Unit 6: Application layer

I. Application-Layer Orientation

The application layer is the highest layer of the TCP/IP model and corresponds broadly to the application, presentation, and session layers of the OSI model. It supplies network services directly to user applications while relying on transport protocols such as TCP and UDP for end-to-end delivery.

• Core purpose: Supports resource naming, host configuration, remote access, messaging, file exchange, web access, network management, and security services.
• Client–server model: A client initiates requests, while a continuously available server answers them; for example, a browser requests a page from a web server.
• Peer-to-peer model: End systems may act as both clients and servers, distributing control and resources among peers.
• Application protocols: Define message formats, message order, semantics, and actions taken when messages are sent or received.
• Transport choice:
  • TCP: Connection-oriented and reliable; used by HTTP, TELNET, SMTP, and FTP.
  • UDP: Connectionless and low-overhead; commonly used by DNS, DHCP, and SNMP.
• Addressing convention: Applications are identified through IP addresses and transport-layer port numbers; for example, HTTPS normally uses TCP port 443.
• Security principle: Authentication, confidentiality, integrity, access control, and traffic filtering may be provided through TLS, IPSec, VPNs, and firewalls.

II. Domain Name System — Hierarchical Name Resolution

DNS is a distributed naming system that translates human-readable domain names into IP addresses and stores other information associated with domains.

A. Domain Name System (DNS)

DNS organizes the global namespace as an inverted tree and resolves names through cooperating servers.

• Hierarchy:
  • Root: Represented by a trailing dot and served by root name servers.
  • Top-level domain: Includes generic domains such as .com and country-code domains such as .in.
  • Subdomain and host: In www.example.com, example is beneath .com, while www identifies a host or service.
• Server roles:
  • Recursive resolver: Obtains the final answer for a client.
  • Root and TLD servers: Refer the resolver to lower authoritative levels.
  • Authoritative server: Stores definitive records for a DNS zone.
• Resource records:
  • A/AAAA: Map a name to an IPv4/IPv6 address.
  • CNAME: Defines an alias.
  • MX: Identifies mail servers.
  • NS: Identifies authoritative name servers.
  • PTR: Supports reverse lookup.
• Operation: DNS normally uses UDP port 53; TCP port 53 is used for zone transfers and responses unsuitable for ordinary UDP delivery.
• Caching: Answers are retained for their time to live, or TTL, reducing latency and server load.
• Example: Resolving www.example.com may involve referrals from a root server to .com, then to the authoritative server for example.com.

III. Dynamic Host Configuration Protocol — Automatic Host Configuration

DHCP automatically supplies hosts with the parameters required to communicate on an IP network.

A. Dynamic Host Configuration Protocol (DHCP)

DHCP uses a client–server exchange to lease addresses rather than requiring manual configuration.

• Configuration supplied: Common options include an IP address, subnet mask, default gateway, DNS server, and lease duration.
• DORA exchange:
  1. DHCPDISCOVER: The unconfigured client broadcasts to locate servers.
  2. DHCPOFFER: A server proposes an address and options.
  3. DHCPREQUEST: The client requests the selected offer.
  4. DHCPACK: The server confirms the lease.
• Ports: DHCP servers use UDP port 67, while clients use UDP port 68.
• Lease renewal: A client normally attempts renewal before expiry, initially contacting the leasing server.
• Relay agent: Forwards DHCP messages across routers because ordinary broadcasts do not cross subnet boundaries.
• Limitation: A rogue DHCP server can provide a false gateway or DNS address; switch-based DHCP snooping helps control this threat.

IV. Remote Logging — Centralized Event Collection

Remote logging transfers system and application event records to another host for centralized monitoring, diagnosis, and auditing.

A. Remote logging

The syslog architecture separates message producers, relays, and collectors.

• Message content: A record commonly contains facility, severity, timestamp, hostname, application, and event text.
• Severity levels: Values range from emergency conditions to debugging information; lower numerical severity represents greater urgency.
• Transport: Traditional syslog commonly uses UDP port 514; reliable deployments may use TCP, while syslog over TLS commonly uses TCP port 6514.
• Advantages: Central storage preserves evidence even if a source machine fails or is compromised and enables correlation across routers, servers, and firewalls.
• Limitations: Plain UDP provides neither guaranteed delivery nor confidentiality; authenticated, encrypted transport and synchronized clocks improve evidential value.

