Computer Networks Study Notes

Hamming Code can detect and correct single-bit errors. Redundant bits (r) are placed at positions 2^0, 2^1, 2^2, ... Each redundant bit checks specific data bits.

Formula: 2^r ≥ m + r + 1 (where m = data bits, r = redundant bits)

            Sender: |Frame 0|Frame 1|Frame 2|Frame 3|Frame 2|Frame 3|

            Receiver: |—ACK 0—|—ACK 1—|—Discard—|—Discard—|

            (Frame 2 lost → ACK 2 never received → Sender times out → retransmits Frame 2 & 3)

            Sender Window (size 4): [0, 1, 2, 3] → slides right on each ACK

            Receiver Window (size 4): [0, 1, 2, 3] → accepts frames within window


            If Frame 2 is lost: Receiver buffers 3, 4. Sender retransmits only 2.

            After 2 received: receiver delivers 2, 3, 4 in order to network layer.

IPv4 (Internet Protocol version 4) uses 32-bit addresses written in dotted decimal notation (e.g., 192.168.1.1). It provides ~4.3 billion unique addresses.

Class A: 0xxxxxxx (1.0.0.0 – 126.255.255.255) /8, 16.7M hosts
Class B: 10xxxxxx (128.0.0.0 – 191.255.255.255) /16, 65K hosts
Class C: 110xxxxx (192.0.0.0 – 223.255.255.255) /24, 254 hosts
Class D: 1110xxxx (224.0.0.0 – 239.255.255.255) — Multicast
Class E: 1111xxxx (240.0.0.0 – 255.255.255.255) — Reserved

Subnetting divides a large network into smaller logical sub-networks (subnets) by borrowing bits from the host portion of the IP address. Benefits: reduced traffic, easier management, improved security.

CIDR (Classless Inter-Domain Routing) represents IP addresses as a prefix (e.g., 192.168.1.0/24). It eliminates class boundaries and allows flexible allocation of address blocks. Notation: IP address / prefix length.

VLSM (Variable Length Subnet Mask) allows different subnets to use different subnet masks within the same network. Enables efficient IP address allocation by using smaller subnets where fewer hosts are needed.

IPv6 uses 128-bit addresses (written in hexadecimal groups, e.g., 2001:0db8:85a3::8a2e:370:7334). Provides ~3.4 × 10^38 addresses. Built-in IPSec, simplified header, no broadcast (uses multicast/anycast).

ARP (Address Resolution Protocol) maps a known IPv4 address to its MAC address. When a host needs to send a packet, it broadcasts an ARP request asking "Who has IP X.X.X.X? Tell Y.Y.Y.Y". The owner replies with its MAC address.

RARP (Reverse ARP) maps a known MAC address to its IP address. Used by diskless workstations at boot time to discover their own IP address. Largely replaced by BOOTP and DHCP.

ICMP (Internet Control Message Protocol) is used for diagnostic and error-reporting in IP networks. Tools: ping (ICMP Echo Request/Reply), traceroute (ICMP Time Exceeded). ICMP messages include Destination Unreachable, Time Exceeded, Redirect, etc.

NAT (Network Address Translation) translates private IP addresses to public IP addresses (and vice versa) at the router. Types: Static NAT (1:1 mapping), Dynamic NAT (pool of public IPs), PAT (Port Address Translation / NAT Overload — multiple private IPs share one public IP using different port numbers).

DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses and network configuration to hosts. Uses DORA process: Discover → Offer → Request → Acknowledge. Port 67 (server), Port 68 (client).

Physical Layer: Repeater, Hub (regenerate signals, broadcast to all ports)
Data Link Layer: Bridge, Switch (filter by MAC address, forward to correct port)
Network Layer: Router (forward packets based on IP address, connect different networks)
Application Layer: Gateway (protocol conversion between different network architectures)

The Default Gateway is the IP address of the router that a host uses to send packets to destinations outside its local network. It is the next hop for all packets not destined for the local subnet.

Classful Addressing: IP addresses divided into 5 classes (A-E) with fixed boundaries. Problems:
— Class A wastes millions of addresses for small organizations
— Class C limited to 254 hosts
— No flexibility for medium-sized networks needing, say, 1000 hosts

CIDR Solution: Classless addressing using prefix notation. E.g., 200.10.5.0/23 gives 2^(32-23) = 512 addresses (510 usable).

