ISO Layers and Protocols

The ISO-OSI 7 layer Reference Model (officially known as ISO Standard 7498, 1984, 7498-1:1994. and CCITT standard X.200) was developed by the Internet Architecture Board and drafted by the IETF.

“It provides a common basis for the coordination of standards development for the purpose of systems interconnection, while allowing existing standards to be placed into perspective within the overall Reference Model. The model identifies areas for developing or improving standards. It does not intend to serve as an implementation specification.”

Topics this page:

Related:

Site Map  
About this site  

Homer Simpson asks “Welcome to the Internet, my friend. How can I help you?”

The table above show how the OSI model corresponds to the 4 Layers of the 1981 TCP/IP Core Transport Prototol Conceptual model. Both provide virtual connections this way:



• Each layer uses the services of the layer below it to transparently send data to a peer layer in a receiving machine. This conceptually hides the technical intricacies of lower layers.
• Headers are appended (added) to each data package (service data units) by each middle layer.
• Headers are removed by the same layer in the receiving computer.

These models provide a common basis for various vendors to use in describing how their products conceptually fit with other products already on the market. For example, IPSec runs at Layer 3, so can carry only IP packets.
PPTP and L2TP run at Layer 2, so they can carry packets from other protocols (the set of rules governing communication between technical components).

Cisco calls the upper 4 OSI layers the Host layers responsible for accurate data delivery between end devices.
Cisco calls the lower 3 OSI layers the Media layers responsible for physical delivery of data over the network.

Application Layer

Among the 1,024 ports historically assigned by the IANA and tracked by Portsdb.org, Richard Ackerman, Network Ice, and Neohapsis:

Server Service	Port
FTP data to client	20
FTP for binding	21
TFTP	69 ?
Secure Shell (SSH)	22
Telnet remote logins	23
SMTP	25
time	37
SIMAP (IMAP over SSL)	993
SSMTP (SMTP over SSL)	465
DNS [RFC 1034 & 1035]	53
DHCP	68
Whois	43
Finger	79
HTTP Server	80
Auth	113
POP3	110
SPOP3 (POP3 over SSL)	995
NNTP Network News Transfer Protocol	119
RPC	135,139,445
RMI registry	1099
NetBIOS session service	137 - 139
Direct Host (NetBIOSv2)	TCP/UDP 445
IMAP	143
SQLSRV	156
AD-LDAP	389
LDAP	1002
NIX-specific ports	443
HTTPS (SSL)	512 - 515
HTTP HTML Browsers	1210
SOCKS Proxy server	1080
NIX-based NFS	2049
mySQL	3306
Oracle	1521
PnP	5000
IRC	6667
Web caching proxy servers	8080
Total	65,536 ports (16 bit numbers)

To check ports used, use netstat -a .

Function	Command or Diagnostic	NT Server Service	Winnt\ System32\ Files
My 15 user/16 system char. NetBIOS Name with seg. Scope ID	NBTSTAT -N HOSTNAME	Name Registration Request, Response, Renewal, Release
My IP Address, Subnet, Gateway?	IPCONFIG /all Return of subnet 0.0.0.0 indicates a duplicate address
Register, Renew, Release associations of IP Address with NetBIOS Name	NET USE X: \\server\ ... UNC NBTSTAT -R to puRge, -C to show, then CP, Services, Tools, WINS Manager, Mappings, Show Database	Local cache WINS Windows Internet Name Server (an RFC 1001/2 NetBios Name Server) sends an internet group (of up to 25 domain names) to clients Dynamic file Wins\ Wins.mdb, Winstmp.mdb, J50.log, J50.chk Local network broadcast Static Drivers\Etc\ LMHOSTS.SAM <IP address of> <master browser server NetBIOS name> #PREload #DOM: <remote PDC & BDC NetBIOS name>
local or remote Hostname (Fully Qualified Domain Name) to IP Address	NSLOOKUP <hostname> gives DNS server & IP address for PING <hostname>	same as local? local (UNIX) HOSTS. file DNS Server (requested at 5, 10, 20, 40, 5, 10, 20 seconds) resolved iteratively by domain. File CACHE.DNS WINS NetBIOS-IP cache Local network Broadcast
Network to local network Domain ID's	-	-	NETWORKS.
TCP/IP and IPX/SPX binding to NIC MAC addresses	ARP	NWLINK CSNW Client Services for NetWare	PROTOCOL. (RPF 1060)
Service name to Sockets Port Name	NETSTAT	-	SERVICES.

Presentation Layer

Session layer

Windows 2000 uses WinSock sockets.

Session layer manages checkpoints to limit re-transmission (which improves thruput).

