Unit 5: Transport layer

I. Transport-Layer Foundations

A. Transport-layer orientation

The transport layer provides logical, end-to-end communication between application processes running on different hosts, while the network layer delivers packets only between hosts.

• Position in the architecture: In the TCP/IP model, the transport layer lies above IP and below application protocols such as HTTP, DNS, SMTP, and FTP.
• Process-to-process delivery: IP addresses identify source and destination hosts; transport-layer port numbers identify the particular processes on those hosts.
• End-to-end principle: Transport functions are performed mainly at end systems rather than by intermediate routers.
• Segmentation and reassembly: A sending transport protocol divides application data into transport-layer units; the receiver reconstructs the original data.
  • TCP calls its data unit a segment.
  • UDP commonly calls its data unit a user datagram.
• Multiplexing and demultiplexing: Multiple applications can share the network layer, while incoming data is directed to the correct application through port numbers.
• Service alternatives:
  1. UDP: Connectionless, message-oriented, and low-overhead service.
  2. TCP: Connection-oriented, reliable, byte-stream service.
• Performance responsibilities: Depending on the protocol, the layer may provide error recovery, flow control, congestion control, and support for Quality of Service.

II. Process Addressing — Identifying Network Applications

A. Port addresses

A port address is a 16-bit transport-layer identifier used to distinguish an application process on a host.

• Port-number range: A 16-bit field permits values from 0 through 65,535.

Number of possible ports = 2^16 = 65,536

• 16 is the number of bits in the port field.
• Port 0 is reserved and is not normally assigned to an application service.

• Port categories:
  • Well-known ports (0–1023): Assigned to common server applications; examples include HTTP port 80, HTTPS port 443, DNS port 53, and SMTP port 25.
  • Registered ports (1024–49151): Associated with particular applications or services through registration.
  • Dynamic/private ports (49152–65535): Commonly selected temporarily by client operating systems as ephemeral ports.
• Source and destination ports: Every TCP segment or UDP datagram contains both fields.
  • The destination port identifies the receiving service.
  • The source port identifies where a response should be delivered.
• Multiplexing: A host can run a browser, email client, and messaging application simultaneously because each communication uses an appropriate port.
• Concrete example: A browser may send from temporary port 53000 to a web server at destination port 443; the server’s response reverses those source and destination port roles.
• Limitation: A port number alone does not globally identify a process because different hosts can use the same port simultaneously.

B. Socket address

A socket address combines an IP address and a port number to identify one communication endpoint.

• Representation: An IPv4 socket is commonly written as IP-address:port, such as 192.0.2.10:443.
• Endpoint identity:
  • The IP address identifies the host or network interface.
  • The port identifies the process or service within that host.
• TCP connection identity: A TCP connection is uniquely distinguished by a four-part combination:

(source IP, source port, destination IP, destination port)

• Concrete example: Connections from 192.0.2.20:51000 and 192.0.2.21:51000 to 203.0.113.8:443 remain distinct because their source IP addresses differ.
• Socket API role: Applications use operations such as socket, bind, listen, accept, connect, send, and receive to access transport services.
• Server and client convention: A server usually binds to a stable port, while a client is usually assigned an ephemeral port for the session.

III. User Datagram Protocol — Lightweight Message Delivery

A. User Datagram Protocol (UDP)

UDP is a connectionless transport protocol that sends independent messages without guaranteeing delivery, order, or duplicate suppression.

• Connectionless operation: UDP transmits immediately without connection establishment or termination handshakes.
• Header size: The UDP header is fixed at 8 bytes, consisting of four 16-bit fields:
  • Source port
  • Destination port
  • Length
  • Checksum
• Length field: It gives the total size of the UDP header and payload.

UDP length = 8 + application-data length

• Lengths are measured in bytes.
• For a 100-byte payload, the UDP length is 108 bytes.

• Checksum: The checksum detects corruption over the UDP header, data, and an IP-derived pseudo-header. It does not repair errors or request retransmission.
• Message orientation: Each application write normally corresponds to one datagram, so message boundaries are preserved.
• No reliability machinery: UDP provides no acknowledgements, sequence-based reordering, retransmission, flow control, or built-in congestion control.
• Advantages: Its small header and lack of setup reduce delay and processing overhead, especially for brief exchanges.
• Applications: UDP is used by DNS queries, DHCP, real-time voice/video, online games, and applications such as QUIC that implement additional control above UDP.
• Limitations: Applications requiring reliability must add acknowledgements, timeouts, retransmissions, or loss tolerance themselves.

IV. Transmission Control Protocol — Reliable Byte-Stream Transport

A. Transmission Control Protocol (TCP)

TCP is a connection-oriented protocol that provides reliable, ordered, full-duplex byte-stream delivery between two application processes.

• Byte-stream service: TCP treats application data as a continuous sequence of bytes rather than preserving application message boundaries.
• Sequence numbers: Each transmitted byte is numbered; a segment’s sequence number identifies the first data byte it carries.
• Acknowledgements: TCP normally uses cumulative acknowledgements. An acknowledgement number of 5001 indicates that all bytes through 5000 were received and byte 5001 is expected next.
• Reliability: Lost or damaged data is retransmitted after a timeout or indications such as duplicate acknowledgements.
• Error detection: A 16-bit checksum covers the TCP header, data, and pseudo-header.
• Flow control: The receiver advertises a receive window, limiting how much unacknowledged data the sender may transmit.

