YARMOUK UNIVERSITY

CS 492: Special Topics

Preliminaries to Network Monitoring

Dr. Ahmed Manasrah

2 | P a g e

Table of Contents OSI Model (Open System Interconnection Model) ................................................................... 4

Layer 1 - Physical Layer .......................................................................................................... 4

Layer 2 - Data Link Layer (LLC and MAC) ............................................................................... 4

Functions ........................................................................................................................... 5

Layer 3 - Network Layer............................................................................................................. 5

Functions ........................................................................................................................... 5

Protocols ............................................................................................................................ 5

Layer 4 - Transport Layer ....................................................................................................... 5

Functions ........................................................................................................................... 6

Protocols ............................................................................................................................ 6

Layer 5 - Session Layer........................................................................................................... 6

Protocols ................................................................................................................................ 6

Layer 6 - Presentation Layer .................................................................................................. 6

Protocols ............................................................................................................................ 7

Layer 7 - Application Layer .................................................................................................... 7

Protocols ............................................................................................................................ 7

Network Communication through OSI: an Example ................................................................. 8

Network Protocols Header, size, format and encapsulation .................................................. 11

IP Header Format ................................................................................................................ 11

TCP Header Format ............................................................................................................. 12

UDP Header Format ............................................................................................................ 13

ARP operation and header structure (Format) ................................................................... 13

ICMP header structure (Format) ......................................................................................... 14

Ethernet Frame Format ....................................................................................................... 15

Examples .................................................................................................................................. 16

IP and ICMP Header format ................................................................................................. 16

Ethernet and ARP Format .................................................................................................... 17

3 | P a g e

List of Figures Figure 1: OSI Reference Model .................................................................................................. 4

Figure 2: Network Communication Example (OSI emulation) .................................................. 9

Figure 3: Data Encapsulation example .................................................................................... 10

Figure 4. IP packet Format. ...................................................................................................... 11

Figure 5. The basic structure of a TCP packet ......................................................................... 12

Figure 6. The basic structure of a UDP packet ........................................................................ 13

Figure 7. ARP is used to map a device's data-link identifier to its IP address (ARP format) ... 13

Figure 8. ICMP packet format and Types. ............................................................................... 14

Figure 9: Ethernet Frame Format ............................................................................................ 15

Figure 10: IP and ICMP Encapsulation Example ...................................................................... 16

Figure 11: : Ethernet frame and ARP Encapsulation Example ................................................. 17

OSI Model (Open System Interconnection Model)

The OSI, or Open System Interconnection, model defines a network

for implementing protocols in seven layers. Control is passed from one layer to the

next, starting at the application laye

layer, over the channel to the next station and back up the hierarchy.

Layer 1 - Physical LayerPhysical layer defines the cable or physical medium itself Functions

• Transmits raw bit stream over physical cable.• Defines cables, cards, and physical aspects.• Defines NIC attachments to hardware, how cable is attached to NIC.• Defines techniques to transfer bit stream to cable.

Layer 2 - Data Link Layer (LLC and MAC)Data Link layer defines the format of data on the network. A network data frameincludes checksum, source and destination address, and data. The largest packet that can be sent through a data link layer defines Ethernet addresses a host using a unique, 48Media Access Control (MAC) address.

4

OSI Model (Open System Interconnection Model)

The OSI, or Open System Interconnection, model defines a networking framewor

for implementing protocols in seven layers. Control is passed from one layer to the

application layer in one station, and proceeding to the bottom

layer, over the channel to the next station and back up the hierarchy.

Figure 1: OSI Reference Model

Layer Physical layer defines the cable or physical medium itself.

Transmits raw bit stream over physical cable. Defines cables, cards, and physical aspects. Defines NIC attachments to hardware, how cable is attached to NIC. Defines techniques to transfer bit stream to cable.

ata Link Layer (LLC and MAC) Data Link layer defines the format of data on the network. A network data frameincludes checksum, source and destination address, and data. The largest packet that can be sent through a data link layer defines the Maximum Transmission Unit (MTU). Ethernet addresses a host using a unique, 48-bit address called its Ethernet address or

(MAC) address.

4 | P a g e

framework

for implementing protocols in seven layers. Control is passed from one layer to the

to the bottom

Data Link layer defines the format of data on the network. A network data frame includes checksum, source and destination address, and data. The largest packet that

the Maximum Transmission Unit (MTU). bit address called its Ethernet address or

5 | P a g e

Functions

• Turns packets into raw bits 100101 and at the receiving end turns bits into packets.

• Handles data frames between the Network and Physical layers. • The receiving end packages raw data from the Physical layer into data frames

for delivery to the Network layer. • This layer defines the methods used to transmit and receive data on the

network.

Layer 3 - Network Layer this layer uses Internetwork Protocol (IP) as its network layer interface. IP is responsible for routing, directing datagrams from one network to another.

Functions

• Translates logical network address and names to their physical address (e.g. computername ==> MAC address).

• Responsible for addressing, determining routes for sending and managing network problems such as packet switching, data congestion and routing.

• If router can’t send data frame as large as the source computer sends, the network layer compensates by breaking the data into smaller units. At the receiving end, the network layer reassembles the data.