Transport layer

1. Initiating host sends data segment with synchronization SYN flag = on
2. Receiving host acknowledges with a segment having
   • SYN=on
   • Acknowledged Sequence number of the starting byte for a segment it may send.
   • ACK byte sequence number of the next segment it expects to receive.
3. Requesting host sends back a segment with the acknowledged sequence number and ACK number.

in order to guarantee the delivery of packets, in the proper sequence, AND provides a checksum feature that validates both the packet header and its data for accuracy.

To reduce the impact on performance, most hosts send an acknowledgment for every other segment.

Netmon Sniffers capture data that travels across the network as packets, each contain:

• Source address
• Destination address
• Protocol headers
• The actual data payload
• A cyclical redundancy check, or CRC

HKLM\System\Servicse\NBF\Parameters


The NBF is for NetBIOS Frame — Microsoft's implementation of NetBEUI v3, which overcomes the original 254-session connection limit.

DLC (Data Link Control protocol) used by HP JetDirect cards. It is reroutable on TCP/IP networks.

UDP (User Datagram Protocol) [RFC 768] supplies IP address & port number of destination makes for a connection-less oriented link with no guarantees that packets were delivered. This is used by applications that don't require ACK of receipt of (usually small amounts of) data. This is faster because of no acknowledgement overhead.

UDP port 137 - NetBIOS-NS name service

UDP Port 138 - NetBIOS-DGM datagram service

UDP Port 69 - TFTP Trivial FTP

UDP Port 15 - NETSTAT to view a list of all current TCP/IP connections

UDP port 161 - Under SNMP Simple Network Management Protocol methods, agents (wiring hubs, routers, bridges) act as traps to store information about significant events in a MIB (Management Information Base). SNMP managed devices respond to polling from a Microsoft SMS Systems Management Server in its SNMP community or generate interrupt messages.

UDP port 162 - SNMP traps received.

UDP Header Packet Structure: Source Port, Destination Port, Message Length, Checksum

Network Internet Layer 3

Encapsulates packets into datagrams (small network-transportable packets) using routing algorithms.

Concerned with routing -- addressing and looking for the best path on which to send information.

Prioritizes data and other Quality of Service (QoS) functions.

• Gateways: Max 126 character URL Domain name
  • ping IPaddress to verify connections (127.0.0.1 loopback to itself)
  • Use ROUTE.EXE to configure static gateways.
  • route -add [destination network address] mask [netmask] [gateway].
  • RIP Routing Internet Protocol and OSPF Open Shortest Path First are two common routing protocols
• Diskless workstations send RARP Reverse Address Resolution Protocol requests to find IP addresses for a known MAC address.
• When a host requests communications to be initiated, ARP (Address Resolution Protocol [RFC 826]) obtains hardware MAC (Media Access Control) addresses of destination hosts by examining subnet mask, Routing table, default gateway.
  To collect data packets to analyse them with a spreadsheet program, use Performance Monitor.
  
  1. ARP checks the subnet mask to see if the address is local or remote.
  2. If Local
     1. host ARP checks own cache for the address of the destination host. NT maintains a separate ARP cache for each IP address requested:
        • Dynamic entries have a potential lifetime of 10 minutes but are automatically deleted after 2 minutes unless Registry parameter ARPCacheLife overrides this default # of Seconds.
        • Static entries remain in cache until computer is restarted
          To manually check the cache: arp -a or arp -g
          To add a static entry to the ARP cache:
          arp -s IPaddress MACaddress
        • Entry can be manually deleted with arp -d
     2. ARP uses address FF FF FF FF FF FF to broadcast a request for the address to all local hosts on the same physical node
     3. Each host on the local network reads the broadcast and ignores it if it doesn't own the IP address requested. If the host sees that it owns the IP address requested, the host sends its hardware address in a reply to the source host.
  3. If Remote
     • Address Resolution:
       1. Source host checks its local ARP routing table for a route to the destination host or network.
       2. If no mapping is found, ARP broadcasts a request to default gateways. If a gateway router responds with the destination host's address, ARP sends the data packet to the responding router. The router then does its own Resolution.
       3. After destination host receives the request, it formulates an ICMP echo reply vice versa.
     • To manually retrieve system information from a remote computer, finger a remote IP address which supports the finger service.
     • To determine what route a packet takes to get from the source to the destination, use Windows TRACERT or UNIX traceroute or Net.Medic from Vital Signs Software.

  4. ICMP (Internet Control Message Protocol [RFC 792] by Jon Postel specifies the Error and Query IP datagrams sent by a gateway:
     • responding to a Ping Echo Request with an Echo reply (The default ping packet-size is set to 64 bytes)
     • or host reporting Destination Unreachable errors
     • reporting IP datagrams (Time Exceeded) timeout (TTL=zero)
     • redirecting hosts to use a router with a better path
     • responding to network congestion by requesting flow control Source Quench to a Host to slow down rate of transmission But multihomed NT's with several NIC cards used as Routers drop packets and do not send Source Quench messages!

