2.3 Transport & Application Layer Protocols

Transport & Application Layer Protocols & Services

While the Network Layer delivers packets host-to-host across internetworks, the Transport Layer (Layer 4) delivers data process-to-process between specific applications. Building directly upon transport capabilities, Application Layer (Layer 7/5) protocols provide the high-level services—including web browsing, name resolution, automated addressing, and remote administration—that define modern enterprise IT environments.

---

1. Transport Layer Protocols: TCP vs. UDP

The two workhorse protocols of the Transport Layer are the Transmission Control Protocol (TCP) and the User Datagram Protocol (UDP). Each provides a different set of trade-offs between reliability, overhead, and latency.

+-----------------------------------------------------------------------------------------+
|                           TCP 3-WAY HANDSHAKE & TERMINATION                             |
|                                                                                         |
|   [CLIENT]                                                       [SERVER]               |
|      |                                                              |                   |
|      | -------- 1. SYN (Seq = 100, Flags = SYN) ------------------> | (Listens on port) |
|      |                                                              |                   |
|      | <------- 2. SYN-ACK (Seq = 300, Ack = 101, Flags = SYN,ACK) -| (Synchronizes)   |
|      |                                                              |                   |
|      | -------- 3. ACK (Seq = 101, Ack = 301, Flags = ACK) -------> | (ESTABLISHED)     |
|   (ESTABLISHED)                                                     |                   |
|      |                                                              |                   |
|   [DATA TRANSFER PHASE (Sliding Window Flow Control, Checksums, Ordered Sequencing)]   |
|      |                                                              |                   |
|      | -------- 4. FIN (Flags = FIN,ACK) -------------------------> |                   |
|      | <------- 5. ACK (Flags = ACK) -------------------------------|                   |
|      | <------- 6. FIN (Flags = FIN,ACK) ---------------------------|                   |
|      | -------- 7. ACK (Flags = ACK) -----------------------------> | (CLOSED)          |
+-----------------------------------------------------------------------------------------+

Transmission Control Protocol (TCP - RFC 793)

TCP is a connection-oriented, stateful protocol that guarantees the reliable, in-order delivery of data streams:

• The 3-Way Handshake: Before transmitting data, TCP establishes an active virtual connection between client and server:
  1. SYN (Synchronize): The client sends a segment with the SYN flag set and an Initial Sequence Number (ISN).
  2. SYN-ACK: The server responds with SYN and ACK flags set, acknowledging the client's ISN (Ack = ISN + 1) and providing its own ISN.
  3. ACK: The client sends an ACK acknowledging the server's ISN. The socket transitions to ESTABLISHED.
• Connection Termination (4-Way Handshake): Either endpoint initiates a graceful teardown by sending a segment with the FIN (Finish) flag, which is acknowledged by the peer with an ACK, followed by a FIN from the peer and a final ACK.
• Ordered Sequencing & Acknowledgment: Every byte transmitted is assigned a 32-bit sequence number. If segments arrive out of order, the receiver reassembles them in correct sequence; if a segment is dropped in transit, the sender detects the missing ACK and retransmits it.
• Flow Control (Sliding Window): The receiver advertises a Window Size in its header, informing the sender how many bytes of buffer space are currently available, preventing fast senders from overwhelming slow receivers.
• Congestion Control: Algorithms (e.g., Slow Start, Congestion Avoidance) monitor packet loss to dynamically throttle throughput across congested WAN links.

User Datagram Protocol (UDP - RFC 768)

UDP is a connectionless, lightweight protocol that provides best-effort datagram delivery with minimal protocol overhead:

• No Handshake / No State: UDP transmits datagrams immediately without establishing a prior connection or maintaining session state.
• No Retransmission / No Sequencing: UDP does not acknowledge receipt, reorder out-of-sequence datagrams, or retransmit lost packets. Any error recovery must be implemented by the application itself.
• Minimal Overhead: A UDP header is fixed at only 8 bytes (Source Port, Destination Port, Length, Checksum), compared to TCP's variable 20–60 byte header.
• Ideal Applications: Real-time communications where low latency is critical and dropped packets are preferable to buffering delays: VoIP (Voice over IP), video streaming, online multiplayer gaming, DNS queries, DHCP, NTP, and SNMP.

