of Windows machines (although it’s still around in Windows 98); Microsoft is taking a page from the competition’s automatic name services and directory services and will be rolling TCP/IP name services together with their username and password services. This will be called Active Directory.
The notion of a directory is similar to the name services concept, but it goes one step further: Instead of simply resolving a name to a number, directory services offer many pieces of vital data on the network. In particular, directory services allow users from all over to log in to the network rather than into a specific server; each server on the network relies on the directory services to assign security rights, and so on.

This is terrific because administrators no longer need to update multiple servers with username and password information; instead, they can administer updates from one point and distribute them throughout the network. Although the long-term goal has been simplification, which makes troubleshooting easier, beware of early implementations. Even Novell’s NDS—arguably the “best” directory service around (it’s been around a number of years and has a lot of support)—had a lot of problems out of the gate.
Some sort of directory service—whether it’s Microsoft’s, Novell’s, or Acme’s—is definitely in your future.

What is DNS?

2010-12-23T06:37:00.000+07:00

Prologue for this article.
You’ve probably asked yourself in one of the preceding paragraphs, “How does www.co.chatham.ga.us get translated into 167.195.160.9?” Furthermore, why use names at all? People can deal with phone numbers, why not just use the IP number? These are good questions. The answer to the latter is that just because people can deal with a number doesn’t mean that they prefer to use a number. Which would you rather remember, 1-800-NETWORK or 1-800-638-9675? Obviously, most people prefer to remember a name. Actually, names are the better thing to use when networking, because numerical addresses can change during a reconfiguration or a move, whereas symbolic names typically stay the same.
Name-to-address translation (also known as name lookup or name resolution) occurs via name services. Very similar to the speed dial button on your phone, name services are the networking equivalent of an electronic phone book. They’re actually a lot cooler than your speed dial: For example, suppose you could say “Mom” to make your phone dial your mother.

DNS (Domain Name System)

Name services run as a service on any given name server; that is, a specific program runs on a name server that hands out an address when you give it a name. Like your speed dial buttons, you must program in a name entry; entering the correct number for a given name is important. In particular, TCP/IP name services, although powerful and able to handle millions and millions of names, isn’t exactly plug-and-play. The DNS (Domain Name Service) that you use when surfing the Web works pretty automatically for you once it’s configured correctly, and it will translate www.co.chatham.ga.us to 167.195.160.9. However, you’ll need to know the exact number of your DNS server. Unlike telephone information, DNS servers all have different addresses; verifying that a workstation’s DNS server is correct can be an important troubleshooting step

Note that most smaller sites that use TCP/IP usually don’t have DNS set up. Instead, each workstation has a local (hard drive) “hosts” file that lists the addresses and host names the workstation needs to get to. (Think of this as your personal phone book rather than the corporate directory.) As you can imagine, this gets hard to manage when you have more than a handful of workstations, unless the addresses of the servers never change. As sites grow, or as they get connected to the Internet, DNS servers are added. Can you imagine how big a single file with all the servers on the Internet would be? Fortunately, each DNS server for a given DNS zone is only responsible for its own information.
A DNS zone (its scope of responsibility for naming) can be huge—for example, .com has millions of subzones (yahoo.com, jotto.com, and so on); on the other hand, it can be small—for example, feldman.org lists only one host (www.feldman.org) and no subzones.
With DNS servers getting easier to manage and being a mandatory component of Internet access, you can expect to see more of them in smaller shops as time goes on. It’s worth mentioning that each DNS server is responsible for only its own zone, so if you can’t get to one particular address (say, yahoo.com) but can get to another (say, jotto.com), it may be that the name server responsible for that zone is down. On the Internet at large, this rarely happens, because the DNS organizers require back-up DNS servers for a zone. DNS problems are more likely to happen within a smaller organization’s intranet, particularly when all the eggs for that organization are in one basket.

What is LAN and WAN?

2010-12-12T13:53:00.000+07:00

A LAN is a high-speed, fault-tolerant data network that covers a relatively small geographic area. It typically connects workstations, personal computers, printers, and other devices. LANs offer computer users many advantages, including shared access to devices and applications, ﬁle exchange between connected users, and communication between users via electronic mail and other applications.

A WAN is a data communications network that covers a relatively broad geographic area and often uses transmission facilities provided by common carriers, such as telephone companies. WAN technologies function at the lower three layers of the OSI reference model: the physical layer, the data link layer, and the network layer.

TYPES OF DOS ATTACKS

2010-10-22T19:17:00.000+07:00

To be able to perform, find, or protect against DoS activities, you must first understand the basic principles and types of these attacks. Three main types of DoS attacks exist:

Consumption of resources, such as bandwidth, hard disk space,
CPU resources, and so on
Disruption of configuration information, routing, DNS, and other information
Direct disruption of network communication between the client and the server

As information about common DoS attacks has been mentioned in many other Hacking Exposed books, we'll only briefly describe these types of DoS attacks and will then move on to spend more time on Cisco-centric issues. We'll also include details on the methods of stopping DoS attacks on the perimeter of your network using built-in functions of Cisco devices.

Consumption of Resources

The bandwidth consumption attack is the most common type of DoS in the world. Many Internet companies such as Yahoo!, eBay, Microsoft, Amazon, and others have experienced downtime and financial losses due to this type of attack.

This type of attack makes up the majority of distributed denial of service (DDoS) attacks, as well as the early DoS methods of using ping -f floods by attackers with larger Internet pipes than those of their targets. These attacks are more difficult, and sometimes even impossible, to mitigate due to the nature of the protocols on which the Internet is built. However, efficient means of traffic rate control have been implemented by Cisco Systems for routers, and we will review these methods in this chapter. CPU resource consumption attacks can be the result of programming flaws found in the TCP/IP stack, server-side services, and other network-interacting software to which attackers can connect. These attacks can usually be rectified by patching the buggy software code using vendor patches. Hard disk space consumption occurs when the software or service is tricked into storing excessive amounts of information on the server's storage facility, thus consuming all available storage resources and memory. This will most likely lead to a denial of services for legitimate users and can be rectified by cleaning up the disk space, fixing the buggy software code, and/or rebooting the server. An example of such an attack is the flooding of an unauthenticated syslog server (usually found on port 514/UDP) by junk messages. An attacker can send any information to that port and it will be stored in the system log files. Depending on the attacker's bandwidth and the storage available, this method can be effective in disabling the logging facilities of the server or even the entire enterprise, making attacker tracing and prosecution a very difficult task.

Disruption of Information Flow

This type of attack is less common than bandwidth consumption; however, such an attack can affect many users, organizations, and, if properly launched, even entire countries or continents. For instance, the DNS entry of a company or an entire country can be altered or diverted to a different location or to /dev/null, thus disabling connectivity of the targeted networks for the duration of the attack. The motives behind this type of attack are usually political or corporate in nature. Another example of such an attack can be discovered when an attacker fiddles with the routers responsible for Border Gateway Protocol (BGP) routing updates; this can easily bring a large chunk of the Internet to its knees with only a few packets.

Disruption of Communication

This type of attack causes a disruption of established communication channels between the client and server. A typical attack would involve resetting a management TCP session to the device, such as a PIX firewall, to stop a system administrator from reconfiguring the device to counter a different attack. These attacks are usually possible due to a system software fault and can be rectified by applying a vendor patch.

DOS ATTACK MOTIVES

2010-10-22T09:15:00.000+07:00

The Internet has experienced numerous cases of DoS attacks. Unfortunately, due to the nature and existing inherited drawbacks of current Internet-centric protocols, these attacks are likely to stay with us for a long time, causing havoc and financial losses to thousands of organizations all over the world.

As we have already stated, the usual cause behind the attacks from experienced Black Hat hackers is to achieve some level of remote control (be it enable or unprivileged access) over the device. Therefore, the main reason why these attacks are uncommon among experienced hackers is that after successfully performing a series of DoS attacks, the device or targeted equipment becomes useless or obsolete for the duration of the attack or until the device is restarted. This scenario is usually true unless the attacked device is being specifically targeted to disable its operations as a part of some malicious "master plan."

