59

Interesting perspective and question! Yes, most of what UDP does is supply a standard means for multiple applications to co-exist using the same IP address, by defining the concept of UDP ports. The exciting part about UDP isn't so much the network protocol but the API implemented by operating systems and socket libraries. While not part of the UDP ...


45

UDP is a transport protocol, like TCP. That means it provides a protocol for an application to use IP. Like TCP, UDP has addressing (ports) to which applications bind so that datagrams destined to bound applications get sent by UDP to the correct applications. UDP for IPv4 also provides an optional checksum, but the checksum is required for IPv6. UDP is a ...


31

The receiver has to look at the Ethernet frame to decide its contents, which might be DECnet, Appletalk or many other things -- Internet Protocol is only one of many protocols running on top of Ethernet. When Ethernet was being designed, it wasn't obvious at all what protocols might exist in the future, and the winner-take-all effect wasn't obviously so ...


15

No, a TCP connection is uniquely identified by both source and destination IP and TCP (port) addresses. Changing any one of those will break the TCP connection (or prevent it from forming in the handshake). What you may be referring to is the fact that a web browser will form, use, and close multiple TCP connections with the web server. Each connection will ...


14

I would encourage you to look at how higher level protocols that utilize UDP actually use it. Classic and well documented examples are DNS (in most cases at least, it's possible to do DNS over TCP but it's really uncommon), DHCP, NTP, and PTP. All of these protocols have some specific things in common: They care about being able to coexist with other ...


12

First, TCP does not care about single packets. If these are just data packets without any previous connection establishment than they will be simply dropped, no sockets involved. So I'm assuming that this is about established connections, or initial packets to establish a connection. A TCP connection is defined at least by the 4 tuple of (src-ip, src-port, ...


9

I think you are confused about ARP requests. ARP requests are sent from a source host to the broadcast address, and every host on the broadcast domain will inspect the request. Only the host with the IPv4 address in the ARP request will reply. All other hosts on the broadcast domain will ignore the request. For a layer-2 broadcast domain, a router is just ...


9

We know that port 80 is just a welcoming port, when the web server reveives a http request, it create a new connection port(let's say 5000) That's not correct for the HTTP protocol. Some protocols, namely FTP, work similarly to that, but not HTTP. So my understanding is, the initial address of the client uses to send packet to the the server's ip address + ...


7

There's an important point that UDP does not require setting up a "connection". For example, it would be hard and complex, if not impossible, to implement DHCP on top of TCP, where a client has no IP address and zero knowledge of the existing network environment. It's therefore meaningless to "set up a connection", as the client doesn't ...


6

This is a fun question with a lot of history. Originally, the EtherType field indicated the length of the frame; not the type of payload. The relevant Wikipedia article contains a good explanation with references. MPLS is an example of a protocol which lacks a field indicating the payload type. This has important consequences! Although the devices at ...


6

Should TCP slow start be used with SIP-over-TCP? SIP does not transfer large data with TCP. SIP is only used for signaling, the transport of the actual data (voice, video, ...) is done with RTP and thus using UDP. The SIP messages are small enough to not be affected by slow start. The control flow of SIP is not affected either by slow start since messages ...


6

To me the key thing that UDP does is provide both source and destination port numbers and hence allow not just multiple different application protocols, but also multiple instances of the same application protocol. In principle you could build your application protocol directly on top of IP and obtain a protocol number for it. That works fine if you have ...


6

We know that port 80 is just a welcoming port, when the web server reveives a http request, it create a new connection port(let's say 5000) This seems to be the source of your misunderstanding. This is not accurate. The client picks a random high-number port as the source port when making the connection. This happens before the TCP SYN packet is sent, so it ...


5

The maximum size of an IPv4 packet is 65,535 because the Total Length field is a 16-bit unsigned integer, which has a possible 65,536 values (from 0 to 65,535). The maximum payload is 65,515 only if the header is 20. If the header is 60, then you must subtract 40 from that because the total packet size cannot exceed 65,535. IPv6 does it differently, using ...


5

In many cases, an ICMP error message contains the header of the packet that caused the error. Example: The ICMP Type3 Code 3 "Port Unreachable" response from a "server" (172.19.41.35) to an unsolicited UDP packet generated with iperf2 from a "client" (172.19.41.135) 1 The blue frame shows the packet that caused the error; the ...