Comprehensive TCP vs. UDP Comparison Matrix

---

2. Port Numbers & Socket Architecture

A Network Socket is the endpoint of a two-way communication link across a network, defined by the combination of an IP Address and a Port Number (e.g., 192.168.1.50:443). Port numbers are 16-bit unsigned integers ranging from 0 to 65535 that allow an operating system to multiplex concurrent network traffic among hundreds of running applications.

+-----------------------------------------------------------------------------------------+
|                            PORT NUMBER RANGE CLASSIFICATION                             |
|                                                                                         |
|   [0 ---------------- 1023]    [1024 ---------------- 49151]    [49152 -------- 65535]  |
|     WELL-KNOWN PORTS              REGISTERED PORTS                DYNAMIC / EPHEMERAL   |
|     (System / Root services)      (Vendor / App services)         (Client OS outbound)  |
|     HTTP(80), HTTPS(443),         MySQL(3306), RDP(3389),         Short-lived source    |
|     SSH(22), DNS(53), DHCP(67)    PostgreSQL(5432), SIP(5060)     ports for clients     |
+-----------------------------------------------------------------------------------------+

Essential Enterprise Ports & Protocols Table

---

3. Domain Name System (DNS) Resolution Mechanics

The Domain Name System (DNS) is the distributed, hierarchical database that resolves human-memorable Fully Qualified Domain Names (FQDNs, such as www.example.com) into computer-routable IP addresses (93.184.216.34 or 2606:2800:220:1:248:1893:25c8:1946).

+-----------------------------------------------------------------------------------------+
|                                 THE DNS HIERARCHY TREE                                  |
|                                                                                         |
|                                     [ . (Root Zone) ]                                   |
|                                    /        |        \                                  |
|                              [ .com ]    [ .org ]    [ .edu ]    (Top-Level Domains)    |
|                                 /           |                                           |
|                         [ google.com ]  [ wikipedia.org ]        (Second-Level Domains) |
|                           /        \                                                    |
|                  [ www.google.com ] [ mail.google.com ]          (Subdomains)           |
+-----------------------------------------------------------------------------------------+

The Step-by-Step DNS Lookup Process

1. Local Cache Check: The client OS checks its local memory cache and local hosts file. If unresolved, the client generates a Recursive DNS Query to its configured Recursive DNS Resolver (usually provided by the ISP or corporate network, e.g., 8.8.8.8).
2. Root Name Server Query: If the recursive resolver does not have the record cached, it performs an Iterative Query to one of the 13 global root name server clusters (named a.root-servers.net through m.root-servers.net). The root server responds with a referral to the Top-Level Domain (TLD) Name Servers responsible for .com.
3. TLD Name Server Query: The recursive resolver queries the .com TLD server. The TLD server responds with a referral to the Authoritative Name Server responsible for example.com (e.g., ns1.example.com).
4. Authoritative Name Server Query: The resolver queries the Authoritative Name Server, which holds the official zone records. The authoritative server returns the final A or AAAA IP address mapping.
5. Caching and Client Delivery: The recursive resolver caches the record according to its configured Time to Live (TTL) value and returns the final IP address to the client.

Essential DNS Resource Record Types Matrix

---

4. Dynamic Host Configuration Protocol (DHCP) & Address Leasing

The Dynamic Host Configuration Protocol (DHCP) automates the assignment of IP addresses, subnet masks, default gateways, DNS servers, and NTP time sources to client devices connecting to a network. DHCP operates via UDP using Server Port 67 and Client Port 68.

+-----------------------------------------------------------------------------------------+
|                                 THE DHCP DORA WORKFLOW                                  |
|                                                                                         |
|   [CLIENT (0.0.0.0:68)]                                        [DHCP SERVER (:67)]      |
|             |                                                           |               |
|             | ===== 1. DHCP DISCOVER (Broadcast 255.255.255.255) =====> |               |
|             |          "Who is a DHCP server? I need an IP address!"    |               |
|             |                                                           |               |
|             | <==== 2. DHCP OFFER (Unicast/Broadcast) ================= |               |
|             |          "I offer 192.168.1.100, Mask /24, Gateway .1"    | (Reserves IP) |
|             |                                                           |               |
|             | ===== 3. DHCP REQUEST (Broadcast 255.255.255.255) ======> |               |
|             |          "I accept Server 192.168.1.1's offer of .100!"   |               |
|             |                                                           |               |
|             | <==== 4. DHCP ACKNOWLEDGE (Unicast/Broadcast) =========== | (Binds Lease) |
|             |          "Confirmed! Lease is active for 8 days."         |               |
+-----------------------------------------------------------------------------------------+

