CHAPTER 6: The OSI Model and Networking Protocols 246 TCP/IP protocols on the Internet and the IPX addresses used by the IPX/SPX protocols on NetWare networks are examples of logical addresses. These protocol stacks are referred to as routable because they include address- ing schemes that identify both the network or subnet and the particular client on that network or subnet. Other network/transport protocols, such as NetBIOS Extended User Interface (NetBEUI), do not have a sophisti- cated addressing scheme (nor the programming intelligence of high OSI model layers such as network and transport layers), thus crippling it and not allowing it to be routed across different networks. To make sure you understand what is meant by this, view Figure 6.7. Here, you see a network subdivided by different IP subnets (this will be covered in greater depth in Chapter 7). You can see that each local area network (LAN) is connected to each other via a WAN, using Frame Relay (both of which will be covered in depth in Chapter 7). The most critical fact here is that all of this logical address- ing and routing are done at the network layer of the OSI model. Each sub- net must be unique, and each LAN will need to know how to get to the other LANs. That’s where the WAN and the routers come in, acting as the default gateway for your network. Also, you need to understand that logical addressing (such as the 10.1.1.1 255.255.255.0 address being assigned to the router on the LAN as the default gateway) is important; it defines how and where the packets are sent and so on. So, now that you have assigned the IP address, how does the MAC address tie in? Well, a TCP/IP protocol called Address Resolution Protocol (ARP) will help map an IP address to a physical machine address. The network layer is also responsible for creating a virtual circuit (a logical connection, not a physical connection) between points or nodes. A node is a device that has a MAC address, which typically includes Note To understand the difference between physical and logical addresses, consider this analogy: if you buy a house, it has a physical address that identifies exactly where it is located on the earth, at a specific latitude and longitude. This never changes (unless you have a mobile home that can be moved from one plot of land to another). This is like the MAC address on a NIC. Your house also has a logical address assigned to it by the post office, consisting of a street number and street name. The city can (and occasionally does) change the names of streets or renumber the houses located on them. This is like the IP address assigned to a network interface. The OSI Model 247 computers, printers, and routers. This layer is also responsible for routing, Layer 3 switching (which is nothing more than a Layer 2 switch with a Layer 3 router built into it) and the forwarding of packets. Routing refers to forwarding packets from one network or subnet to another. Without routing, computers can communicate only with other computers that are on the same network via ARP broadcasts. Routing makes it possible for computers to send data through many networks to other computers that are on the other side of the world. Routing is the key to the FIGURE 6.7 TCP/IP Networks Subdivided and Connected via Routers. CHAPTER 6: The OSI Model and Networking Protocols 248 global Internet and is one of the most important duties of the network layer. Easy to remember, routing is simple to understand. If you start with a LAN that has the 10.1.1.0 255.255.255.0 network and you wanted to get to the 10.1.2.0 255.255.255.0 network (which has a different network number in the third octet), you would need a router with a routing table (so it knows where to send the packet) to get it there. Finally, the network layer provides additional levels of flow control and error control. As mentioned earlier, from this point on, the primary methods of implementing the OSI model architecture involve software rather than hardware. Devices that operate at this layer include, most prominently, routers and Layer 3 switches. Layer 4: Transport Layer 4 is the transport layer. As the name implies, it is responsible for transporting the data from one node to another. It provides transparent data transfer between nodes and manages the end-to-end flow control, error detection, and error recovery. The transport layer protocols initiate contact between host computers and set up a virtual circuit. The transport protocols on each host computer verify that the application sending the data is authorized to access the network and that both ends are ready to initiate the data transfer. When this synchronization is complete, the data can be sent. As the data is being transmitted, the transport protocol on each host monitors the data flow and watches for transport errors. If transport errors are detected, the transport protocol can provide error recovery. The functions performed by the transport layer are very important to network communication. Just as the data link layer provides lower-level reliability and connection-oriented or connectionless communications, the transport layer does the same thing at a higher level. In fact, the two protocols most commonly associated with the transport layer are defined by their connection state: TCP, which is connection-oriented, whereas UDP, which is connectionless. What else does the transport layer do? It handles another aspect of logical addressing: ports. If you think of a computer’s IP address as analogous to the street address of a building, you can think of a port as a suite number or apartment number within that building. It