Protocols

IP

ARP

RARP

ICMP

Layer 4 - Transport Layer Transport layer subdivides user-buffer into network-buffer sized datagrams and enforces desired transmission control. Two transport protocols, Transmission Control Protocol (TCP) and User Datagram Protocol (UDP), sits at the transport layer. Reliability and speed are the primary difference between these two protocols. TCP establishes connections between two hosts on the network through 'sockets' which are determined by the IP address and port number. TCP keeps track of the packet delivery order and the packets that must be resent. Maintaining this information for each connection makes TCP a stateful protocol. UDP on the other hand provides a low overhead transmission service, but with less error checking.

6 | P a g e

Functions

• Additional connection below the session layer. • Manages the flow control of data between parties across the network. • Divides streams of data into chunks or packets; the transport layer of the

receiving computer reassembles the message from packets. • Provides error-checking to guarantee error-free data delivery, with on losses or

duplications • Provides acknowledgment of successful transmissions; requests retransmission

if some packets don’t arrive error-free. • Provides flow control and error-handling.

Protocols TCP UDP

Layer 5 - Session Layer The session protocol defines the format of the data sent over the connections. Login sessions uses TCP. Functions

• Establishes, maintains and ends sessions across the network. • Responsible for name recognition (identification) so only the designated

parties can participate in the session. • Provides synchronization services by planning check points in the data stream

=> if session fails, only data after the most recent checkpoint need be transmitted.

• Manages who can transmit data at a certain time and for how long. • Examples are interactive login and file transfer connections, the session would

connect and re-connect if there was an interruption; recognize names in sessions and register names in history.

Protocols NetBIOS

Layer 6 - Presentation Layer External Data Representation (XDR) sits at the presentation level. It converts local representation of data to its canonical form and vice versa.

Functions

• Translates from application to network format and vice-versa.

7 | P a g e

• All different formats from all sources are made into a common uniform format that the rest of the OSI model can understand.

• Responsible for protocol conversion, character conversion,data encryption / decryption, expanding graphics commands, data compression.

• Sets standards for different systems to provide seamless communication from multiple protocol stacks.

• Not always implemented in a network protocol.

Protocols MIME

Layer 7 - Application Layer Provides network services to the end-users. Mail, ftp, telnet, DNS, NIS, NFS are examples of network applications. Functions

• Used for applications specifically written to run over the network. • Allows access to network services that support applications. • Directly represents the services that directly support user applications. • Handles network access, flow control and error recovery. • Example apps are file transfer,e-mail, NetBIOS-based applications.

Protocols DNS

8 | P a g e

Network Communication through OSI: an Example

Assume two networked computers running identical operating systems and applications and are using identical protocols (or rules) at all OSI layers. Working in conjunction, the applications, the OS, and the hardware implement the seven functions described in the OSI model. Each computer is also running an e-mail program that is independent of the OSI layers. The e-mail program enables the users of the two computers to exchange messages. The figure represents the transmission of one message from Sam to Charlie. The transmission starts when Sam types in a message to Charlie and presses the "send" key. Sam's operating system appends to the message (or "encapsulates") a set of application-layer instructions (OSI Layer 7) that will be read and executed by the application layer on Charlie's computer. The message with its Layer 7 header is then transferred to the part of the operating system that deals with presentation issues (OSI Layer 6) where a Layer 6 header is appended to the message. The process repeats through all the layers until each layer has appended a header. The headers function as an escort for the message so that it can successfully negotiate the software and hardware in the network and arrive intact at its destination. When the data-link-layer header is added at Layer 2, the data unit is known as a "frame." The final header, the physical-layer header (OSI Layer 1) tells the hardware in Sam's computer the electrical specifics of how the message will be sent (which medium, at which voltage, at which speed, etc.). Although it is the final header to be added, the Layer 1 header is the first in line when the message travels through the medium to the receiving computer. When the message with its seven headers arrives at Charlie's computer, the hardware in his computer is the first to handle the message. It reads the instructions in the Layer 1 header, executes them, and strips off the header before passing the message to the Layer 2 components. These Layer 2 components execute those instructions, strip off the header, and pass the message to Layer 3, and so on. Each layer's header is successively stripped off after its instructions have been read so that by the time the message arrives at Charlie's e-mail application; the message has been properly received, authenticated, decoded, and presented.

9 | P a g e

Figure 2: Network Communication Example (OSI emulation)

10 | P a g e

The whole encapsulation process appears as the following figure.

Figure 3: Data Encapsulation example

11 | P a g e

Network Protocols Header, size, format and encapsulation

IP Header Format: this header generated at layer 3, the format of the protocol as

follows.

Another view if the IP header structure,

Figure 4. IP packet Format.

12 | P a g e

TCP Header Format: this header generated at layer 4, the format of the protocol as

follows. TCP is a connection oriented protocol that regulates the flow of data.

Another view if the TCP header structure,

Figure 5. The basic structure of a TCP packet

13 | P a g e

UDP Header Format: this header generated at layer 4, the format of the protocol as

follows. UDP is a connectionless protocol.

Figure 6. The basic structure of a UDP packet

ARP operation and header structure (Format) : this protocol is used to map

the IP address to its MAC address

Figure 7. ARP is used to map a device's data-link identifier to its IP address (ARP format)

14 | P a g e

ICMP header structure (Format) : this protocol is used for error reporting

Figure 8. ICMP packet format and Types.

15 | P a g e

Ethernet Frame Format: look at this as the content of the data inside the cable.

Figure 9: Ethernet Frame Format

16 | P a g e

Examples

IP and ICMP Header format

Figure 10: IP and ICMP Encapsulation Example

17 | P a g e

Ethernet and ARP Format

Figure 11: : Ethernet frame and ARP Encapsulation Example