In contrast, many unskilled hackers who do not manage to gain remote access to a device are likely to be frustrated, pitiful people who also show their underdeveloped egos by bragging on Internet Relay Chat (IRC) channels or underground message boards to increase their device frag count. These attackers will try to crash the device by all means possible to satisfy their egos and boast about such "marvelous" achievements to their virtual friends. What motivates different types of crackers to perform DoS attacks? The list of reasons can go on forever, but here are just a few of them:

Industrial and corporate competition
Profit-related causes (racketeers or mafia)
Political or social reasons
Having fun
Bragging rights
Revenge
Hatred

7 Layer OSI : Physical Layer

2010-08-07T10:50:00.001+07:00

The physical layer is responsible for activating the physical circuit between the Data Terminal Equipment (DTE) and Data Circuit-terminating Equipment (DCE), communicating through it, and then deactivating it. Additionally, the physical layer is also responsible for the communication between DCEs. A computer or router can represent the DTE. The DCE, on the other hand, is usually represented by a modem or a multiplexer.

To put it differently, the physical layer describes the electric or optical signals used for communicating between two computers. Physical circuits are created on the physical layer. Other appliances such as modems modulating a signal for a phone line are often put in the physical circuits created between two computers.
Physical layer protocols specify the following:
• Electrical signals (for example, +1V)
• Connector shapes (for example, V.35)
• Media type (twisted pair, coaxial cable, optical fiber, etc.)
• Modulation (for example, FM, PM, etc.)
• Coding (for example, RZ, NRZ, etc.)
• Synchronization (synchronous and asynchronous communication, time source, and so on)

7 Layer OSI : Data Link Layer

2010-08-06T10:39:00.000+07:00

As for serial links, the link layer provides data exchange between neighboring computers as well as data exchange between computers within a local network.
For the link layer, the basic unit of data transfer is the data link packet frame. A data frame is composed of a header, payload, and trailer.

A frame carries the destination link address, source link address, and other control information in the header. The trailer usually contains the checksum of the transported data. By using the checksum, we can find out whether the payload has been damaged during transfer. The network-layer packet is usually included in the payload.
The link layer does not engage in a conversation between DTE and DCE (the link layer does not see the DCE). It is engaged, however, in the frame exchange between DTEs. (It relies on the physical layer to handle the DCE issue.)
The following figure illustrates that different protocols can be used for each end of the connection on the physical layer. In our case, one of the ends uses the X.21 protocol while the other end uses the V.35 protocol. This rule is valid not only for serial links, but also for local networks. In local networks, you are more likely to encounter more complicated setups in which a switch that converts the link frames of one link protocol into link frames of a second one (for example, Ethernet into FDDI) is inserted between the two ends of the connection. This obviously results in different protocols being used on the physical layer.

A serial port or an Ethernet card can serve as a link interface. A link interface has a link address that is unique within a particular Local Area Network (LAN).

7 Layer OSI : Network Layer

2010-08-05T10:34:00.002+07:00

The network layer ensures the data transfer between two remote computers within a particular Wide Area Network (WAN). The basic unit of transfer is a datagram that is wrapped (encapsulated) in a frame. The datagram is also composed of a header and data field. Trailers are not very common in network protocols.

As shown in the figure above, the datagram header, together with data (network-layer payload), creates the payload or data field of the frame.
There is usually at least one router on WANs between two computers. The connection between two neighboring routers on the link layer is always direct. The router unpacks the datagram from a frame, only to wrap it again into a different frame (or, more generally, in a frame of different link protocol) before sending it to a different line. The network layer does not see the appliances on the physical and link layers (modems, repeaters, switches, etc.).
The network layer does not care about what kind of link protocols are used on route between the source and the destination.

A serial port or an Ethernet card can be used as a network interface. A network interface has a one or more unique address within a particular WAN.

7 Layer OSI : Transport Layer

2010-08-04T10:26:00.001+07:00

A network layer facilitates the connection between two remote computers. As far as the transport layer is concerned, it acts as if there were no modems, repeaters, bridges, or routers along the way. The transport layer relies completely on the services of lower layers. It also expects that the connection between two computers has been established, and it can therefore fully dedicate its efforts to the cooperation between two distant computers. Generally, the transport layer is responsible for communication between two applications running on different computers.
There can be several transport connections between two computers at any given time (for example, one for a virtual terminal and another for email). On the network layer, the transport packets are directed based on the address of the computer (or its network interface). On the transport layer, individual applications are addressed. Applications use unique addresses within one computer, so the transport address is usually composed of both the network and transport addresses.

In this case, the basic transmission unit is the segment that is composed of a header and payload.
The transport packet is transmitted within the payload of the network packet.

7 Layer OSI : Session Layer

2010-08-03T10:25:00.000+07:00

The session layer facilitates exchange of data between two applications. In other words, it serves as a checkpoint and is involved in synchronizing transactions, correctly closing files, and so on. Sharing a network disk is a good example of a session. The disk can be shared for a certain period of time, but the disk is not used for the entire time. When we need to work with a file on the network disk, a connection is established on the transport layer from the time when the file is opened to when it is closed. The session, however, exists on the session layer for the entire time the disk is being shared.
The basic unit is a session layer PDU (Protocol Data Unit), which is inserted in a segment. Other books often illustrate this with a figure of a session-layer PDU, composed of the session header and payload, being inserted in the segment. Starting with the session layer, however, this does not necessarily have to be the case. The session layer information can be transmitted inside the payload. This situation is even more noticeable if, for example, the presentation layer encrypts the data, and thus changes the whole content of the session-layer PDU.

Brief History of Internet Protocol

2010-02-22T09:49:00.000+07:00

This number is an exclusive number or address for all information technology devices (printers, routers, modems, et al) use which identifies and allows them the ability to communicate with each other on a computer network. There is a standard of communication, called an Internet Protocol standard (IP). In laymans terms it is the same as your home address. In order for you to receive snail mail at home the sending party must have your correct mailing address (IP address) in your town (network) or you do not receive bills, pizza coupons or your tax refund. The same is true for all equipment on the internet. Without this specific address, information cannot be received. IP addresses may either be assigned permanently for an Email server/Business server or a permanent home resident or temporarily, from a pool of available addresses (first come first serve) from your Internet Service Provider. A permanent number may not be available in all areas and may cost extra so be sure to ask your ISP.
Domain Name System (DNS): IP address to be translated to words. It is much easier to remember a word than a series of numbers. The same is true for email addresses.
For example, it is much easier for you to remember a web address name such as whatismyip.com than it is to remember 192.168.1.1 or in the case of email it is much easier to remember email@somedomain.com than email@192.168.1.1
Dynamic IP: One that is not static and could change at any time. This type of IP is issued to you from a pool of IP addresses allocated by your ISP or DHCP Server. This is for a large number of customers that do not require the same IP all the time for a variety of reasons. Your computer will automatically get this number as it logs on to the network and saves you the trouble of having to know details regarding the specific network configurations. This number can be assigned to anyone using a dial-up connection, Wireless and High Speed Internet connections. If you need to run your own email server or web server, it would be best to have a static IP.
Static IP: One that is fixed and never changes. This is in contrast to a dynamic IP which may change at any time. Most ISP's a single static IP or a block of static IP's for a few extra bucks a month.
IP version 4: Currently used by most network devices. However, with more and more computers accessing the internet, IPv4 IPs are running out quickly. Just like in a city, addresses have to be created for new neighborhoods but, if your neighborhood gets too large, you will have to come up with an entire new pool of addresses. IPv4 is limited to 4,294,967,296 IPs.
IP version 5: This is an experimental protocol for UNIX based systems. In keeping with standard UNIX (a computer Operating System) release conventions, all odd-numbered versions are considered experimental. It was never intended to be used by the general public.
IP version 6: The replacement for the aging IPv4. The estimated number of unique IPs for IPv6 is 340,282,366,920,938,463,463,374,607,431,768,211,456 or 2^128.
The old and current standard of IPs was this: 192.168.100.100 the new way can be written different ways but means the same and are all valid:
* 1080:0000:0000:0000:0000:0034:0000:417A
* 1080:0:0:0:0:34:0:417A
* 1080::34:0:417A

7 Layer OSI : Presentation Layer

2010-01-28T14:19:00.001+07:00

The Presentation layer gets its name from its purpose: It presents data to the Application layer and is responsible for data translation and code formatting.

