Existing Network Protocols

CS 493/693 Lecture, Dr. Lawlor, 2006/01/30

See page 23 of "Network Intrusion Detection" and onward for details on TCP, which we'll talk about today.

Network Protocol Design (by example)

An Ethernet packet has a binary header consisting of a "preamble" (for clock synchronization), a source and destination address, a big chunk of binary data, and a packet checksum.

Any IPv4 packet has a binary header consisting of 5 big-endian 32-bit integers, which include all the good stuff we've said a header should have: the version number, the length of the data to follow, a *header* checksum, a source and destination address, and other housekeeping.  Note that the destination address is used to deliver the packet.  The source address can be used to call the sender back, but like anything in a network packet, the source address might be "spoofed"--i.e., not the IP address of the real sender.

UDP adds just two ints to IP, divided up into four 16-bit ints.  These are the source and destination UDP port number, packet length, and a packet checksum.  UDP is connectionless, so a single UDP packet is self-contained (as far as UDP goes).

TCP adds five more ints to IP, including the source and destination 16-bit port numbers again, a "sequence number" used to arrange the packets into a single data stream, "acknowledgements" used for retransmissions, flow control options, and connection data.  These fields are used to reassemble packets into a reliable byte stream.  The extra work done by TCP to provide reliable access over arbitrary networks is quite useful, which is why almost all higher-level protocols are built on TCP (instead of UDP or bare IP).

HTTP (the standard protocol of the web) sends and receives data over TCP.  The client sends an ASCII "GET" request header.  The server responds with an ASCII response header followed by binary data.  Official details are in rfc2068.

So, for example, to read this web page, your machine probably received:
This "nesting" design is extremely common on networks and file formats.

Good protocol meta references: