Computer Networks

Subject 1 of 10 · from the OSI model to network security, with the tables and formulas that actually matter.

1. Network Basics & the OSI Model

The OSI (Open Systems Interconnection) model is a conceptual framework that standardizes how network communication is designed. It splits communication into seven distinct layers. Each layer provides services to the layer above it and receives services from the layer below. These layers form the foundation for understanding how data moves through networks, from raw physical signals up to application-level messages.

The seven layers

Two groups of layers

• Upper layers (5–7) handle user-oriented functions: what applications see.
• Lower layers (1–4) handle network-oriented functions: moving bits across the wire.

Data flows down the stack when sending and up the stack when receiving. The key benefit of the whole scheme is interoperability: equipment from different manufacturers can talk to each other because everyone standardizes against the same layer boundaries.

2. Network Topologies

Wireless networks are classified by their infrastructure.

Infrastructure mode

• Basic Service Set (BSS): one central access point connected to the wired network. Each station talks directly to the base station in a single hop. Example: a traditional Wi-Fi access point that all your devices join.
• Extended Service Set (ESS): multiple access points sharing one SSID, stitched together over the wired network. Extends coverage seamlessly — your phone roams between APs without noticing.

Ad hoc networks

Infrastructure-less communication: no central base station, no wired backbone. Every node can act as both client and router, talking directly device-to-device.

• Self-organizing and self-healing
• Needs a distributed routing process
• Example: Bluetooth devices coordinating during an emergency with no cell coverage

3. Physical Layer

The Physical Layer sits at the very bottom of the OSI model. It handles the actual transmission of raw bits over the physical medium: managing the physical connection between devices, controlling how bits are pushed through cables, and converting raw bits into signals.

Key specifications

Transmission media

• Copper cables — twisted pair, coaxial
• Fiber optic — light-based, single-mode and multi-mode
• Wireless — radio waves, microwaves

Signal characteristics define how long each bit is transmitted (bit duration = 1 / bandwidth) and the signaling method used (NRZ, Manchester, and friends).

4. Data Link Layer

The Data Link Layer (Layer 2) manages reliable transmission between directly connected nodes. Its jobs: framing, error detection, flow control, and mediating access to a shared medium.

Framing

Framing converts packets from the Network Layer into frames by adding a header and a trailer. Each frame carries a header with control information (like MAC addresses), the data payload, and a trailer with error-detection codes.

Error detection

An error-detection code is computed for each frame. The common methods:

• Checksums — simple addition-based verification
• CRC (Cyclic Redundancy Check) — polynomial division, robust detection
• Parity bits — single-bit error detection

The receiver extracts frames from the bit stream, verifies integrity with the code, and requests retransmission if errors are found.

Ethernet (IEEE 802.3)

Ethernet defines both physical and data-link behavior for LANs. It is connectionless (no setup before sending) and best-effort (no acknowledgments, flow control, or error recovery at this layer). Classic Ethernet used a shared bus with CSMA/CD for medium access.

Frame size limits

• Minimum: 64 bytes — 6 + 6 + 2 + 46 + 4. The minimum exists so collision detection works properly across the maximum cable length: a frame must still be on the wire when a collision's echo returns.
• Maximum: 1518 bytes — 6 + 6 + 2 + 1500 + 4.

CSMA/CD performance

Key insight: longer frames improve efficiency by shrinking the relative cost of collision overhead. When N stations compete, the probability that exactly one transmits successfully in a slot is P = N·p·(1−p)^N−1, and the average contention period before success is k × 2τ where k = 1/p.

ARP — Address Resolution Protocol

ARP maps IP addresses to MAC addresses when a device needs to talk on its local network. A device knows the destination IP but needs the MAC to build the frame.

• ARP request: broadcast containing sender IP/MAC and target IP (target MAC unknown).
• ARP reply: unicast straight back to the requester with the target's MAC.
• ARP cache: mappings are cached ~20–30 minutes, so repeat traffic to the same host needs no new broadcast.
• Encapsulation: ARP rides directly in Ethernet frames with EtherType 0x0806 — no IP header involved.

Four use cases: host-to-host on the same network, host-to-router (needs the router's MAC), router-to-router (next-hop MAC), router-to-host (final delivery).

RARP and its successors

RARP did the reverse: given only a MAC address, get an IP (for diskless workstations). It needed a dedicated RARP server per segment and its broadcasts couldn't cross routers — a scaling dead end. BOOTP extended the idea, and DHCP eventually replaced RARP entirely.

5. Flow Control & ARQ Protocols

Flow control regulates how fast a sender transmits so it never overwhelms the receiver. The classic family is ARQ — Automatic Repeat reQuest.

Stop-and-Wait ARQ

The sender transmits one frame, then waits for its acknowledgment before sending the next. Simple, but the channel sits idle most of the time.

On a satellite link with 270 ms propagation delay and 1 ms transmission time, η ≈ 1/(1+540) ≈ 0.0018 — under 0.2% utilization. Stop-and-wait collapses wherever bandwidth is high or distance is long.

Go-Back-N ARQ

A sliding-window protocol: the sender may have up to N frames unacknowledged. The receiver only accepts in-order frames (receiver window = 1) and sends cumulative ACKs.

• Maximum window for N-bit sequence numbers: 2^N − 1
• On timeout, the sender retransmits everything from the oldest unacknowledged frame — simple, but wasteful on noisy links.

Selective Repeat ARQ

The efficient sibling: the receiver buffers out-of-order frames and the sender retransmits only the lost or corrupted ones. Each frame gets its own ACK. Maximum window is 2^(N−1) for N-bit sequence numbers.

Sliding window, summarized

6. MAC Sublayer & Wireless LANs

CSMA/CA — why wireless can't use CSMA/CD

On a wire, a station can listen while transmitting and detect collisions. On radio it can't — its own transmission drowns out everything else. Two extra problems appear:

• Hidden terminal: two stations can't hear each other but both reach the access point; they collide unknowingly.
• Exposed terminal: a station holds off transmitting because it hears a neighbor, even though its own transmission wouldn't have interfered.

So 802.11 uses CSMA/CA (collision avoidance): listen first, then reserve the channel with an RTS/CTS handshake before sending data. Timing gaps keep things orderly: SIFS (short, for immediate responses like ACK/CTS) and DIFS (longer, before contending for the channel).

802.11 standards

Joining a network: scanning

• Passive scanning: listen for the AP's periodic beacon frames. Cheap, slow.
• Active scanning: broadcast probe requests, APs answer with probe responses, then association request/response. Faster discovery, more airtime.

802.11 frame structure

Frame Control subfields (16 bits)

Token Ring (IEEE 802.5)

A deterministic LAN: stations sit on a ring and take turns transmitting by passing a small token frame. No collisions, ever — you can only send while holding the token. A station may hold it for at most the Token Holding Time (THT), and priority levels (0–7) let urgent traffic jump the queue. A dedicated monitor station keeps ring timing healthy and regenerates lost tokens.

Higher speeds need shorter rings to keep signal quality up. Token frame: SD (1 byte) + AC (1 byte) + ED (1 byte).

7. Network Layer & IP Addressing

The Network Layer (Layer 3) handles logical addressing and routing: assigning IP addresses, picking the best path, forwarding packets through routers, and fragmenting/reassembling packets that exceed a link's MTU.

Delivery types

• Unicast — one to one
• Multicast — one to many (group)
• Broadcast — one to all on the network

IPv4 address classes

Special addresses worth memorizing: 0.0.0.0 (this network), 127.0.0.1 (loopback), 255.255.255.255 (limited broadcast), and the private ranges 10/8, 172.16/12, 192.168/16.

Subnetting

Subnetting borrows host bits to carve one network into smaller ones. A subnet mask (e.g. 255.255.255.0, or /24) splits the address into network + host portions. Benefits: less broadcast traffic, better address use, simpler routing through aggregation.

IPv4 header

IPv6 basics

128-bit addresses, written as eight hex groups (2001:db8::1), give ~3.4×10³⁸ addresses. The header is fixed at 40 bytes and simpler than IPv4's: no checksum (left to lower layers), no fragmentation fields (only the source fragments).

IPv6 Next Header values

ICMP

The Internet Control Message Protocol is IP's error-reporting sidekick: destination-unreachable, time-exceeded (that's what traceroute exploits), echo request/reply (ping). It reports problems; it doesn't fix them.

8. Routing Algorithms

Distance Vector (RIP)

Each router keeps a vector of (destination, distance) and periodically shares it with neighbors. Bellman-Ford underneath. Simple, but slow to converge — and infamous for the count-to-infinity problem when a link dies. Fixes: split horizon, poison reverse, holddown timers.

Link State (OSPF)

Each router learns the full topology, then runs Dijkstra locally. The five steps:

1. Discover neighbors, learn their network addresses
2. Measure the cost (delay) to each neighbor
3. Bundle it into a link-state packet
4. Flood the packet to all routers
5. Compute the shortest path tree to every destination

Fast convergence, hierarchical areas to keep large networks manageable.

Path Vector (BGP)

The protocol of the internet backbone: inter-autonomous-system routing. Instead of raw distances, routers exchange full paths, which kills count-to-infinity and lets operators enforce policy ("don't route through AS X").

9. Transport Layer

The Transport Layer manages reliable data delivery between applications on different hosts: segmentation, port-based addressing, connection control, flow control, error control, and congestion control. It delivers end-to-end reliability regardless of what the network underneath does.

TCP — Transmission Control Protocol

TCP is connection-oriented and reliable: a byte stream with acknowledgments and retransmissions. Connections are point-to-point, with a sliding window for flow control.

• Connection establishment: three-way handshake (SYN → SYN-ACK → ACK).
• Connection termination: four-way handshake with FIN segments.
• Sequence numbers: every byte is numbered; the initial sequence number is randomized per connection.

Control flags: SYN, ACK, FIN, RST, PSH, URG.