       Note: ICMP messages are not generated concerning multicast frames.

       ICMP Type Numbers assigned by IANA

  5. IGMP (Internet Group Management Protocol [RFC 1112] is used by IP hosts to send (unreliable) IP datagrams to inform multicast routers that hosts of a specific multicast group are available on a given network.

Data Link
Layer 2

Organizes raw data into a logical structure of frames (addressable units of information) thru NIC's fed by Switches and Bridges.

Concerned with physical (as opposed to network logical) addressing, network topology, line discipline (how end systems will use the network link),

data transmission synchronization: ordered delivery (sequencing) of frames,

Flow control: waits for a positive ACK.

Performs error notification.

Physical
Layer 1

Signal Encoding: Puts raw data bits on the wire and pulls them off the transmission medium.

Cables, Connectors, Terminators, Transeivers, Repeaters, Passive Hubs, Active Hubs, Switches send data to specific lines

Controls the transmission technique, pin layout, and connector type.

Concerned with voltage levels, data rates, timing of voltage changes.

Cabling

• 1972-3, Robert Metcalfe (later co-founder of 3Com) and colleagues at the Xerox Palo Alto Research Center (PARC) designed and announced the first Ethernet network, named the ALTO ALOHA Network.
• September 1980: Ethernet II 10base5 thicknet thick coax from 2.5 m to 500 m (8.25 to 1,650 feet) The BNC (British Naval Connector) connectors are attached with vampire taps . Transceiver box with Male DIX connectors attach to the server.
• 1985: 10base2 thinnet IEEE 802.3 thin coax from 2.5 m to 180 m (1992 RFC 1340) bus topology of RG-58AU coaxial cable threads with no more than 30 devices (T-connectors) and electrical Continuity of 50 ohms with a 50 ohm resistor terminator at each end (of which ONLY ONE is earthed). (25+ Ohm impedence between center & shell of T connectors) Minimum 1 meter and maximum 300 meters per cable segment. Volt meters should see -.9 to -1.2 for carrier sense. Variation from this indicates that one or more cards are ignoring the carrier signal. high = -.2 to -.5, low = -1.6 to -1.9, -1.7v on streaming (continuously sending) NIC's. Noise should be lower than 0.04v per cable segment when all workstations are turned off.
• For both types: Max 4 repeaters (3 with nodes) among 5 segments.
• 10 Mbps (10baseT) star Hub with (using only lines 1,2,3,6 of) RJ-45 connectors and 22, 23, or 26 AWG American Wire Guage EIA Electrical Industries Association Category 5 data grade UTP Unshielded Twisted Pair cables carrying 85 to 110 ohms as individual segments.
• 100 Mbps VG Voice Grade AnyLAN of 4 pairs (8 lines) of cat 3-5 UTP max. 250 meters to a cascaded star topology. Uses demand 2 priority access and supports Token Ring packets.
• 100 Mbps (100baseT4) VG Voice Grade AnyLAN of 4 pairs (8 lines) of cat 3-5 UTP max. 250 meters to a cascaded star topology. Uses demand 2 priority access and supports Token Ring packets.
• 100baseTX of two pairs cat 5 UTP
• 10baseFL to Fiber Optic star Hub concentrators of up to 1,024 segments max. 2,000 meters each
• Segmentation
• Monitor traffic and TCP/IP statistics with command NETSTAT -e -s
• IEEE 802.3z and 802.3ab standards for Gigabit Ethernet have been finalized.

• Serial lines (RFC 1055) (with modems) over dial-up, digital, or leased lines.
  NT4 doesn't support obsolete UNIX SLIP Serial Line Internet Protocol clients PPP Point to Point datalink protocol [RFC 1547 & 1661] is more secure. L2F. L2TP (Level 2 Tunneling Protocol) [ RFC 2661] supported by Win2K is even better. IANA parameters
  modems
• Packet-switched networks:
  • X.25
  • Frame Relay
  • ATM Asynchronous Transfer Mode constantly transmits delay-sensitive audio, video, data in cells of 53 octets (5 octet header) over fiber optic or copper between switched PPP circuits of a IEEE 802.9 BISDN Broadband Integrated Services Digital Network mbone. Programmers use CAPI to access ISDN cards.
  AS/400 Connectivity

Network Speeds

For More Information ...

Take the Brainbench certification test

• These notes relate to skills being measured in the MCSE TCP/IP Exam.
• RFC's Requests For Comments listed on the IAB Internet Architecture Board Official Protocol Standard
  • Classifications: Required, Recommended, Elective, Limited Use, Not Recommended
  • Maturity Levels: Proposed, Draft, Standard
• Cisco Systems' Internetworking Technology Overview and Troubleshooting Guide, and Glossary
• Patrick de Boer's Architectural Overview
• Essentials of Networking slide show
• OSPF Authentication codes defined by IANA