This layer is essentially a translator and provides coding and conversion functions. A successful data-transfer technique is to adapt the data into a standard format before transmission. Computers are configured to receive this generically formatted data and then convert the data back into its native format for actual reading (for example, EBCDIC to ASCII). By providing translation services, the Presentation layer ensures that data transferred from the Application layer of one system can be read by the Application layer of another one.

The OSI has protocol standards that define how standard data should be formatted. Tasks like data compression, decompression, encryption, and decryption are associated with this layer. Some Presentation layer standards are involved in multimedia operations too.

The Presentation Layer is composed of two sublayers:

CASE (Common Application Service Element)
SASE (Specific Application Service Element)

CASE

The CASE sublayer provides services for the Application Layer and request services from the Presentation Layer. It provides support for common application services, such as:

ACSE (Association Control Service Element)
ROSE (Remote Operation Service Element)
CCR (Commitment Concurrency and Recovery)
RTSE (Reliable Transfer Service Element)

SASE

The SASE sublayer provides application specific services (protocols), such as

FTAM (File Transfer, Access and Manager)
VT (Virtual Terminal)
MOTIS (Message Oriented Text Interchange Standard)
CMIP (Common Management Information Protocol)
JTM (Job Transfer and Manipulation) a former OSI standard
MMS (Manufacturing Messaging Service)
RDA (Remote Database Access)
DTP (Distributed Transaction Processing)
Tel Net(a remote terminal access protocol)

7 Layer OSI : Application Layer

2010-01-25T18:12:00.000+07:00

Now we'll talk about layer in OSI. As we know, there are 7 layer for networking that usually used. Let we mention it below.

That's all layers we need to now. In this post, we will talk about the first layer, Application layer. The Application layer of the OSI model marks the spot where users actually communicate to the computer. This layer only comes into play when it’s apparent that access to the network is going to be needed soon. Take the case of Internet Explorer (IE). You could uninstall every trace of networking components from a system, such as TCP/IP, NIC card, and so on, and you could still use IE to view a local HTML document—no problem. But things would definitely get messy if you tried to do something like view an HTML document that must be retrieved using HTTP or nab a file with FTP or TFTP. That’s because IE will respond to requests such as those by attempting to access the Application layer. And what’s happening is that the Application layer is acting as an interface between the actual application program which isn’t at all a part of the layered structure and the next layer down by providing ways for the application to send information down through the protocol stack. In other words, IE doesn’t truly reside within the Application layer it interfaces with Application layer protocols when it needs to deal with remote resources.

The Application layer is also responsible for identifying and establishing the availability of the intended communication partner and determining whether sufficient resources for the intended communication exist.

These tasks are important because computer applications sometimes require more than only desktop resources. Often, they’ll unite communicating components from more than one network application. Prime examples are file transfers and email, as well as enabling remote access, network management activities, client/server processes, and information location. Many network applications provide services for communication over enterprise networks, but for present and future internetworking, the need is fast developing to reach beyond the limits of current physical networking.

It’s important to remember that the Application layer is acting as an interface between the actual application programs. This means that Microsoft Word, for example, does not reside at the Application layer but instead interfaces with the Application layer protocols.

The Benefits of Using TCP/IP

2009-11-19T15:40:00.000+07:00

By using TCP/IP, it enables cross-platform, or heterogeneous, networking. For example, a Windows NT/2000 network could contain Unix and Macintosh workstations or even networks mixed in it. TCP/IP also has the following characteristics that make it unique:

Good failure recovery
The ability to add networks without interrupting existing services
High error-rate handling
Platform independence
Low data overhead

Because TCP/IP was originally designed for Department of Defense–related purposes, what we now call features or characteristics were actually design requirements. The idea behind “Good Failure Recovery” was that if a portion of the network were disabled during an incursion or attack, its remaining pieces would still be able to function fully. Likewise is the capability of adding entire networks without any disruption to the services already in place. The ability to handle high error rates was built in so that if a packet of information got lost using one route, there would be a mechanism in place to ensure that it would reach its destination using another route. Platform independence means that the networks and clients can be Windows, Unix, Macintosh, or any other platform or combination thereof. The reason TCP/IP is so efficient lies in its low overhead. Performance is key for any network. TCP/IP is unmatched in its speed and simplicity.

TCP Features : Connections

2009-11-09T20:53:00.001+07:00

Before application processes can send data by using TCP, they must establish a connection. The connections are made between the port numbers of the sender and the receiver nodes. A TCP connection identifies the end points involved in the connection. The end point on picture below is formally defined as a pair that includes the IP address and port number:

(IP address, port numbers)

The IP address is the internetwork address of the network interface over which the TCP/IP application communicates. The port number is the TCP port number that identifies the application. The end point contains both the IP address and port numbers because port identifiers are selected independently by each TCP, and they may not be unique. By concatenating the unique IP address with port numbers, a unique value for
the end point is created.
A TCP connection is established between two end points. The TCP connection is identified by the parameters of both end points, as follows:
(IP address1, port number1, IP address2, port number2)

These parameters make it possible to have several application processes connect to the same remote end point. Picture above shows that several application processes connect to the same remote end point (199.11.23.1, 2001). The TCP module at 199.11.23.1 can keep the different TCP connections separate because TCP uses both the local and remote end points to identify the connection. In that picture, the end point (199.11.23.1, 2001) is the same, but the end points at the other end of the connection are different. This difference enables TCP to keep these connections separate.
The picture also illustrates that TCP can support multiple connections concurrently. These connections are multiplexed over the same network interface.
A connection is fully specified by the pair of end points. A local end point can participate in many connections to different foreign end points. A TCP connection can carry data in both directions; that is, it is full duplex.

In relationship to TCP connections, it is also helpful to define the notion of a half association and a full association. A half association is an end point that also includes the transport protocol name, as follows:
(TransportProtocol, IP address, port number)

The half associations in picture are, therefore, the following:
(tcp, 199.21.32.2, 1400)
(tcp, 196.62.132.1, 21)
A full association consists of two half associations and is expressed by the following ordered pair:
(TransportProtocol, IP address1, port number1, IP address2, port number2)

The TransportProtocol is listed only once because it has to be the same on both parts of the half association. The concept of half and full associations is useful when dealing with different transport protocols. As an example, the full association in picture is listed as follows:
(tcp, 199.21.32.2, 1400, 196.62.132.1, 21)

A full association consisting of source and destination IP addresses, and source and destination port numbers uniquely identifies a TCP connection.

TCP Features : Multiplexing

2009-11-09T17:53:00.000+07:00

TCP enables many processes within a single computer to use the TCP communications services simultaneously; this is called TCP multiplexing. Because these processes may be communicating over the same network interface, they are identified by the IP address of the network interface. However, you need more than the IP address of the network interface to identify a process because all processes that are using the same network interface on a computer have a common IP address.
TCP associates a port number value for applications that use TCP. This association enables several connections to exist between application processes on remote computers because each connection uses a different pair of port numbers.

This picture shows several connections being multiplexed over TCP.
The binding of ports to application processes is handled independently by each computer. In many computer systems, a logger or super daemon process watches over the port numbers that are identified or well known to other computer systems.