Usable send window = min(rwnd, cwnd)

• rwnd is the receiver-advertised window.
• cwnd is the sender’s congestion window.

• Header fields: Important fields include source and destination ports, sequence number, acknowledgement number, flags, window size, checksum, and options.
• Flags: SYN establishes sequence-number synchronization, ACK validates the acknowledgement field, FIN closes normally, and RST aborts a connection.
• Trade-off: TCP’s reliability and control are suitable for web transfer, email, and file transfer, but introduce more delay and overhead than UDP.

B. 3-way handshaking

The TCP three-way handshake establishes a connection, synchronizes initial sequence numbers, and confirms that both endpoints can send and receive.

1. SYN — client to server:
   • The client sends a segment with SYN=1 and initial sequence number x.
   • The client enters the SYN-SENT state.
2. SYN-ACK — server to client:
   • The server replies with SYN=1, ACK=1, sequence number y, and acknowledgement number x+1.
   • The server enters the SYN-RECEIVED state.
3. ACK — client to server:
   • The client sends ACK=1 with acknowledgement number y+1.
   • Both endpoints can then enter the ESTABLISHED state.

Client                         Server
SYN, Seq=x          -------->
                    <--------  SYN+ACK, Seq=y, Ack=x+1
ACK, Ack=y+1        -------->

• Why three messages are required: Each side announces its sequence number, and each announcement is acknowledged.
• Negotiation: TCP options exchanged during the handshake may establish maximum segment size, window scaling, timestamps, and selective acknowledgement capability.
• Security concern: A SYN-flood attack sends many requests without completing the handshake; SYN cookies can reduce server resource exhaustion.

V. Network Load Management

A. Congestion control

Congestion control prevents excessive traffic from overwhelming network links, router buffers, and processing resources.

• Congestion indicators: Increasing delay, packet loss, duplicate acknowledgements, retransmission timeouts, or explicit congestion signals can reveal overload.
• Congestion window: TCP limits outstanding data using cwnd, measured in bytes or segments.
• Slow start: TCP begins with a relatively small congestion window and increases it rapidly, approximately doubling it each round-trip time when acknowledgements arrive.
• Congestion avoidance: After reaching the slow-start threshold, TCP generally uses additive increase, producing slower, roughly linear growth.
• Multiplicative decrease: When congestion is inferred, the sending rate is reduced significantly rather than continuing unchanged.
• Fast retransmit: Multiple duplicate acknowledgements can trigger retransmission before the retransmission timer expires.
• Fast recovery: Some TCP variants reduce the window after duplicate acknowledgements but avoid restarting from the minimum rate.
• Timeout response: A timeout suggests more severe congestion, so TCP sharply reduces cwnd and resumes cautious growth.
• Explicit Congestion Notification: ECN-capable routers mark packets instead of dropping them, allowing endpoints to lower their sending rates.
• Distinction from flow control: Flow control protects a slow receiver; congestion control protects the network as a whole.

VI. Service Performance and Improvement

A. Quality of service

Quality of Service (QoS) is the network’s ability to provide predictable performance appropriate to different traffic classes or applications.

• Bandwidth: The transmission capacity available to a flow, commonly measured in bits per second.
• Delay: The end-to-end time taken by a packet.

Total delay = processing + queuing + transmission + propagation delay

• Jitter: Variation in packet delay; high jitter disrupts real-time voice and video even when average delay is acceptable.
• Packet loss: The proportion of packets that fail to reach the destination, often because router queues overflow.
• Reliability: Error rates, availability, and delivery consistency influence service quality.
• Application differences:
  • File transfer prioritizes reliable delivery and throughput.
  • Voice calls prioritize low delay and low jitter.
  • Streaming video requires sustained bandwidth and manageable loss.
• Service models: Best-effort service gives no strict guarantees, while differentiated or reserved services provide preferential treatment.

B. Techniques to improve QoS

QoS techniques classify traffic and control resources so that important flows receive suitable bandwidth, delay, jitter, and loss performance.

• Scheduling:
  • Priority queuing serves high-priority packets first but can starve lower classes.
  • Weighted Fair Queuing allocates service according to configured weights while preserving fairness.
• Traffic shaping:
  • Leaky bucket releases traffic at a controlled, near-constant rate.
  • Token bucket generates tokens at rate r and stores up to B tokens, permitting bursts up to bucket capacity B.
• Admission control: A new flow is accepted only if sufficient bandwidth and buffer resources are available.
• Resource reservation: Mechanisms such as RSVP can request resources along a path for particular flows.
• Traffic classification and marking: Routers examine fields such as addresses, ports, or Differentiated Services markings to assign packets to classes.
• Congestion avoidance: Active queue management, including Random Early Detection, drops or marks packets before a queue becomes completely full.
• Buffering and jitter control: Playback buffers temporarily hold real-time packets so that variable arrival times produce smoother output, at the cost of added delay.
• Overprovisioning: Installing capacity beyond normal demand reduces contention but may be expensive and cannot alone guarantee performance during exceptional loads.