            Client → Broadcast: DHCPDISCOVER

            Server → Client: DHCPOFFER (IP: 192.168.1.100)

            Client → Broadcast: DHCPREQUEST

            Server → Client: DHCPACK (Lease confirmed, time: 86400s)


            Lease renewal at T1 (50% of lease time) and T2 (87.5%)

            Release: Client sends DHCPRELEASE when disconnecting.

            Slow Start (exponential): cwnd: 1 → 2 → 4 → 8 → 16 → 32 → 64

            Congestion Avoidance (linear): 64 → 65 → 66 → 67 → 68 → 69 …

            On 3 dupACKs: ssthresh = cwnd/2, cwnd = ssthresh + 3

            On Timeout: ssthresh = cwnd/2, cwnd = 1 (restart Slow Start)

Client → Server: SYN (seq = x, ISN_x)

            Server → Client: SYN-ACK (seq = y, ISN_y; ack = x+1)

            Client → Server: ACK (seq = x+1; ack = y+1)


            Connection ESTABLISHED — data transfer begins

Client → Server: FIN (seq = u) — "I'm done sending"

            Server → Client: ACK (ack = u+1) — "Got your FIN"

            [Server can still send data to Client — half-closed state]

            Server → Client: FIN (seq = v) — "I'm done too"

            Client → Server: ACK (ack = v+1) — "Got your FIN"


            Connection CLOSED after TIME_WAIT (2MSL)

            Rate r = 1 token/ms, Bucket size b = 10 tokens

            After 10ms of silence: 10 tokens accumulated

            Can now send 10 packets instantly (burst of 10)

            Then limited to 1 packet per ms (steady rate)

            
 Client (A)                    Server (B)
    |                               |
    |── SYN (seq=x) ──────────────→|
    |                               |  SYN_SENT → SYN_RCVD
    |←── SYN-ACK (seq=y, ack=x+1) ─|
    |                               |
    |── ACK (seq=x+1, ack=y+1) ───→|
    |                               |  ESTABLISHED
    |==== DATA TRANSFER ===========|
            

HTTP (HyperText Transfer Protocol) is the application layer protocol for the World Wide Web. Uses port 80 (HTTP) or 443 (HTTPS). It is stateless — each request is independent.

HTTPS (HTTP Secure) is HTTP over SSL/TLS. Uses port 443. Provides encryption, server authentication, and data integrity. Prevents eavesdropping and tampering.

DNS (Domain Name System) translates human-readable domain names (www.google.com) to IP addresses (142.250.185.14). Uses a hierarchical distributed database. Port 53 (TCP for zone transfers, UDP for queries).

SMTP (Simple Mail Transfer Protocol) is used for sending emails between mail servers. Port 25 (plain), 465 (SMTPS/SSL), 587 (STARTTLS). Uses TCP (reliable delivery required).

POP3 (Post Office Protocol v3) is used by email clients to retrieve emails from a mail server. Downloads and typically deletes from server. Port 110 (plain), 995 (POP3S). Simple, offline access.

IMAP (Internet Message Access Protocol) is a more advanced email retrieval protocol. Keeps emails on the server, allows multiple device access, supports folders. Port 143 (plain), 993 (IMAPS).

FTP (File Transfer Protocol) transfers files between client and server using two connections: Control (port 21, TCP) and Data (port 20, TCP). Modes: Active (server connects to client) and Passive (client connects to server).

Active FTP: Server connects to client's data port (problematic with firewalls/NAT). Passive FTP: Client connects to server's data port (better for firewalls/NAT — client initiates all connections).

Telnet is a remote login protocol (port 23) that allows a user to log into a remote host and execute commands. It is unencrypted — all data including passwords is sent in plaintext. Replaced by SSH for security.

SSH (Secure Shell) is a secure remote login protocol (port 22). Provides encrypted communication, strong authentication (password + public key), and secure file transfer (SCP, SFTP). Replaces insecure Telnet and FTP.

SNMP (Simple Network Management Protocol) is used for monitoring and managing network devices. Uses a manager-agent model. Port 161 (queries), 162 (traps). Versions: SNMPv1, SNMPv2c, SNMPv3 (with security).

A Firewall is a network security device that monitors and filters incoming/outgoing traffic based on predetermined security rules. Types: Packet Filter, Stateful Inspection, Application Proxy, Next-Generation Firewall (NGFW).

