Section 4 TCP_IP Transport Layer

• newEditor

Section 4: TCP/IP Transport Layer

• Learning Outcome 1 Layered Models

Establish the TCP/IP transport layer on the OSI layered model

Transport Layer

• The Transport Layer in TCP/IP corresponds directly to the Transport Layer (Layer 4) of the OSI model.

• TCP/IP Transport Layer = OSI Transport Layer (Layer 4)

• This layer is responsible for end-to-end communication, including:

• Segmentation and reassembly

• Breaks data into segments and reassembles them at the destination.

• Connection management

• Depending on the protocol used:

• TCP: Connection-oriented (uses a handshake and reliable delivery)

• UDP: Connectionless (fast but no reliability)

Transport Layer

• Reliability and error handling (TCP)

• TCP includes:

• Acknowledgements (ACKs)

• Retransmissions

• Sequence numbers

• Flow control (sliding window) prevents a fast sender from overwhelming a slow receiver by limiting unacknowledged data to the receiver's available buffer capacity.

• Congestion control

• UDP does not—it simply sends datagrams without guarantee.

Transport Layer

• Port numbers

• The Transport Layer uses ports to allow multiple applications to communicate:

• Example: HTTP = port 80, HTTPS = port 443, DNS = port 53.

• Multiplexing and demultiplexing

• Multiple applications can share the same network connection:

• Multiplexing = sending data from many applications over one connection.

• Demultiplexing = delivering received data to the correct application using port numbers.

Identify the encapsulated application data, inside the TCP segment, inside the IP packet, inside the Ethernet frame.

• Encapsulation Order

• Application Data → TCP Segment → IP Packet → Ethernet Frame

Application Data

• This is the original data created by an application.

• Examples:

• An HTTP request (GET /index.html)

• An email message (SMTP)

• A DNS query

• A file transfer block (FTP)

• This data is passed to the Transport Layer.

TCP Segment

• The Transport Layer (TCP) encapsulates the application data.

• A TCP segment contains:

• TCP Header, which includes:

  • Source port

  • Destination port

  • Sequence number

  • ACK number

  • Flags (SYN, ACK, FIN…)

  • Window size  a 16-bit field in the TCP header that tells the sender how much data (in bytes) the receiver is willing to accept before an acknowledgment (ACK) is required

• TCP Payload
  → This payload IS the application data.

• So inside the TCP segment, you will find:
  Application data

IP Packet

• The TCP segment is passed to the Network Layer (IP), which encapsulates it into an IP packet.

• An IP packet contains:

• IP Header, including:

  • Source IP address

  • Destination IP address

  • TTL

    • TTL is a counter that prevents IP packets from circulating forever in the network.

    • Every time a packet passes through a router (a hop), the TTL value is reduced by 1.

    • If the TTL reaches 0, the router drops the packet and sends back an ICMP Time Exceeded message.

  • Protocol (indicates TCP = 6)

• IP Payload
  → This payload IS the entire TCP segment, including the application data.

Ethernet Frame

• Finally, Layer 2 encapsulates the IP packet into an Ethernet frame.

• An Ethernet frame contains:

• Ethernet Header, including:

  • Destination MAC address

  • Source MAC address

  • EtherType (indicates IPv4 = 0x0800)

• Frame Payload
  → This payload IS the entire IP packet, which contains the TCP segment and the application data

• FCS (Frame Check Sequence) at the end for error detection

Distinguish between TCP and UDP.

TCP = Transmission Control Protocol

• Characteristics:

• Creates a reliable connection between sender and receiver. Using the three way hand shake

• Guarantees all data arrives without errors.

• Retransmits lost packets.

• Makes sure packets arrive in order.

• Good for applications where accuracy matters more than speed.

• Example uses:

• Websites (HTTP/HTTPS)

• Email (SMTP)

• File transfers (FTP)

• Remote login (SSH)

UDP = User Datagram Protocol

• Characteristics:

• No connection is established.

• No guarantee packets arrive or arrive in order.

• Very fast and efficient.

• Suitable for time-sensitive applications where small losses are acceptable.

• Example uses:

• Video and audio streaming

• Voice calls (VoIP)

• Online gaming

• DNS lookups

Outline the TCP handshake.

• The TCP handshake is the process used to establish a reliable connection between two devices before data is sent.

