The TCP/IP stack and protocols

The four layers, encapsulation, ports and sockets, and HTTP, HTTPS, FTP, SMTP, POP3 and SSH.

A12.4Networks and the webA level30 min

At GCSE (F10.7 and F10.8) you named the four layers of TCP/IP and matched protocols to what they do. At A level you need to explain what each layer adds as data goes down the stack, how ports and sockets let one computer run many conversations at once, and how the standard application protocols are used, down to the commands a client sends.

Four layers

The TCP/IP stack is the set of protocols the Internet runs on, arranged in four layers. Each layer does one job and uses the layer below; no layer needs to know how the others work.

Going down the stack, each layer wraps the data from the layer above in its own header. This is encapsulation. At the receiver the process runs in reverse: each layer reads and removes its own header and passes the rest up.

As a packet crosses the Internet, routers work only up to the network layer. At each hop the link layer header is replaced with a new one, because MAC addresses only mean something on one local network, but the IP addresses stay the same all the way (unless NAT changes them, A12.6).

MAC addresses are 48-bit addresses given to each network interface when it is made, written as six hexadecimal pairs such as 3C:61:05:1A:9F:02. They are used by the link layer to deliver frames within one network.

Ports and sockets

One computer may be serving web pages, sending email and running an SSH session at the same moment, all through one IP address. The transport layer tells them apart with port numbers, 16-bit numbers from 0 to 65535 that identify a particular process or service.

• Well-known ports (0 to 1023) are assigned to standard services, so a client knows where to find them: a web server listens on port 80.
• A client port (an ephemeral port, usually 49152 to 65535) is picked by the client's operating system for one connection and released when it closes.

A socket is the combination of an IP address and a port number, such as 192.168.4.1:80. It is one endpoint of a connection. A connection is identified by its two sockets, so a server can hold thousands of connections on port 80 at once: each has a different client socket.

The application protocols

HTTP (hypertext transfer protocol) is how a browser requests resources from a web server, the program that stores pages and serves them. A request is plain text: a method, a path, a version, then headers:

GET /a12/index.html HTTP/1.1
Host: lessons.bugbot.example

The server replies with a status line such as HTTP/1.1 200 OK, headers, and the resource. HTTPS is the same protocol sent inside an encrypted TLS connection, so anyone intercepting the packets cannot read or alter the pages, passwords or card numbers in them; the server proves its identity with a digital certificate (A12.7).

FTP (file transfer protocol) moves files between a client and a server. A server can allow anonymous access, where anyone may log in (typically as the user anonymous) to download public files, or non-anonymous access, where a username and password are needed.

SMTP (simple mail transfer protocol) sends email: from your email client to your email server, and from that server on to the recipient's. POP3 (post office protocol version 3) is how a client retrieves mail from its server; the messages are downloaded and usually deleted from the server.

SSH (secure shell) gives an encrypted, authenticated connection to a remote computer, used for remote management: logging in to a server's command line to run commands, update software or edit its configuration. Because it simply makes an encrypted TCP connection to a port, an SSH client can also be used to connect to another service's port and type that application protocol's commands by hand: GET to a web server, or EHLO, MAIL FROM and RCPT TO to a mail server.

A packet of your own

The task below builds a packet in a simple text format of our own: the network and transport information, the data, and a checksum so the receiver can tell whether it was damaged. The checksum here is the sum of the character codes of the whole body, modulo 256, written as two hexadecimal digits:

def checksum(text):
    total = 0
    for ch in text:
        total = total + ord(ch)
    return format(total % 256, "02X")

body = "192.168.4.23,192.168.4.1,49152,80,GET /led"
print(body + "*" + checksum(body))

damaged = body.replace("led", "lec")          # one character changed in transit
print("received checksum", checksum(body), "but body now gives", checksum(damaged))

Run this in the simulator

Task: wrap it and unwrap it

The robot at 192.168.4.23 asks the Server at 192.168.4.1 for its battery level.

Write checksum(text): its input is any string; it returns the sum of the character codes (ord) of every character in text, modulo 256, as two uppercase hexadecimal digits (format(n, "02X")).

1. Build and send one packet: the body <source IP>,<destination IP>,<source port>,<destination port>,<data> with source port 49152, destination port 80 and data GET /battery, then *, then the body's checksum.
2. The Server replies with a packet in the same format. Wait for it, checking messages() every 0.1 s.
3. Split off the checksum after the last *. If the body's checksum matches, print checksum ok, then from socket <source IP>:<source port>, then data: <data>. The data is everything after the fourth comma. If it does not match, print checksum wrong.

The robot does not drive.

# the two lines every program starts with: the commands, then the robot
from bugbot import *
connect()

def checksum(text):
    return "00"

send("192.168.4.23,192.168.4.1,49152,80,GET /battery")

Challenges

1. Swap two characters in a body. Does the checksum notice? Why not, and what does that say about this checksum?
2. Add a TTL field to the packet and a router function that decrements it and drops the packet at 0.
3. Look up which port IMAP uses and why many people now use it instead of POP3.