SSL (Secure Sockets Layer) and TLS (Transport Layer Security) are cryptographic protocols that provide secure communication over a network. TLS is the modern successor to SSL. They use asymmetric encryption for key exchange and symmetric encryption for data transfer.

DNS Resolution Process: Converting www.example.com → IP address involves a hierarchical lookup through DNS servers.

            1. Client queries Local DNS Server (recursive query)

            2. Local DNS queries Root Server (iterative) → ".com" TLD servers

            3. Local DNS queries .com TLD server (iterative) → "example.com" authoritative server

            4. Local DNS queries example.com authoritative server → gets IP (93.184.216.34)

            5. Local DNS returns IP to Client

            6. Client connects to 93.184.216.34:80

Feature	POP3	IMAP
Port (plain)	110	143
Port (SSL)	995	993
Message Storage	Downloads to client, deletes from server	Keeps on server, syncs with client
Multi-device	No (email on one device)	Yes (sync across devices)
Folders	Limited (local only)	Full folder support on server
Offline Access	Yes (all mail downloaded)	Limited (needs connection for search)
Bandwidth	Less (downloads once)	More (syncs headers/body)

SMTP Mail Delivery Process:
1. Sender's email client connects to sender's SMTP server (port 25/587)
2. Client sends MAIL FROM command (sender address)
3. Server responds 250 OK
4. Client sends RCPT TO (recipient addresses) — one per recipient
5. Server responds for each recipient
6. Client sends DATA command → server responds 354
7. Client sends email content → ends with <CRLF>.<CRLF>
8. Server queues email for delivery
9. Sender's server connects to recipient's SMTP server and transfers email
10. Recipient's server stores email in mailbox (user's inbox)
11. Recipient's email client uses POP3/IMAP to retrieve email

ENCRYPTION TYPES:
1. Symmetric Encryption: Same key for encryption and decryption. Fast. Examples: AES (Advanced Encryption Standard, 128/256-bit), DES, 3DES, RC4.

2. Asymmetric Encryption: Public key + private key pair. Slower but solves key distribution problem. Examples: RSA (used in TLS), Diffie-Hellman (key exchange), ECC (Elliptic Curve).

3. Hashing: One-way function producing fixed-size digest. Used for integrity verification. Examples: MD5 (broken), SHA-1 (deprecated), SHA-256, SHA-3.

FIREWALL TYPES:
— Packet Filter: Examines IP headers and port numbers. Fast but stateless. Rules: Allow/Deny based on IP, port, protocol.
— Stateful Inspection: Tracks connection state (connection table). More secure — knows if packet belongs to an established connection.
— Application Proxy: Inspects application layer data. Acts as intermediary. Very secure but slow.
— NGFW: Combines stateful inspection with deep packet inspection, IDS/IPS, application awareness.

SSL/TLS HANDSHAKE (Simplified):
1. Client sends Client Hello (supported cipher suites, random nonce)
2. Server sends Server Hello (chosen cipher, certificate with public key, random nonce)
3. Client verifies certificate, generates pre-master secret, encrypts with server's public key → sends to server
4. Both sides derive session keys from pre-master secret + nonces
5. Encrypted communication begins (Finished messages confirm handshake)

HTTP (HyperText Transfer Protocol):
— Application layer protocol (port 80), stateless, request-response model
— Request methods: GET, POST, PUT, DELETE, HEAD, OPTIONS, PATCH
— Response codes: 1xx (Info), 2xx (Success: 200 OK), 3xx (Redirect: 301, 302), 4xx (Client Error: 404 Not Found, 403 Forbidden), 5xx (Server Error: 500, 503)
— HTTP/1.1: persistent connections (keep-alive), pipelining
— HTTP/2: multiplexing, header compression, server push
— HTTP/3: QUIC over UDP (faster, lower latency)

HTTPS:
— HTTP over TLS/SSL. Port 443. Provides confidentiality, integrity, authentication.
— TLS Handshake: Negotiate cipher suite → Exchange certificates → Key exchange (ECDHE) → Derive session keys → Encrypted communication