• It has three steps:

• SYN — Synchronize

• SYN-ACK — Synchronize + Acknowledge

• ACK — Acknowledge

• A full, reliable TCP connection is now established, and data transfer can begin.

SYN — Synchronize

• The client sends a packet with the SYN flag set.

• Purpose:

• Requests to start a TCP connection

• Sends the initial sequence number (ISN)

• Client → Server:

SYN-ACK — Synchronize + Acknowledge

• The server responds with a packet that has both SYN and ACK flags set.

• Purpose:

• Acknowledges the client’s SYN

• Sends its own sequence number

• Server → Client:

ACK — Acknowledge

• The client sends a final packet with the ACK flag set.

• Purpose:

• Confirms the server’s SYN-ACK

• Connection is now established

Very Short Summary

• SYN — Client: “Can we talk?”

• SYN-ACK — Server: “Yes, let’s talk.”

• ACK — Client: “Great, starting now.”

TCP Connection Teardown (4-Way Handshake)

• TCP uses a 4-step process to close a connection cleanly.
  Either side (client or server) may initiate the close.

FIN — Finish

• The device that wants to end the connection sends a FIN packet.

• Purpose:

• Says “I’m finished sending data.”

• Side A → Side B:

ACK — Acknowledge

• The receiving side acknowledges the FIN by sending an ACK.

• Purpose:

• Confirms receipt of the FIN.

• The connection becomes half-closed (one side has stopped sending).

• Side B → Side A:

ACK — Acknowledge

• The original device sends a final ACK to confirm the second FIN.

• Side A → Side B:

FIN — Finish (from the other side

• When the second side is ready to close its end of the connection, it sends its own FIN.

• Purpose:

• Indicates it is also done sending data.

• Side B → Side A:

Identify MAC addresses, IP addresses; and the additional port addresses, sequence and acknowledgement numbers at this layer.

MAC Addresses (Layer 2 — Data Link Layer)

• MAC address = Physical address of a network interface

• 48-bit (6 bytes)

• Written as: AA:BB:CC:DD:EE:FF

• Burned into NIC hardware (though can be changed in software)

• Used only on the local network (LAN)

• Found in the Ethernet frame header

• Purpose

• Identifies the source MAC and destination MAC for local delivery.

IP Addresses (Layer 3 — Network Layer)

• IP address = Logical address used for end-to-end delivery across networks

• IPv4 example: 192.168.1.10

• IPv6 example: 2001:db8::1

• Used by routers to move packets across networks

• Found in the IP packet header

• Purpose

• Identifies the source IP and destination IP of the packet.

• Uniquely identifies devices across the entire internet, not just the LAN.

Port Numbers (Layer 4 — Transport Layer)

• Port numbers = Application identifiers for TCP or UDP communication

• Range 0–65535

• Found in TCP or UDP headers

• Purpose

• Port numbers identify:

• Source port → sending application

• Destination port → receiving application

• Examples:

• HTTP → Port 80

• HTTPS → Port 443

• DNS → Port 53

• SSH → Port 22

Sequence Numbers (TCP Only)

• Sequence number = Position of the first byte of data in a TCP segment

• Purpose:

• Ensures in-order delivery

• Helps identify missing segments

• Supports retransmissions

• Example:

• If sequence number = 1000, the segment starts with byte 1000.

Acknowledgement Numbers (TCP Only)

• Acknowledgement number = The next expected byte from the other side

• Purpose:

• Confirms successful receipt of data

• Used for reliable delivery

• Example:

• ACK = 1001 means:

  • “I got everything up to byte 1000; send me byte 1001 next.”

Identify the operation of the sequence and acknowledgement numbers.

• A sequence number identifies the position of the first byte of data in a TCP segment.

• Main operations:

• Track data order

  • Every byte in a TCP stream is numbered.

  • Ensures packets are reassembled correctly even if they arrive out of order.

• Detect missing data

  • If a segment doesn’t arrive, the gap in sequence numbers reveals the missing bytes.

• Support retransmissions

  • If the receiver does not acknowledge certain sequence numbers, the sender retransmits.

  • Example:

  • If SEQ = 1000 and the TCP header says the payload is 500 bytes,
    the next expected segment should start at byte 1500.

• The acknowledgement number tells the sender:

• “I have successfully received all bytes up to this number minus one—send the next byte starting from here.”

• Main operations:

• Confirm receipt of data

  • Every ACK confirms the highest contiguous sequence of bytes received.