further defines exactly where the data should go. A computer might have several network applications running at the same time: a Web browser sending a request to a Web server for a Web page, The OSI Model 249 an e-mail client sending and receiving mail, and a file transfer program uploading or downloading information to and from an FTP server. There must be some mechanism to determine which incoming data packets belong to which application, and that’s the function of port numbers. The FTP protocol used by that program is assigned a particular port, whereas the Web browser and e-mail clients use different protocols (HTTP and Post Office Protocol [POP3] or Internet Message Access Protocol [IMAP]) that have their own assigned ports. Thus the information that is intended for the Web browser doesn’t go to the e-mail program by mistake. Port numbers are used by the transport layer protocols (TCP and UDP). Finally, the transport layer deals with name resolution. Because human beings prefer to identify computers by names instead of IP addresses (after all, it’s easier to remember “www.microsoft.com” for Microsoft’s Web server than “207.46.249.222,” for example), but computers know only how to interpret numbers (and binary numbers, at that), there must be a way for names to be matched with numerical addresses so that people and computers don’t drive one another crazy. Name resolution methods such as the domain name system (DNS) solve this problem, and they generally operate at the upper layers of the OSI model. HEAD OF THE CLASS… Different Switches for Different Layers Troubleshooting network problems requires that you understand which protocols and devices operate at which layers of the networking model. It’s important to understand that all switches are not created equal. There are actually several different types of devices that are called switches and they operate at different layers of the OSI model. Layer 2 switches are sometimes called standard switches. They operate at the data link layer and func- tion like sophisticated hubs. When a computer sends data to a hub, the hub sends it back out on all ports, to all the connected computers. A switch sends the data only out the port to which the destination computer (based on the addressing information in the headers) is attached. This decreases the amount of unnecessary traffic on the network and also increases security. Layer 3 switches operate at the network layer and are really a specialized type of router. They’re sometimes called switched routers. Layer 3 switches use the information in the packet headers to apply policies, in addition to performing normal routing functions. Layer 4 switches operate at the transport layer (in addition to the lower layers) and can use the port number information from TCP or User Datagram Protocol (UDP) headers. They can provide access control lists (ACLs) to filter traffic for better security and are able to control bandwidth allocation for load balancing purposes. Some routers also function as Layer 4 switches. These devices can help to identify application layer (Layer 7) protocols, such as capable Hypertext Transfer Protocol (HTTP), File Transfer Protocol (FTP), and so on. CHAPTER 6: The OSI Model and Networking Protocols 250 Layer 5: Session After the transport layer has established the virtual connection, a communi- cation session can be established. A communication session occurs between two processes on two different computers. The session layer is responsible for establishing, monitoring, and terminating sessions, using the virtual circuits established by the transport layer. The session layer is also responsible for putting header information into data packets to indicate where the message begins and ends. Once header information is attached to the data packets, the session layer performs synchronization between the sender’s session layer and the receiver’s session layer. The use of acknowledgement (ACK) messages helps coordinate transfer of data at the session layer. A very important function of the session layer is controlling whether the communications within a session are sent as full-duplex or half-duplex messages. Half-duplex communication goes in both directions between the communicating computers, but information can travel in only one direction at a time (as with walkie-talkie radio communications, in which you have to hold down the microphone button to transmit and cannot hear the person on the other end when you do). With full-duplex communica- tion, information can be sent in both directions at the same time (as in a regular telephone conversation, in which both parties can talk and hear one another at the same time). HEAD OF THE CLASS… Connection-Oriented versus Connectionless What’s the difference between a connection-oriented and a connectionless protocol? A connection-oriented protocol such as TCP creates a connection between the two computers before actually sending the data and then verifies that the data has reached their destination by using acknowledgements (messages sent back to the sending computer from the receiving computer that acknowledge receipt). Connectionless protocols send the data and trust that it will reach the proper destination. Consider an analogy: you need to send a very impor- tant letter to a business associate, containing valuable papers that must not get lost along the way. You call him before mailing the letter, to let him know he should expect it (establishing the connection). You might even insure it or send it via certified mail. After a few days have passed, your friend calls you back to let you know that he did