TCP Features : Flow Control

2009-11-07T20:19:00.000+07:00

Computers that send and receive TCP data segments can operate at different data rates because of differences in CPU and network bandwidth. As a result, it is quite possible for a sender to send data at a much faster rate than the receiver can handle. TCP implements a flow control mechanism that controls the amount of data sent by the sender. TCP uses a sliding window mechanism for implementing flow control.
TCP flow control mechanism exhibits the following properties:
• Octets that are to the left of the window range have already been sent and acknowledged.
• Octets in the window range can be sent without any delay. Some of the octets in
the window range may already have been sent, but they have not been acknowledged. Other octets may be waiting to be sent.
• Octets that are to the right of the window range have not been sent. These octets can be sent only when they fall in the window range.

The left edge of the window is the lowest numbered octet that has not been acknowledged. The window can advance; that is, the left edge of the window can move to the right when an acknowledgment is received for data that has been sent. The TCP packet containing the acknowledgment contains information about the window size that the sender should use.
The window size reflects the amount of buffer space available for new data at the receiver. If this buffer space size shrinks because the receiver is being overrun, the receiver will send back a smaller window size. In the extreme case, it is possible for the receiver to send a window size of only one octet, which means that only one octet can be sent. This situation is referred to as the silly window syndrome, and most TCP implementations take special measures to avoid it.
A TCP module sending back a window size of zero indicates to the sender that its buffers are full and no additional data should be sent. TCP includes mechanisms to shrink window size when the receiver experiences congestion of data and to expand window size as the congestion problem clears.
The goal of the sliding window mechanism is to keep the channel full of data and to reduce to a minimum the delays experienced by waiting for acknowledgments.

TCP Features : Reliability

2009-06-23T21:03:00.001+07:00

One of the most important features of TCP is reliable end-to-end data
delivery. In order to provide reliability, TCP must recover from data
that is damaged, lost, duplicated, or delivered out of order by the
Network Layer. TCP uses the Positive Acknowledgment Retransmission
(PAR) scheme for achieving reliability.

TCP implements PAR by assigning a sequence number to each octet that
is transmitted and by requiring a positive acknowledgment (ACK) from
the receiving TCP module. If the ACK is not received within a time-out
interval, the data is retransmitted. At the receiver TCP module, the
sequence numbers are used to correctly order segments that may have
arrived out of order and to eliminate duplicates. Corruption of data
is detected by using a checksum field filed in the TCP packet header.
Data segments that are received with a bad checksum field are
discarded. Unless a physical break in the link causes physical
partitioning of the network, TCP recovers from most Internet
communications system errors.

TCP Features : Basic Data Transfer

2009-06-21T15:27:00.000+07:00

Basic data transfer is the capability of TCP to transfer a continuous stream of octets in each direction. The octets are sent among application processes running on remote systems that use TCP. The application processes then group a set of bytes that need to be sent/received into a message segment. Message segments can be of arbitrary length. Ultimately, the messages have to be sent in IP datagrams that are limited by the MTU size of a network interface. However, at the TCP level, there is no real restriction on message size because the details of accommodating the message segments in IP datagrams
is the task of the IP Layer. For reasons of efficiency in managing messages, TCP connections typically negotiate a maximum segment size.

Messages sent by TCP have an octet stream orientation (see Figure below). TCP keeps track of each octet that is sent/received. The TCP has no inherent notion of a block of data, unlike other transport protocols, which typically keep track of the Transport Protocol Data Unit (TPDU) number and not the octet number. TCP can be used to provide multiple virtual-circuit connections between two TCP hosts.

Application processes that use TCP send data in whatever size is convenient for sending. For example, an application can send data that is as little as one octet or as big as several kilo-octets. TCP numbers each octet that it sends. The octets are delivered to the application processes at the receiving end in the order in which they are sent. This process is called sequencing of octets.

An application can send data to TCP a few octets at a time. TCP buffers this data and sends these octets either as a single message or as several smaller message segments. All that TCP guarantees is that data arrives at the receiver in the order in which it was sent. For example, if an application sends 1,024 octets of data over a period of ten seconds, the data can be sent across the network in a single TCP packet of 1,024 octets, or in four TCP packets of 256 octets, or in any combination of octets.

Because TCP sends data as a stream of octets, there is no real end-of-message marker in the data stream. To ensure that all the data submitted to the TCP module has been transmitted, a push function is required to be implemented by TCP. The push causes the TCP promptly to send any data that it has received from an application up to that point. The actual data that is sent by TCP is treated as an unstructured stream of octets. TCP does not contain any facility to superimpose an application-dependent structure on the data. For example, you cannot tell TCP to treat the data as a set of records in a database and to send one record at a time. Any such structuring must be handled by the application processes that communicate by using TCP.

Hard Drive Data Recovery using Freeware Programs - Page 1

2009-06-20T09:11:00.001+07:00

Hi,

http://www.hiren.info/downloads/data-recovery/hard-drive/1

From ra7d_si2gar@yahoo.co.id r01-05.opera-mini.net_64.255.180.21 using 'Send this page to a Friend' service.

Intel Announces Intel® Atom™ Brand for New Family of Low-Power Processors

2009-06-19T17:22:00.000+07:00

Intel's Smallest Processor Built Using World's Smallest Transistors Designed for New Internet Devices, Low-Cost PCs

SANTA CLARA, Calif., March 2, 2008 – The Intel® Atom™ processor will be the name for a new family of low-power processors designed specifically for mobile Internet devices (MIDs) and a new class of simple and affordable Internet-centric computers arriving later this year. Together, these new market segments represent a significant new opportunity to grow the overall market for Intel silicon, using the Intel Atom processor as the foundation. The company also announced the Intel® Centrino® Atom™ processor technology brand for MID platforms, consisting of multiple chips that enable the best Internet experience in a pocketable device.

Product logos for download


Intel® Atom™ processor	Intel® Centrino® Atom™ processor technology

The Intel Atom processor is based on an entirely new microarchitecture designed specifically for small devices and low power, while maintaining the Intel® Core™ 2 Duo instruction set compatibility consumers are accustomed to when using a standard PC and the Internet. The design also includes support for multiple threads for better performance and increased system responsiveness. All of this on a chip that measures less than 25 mm², making it Intel's smallest and lowest power processor yet.¹ Up to 11 Intel Atom processor die -- the tiny slivers of silicon packed with 47 million transistors each -- would fit in an area the size of an American penny.

These new chips, previously codenamed Silverthorne and Diamondville, will be manufactured on Intel's industry-leading 45nm process with hi-k metal gate technology. The chips have a thermal design power (TDP) specification in 0.6-2.5 watt range and scale to 1.8GHz speeds depending on customer need. By comparison, today's mainstream mobile Core 2 Duo processors have a TDP in the 35-watt range.

"This is our smallest processor built with the world's smallest transistors," said Intel Executive Vice President and Chief Sales and Marketing Officer Sean Maloney. "This small wonder is a fundamental new shift in design, small yet powerful enough to enable a big Internet experience on these new devices. We believe it will unleash new innovation across the industry."

With personal computing increasingly going mobile and the computer industry rapidly developing new classes of products to connect the next billion people to the Internet, the Intel Atom processor offers customers the unique ability to innovate around the new low-power design. In addition to the MID opportunity, Intel believes the demand for a new category of low-cost, Internet-centric mobile computing devices dubbed "netbooks" and basic Internet-centric desktop PCs dubbed "nettops," will grow substantially over the next several years. The Intel Atom processor is perfectly suited to meet these new market segments.

Intel said the Intel Atom processor also has potential for future revenue opportunities in consumer electronic devices, embedded applications and thin clients.

Intel Centrino Atom Processor Technology
The Intel Centrino Atom processor technology brand represents Intel's best technology for MIDs. Formerly codenamed "Menlow," Intel Centrino Atom processor technology includes the Intel Atom processor, a low-power companion chip with integrated graphics, a wireless radio, and thinner and lighter designs. Together, these components are designed to enable the best mobile computing and Internet experience on these new devices.

TCP Features

2009-06-17T22:26:00.001+07:00

TCP has the following noteworthy features:

Basic data transfer
Reliability
Flow control
Multiplexing
Connections
Precedence and security

For more detail, I will write it in the next post.....