4

I don't understand why it is only done for the side closing the connection. Remember that that when the first side sends a FIN, it is done sending, but it will still receive and process as long as the other side is willing to send, and sends ACKs for any segments received until the other side is done. It goes into the FIN-WAIT-1 state until it receives the ...


4

First, remember that the OSI model is just a model, and nothing in the real world follows it because the host/server OSes have not implemented it. Ports are addresses for some transport protocols to point to an application-layer process that has bound itself to the transport protocol. The ports are unique to each transport protocol that uses ports. For ...


4

No ,! Server destination port never changes its remain same in your scenario it's http port 80 . Application is hosted on port80 and services are listening on port 80 at destination server . When client requests accessing webserver on port 80 client will generate a souce port as per your example it is port 5000 and destination port is port 80 and port ...


3

Entries in an ARP table on modern OSes will time out. This is not an official part of RFC 826, An Ethernet Address Resolution Protocol, although the RFC does discuss it at the end: Related issue: It may be desirable to have table aging and/or timeouts. The implementation of these is outside the scope of this protocol. Here is a more detailed description (...


3

so my question is, how many packets can be send in the pipeline (what's the window size of TCP pipelined sending) There is no single answer for that. The window size changes as the receiver sends ACKs back to the sender. It is up to the receiver as to the window size, which is based on octets, not segments. RFC 793, Transmission Control Protocol explains: ...


3

And MSS is one of the parameters which is negotiated during the 3-way handshaking. No, the value is not negotiated, it is simply sent by one or both sides. Technically, do both sides need to agree on an MSS value (the lower value), or each can use their own? No, the sides do not need to agree, and each can have its own MSS. What a particular ...


3

Traceroute is not a protocol. It is an application that uses ICMP (Windows) or UDP (*nix) packets with short TTL values. It relies on ICMP error messages to determine the hops. VPN tunnels act as a single hop, so yes using the tunnel will affect your traceroute results.


3

Answering #2: Why are ASN 56779 and ASN 8905 repeated. The number of AS hops is a key factor in determining which path traffic takes. Lets say you are running a dual-homed enterprise with a 10-gig ISP connection and a 1-gig ISP connection. You want most ingress traffic to come in via the 10-gig connection. An easy way to achieve that is to "AS path ...


3

It offers multiplexing/demultiplexing services to the upper layers (App) so it can handle data from different processes. With the checksum, it will also bring you error detection. UDP, being such a simple protocol, is useful for upper layer protocols that prefer fast communication, without the need for establishing a connection or reliable data transfer. ...


3

An ICMP error message will contain the IP header and first 64 bits (eight octets) of the original data. See RFC 792, Internet Message Control Protocol: Internet Header + 64 bits of Data Datagram The internet header plus the first 64 bits of the original datagram's data. This data is used by the host to match the message to the appropriate process. If a ...


3

Your understanding is generally correct. The problems you face are mainly due to your assumption that things are better defined than they actually are. For example: What exactly is a network layer? Like many, many networking terms, there is no exact definition. There are only two models that try to define them (OSI and IP protocol Suite), and only one ...


3

The MSS is sent in the handshake, and it is the maximum size of a segment that the side sending it will receive. The window is sent in all the segments, and the sender of it is telling the other side how much data it will accept from the other side, even in multiple segments. The window size is constantly adjusted, based on what the receiver of the data can ...


3

But what if we eliminated this from the protocol. Then it would not be TCP. The point of flow control is that the receiving host has a buffer to receive data, and it is a fixed size. The receiver tells the sender what the available buffer space is left in the acknowledgements. As the receiving TCP receives data and fills the buffer, the window shrinks, and ...


3

RFC 6164, Using 127-Bit IPv6 Prefixes on Inter-Router Links explains that /127 networks are good for point-to-point links: Abstract On inter-router point-to-point links, it is useful, for security and other reasons, to use 127-bit IPv6 prefixes. Such a practice parallels the use of 31-bit prefixes in IPv4. This document specifies the motivation for, and ...


2

If I'm not mistaken, it looks like the confusion that the OP has is not with ordinary TCP data traffic once the TCP connection is established, but the TCP control signaling. The OP writes before sending information, TCP has to establish a connection with another host which looks like the context, followed by: So, does the request from TCP get encapsulated ...


Only top voted, non community-wiki answers of a minimum length are eligible