DNS (Domain Name System):
— Hierarchical, distributed database for name-to-IP mapping
— Hierarchy: Root → TLD (.com, .org, .in) → Second-level (google.com) → Subdomain (mail.google.com)
— DNS uses UDP (port 53) for queries, TCP for zone transfers (large responses)
— Record types: A, AAAA, MX, CNAME, NS, PTR, TXT, SOA

EMAIL PROTOCOLS:
— SMTP (port 25/587): Push protocol for sending mail between servers
— POP3 (port 110/995): Pull protocol, downloads mail, removes from server
— IMAP (port 143/993): Pull protocol, syncs mail across devices, keeps on server

HOW A WEB PAGE LOADS (Step-by-Step):
1. User types https://www.example.com in browser
2. Browser checks DNS cache → if miss, queries OS resolver
3. OS sends DNS query to configured DNS server
4. DNS server returns IP (e.g., 93.184.216.34)
5. Browser opens TCP connection to port 443 (HTTPS)
6. TLS Handshake: certificate exchange, key agreement
7. Browser sends HTTP GET request (encrypted)
8. Server processes request, sends HTTP 200 OK + HTML content
9. Browser parses HTML, discovers CSS/JS/image URLs
10. Browser sends additional HTTP requests for each resource (parallel, HTTP/2 multiplexed)
11. Server responds with CSS, JS, images
12. Browser renders complete page

FTP (File Transfer Protocol):
— Application layer protocol (RFC 959) for transferring files
— Uses TWO connections:
  • Control Connection: TCP port 21 (commands/responses throughout session)
  • Data Connection: TCP port 20 (actual file transfer)
— Modes:
  • Active Mode: Client sends PORT command telling server its listening port. Server connects to client on that port for data. Problem: Client behind firewall blocks incoming connections from server.
  • Passive Mode (PASV): Server sends PASV response with its port number. Client initiates data connection to server's port. Solution: Works through firewalls since client initiates all connections.
— Anonymous FTP: Login with username "anonymous" and email as password.
— Commands: USER, PASS, LIST, RETR, STOR, DELE, QUIT

TELNET:
— Remote terminal protocol (port 23, TCP)
— Provides character-based terminal emulation
— Completely unencrypted — passwords and data sent in plaintext
— Replaced by SSH for all secure remote access

SSH (Secure Shell):
— Secure remote login and command execution (port 22, TCP)
— Provides: encrypted communication, host authentication, user authentication
— Authentication methods: password, public key (RSA/ECDSA), keyboard-interactive
— Features: X11 forwarding, port forwarding/tunneling, SFTP
— SSH-1 (obsolete), SSH-2 (current standard)

SNMP (Simple Network Management Protocol):
— Used for monitoring and managing network devices (routers, switches, servers)
— Three components: Manager (NMS), Agent (software on device), Management Information Base (MIB — database of managed objects)
— Port 161 (Get/Set requests), Port 162 (Traps — unsolicited alerts)
— Versions: SNMPv1 (basic, no security), SNMPv2c (community-based, bulk retrieval), SNMPv3 (user-based authentication, encryption, integrity)
— Operations: GET, GETNEXT, SET, GETBULK, INFORM, TRAP

NETWORK SECURITY FUNDAMENTALS:

Encryption:
— Symmetric (AES-256): Fast, same key for encrypt/decrypt. Problem: key distribution.
— Asymmetric (RSA-2048, ECC): Public key encrypts, private key decrypts. Solves key distribution. Slower.
— Hash Functions (SHA-256): One-way, verify integrity. Digital signatures combine hashing + asymmetric encryption.

Firewalls:
— Packet Filter: Simple rules (IP, port, protocol). Stateless. Fast but limited security.
— Stateful Inspection: Tracks connections. Knows if packet is part of established connection.
— Application Proxy: Inspects payload at application layer. Very secure, acts as intermediary.
— NGFW: Next-gen with deep packet inspection, IDS/IPS, application control, sandboxing.

SSL/TLS Handshake (Full Process):
1. Client Hello: TLS version, cipher suites, random number
2. Server Hello: Selected cipher, server certificate (X.509), random number
3. Client verifies certificate against CA trust store
4. Client generates pre-master secret, encrypts with server's public key → sends
5. Server decrypts with private key → both now have pre-master secret
6. Both derive session keys (encryption + MAC keys) from pre-master + nonces
7. Client sends Finished (encrypted with session key)
8. Server sends Finished (encrypted with session key)
9. Encrypted application data transfer begins