receive the letter or you get back the return receipt that you requested (acknowledgement). This is the way a connection-oriented communication works. It’s different from mailing a relatively unimportant item, such as a postcard to a friend when you’re on vacation. In that case, you just drop it in the mailbox and hope it gets to the addressee. You don’t expect or require any acknowledgement. This is like a connectionless communication. The OSI Model 251 Although the transport layer establishes a connection between two machines, the session layer establishes a connection between two processes. A process is a defined task related to an application. An application may run many processes simultaneously to accomplish the work of the application. These processes are small executable files that together do the work required by the application. You can view the processes running on your Windows-based computer by pressing CTLALTDEL, selecting Task Manager, and then clicking the Processes tab. You’ll notice you have far more processes running than applications since each application typically runs more than one process at a time. The session layer, then, is responsible for setting up the connection between an application process on one computer and an application process on another computer, after the transport layer has established the connection between the two machines. There are many important protocols that operate at the session layer, including Windows Sockets (the Winsock interface) and NetBIOS (the Network Basic Input/Output interface). Layer 6: Presentation Data translation is the primary activity of Layer 6, the presentation layer. When data is sent from sender to receiver, the data is translated at the presentation layer. The sender’s application passes data down to the presentation layer, where it is put into a common format. When the data is received on the other end, the presentation layer changes the data from the common format back into a format that is useable by the application. Protocol translation, the conversion of data from one protocol to another so that it can be exchanged between computers that use different platforms or operating systems, takes place here. This is the layer at which many gateway services operate. Gateways are connection points between networks that use different platforms or Note Earlier in this chapter, we mentioned multiplexing. Computer communications can be in half-duplex or full-duplex mode. Simplex, or unidirectional (one-way) communication, generally, is not used in computer networking. It is the type of communication used for radio and over-the-air TV broadcasts (many cable television [CATV]) transmissions now use two-way signaling to allow for interactive TV). CHAPTER 6: The OSI Model and Networking Protocols 252 applications. Examples include e-mail gateways (which allow for com- munications between two different e-mail programs using a common protocol such as Simple Mail Transfer Protocol [SMTP]), Systems Network Architecture (SNA) gateways (which allow PCs to communicate with mainframe computers), and gateways that cross platforms or file systems (for example, allowing Microsoft clients that use the Server Message Block (SMB) protocol for file sharing to access files on NetWare servers that use NetWare Core Protocol). Gateways are usually implemented via software, such as the Gateway Services for NetWare (GSNW). Software redirectors also operate at this layer. This layer is also where data compression can take place, to minimize the actual number of bits that must be transmitted on the network media to the receiver. Data encryption and decryption take place in the presentation layer as well. Layer 7: Application The application layer is the point at which the user application program interacts with the network. This layer of the OSI model should not be confused with the application itself. This is very important to understand and remember, as they share the same name. Application processes, such as file transfers or e-mail, are initiated within a user application (for example, an e-mail program). Then the data created by that process are handed to the application layer of the networking software. Everything that occurs at this level is application-specific. File sharing, remote printer access, network monitoring and management, Remote Procedure Calls (RPCs), and all forms of electronic messaging occur at this level. Both FTP (a common way of transferring files across a network) and Telnet function within the application layer, as do SMTP, POP3, and IMAP4, all of which are used for sending or receiving e-mail. There are many other application layer protocols, including HTTP, Network News Test Day Tip Although it’s important to understand the details of the OSI model for the exam, you’re likely to run into a limited number of questions related to the specific layers of the model. Understanding the basic functions of each layer will help you easily identify correct answers to the questions you may see on the exam. It is especially important to remember that, when troubleshooting, you should start with Layer 1 (physical) and work your way up. A common error among technicians and network administrators is starting to troubleshoot at Layer 7. Greater detail about troubleshooting with the OSI model can be found in Chapter 11, “Network Troubleshooting Tools.” The OSI Model 253 Transfer Protocol (NNTP), and Simple Network Management Protocol (SNMP). Be sure to distinguish between the protocols mentioned and applications that may bear the same names. There are many different FTP programs made by different software