The TCP/IP Suite of Protocols

2009-06-17T22:20:00.000+07:00

Although they are frequently identified as just “TCP/IP,” several different component protocols actually exist within the IP suite of protocols. These include:

IP—The Internet Layer protocol.
TCP—The reliable Host-to-Host Layer protocol.
UDP—The best-effort Host-to-Host Layer protocol.
ICMP—A multilayer protocol designed to facilitate control, testing, and management functions within an IP network. The various ICMP protocols span the Host-to-Host Layer and the Process/Application Layer.

TCP Header Structure

2009-06-13T12:33:00.000+07:00

As with IP, the functionality of TCP is limited by the amount of
information that it carries in its header. Thus, understanding the
mechanics and capabilities of TCP requires an appreciation for the
contents of its header.

The TCP protocol header is a minimum of 20 octets and contains the
following fields:

• TCP Source Port—The 16-bit source port field contains the number of
the port that initiates the communications session. The source port and
source IP address function as the packet's return address.

• TCP Destination Port—The 16-bit destination port field is the address
of the port for which the transmission is destined. This port contains
the interface address of the application on the recipient's computer to
which the packet's data will be passed.

• TCP Sequence Number—The 32-bit sequence number is used by the
receiving computer to reconstruct the fragmented data back into its
original form. In a dynamically routed network, it is quite possible for
some of the packets to take different routes and, consequently, to
arrive out of order. This sequencing field compensates for this
inconsistency of delivery.

• TCP Acknowledgment Number—TCP uses a 32-bit acknowledgment (ACK) of
the first octet of data contained in the next expected segment. It may
seem counterintuitive to acknowledge something that hasn't occurred yet,
but a source TCP/IP machine that receives an ACK knows that all the data
up to, but not including, that specified segment has been received. The
number used to identify each ACK is the sequence number of the packet
being acknowledged. This field is only valid if the ACK flag (see Flags,
later in this list) is set.

• Data Offset—This 4-bit field contains the size of the TCP header,
measured in a 32-bit data structure known as a "word."

• Reserved—This 6-bit field is always set to zero. It is reserved for an
as-yet unspecified future use.

• Flags—The 6-bit flag field contains six 1-bit flags that enable the
control functions of urgent field, acknowledgment of significant field,
push, reset connection, synchronize sequence numbers, and finished
sending data. The flags, in their order of appearance in the string, are
URG, ACK, PSH, RST, SYN, and FIN. Given the preceding description of
their functions, these mnemonic abbreviations should be self-apparent.

• Window Size—This 16-bit field is used by the destination machine to
tell the source host how much data it is willing to accept, per TCP segment.

• Checksum—The TCP header also contains a 16-bit error-checking field
known as a "Checksum." The source host calculates a mathematical value,
based upon the segment's contents. The destination host performs the
same calculation. If the content remained intact, the result of the two
calculations is identical, thereby proving the validity of the data.

• Urgent—The Urgent field is an optional 16-bit pointer that points to
the last octet of urgent data within the segment. This field is only
valid if the URG flag was set. If that flag is not set, the Urgent field
is pre-empted with Padding. Segments of data that are identified as
urgent are treated to expedited handling by all TCP/IP devices that lie
in the network intervening the source and destination machines.

• Options—A variable length field of at least 1 octet identifies which
options, if any, are valid for the TCP segment. If no options are set,
this 1-octet field is set equal to 0, which indicates the end of the
Options field. A value of 1 in this octet indicates that no operation is
required. A value of 2 indicates that the next four octets contain the
source machine's Maximum Segment Size (MSS). The MSS is the greatest
number of octets that the data field can be, as agreed to by the source
and destination machines.

• Data—Although not technically a part of the TCP header, it is
important to recognize that segments of application data follow the
Urgent and/or Options fields, but precede the Padding field. The field's
size is the largest MSS that can be negotiated between the source and
destination machines. Segments may be smaller than the MSS, but never
larger.

• Padding—Contrary to any indication of superfluousity that its name
might suggest, padding always serves a mathematical purpose in data
communications. That purpose is to ensure predictability of spacing,
timing, or sizing. Extra zeros are added to this field to ensure that
the TCP header is always a multiple of 32 bits.

Subnetting

2009-06-10T14:08:00.000+07:00

In the mid-1980s, RFCs 917 and 950 were released. These documents proposed a means of solving the ever-growing problem posed by the relatively flat, two-level hierarchy of IP addressing. The solution was termed subnetting. The concept of subnetting is based on the need for a third level in the Internet’s hierarchy. As internetworking technologies matured, their acceptance and use increased dramatically. As a result, it became normal for moderate and large-sized organizations to have multiple networks. Frequently, these networks were LANs. Each LAN may be treated as a subnet.

In such multiple-network environments, each subnetwork would interconnect to the Internet via a common point: a router. The actual details of the network environment are inconsequential to the Internet. They comprise a private network that is (or should be) capable of delivering its own datagrams. Thus, the Internet need only concern itself with how to reach that network’s gateway router to the Internet. Inside the private network, the host portion of the IP address can be subdivided for use in identifying subnetworks. Subnetting, as specified in RFC 950, enables the network number of any classful IP address (A, B, or C) to be subdivided into smaller network numbers. A subnetted IP address actually consists of three parts:
• Network address
• Subnetwork address
• Host address

The subnetwork and host addresses are carved from the original IP address’s host address portion. Thus, your ability to subnet depends directly on the type of IP address being subnetted. The more host bits there are in the IP address, the more subnets and hosts you can create. However, these subnets decrease the number of hosts that can be addressed. You are, in effect, taking bits away from the host address to identify subnetwork numbers. Subnets are identified using a pseudo-IP address, known as a subnet mask. A subnet mask is a 32-bit binary number that can be expressed in dotted-decimal form. The mask is used to tell end systems (including routers and other hosts) in the network how many bits of the IP address are used for network and subnetwork identification. These bits are called the extended network prefix. The remaining bits identify the hosts within the subnetwork. The bits of the mask that identify the network number are set to 1s and the host bits are set to 0s.

For example, a mask of 11111111.11111111.11111111.11000000 (255.255.255.192 in dotted-decimal notation) would yield 64 mathematically possible host addresses per subnet. The values of the right-most six bits, the ones set equal to zero, sum to 64 in the base 10 number system. Thus, you can uniquely identify 64 devices within this subnet. Only 62 of these addresses, however, are actually usable. The other two host addresses are reserved. The first host number in a subnet is always reserved for identifying the subnet itself. The last host number is also reserved, but is used for IP broadcasts within the subnet. Thus, you must always subtract 2 from the maximum number of hosts in a subnet to get the maximum number of usable host addresses per subnet.

The number of mathematically possible subnets, however, depends on what class of IP address is being subnetted. Each class reserves a different number of the available bits for the network number. Thus, each class offers a different number of bits that can be used for subnetting.

Managing the Address Space

2009-06-10T13:35:00.001+07:00

The Internet’s stability is directly dependent on the uniqueness of publicly used network addresses. Thus, some mechanism was needed to ensure that addresses were, in fact, unique. This responsibility originally rested within an organization known as the InterNIC (Internet Network Information Center). This organization is now defunct and was succeeded by the Internet Assigned Numbers Authority (IANA). IANA, too, has been dismantled, and the new caretaker of the Internet’s names and address numbers is the Internet Corporation for the Assignment of Names and Numbers (ICANN). ICANN is currently creating a competitive registry structure that will enable commercial entities to compete with each other in the registration of IP names and numbers.
One important goal is to ensure that duplication of publicly used addresses does not occur. Such duplication would cause instability on the Internet, and compromise
its ability to deliver datagrams to networks using the duplicated addresses.
Although it is entirely possible for a network administrator to arbitrarily select unregistered IP addresses, this practice should not be condoned. Computers having such spurious IP addresses can only function properly within the confines of their network. Interconnecting networks with spurious addresses to the Internet incurs the risk of conflicting with an organization that has legitimate claim to that address space. Duplicated addresses will cause routing problems, and potentially hinder the Internet’s ability to deliver datagrams to the correct network.
In a firewall environment, the private network can use non-unique addresses because network address translation is used so that the addresses on the private network are substituted with the address of the public interface on the firewall. In this case, the private addresses may be non-unique across the Internet. Certain addresses are reserved for private use. Specifically, one Class A addres (10.0.0.0), 16 Class B addresses (172.16.0.0 – 172.31.0.0), and 256 Class C addresses (192.168.0.0 – 192.168.255.0) are designated for private use.