Well-known TCP ports

TCP congestion control

Congestion control keeps the network from collapsing under load, balancing efficiency with fairness. The classic algorithm has four phases:

• Slow start: congestion window grows exponentially (doubling per RTT) to probe available capacity fast.
• Congestion avoidance: past the threshold, growth turns linear (additive increase) — one segment per RTT.
• Fast retransmit: three duplicate ACKs trigger immediate resend, no waiting for the timeout.
• Fast recovery: halve the window instead of dropping back to slow start.

TCP also runs four timers: retransmission (resend unacked segments), persist (probe a zero-window receiver), keepalive (check idle connections), and time-wait (linger after close so late duplicates die).

UDP — User Datagram Protocol

UDP is connectionless and unreliable — no handshake, no ordering, no flow or congestion control. What it buys is speed and simplicity: message-oriented datagrams with an 8-byte header.

Well-known UDP ports: DNS 53, DHCP 67/68, TFTP 69, SNMP 161, RIP 520.

10. Application Layer

The top of the stack: network services delivered directly to end-user applications — file transfer, email, web access, directory services. These are the protocols users actually touch.

DNS — Domain Name System

Translates human-readable names into IP addresses so nobody memorizes numbers. A hierarchical distributed database: root servers → TLD servers → authoritative servers. A lookup for example.com goes: local cache → root → .com TLD → authoritative server → IP back to you. Runs on UDP port 53 (TCP for zone transfers and large responses), with caching at every level.

BOOTP & DHCP

BOOTP let diskless workstations boot: broadcast a request with your MAC, get back an IP configuration. Static mappings, one server per network (relays forward across networks).

DHCP extends BOOTP with dynamic, leased addresses from a pool — the reason your phone just works on any Wi-Fi. The four-step dance (DORA):

1. Discover — client broadcasts "any DHCP server out there?"
2. Offer — server(s) respond with a proposed address
3. Request — client picks one and asks for it
4. ACK — server confirms, lease timer starts

HTTP — Hyper Text Transfer Protocol

The web's protocol: application-layer, client-server, running over TCP port 80. Stateless — each request stands alone (cookies and sessions are layered on top, not part of HTTP itself).

HTTP methods

HTTP connection types

FTP — File Transfer Protocol

Runs over TCP with two connections: port 21 carries commands and responses (control), port 20 carries the actual file data. Two modes for opening the data connection:

• Active: the server connects back to the client — simple, but client firewalls hate it.
• Passive: the client opens both connections — firewall-friendly, the modern default. Extended passive mode covers IPv6.

Relatives: TFTP (trivial FTP, port 69 — no authentication, tiny, used for booting devices) and SFTP (FTP tunneled over SSH, port 22 — not to be confused with FTPS, which is FTP over TLS).

SMTP, POP3, IMAP — email

SMTP (port 25, submission on 587) only sends mail — pushing messages between servers. MIME extends it to attachments and non-ASCII text. Reading mail is a different job:

This is why your phone, laptop, and webmail all show the same inbox: IMAP.

SSH — Secure Shell

Encrypted remote login and command execution on port 22 — the replacement for plaintext Telnet. Handles session management, strong authentication, and full encryption of everything in the session. Also the transport under SFTP and Git-over-SSH.

11. Network Security

Cryptography basics

• Plaintext — the original readable message
• Ciphertext — the encrypted, unreadable form
• Key — the secret that parameterizes the transformation

Types of cryptography

• DES: 56-bit key, 64-bit blocks. Broken by brute force — do not use.
• AES: 128-bit blocks with 128, 192, or 256-bit keys. The current standard.

Common hash algorithms

MACs and digital signatures

• MAC (Message Authentication Code): a keyed hash using a shared secret. Proves the message wasn't altered and came from someone holding the key.
• Digital signature: the sender signs the message digest with their private key; anyone verifies with the public key. Gives integrity, authentication, and non-repudiation — the sender can't deny sending it.

Eavesdropping

A passive attack: the attacker taps transmission lines and silently captures packets — no modification, so it leaves no trace. On a shared Ethernet segment, sniffing tools can harvest passwords, emails, and file transfers sent in plaintext. Targets: serial lines, Ethernet traffic, wireless transmissions, and any unencrypted protocol (HTTP, Telnet, FTP). Defense: encrypt everything in transit (HTTPS, SSH, VPN) and physically secure the infrastructure.

Firewalls, DoS & DDoS

Firewalls filter traffic at network boundaries by rules — what gets in, what stays out.

A Denial-of-Service attack targets availability, not data: flood the target with traffic, burn its CPU/memory/bandwidth, and legitimate requests starve. A Distributed DoS coordinates thousands of compromised machines (a botnet) at once — far harder to block, since there's no single source to filter. A botnet of 1000 machines each sending 100 requests/second is 100,000 requests/second — enough to flatten most web servers.

Common vectors: TCP SYN floods, UDP floods, HTTP request flooding, resource exhaustion (memory, disk). Defenses: rate limiting, traffic filtering, load balancing across servers, dedicated DDoS protection services.

← Back to all subjects