V. TELNET — Text-Based Remote Login

TELNET provides bidirectional, interactive terminal communication with a remote system over TCP.

A. TELNET

TELNET represents terminal data through a standard Network Virtual Terminal abstraction.

• Connection: A TELNET server conventionally listens on TCP port 23.
• NVT principle: Local terminal characters are translated into a common representation, allowing dissimilar systems to communicate.
• Option negotiation: Control commands beginning with the Interpret As Command byte negotiate features such as echoing and terminal type.
• Major weakness: Usernames, passwords, commands, and output are transmitted without encryption, making interception possible.
• Modern replacement: SSH normally uses TCP port 22 and adds server authentication, encrypted sessions, and integrity protection.
• Current use: TELNET remains useful mainly for controlled laboratory demonstrations and testing plain-text TCP services.

VI. Electronic Mail — Store-and-Forward Messaging

Electronic mail uses multiple protocols to submit, relay, store, and retrieve messages.

A. Electronic mail

An email system combines user agents, mail servers, transfer agents, and access protocols.

• SMTP: The Simple Mail Transfer Protocol sends and relays mail; TCP port 25 supports server relay, while port 587 commonly supports authenticated submission.
• Retrieval methods:
  1. POP3: Commonly uses TCP port 110 or 995 with TLS and is oriented toward downloading messages.
  2. IMAP: Commonly uses TCP port 143 or 993 with TLS and keeps folders and message state synchronized on the server.
• Message structure: Headers contain fields such as From, To, Date, and Subject; the body carries the content.
• MIME: Multipurpose Internet Mail Extensions represent attachments, non-ASCII text, and content types such as text/html or image/png.
• Delivery route: The sender’s server queries the recipient domain’s DNS MX record and transfers the message to the selected mail server.
• Security: TLS protects transport links, while SPF, DKIM, and DMARC help detect sender-domain spoofing and unauthorized mail.

VII. File Transfer — Movement of Files Between Hosts

File-transfer protocols provide mechanisms for uploading, downloading, naming, and managing remote files.

A. File transfer

Different file-transfer protocols trade functionality, simplicity, and security.

• FTP architecture: File Transfer Protocol separates control and data connections; the control connection normally uses TCP port 21.
• FTP modes:
  1. Active mode: The server initiates the data connection, traditionally from TCP port 20.
  2. Passive mode: The client initiates both connections, making traversal of NAT devices and firewalls easier.
• FTP functions: Commands support login, directory listing, file retrieval, file storage, and transfer-mode selection.
• TFTP: Trivial File Transfer Protocol uses UDP port 69 and supplies minimal, unauthenticated transfer, often for device bootstrapping.
• SFTP: SSH File Transfer Protocol operates through SSH, normally on TCP port 22, and protects authentication, commands, and file contents.
• Limitation: Standard FTP sends credentials and data in plaintext unless protected by an additional security mechanism such as TLS.

VIII. World Wide Web — Interlinked Hypermedia System

The World Wide Web is a distributed information system in which resources are identified by URLs and accessed through browsers.

A. WWW

The Web combines resource identification, hypertext representation, and network retrieval.

• Core components: Browsers act as clients, web servers store or generate resources, and HTTP transfers representations.
• URL structure: In https://example.com/docs/page.html, https is the scheme, example.com is the authority, and /docs/page.html is the path.
• Hypertext: HTML links documents and embeds resources such as images, scripts, audio, and video.
• Web operation: A browser resolves the domain through DNS, establishes a transport connection, sends an HTTP request, and renders the response.
• Dynamic content: Server-side programs and client-side JavaScript can generate personalized or interactive pages.
• Distinction from Internet: The Internet is the underlying internetwork; the WWW is one service operating over it.

IX. Hypertext Transfer Protocol — Web Request and Response

HTTP is a stateless application protocol for transferring representations of resources between clients and servers.

A. HTTP

HTTP communication is organized around requests, responses, methods, headers, and status codes.