• Request the next byte

  • The ACK number always points to the next expected byte.

• Prevent data loss

  • If an ACK is not received, data is assumed lost and retransmitted.

  • Example:

  • If the receiver sends ACK = 1500, it means:

• It got bytes 0–1499

• It wants the next byte to be 1500

How They Work Together

• CP uses SEQ and ACK numbers to maintain a reliable, ordered, error-checked data stream.

• Simple flow:

• Sender → Receiver

• SEQ = 1000 (sending bytes 1000–1499)

• Receiver → Sender

• ACK = 1500 (send me byte 1500 next)

• This repeats throughout the entire connection.

Explain the purpose of the port address.

• Purpose of a Port Address

• A port address (or port number) identifies the specific application or service running on a device.

• IP address = identifies the device
  Port address = identifies the application on that device

• Together, they allow multiple programs to communicate over the network at the same time.

Explain the purpose of the port address.

• Why we need port addresses

• 1. Application Identification

• Many applications run on the same computer.
  Ports ensure that incoming data is delivered to the correct application.

• Example:

• Web browser uses port 80/443

• Email client uses port 25/110/143

• DNS uses port 53

• Multiple connections at once

• A device can have:

• Several TCP connections

• Several UDP communications

• All active at the same time

• Ports allow each active connection to be uniquely identified.

• Example:
  Your laptop can:

• Browse a website

• Check email

• Download a file

• Stream a video

• All at the same time — each uses different port numbers.

Explain the purpose of the port address.

• End-to-End Communication

• Port numbers form part of the socket, which defines a unique connection.

• A socket pair looks like this:

• Source IP : Source Port → Destination IP : Destination Port

• Example:

• 192.168.1.5:50000 → 142.250.186.206:443

• This ensures data flows to the correct application.

Explain the purpose of the port address.

• Transport Layer Function

• Port numbers are used by TCP and UDP to multiplex/demultiplex data:

• Multiplexing: Many applications share the network connection.

• Demultiplexing: Incoming packets go to the right application.

Explore commonly-used port numbers, e.g. ftp, ssh, smtp, pop3, imap, http(s), etc.

Commonly‑Used Ports and Services

Demonstrate port addresses and connections using command-line tools such as netstat and nmap.

• Open word doc "Demonstrating Port Address Commands

Demonstrate and identify connectivity problems while viewing TCP frames.

1. Packet Loss during Handshake (Connection Timed Out) 

Scenario: A client attempts to connect to a server, but the connection hangs and eventually fails. 

• What you see: A rapid, repeated sequence of SYN packets from the client to the server, with no corresponding SYN-ACK response from the server.

• Identification: In Wireshark, filter by tcp.flags.syn == 1 && tcp.analysis.lost_segment.

• Cause: The server is down, a firewall is silently dropping packets, or routing is incorrect. 

2. Port Unreachable / Connection Refused (Active Drop)

Scenario: The server is up, but the specific application (e.g., web server) is not running or is blocking the request. 

• What you see: A SYN packet from the client, immediately followed by a RST, ACK (Reset) packet from the server.

• Identification: Filter by tcp.flags.reset == 1.

• Cause: The application port is closed, or a firewall is actively rejecting the connection

3. High Packet Loss during Data Transfer (Slow Performance) 

• Scenario: The connection establishes, but data transfer is extremely slow or causes disconnection. 

• What you see: A sequence of data packets followed by repeated TCP Retransmission messages, often with Dup ACK (Duplicate ACK) messages.

• Identification: Use the Expert Info button in Wireshark and look for "Retransmission" or use the filter tcp.analysis.retransmission.

• Cause: Congestion on the network path, faulty network cables, or bad switch ports. 

4. Zero Window / Receiver Overwhelmed

• Scenario: The connection is established, but communication stalls periodically. 

• What you see: The server sends a packet with a Win (Window Size) value of 0. This indicates the server's buffer is full, and it cannot receive more data.

• Identification: Filter by tcp.window_size == 0.

• Cause: The application on the receiving end is processing data too slowly. 

5. Asymmetric Routing / Firewall Interruptions (Sudden Reset)

• Scenario: A stable connection suddenly drops. 

• What you see: The connection works fine, then suddenly a RST flag appears in the middle of a transfer.

• Identification: tcp.flags.reset == 1.

• Cause: A firewall or IDS (Intrusion Detection System) may have flagged the traffic, or an intermediary device lost the context of the connection