The IPv4 Header

2009-06-09T05:59:00.000+07:00

The IP header has the following sizes and fields:

Version—The first 4 bits of the IP header identify the operating version of IP; for example, version 4 or version 6.

Internet Header Length—The next 4 bits of the header contain the length of the header, expressed in multiples of 32.

Type of Service—The next octet contains a series of flags that can be used to specify precedence (that is, absolute priority relative to other IP packets), delay, throughput, and reliability parameters for that packet of data. The precedence flag is 3 bits long whereas the delay, throughput, and reliability flags are each 1 bit in length. The remaining 2 bits are reserved for future use.

Total Length—This 16-bit field contains the total length of the IP packet measured in octets. Valid values can range up to 65,535 octets.

Identifier—Each IP packet is given a unique 16-bit identifier, which is used to identify the fragments of a datagram.

Fragmentation Flags—The next field contains three 1-bit flags that indicate whether fragmentation of the packet is permitted, and if it is used. The first bit is reserved and always set equal to 0. The second bit indicates whether that packet’s data can be fragmented. If this bit is equal to 0, the contents can be fragmented. If it is equal to 1, it cannot be fragmented. The third bit has significance only if the second bit was set to 0. If that bit was equal to 0 (and the data can be segmented across multiple packets), this bit indicates whether this particular packet is the last in the series of the fragment, or whether the receiving application can expect additional fragments. A 0 indicates that this packet is the last one.

Fragment Offset—This 8-bit field measures the offset of the fragmented contents relative to the beginning of the entire packet. This value is measured in 64-bit increments.

Time-to-Live (TTL)—The IP packet cannot be permitted to roam the WAN in perpetuity. It must be limited to a finite TTL. The 8-bit TTL field is incremented by one for each hop the packet makes. After reaching its maximum limit, the packet is assumed to be undeliverable. An ICMP message is generated and sent back to the source machine and the undeliverable packet is destroyed.

Protocol—This 8-bit field identifies the protocol that follows the IP header, such as VINES, TCP, UDP, and so forth.

Checksum—The Checksum field is a 16-bit error-checking field. The destination computer, and every gateway node in the network, will recompute the mathematical calculation on the packet’s header as the source computer did. If the data survived the trip intact, the results of these two calculations are identical. This field also informs the destination host of the amount of incoming data.

Source IP Address—The source address is the IP address of the source computer.

Destination IP Address—The destination address is the IP address of the destination computer.

Padding—Extra zeros are added to this field to ensure that the IP header is always a multiple of 32 bits.

These header fields reveal that IPv4’s Internet Layer is inherently connectionless: The packet forwarding devices in the network are free to determine the ideal path for each packet to take through the network. It also doesn’t provide any of the acknowledgments, flow control, or sequencing functions of higher-level protocols such as TCP. Nor can IP be used to direct the data contained in an IP datagram to the appropriate destination
application. These functions are left to higher-level protocols, such as TCP and UDP.

Class E Addresses

2009-06-08T05:59:00.000+07:00

A Class E address has been defined but is reserved by the IETF for its own research. Thus, no Class E addresses have been released for use on the Internet. The first four bits of a Class E address are always set to ones, thus the range of valid addresses is from 240.0.0.0 to 255.255.255.255. Given that this class was defined for research purposes, and its use is limited to inside the IETF, examining it any further is not necessary.

Class D Addresses

2009-06-08T05:57:00.000+07:00

The Class D address class was created to enable multicasting in an IP network. The Class D multicasting mechanisms are used for applications that use a “push” technology to send a message to a group of nodes. A multicast address is a unique network address that directs packets with that destination address to predefined groups of IP addresses. Thus, a single station can simultaneously transmit a single stream of datagrams that gets routed to multiple recipients simultaneously. This is much more efficient than creating a separate stream for each recipient. Multicasting has long been deemed a desirable feature in an IP network because it can substantially reduce network traffic. IPv6 also uses multicasting for many aspects of its operation.
The Class D address space, much like the other address spaces, is mathematically constrained. The first four bits of a Class D address must be 1110. Presetting the first three bits of the first octet to ones means that the address space begins at 128 + 64 + 32, which equals 224. Preventing the fourth bit from being used means that the Class D address is limited to a maximum value of 128 + 64 + 32 + 8 + 4 + 2 + 1, or 239. Thus, the Class D address space ranges from 224.0.0.0 to 239.255.255.255.
This range may seem odd, as the upper boundary is specified with all four octets. Ordinarily, this would mean that the octets for both host and network numbers are being used to signify a network number. There is a reason for this! The Class D address space isn’t used for internetworking to individual end systems or networks.
Class D addresses are used for delivering multicast datagrams within a private network to groups of IP-addressed end systems. Thus, there isn’t a need to allocate octets or bits of the address to separate network and host addresses. Instead, the entire address space can be used to identify groups of IP addresses (Classes A, B, or C). Today, numerous other proposals are being developed that would allow IP multicasting without the complexity of a Class D address space.

Class C Addresses

2009-06-08T05:54:00.000+07:00

The Class C address space was intended to support lots of small networks. This address class can be thought of as the inverse of the Class A address space. Whereas the Class A space uses just one octet for network numbering, and the remaining three for host numbering, the Class C space uses three octets for networking addressing and just one octet for host numbering.
The first three bits of the first octet of a Class C address are 110. The first two bits sum to a decimal value of 192 (128 + 64). This forms the lower mathematical boundary of the Class C address space. The third bit equates to a decimal value of 32. Forcing this bit to a value of 0 establishes the upper mathematical boundary of the address space. Lacking the ability to use the third bit limits the maximum value of this octet to 255 – 32, which equals 223. Thus, the range of possible Class C host addresses is from 192.0.0.0 to 223.255.255.255.
The last octet is used for host addressing. Each Class C address can support a theoretical maximum of 256 unique host addresses (0 through 255), but only 254 are usable because 0 and 255 are not valid host numbers. There can be 2,097,150 different Class C network numbers.
NB :
In the world of IP addressing, 0 and 255 are reserved host address values. IP
addresses that have all of their host address bits set equal to 0 identify the local
network. Similarly, IP addresses that have all their host address bits set equal to
255 are used to broadcast to all end systems within that network number, also
known as a directive broadcast.

Class B Addresses

2009-06-07T17:37:00.000+07:00

The Class B addresses were designed to support the needs of moderate- to large-sized networks. The range of possible Class B host addresses is from 128.1.0.0 to 191.255.255.255.

The mathematical logic underlying this class is fairly simple. A Class B IP address uses two of the four octets to indicate the network address. The other two octets enumerate host addresses. The first two bits of the first octet of a Class B address are 10. The remaining six bits may be populated with either ones or zeros. This mathematically limits the possible range of the Class B address space to less than or equal to 191, which is the sum of 128 + 32 + 16 + 8 + 4 + 2 + 1.

The last 16 bits (2 octets) identify potential host addresses. Each Class B address can support 65,534 unique host addresses. This number is calculated by multiplying 2 to the 16th power, and subtracting 2 (values reserved by IP). Mathematically, there can be only 16,382 Class B networks defined.

NB :

Class B networks are popular in medium-sized networks. Many large organizations have been assigned Class B addresses.

Class A Addresses

2009-06-07T17:28:00.001+07:00

The Class A IPv4 address was designed to support extremely large networks. Because the need for very large-scale networks was perceived to be minimal, an architecture was developed that maximized the possible number of host addresses, but severely limited the number of possible Class A networks that could be defined.

A Class A IP address uses only the first octet to indicate the network address. The remaining three octets enumerate host addresses. The first bit of a Class A address is always a 0. This mathematically limits the possible range of the Class A address to less than or equal to 127, which is the sum of 64 + 32 + 16 + 8 + 4 + 2 + 1. The left-most bit’s decimal value of 128 is absent from this equation. Thus, there can only ever be 127 possible Class A IP networks.

The last 24 bits (that is, three dotted-decimal numbers) of a Class A address represent possible host addresses. The range of possible Class A network addresses or host range is from 1.0.0.0 to 126.255.255.255.

Notice that only the first octet bears a network address number. The remaining three are used to create unique host addresses within each network number. As such, they are set to zeros when describing the range of network numbers.

Each Class A address can support 16,777,214 unique host addresses. This value is calculated by multiplying 2 to the 24th power and then subtracting 2. Subtracting 2 is necessary because IP reserved the all zeros address for identifying the network and the all ones address for broadcasting within that network. The proportion of network to host octets is presented in the following table.

NB:

Technically, 127.0.0.0 is also a Class A network address, but it is reserved for loopback testing and cannot be assigned to a network. In retrospect, this design is poor because it wastes an entire class A address consisting of a large number of IP addresses.

Class A is generally used for very large networks such as the original ARPANET. Most of the class A addresses are allocated and it is very difficult, if not impossible, to get a class A network address assignment from the InterNIC.

IPv4 Address Formats

2009-06-07T17:14:00.002+07:00

IP was standardized in September 1981. Its address architecture was as forward-looking as could be expected, given the state of computing at that time. The basic IP address was a 32-bit binary number that was compartmentalized into four 8-bit binary numbers, or octets.

To facilitate human usage, IP’s machine-friendly binary addresses were converted into a more familiar number system: base 10. Each of the four octets in the IP address is represented by a decimal number, from 0 to 255, and is separated by dots (.). This is known as a dotted-decimal format. Thus the lowest possible value that can be represented within the framework of an IPv4 address is 0.0.0.0, and the highest possible value is 255.255.255.255. Both of these values, however, are reserved and cannot be assigned to individual end systems. The reason for this requires an examination of the way that the IETF implemented this basic address structure in its protocol.

The dotted-decimal IPv4 address was then broken down into classes, to accommodate large, medium, and small networks. The differences between the classes were the number of bits allocated to network versus host addresses. The five classes of IP addresses, identified by a single alphabetic character, are

• Class A
• Class B
• Class C
• Class D
• Class E

Each address consists of two parts: a network address and a host address. The five classes represent different compromises between the number of supportable networks and hosts.

Layer 7: The Application Layer

2009-06-04T11:00:00.001+07:00

The top layer in the OSI Reference Model is the Application Layer. Despite its name, this layer does not include user applications. Rather, it provides the interface between those applications and the network’s services.
This layer can be thought of as the reason for initiating the communications session. For example, an email client might generate a request to retrieve new messages from the email server. This client application automatically generates a request to the appropriate Layer 7 protocol(s) and launches a communications session to get the needed files.

Layer 6: The Presentation Layer

2009-06-04T09:58:00.001+07:00

The Presentation Layer is responsible for managing the way that data is encoded. Not every computer system uses the same data-encoding scheme, and the Presentation Layer is responsible for providing the translation between otherwise incompatible dataencoding schemes, such as American Standard Code for Information Interchange (ASCII) and Extended Binary Coded Decimal Interchange Code (EBCDIC).

The Presentation Layer can be used to mediate differences in floating-point formats; number formats, such as one’s complement and two’s complement; and byte ordering; as well as to provide encryption and decryption services.

The Presentation Layer represents data with a common syntax and semantics. If all the nodes used and understood this common language, misunderstanding in data representation could be eliminated. An example of this common language is Abstract Syntax Representation, Rev 1 (ASN.1), an OSI recommendation. In fact, ASN.1 is used by the Simple Network Management Protocol (SNMP) to encode its high-level data.

Layer 5: The Session Layer

2009-06-03T13:52:00.001+07:00

The fifth layer of the OSI Model is the Session Layer. This layer is relatively unused many protocols bundle this layer’s functionality into their transport layers.

The function of the OSI Session Layer is to manage the flow of communications during a connection between two computer systems. This flow of communications is known as a session. It determines whether communications can be uni- or bi-directional. It also ensures that one request is completed before a new one is accepted.
The Session Layer also may provide some of the following enhancements:
• Dialog control
• Token management
• Activity management

A session, in general, allows two-way communications (full duplex) across a connection. Some applications may require alternate one-way communications (half duplex). The Session Layer has the option of providing two-way or one-way communications: an option called dialog control.

For some protocols, it is essential that only one side attempt a critical operation at a time. To prevent both sides from attempting the same operation, a control mechanism, such as the use of tokens, must be implemented. When using the token method, only the side holding a token is permitted to perform the operation. Determining which side has the token and how it is transferred between the two sides is known as token management. The token management functions are used in the ISO session layer protocols.

The use of the word “token” here should not be confused with Token Ring operation. Token management is a much higher level concept at Layer 5 of the OSI model. IBM’s Token Ring operation belongs to Layers 2 and 1 of the OSI model.

If you are performing a one-hour file transfer between two machines, and a network crash occurs approximately every 30 minutes, you might never be able to complete the file transfer. After each transfer aborts, you have to start all over again. To avoid this problem, you can treat the entire file transfer as a single activity with checkpoints inserted into the datastream. That way, if a crash occurs, the session layer can synchronize to a previous checkpoint. These checkpoints are called synchronization points.

There are two types of synchronization points: major and minor synchronization points. A major synchronized point inserted by any communicating side must be acknowledged by the other communicating side, whereas a minor synchronization point is not acknowledged. That portion of the session that is between two major synchronization points is called a dialog unit. The operation of managing an entire activity is called activity management. An activity can consist of one or more dialog units.

TCP/IP networks do not have a general Session Layer protocol. This is because some of the characteristics of the Session layer are provided by the TCP protocol. If TCP/IP applications require special session services they provide their own. An example of such a TCP/IP application service is the Network File System (NFS), which implements its own Session Layer service the Remote Procedure Call (RPC) protocol.

The Network File System (NFS) protocol also uses its own Session Layer service: the External Data Representation (XDR) protocol.

Layer 4: The Transport Layer

2009-06-03T12:50:00.001+07:00

The Transport Layer provides a service similar to the Data Link Layer, in that it is responsible for the end-to-end integrity of transmissions. Unlike the Data Link Layer, however, the Transport Layer is capable of providing this function beyond the local LAN segment. It can detect packets that are discarded by routers and automatically generate a retransmit request. In other words, the Transport Layer provides true end-to-end reliability.

Another significant function of the Transport Layer is the resequencing of packets that may have arrived out of order. This can happen for a variety of reasons. For example, the packets may have taken different paths through the network, or some may have been damaged in transit. In any case, the Transport Layer is capable of identifying the original sequence of packets, and must put them back into that sequence before passing their contents up to the Session Layer.

Layer 3: The Network Layer

2009-06-03T10:42:00.001+07:00

The Network Layer is responsible for establishing the route to be used between the originating and destination computers. This layer lacks any native transmission error detection/correction mechanisms and, consequently, relies upon the link for reliable transmission service of the Data Link Layer. End-to-end reliability across several physical links is more of a function of the Transport Layer (Layer 4).

The Network Layer is used to establish communications with computer systems that lie beyond the local LAN segment. It can do so because it has its own routing addressing architecture, which is separate and distinct from the Layer 2 machine addressing. Such protocols are known as routed or routable protocols. Routable protocols include IP, Novell’s IPX, and AppleTalk, although this book will focus exclusively on IP and its related protocols and applications.

Use of the Network Layer is optional. It is required only if the computer systems reside on different network segments that are separated by a router, or if the communicating applications require some service, feature, or capability of either the Network Layer or the Transport Layer. For example, two hosts that are directly connected to the same LAN may communicate well using just that LAN’s communications mechanisms (Layers 1 and 2 of the OSI Reference Model).