• Request elements: A request contains a method, target, protocol version, headers, and sometimes a body.
• Methods: GET retrieves a representation, POST submits data, PUT replaces a resource, and DELETE requests removal.
• Status codes:
  • 200 OK: Successful request.
  • 301 Moved Permanently: Permanent redirection.
  • 404 Not Found: Target resource was not found.
  • 500 Internal Server Error: Server-side failure.
• Ports and protection: HTTP commonly uses TCP port 80; HTTPS uses HTTP over TLS, conventionally on TCP port 443.
• Statelessness: Each request is logically independent; cookies and server-side sessions associate multiple requests with a user.
• Versions: HTTP/1.1 supports persistent connections, HTTP/2 multiplexes streams, and HTTP/3 operates over QUIC using UDP.

X. Simple Network Management Protocol — Monitoring and Control

SNMP enables managers to observe and, where permitted, modify variables maintained by network devices.

A. Simple Network Management Protocol (SNMP)

SNMP follows a manager–agent model and represents managed information as named objects.

• Components: A manager issues queries, an agent runs on the managed device, and the Management Information Base defines accessible objects.
• Object identifiers: Each managed variable has a hierarchical OID, such as an identifier representing an interface counter.
• Operations: GET reads an object, SET changes one, and GETNEXT or GETBULK traverses groups of objects.
• Notifications: Traps and informs allow an agent to report events without waiting for polling.
• Ports: Agents normally receive requests on UDP port 161; managers receive notifications on UDP port 162.
• Versions: SNMPv1 and community-based SNMPv2c provide weak security; SNMPv3 adds authentication, integrity, and optional encryption.

XI. IPSec — Network-Layer Packet Protection

IPSec is a suite of protocols that secures IP traffic through authentication, integrity checking, confidentiality, and anti-replay protection.

A. IPSec

IPSec protects traffic using security associations negotiated manually or through Internet Key Exchange.

• AH: Authentication Header provides integrity and source authentication but not confidentiality; it is identified by IP protocol number 51.
• ESP: Encapsulating Security Payload can encrypt payloads and also provide integrity and authentication; it uses IP protocol number 50.
• Operating modes:
  1. Transport mode: Protects the upper-layer payload while retaining the original IP header.
  2. Tunnel mode: Encapsulates the entire original packet inside a new IP packet, supporting gateway-to-gateway VPNs.
• Security association: Defines algorithms, keys, lifetime, mode, and related parameters for one direction of traffic.
• IKE: Internet Key Exchange commonly uses UDP port 500; NAT traversal commonly uses UDP port 4500.
• Limitation: Configuration complexity and mismatched policies can prevent peers from establishing secure associations.

XII. VPN — Secure Communication Across Untrusted Networks

A Virtual Private Network creates a protected logical connection across a public or shared network.

A. VPN

A VPN uses tunnelling, encryption, authentication, and integrity checks to extend trusted access.

• Remote-access VPN: Connects an individual device to an organizational network, often after user and device authentication.
• Site-to-site VPN: Connects entire networks through security gateways, commonly using IPSec tunnel mode.
• Tunnelling: An original packet is encapsulated inside another protocol so that it can cross an intermediate network.
• Security goals: Encryption provides confidentiality, message authentication detects alteration, and anti-replay mechanisms reject duplicated packets.
• Routing models:
  1. Full tunnel: All client traffic passes through the VPN gateway.
  2. Split tunnel: Only selected traffic uses the VPN, reducing load but expanding exposure.
• Limitation: A VPN protects data in transit but does not make an infected endpoint or malicious destination trustworthy.

XIII. Firewalls — Policy-Based Traffic Control

A firewall monitors and controls traffic crossing a security boundary according to an enforced rule set.

A. Firewalls

Firewalls reduce unauthorized access by permitting, rejecting, or inspecting network communications.

• Packet-filtering firewall: Examines fields such as source address, destination address, protocol, and TCP or UDP port.
• Stateful firewall: Tracks connection state, allowing return packets associated with an established session.
• Application proxy: Terminates client connections and inspects application-layer content before creating separate server connections.
• Next-generation firewall: Combines stateful filtering with application identification, intrusion prevention, and user-aware policies.
• Rule example: A public web server may permit inbound TCP ports 80 and 443 while denying unsolicited traffic to administrative ports.
• Deployment: Network firewalls protect boundaries, while host-based firewalls control traffic entering or leaving an individual machine.
• Policy principle: A default-deny policy permits only explicitly authorized services and is generally safer than allowing traffic unless specifically blocked.
• Limitations: Firewalls cannot fully prevent attacks carried through permitted services, insider misuse, social engineering, or encrypted malicious traffic they cannot inspect.