vendors, but all of them use the FTP protocol to transfer files. Encapsulation of Data One last item to cover before we move on to new material is that you should make sure you understand what encapsulation is and how it works. Notice that each layer in Figure 6.8 adds a header to the data packet so that by the time it reaches the physical layer (the last one on the bottom), it is much longer than when it started at the application layer. When data is received by the receiving host, the headers are stripped off as the data moves back up the stack, one layer at a time, by the layer that corresponds to the one that added it. This means that each layer on the sending computer communicates only with the layer of the same name on the receiving machine. The Microsoft Model Prior to the release of Windows NT 3.1, users who wanted to connect to a network had to obtain the TCP/IP protocol suite from a third party and install it. TCP/IP did not come bundled with the software. At times, the TCP/IP software that was purchased didn’t work well with the operating system (OS) because it handled various tasks of network communication in a slightly different way than did the operating system. This sometimes led to intermittent network problems or time-spent troubleshooting TCP/IP and operating system interoperability. With the release of Windows NT 3.1, TCP/IP was built into the operating system, providing a seamless integration of network- ing functionality in the OS. Since that time, it has become standard to provide TCP/IP with the operating system because many computers today connect to a net- work in one form or another. The Microsoft model as seen in Figure 6.9 provides a standard platform for application developers. FIGURE 6.8 Data Moving through the OSI Layers. CHAPTER 6: The OSI Model and Networking Protocols 254 This modular design enables the developer to rely upon the underlying services of the OS through the use of standard interfaces. (Sound familiar to the discussion we had earlier on the DoD and OSI models?) These interfaces provide specific functionality developers can use as building blocks to develop an application. This makes development time shorter and provides common interfaces for users, making learning and using new applications easier. FIGURE 6.9 The Microsoft Model. The OSI Model 255 Though the Microsoft model is used primarily by programmers, it’s important to understand the framework we explore, of how TCP/IP works on a Microsoft Windows-based computer. Understanding the Function of Boundary Layers The Microsoft model describes software and hardware components and the connections between them that facilitate computer networking. This modular approach both allows and encourages hardware and software vendors to develop products that work together through the Microsoft operating system. Boundary layers are interfaces that reside at the boundar- ies of functionality. They interact with the layer below and the layer above, providing an interface from one layer to the next. Within each layer, various components perform the tasks defined at the layer. A variety of components can provide similar functionality at any given layer. This modular approach provides flexibility for developers while providing common interfaces that reduce development time and cost. A vendor can provide new functionality at any of these layers, knowing their products will integrate with the other layers to provide seamless network com- munications. The interfaces defined by Microsoft are the Network Driver Inter- face Specification (NDIS), Transport Driver Interface (TDI), and the application program interface (API). Figure 6.9 shows the relationship of these boundary layers to both the OSI model and to the Microsoft Architecture. The Windows OS is divided into three primary areas: the User, the Executive, and the Kernel. The Kernel is the core of the Microsoft operating system architecture and it manages the most basic operations including interacting with the hardware abstraction layer that interacts with the hardware (CPU, memory, etc.). The Kernel also synchronizes activities with the Executive level, which includes the Input/Output (I/O) Manager and the Process Manager. The User level interacts with the Executive level; this is the level at which most applications and user interfaces reside. the NDIs boundary Layer The NDIS works at the bottom of the networking architecture and maps to the data link layer of the OSI model and the Network Interface layer of the DARPA model. The NDIS layer is the boundary between the physical network (physical layer of the OSI model) and the higher-level transport protocols. This layer provides the standardized functions that allow various transport protocols to use any network device driver that is compatible with the specifications of this layer, providing both flexibility and reliability to developers. The earliest versions of NDIS were developed by a Microsoft and 3Com joint effort. Later, NDIS versions are proprietary to Microsoft operating systems. . routable because they include address- ing schemes that identify both the network or subnet and the particular client on that network or subnet. Other network/transport protocols, such as NetBIOS. analogous to the street address of a building, you can think of a port as a suite number or apartment number within that building. It further defines exactly where the data should go. A computer. application, and that’s the function of port numbers. The FTP protocol used by that program is assigned a particular port, whereas the Web browser and e-mail clients use different protocols (HTTP and Post