In modern networks, the requirement to connect two networks is so common that the Network Layer is no longer considered optional. Earlier protocols such as NetBEUI that do not provide an explicit network layer have to be handled as special cases in modern network design consisting of interconnected networks.

Layer 2: The Data Link Layer

2009-06-02T15:49:00.000+07:00

The second layer of the OSI Reference Model is called the Data Link Layer. As all the layers do, it has two sets of responsibilities: transmit and receive. It is responsible for providing end-to-end validity of the data being transmitted, typically across a physical link.

On the transmit side, the Data Link Layer is responsible for packing instructions, data, and so forth into frames. A frame is a structure indigenous to the Data Link Layer that contains enough information to ensure that the data can be successfully sent across a physical link (such as a Local Area Network) to its destination.

Successful delivery means that the frame reaches its intended destination intact. Thus, the frame must also contain a mechanism to verify the integrity of its contents upon delivery.
Two things must happen for guaranteed delivery to occur:

The originating node must receive an acknowledgment of each frame received intact by the destination node.
The destination node, prior to acknowledging receipt of a frame, must verify the integrity of that frame’s contents.

Numerous situations can result in transmitted frames either not reaching the destination or becoming damaged and unusable during transit. The Data Link Layer is responsible for detecting and correcting any and all such errors. The Data Link Layer is also responsible for reassembling any binary streams that are received from the Physical Layer back into frames. Given that both the structure and content of a frame are transmitted, however, the Data Link Layer isn’t really rebuilding a frame. Rather, it is buffering the incoming bits until it has a complete frame.

Layers 1 and 2 are required for each and every type of communication, regardless of whether the network is a LAN or WAN. Typically, network cards inside computers implement the Layer 1 and Layer 2 functionality.

Layer 1: The Physical Layer

2009-06-02T15:45:00.000+07:00

The bottom layer is called the Physical Layer. This layer is responsible for the transmission of the bit stream. It accepts frames of data from Layer 2, the Data Link Layer, and transmits their structure and content, typically serially, one bit at a time. The Physical Layer is also responsible for the reception of incoming streams of data, one bit at a time. These streams are then passed on to the Data Link Layer for reframing.

The Physical Layer, quite literally, sees only 1s and 0s. It has no mechanism for determining the significance of the bits it transmits or receives. It is solely concerned with the physical characteristics of electrical and/or optical signaling techniques. This includes the voltage of the electrical current used to transport the signal (the line encoding and framing not to be confused with the data character coding and framing), the media type andvimpedance characteristics, and even the physical shape of the connector that is used tovterminate the media.

A common misperception is that OSI’s Layer 1 includes anything that either generates or carries the data communications signals. This is not true. It is a functional model only. The Physical Layer is limited to just the processes and mechanisms needed to place signals onto the transmission media, and to receive signals from that media. Its lower boundary is the physical connector that attaches to the transmission media. It does not include the transmission media, though the different LAN (Local Area Network) standards, such as 10BASET and 100BASET, do refer to the media type used.

Transmission media include any means of actually transporting signals generated by the OSI’s Layer 1 mechanisms. Some examples of transmission media are coaxial cabling, fiber-optic cabling, and twisted-pair wiring. The confusion seems to stem from the fact that the Physical Layer does provide specifications for the media’s performance. These are the performance characteristics that are required, and assumed to exist, by the processes and mechanisms defined in the Physical Layer.

Consequently, transmission media remain outside the scope of the Physical Layer and are sometimes referred to as Layer 0 of the OSI Reference Model.

OSI Reference Model

2009-06-02T15:15:00.000+07:00

The International Organization for Standardization (ISO) developed the Open Systems Interconnection (OSI) Reference Model in 1978/1979 to facilitate the open interconnection of computer systems. An open interconnection is one that can be supported in a multivendor environment. This model established the global standard for defining the functional layers required for open communications between computers.

When the OSI Reference Model was developed almost 20 years ago, few commercial systems followed that model. Computer manufacturers at that time locked customers into proprietary, single-vendor architectures. Open communication was viewed as an invitation to competition. From the manufacturer’s perspective, competition was undesirable. Consequently, all functions were integrated as tightly as possible. The notion of functional
modularity, or layering, seemed antithetical to any manufacturer’s mission.
It is important to note that the model has been so successful at achieving its original goals that it almost renders itself moot. The previous proprietary, integrated approach has disappeared. Open communications, today, are requisite. Curiously, very few products are fully OSI-compliant. Instead, its basic layered framework is frequently adapted to new standards. Nevertheless, the OSI Reference Model remains a viable mechanism for demonstrating the functional mechanics of a network.

Despite its successes, numerous misperceptions about the OSI Reference Model persist. Consequently, it is necessary to provide yet another overview of this model in this section. The overview identifies and corrects these misperceptions.

The first misperception is that the OSI Reference Model was developed by the International Standards Organization (ISO). It was not. The OSI Reference Model was developed by the International Organization for Standardization. This organization prefers to use a mnemonic abbreviation rather than an acronym. The mnemonic abbreviation is based on the Greek word, isos, which means equal or standard.

The OSI model categorizes the various processes necessary in a communications session into seven distinct functional layers. The layers are organized based on the natural sequence of events that occurs during a communications session.

Figure below illustrates the OSI Reference Model. Layers 1–3 provide network access, and
Layers 4–7 are dedicated to the logistics of supporting end-to-end communications.

OSI Reference Model Layer OSI Layer Number
Application 7
Presentation 6
Session 5
Transport 4
Network 3
Data Link 2
Physical 1

Privacy Policy

2009-06-01T22:36:00.001+07:00

Privacy Policy for rahimrasyid.blogspot.com

If you require any more information or have any questions about our privacy policy, please feel free to contact us by email at rahim.rasyid@ymail.com.

At rahimrasyid.blogspot.com, the privacy of our visitors is of extreme importance to us. This privacy policy document outlines the types of personal information is received and collected by rahimrasyid.blogspot.com and how it is used.

Log Files
Like many other Web sites, rahimrasyid.blogspot.com makes use of log files. The information inside the log files includes internet protocol ( IP ) addresses, type of browser, Internet Service Provider ( ISP ), date/time stamp, referring/exit pages, and number of clicks to analyze trends, administer the site, track user’s movement around the site, and gather demographic information. IP addresses, and other such information are not linked to any information that is personally identifiable.

Cookies and Web Beacons
rahimrasyid.blogspot.com does use cookies to store information about visitors preferences, record user-specific information on which pages the user access or visit, customize Web page content based on visitors browser type or other information that the visitor sends via their browser.

DoubleClick DART Cookie
.:: Google, as a third party vendor, uses cookies to serve ads on rahimrasyid.blogspot.com.
.:: Google's use of the DART cookie enables it to serve ads to users based on their visit to rahimrasyid.blogspot.com and other sites on the Internet.
.:: Users may opt out of the use of the DART cookie by visiting the Google ad and content network privacy policy at the following URL - http://www.google.com/privacy_ads.html

Some of our advertising partners may use cookies and web beacons on our site. Our advertising partners include ....
Google Adsense

These third-party ad servers or ad networks use technology to the advertisements and links that appear on rahimrasyid.blogspot.com send directly to your browsers. They automatically receive your IP address when this occurs. Other technologies ( such as cookies, JavaScript, or Web Beacons ) may also be used by the third-party ad networks to measure the effectiveness of their advertisements and / or to personalize the advertising content that you see.

rahimrasyid.blogspot.com has no access to or control over these cookies that are used by third-party advertisers.

You should consult the respective privacy policies of these third-party ad servers for more detailed information on their practices as well as for instructions about how to opt-out of certain practices. rahimrasyid.blogspot.com's privacy policy does not apply to, and we cannot control the activities of, such other advertisers or web sites.

If you wish to disable cookies, you may do so through your individual browser options. More detailed information about cookie management with specific web browsers can be found at the browsers' respective websites.