The 4-Step DORA Process

1. Discover (DHCPDISCOVER): The unconfigured client broadcasts a UDP packet to 255.255.255.255 on port 67 (with source IP 0.0.0.0 and source port 68), requesting an IP lease.
2. Offer (DHCPOFFER): Available DHCP servers on the subnet receive the broadcast and respond with an offer containing an available IP address, subnet mask, default gateway, DNS server IPs, and lease duration.
3. Request (DHCPREQUEST): The client broadcasts a formal acceptance of the specific server's offer, alerting any other DHCP servers that made simultaneous offers to release their reserved addresses back into their pools.
4. Acknowledge (DHCPACK): The selected DHCP server sends an acknowledgment confirming the lease, binding the IP address to the client's MAC address in its lease database.

DHCP Architecture Components

• DHCP Scope (Pool): The configured range of contiguous IP addresses available for dynamic distribution (e.g., 192.168.1.100 to 192.168.1.200).
• Exclusions: Specific addresses within a scope omitted from dynamic distribution, reserved for static assignment (e.g., printers, routers, servers).
• DHCP Reservation (Static IP Mapping): A permanent mapping binding a specific IP address to a client's 48-bit hardware MAC address, ensuring the device always receives the same IP while remaining dynamically managed.
• Lease Time & Renewal: The duration for which an address assignment is valid. At 50% of lease expiration (T1 timer), the client sends a unicast DHCPREQUEST to the leasing server to renew. If unacknowledged, at 87.5% (T2 timer), the client broadcasts to any available DHCP server.
• DHCP Relay Agent (IP Helper): Routers do not forward broadcasts. In enterprise networks with centralized DHCP servers located on separate subnets, a router or switch interface must be configured as a DHCP Relay Agent (e.g., Cisco ip helper-address), converting incoming Layer 2 broadcast DHCPDISCOVER packets into unicast packets routed directly to the central DHCP server.

---

5. Network Address Translation (NAT) & Port Address Translation (PAT)

Because private RFC 1918 IPv4 addresses cannot be routed across the public Internet, enterprise edge firewalls and SOHO routers perform Network Address Translation (NAT) to translate private internal addresses into publicly routable IP addresses.

+-----------------------------------------------------------------------------------------+
|                    PORT ADDRESS TRANSLATION (PAT / NAT OVERLOAD)                        |
|                                                                                         |
|   Internal Private Network               Edge Router / NAT Gateway        Public Internet|
|   +-----------------------+              +------------------------+      +--------------+|
|   | Host A:               |              | Public WAN IP:         |      | Web Server:  ||
|   | 192.168.1.10:52100 ---+-----\        | 203.0.113.5            |      | 93.184.216.34||
|   +-----------------------+      |       +------------------------+      | Port: 443    ||
|                                  +=====> | NAT TRANSLATION TABLE  | ===> +--------------+|
|   +-----------------------+      |       | Priv IP:Port  Pub Port |                     |
|   | Host B:               |-----/        | .1.10:52100 -> :40001  |                     |
|   | 192.168.1.20:52100 ---+              | .1.20:52100 -> :40002  |                     |
|   +-----------------------+              +------------------------+                     |
+-----------------------------------------------------------------------------------------+

Flavors of NAT:

1. Static NAT: A permanent 1-to-1 mapping between an internal private IP address and a dedicated external public IP address. Commonly used to expose internal servers (e.g., an internal web server at 10.0.0.10 mapped to public 203.0.113.10).
2. Dynamic NAT: A 1-to-1 mapping where private IPs are dynamically assigned an available public IP from a pool of registered public addresses on a first-come, first-served basis.
3. Port Address Translation (PAT / NAT Overload): A many-to-1 mapping where thousands of internal hosts sharing private IP addresses are multiplexed across a single public IP address. The NAT router tracks connections in a state table by assigning a unique source port number to each outbound flow. When return traffic arrives on that specific port, the router translates the destination port and IP back to the original internal host.