Unit 6: Application layer - Subjective Questions

Domain Name System (DNS) is a distributed and hierarchical naming system that translates human-readable domain names, such as www.example.com, into IP addresses and vice versa.

Hierarchical namespace:

• Root domain: Represented by a dot and managed by root name servers.
• Top-Level Domain (TLD): Examples include .com, .org, .edu, and country-code domains such as .in.
• Second-level domain: The organization-specific portion, such as example in example.com.
• Subdomain or host: Identifies a division or host, such as www in www.example.com.

Major components:

• DNS resolver: Accepts queries from applications and obtains answers from DNS servers.
• Root name server: Directs the resolver to the appropriate TLD server.
• TLD name server: Directs the resolver to the authoritative server.
• Authoritative name server: Stores the actual records for a domain.
• Resource records: Store mappings and other domain information.

DNS is distributed to improve scalability, availability, fault tolerance, and administrative control.

DNS resolution can use recursive or iterative queries.

Recursive query:

• The queried server must return either the final answer or an error.
• A host typically sends a recursive query to its local DNS resolver.

Iterative query:

• A server returns the best information it currently has, often a referral to another server.
• DNS resolvers commonly use iterative queries when communicating with root, TLD, and authoritative servers.

Resolution of www.example.com:

1. The client checks its browser, operating-system, and local DNS caches.
2. If no valid cached record exists, it asks the local recursive resolver.
3. The resolver asks a root server, which refers it to a .com TLD server.
4. The resolver asks the TLD server, which returns the authoritative name server for example.com.
5. The resolver asks the authoritative server for the record of www.example.com.
6. The authoritative server returns an IPv4 A record or IPv6 AAAA record.
7. The resolver caches the result according to its Time to Live (TTL) and returns it to the client.

Caching reduces lookup delay and DNS traffic, while TTL controls how long cached data remains valid.

A DNS resource record (RR) contains information associated with a domain name. Important records include:

• A: Maps a host name to an IPv4 address.
• AAAA: Maps a host name to an IPv6 address.
• CNAME: Defines an alias for a canonical domain name.
• MX: Identifies mail servers and their preference values.
• NS: Identifies authoritative name servers for a zone.
• SOA: Contains zone authority information, including serial number and timing parameters.
• PTR: Maps an IP address back to a host name.
• TXT: Stores arbitrary text, including SPF and domain-verification information.

Forward lookup:

• Converts a domain name into an IP address.
• Uses records such as A and AAAA.

Reverse lookup:

• Converts an IP address into a domain name.
• Uses PTR records under in-addr.arpa for IPv4 and ip6.arpa for IPv6.

Forward lookup is commonly used to contact servers, whereas reverse lookup is useful for logging, diagnostics, and some mail-server security checks.

Dynamic Host Configuration Protocol (DHCP) automatically provides hosts with network configuration, including an IP address, subnet mask, default gateway, DNS server addresses, and lease duration. DHCP uses UDP port 67 on the server and UDP port 68 on the client.

The allocation process is called DORA:

1. DHCPDISCOVER: A client without an IP address broadcasts a request to locate DHCP servers.
2. DHCPOFFER: A server offers an available address and configuration parameters.
3. DHCPREQUEST: The client broadcasts its selection of an offer and requests the offered address.
4. DHCPACK: The selected server confirms the lease and supplies the final configuration.

If the request cannot be accepted, the server may return DHCPNAK. A client may also send DHCPRELEASE when it no longer requires the address. Leasing allows addresses to be reused efficiently and reduces manual configuration errors.

DHCP supports three principal allocation methods:

• Manual allocation: An administrator binds a specific address to a client's hardware identifier. It is suitable for servers and devices requiring stable addresses.
• Automatic allocation: The server permanently assigns an available address to a client from a pool.
• Dynamic allocation: An address is assigned for a limited lease period and can later be reused. This is the most common method.

Lease renewal:

• At approximately T1, normally 50% of the lease duration, the client unicasts a renewal request to the original server.
• If renewal fails, at T2, normally 87.5% of the lease duration, the client broadcasts a rebinding request to any available server.
• If the lease expires without renewal, the client must stop using the address and restart allocation.

DHCP relay agent:

• DHCP discovery messages are broadcasts and routers normally do not forward them.
• A relay agent receives a client's broadcast and forwards it as a unicast message to a DHCP server on another subnet.
• This permits one centralized DHCP server to serve multiple networks.

Remote logging transfers event messages from hosts, routers, switches, servers, and applications to a centralized log server. Syslog is a widely used protocol for this purpose.

Operation:

• A device generates a message describing an event.
• The message includes metadata such as timestamp, host, facility, severity, and text.
• It is sent to a local or remote Syslog collector.
• Traditional Syslog commonly uses UDP port 514; reliable or secured variants can use TCP or TLS.

Facility identifies the message source, such as kernel, mail, authentication, daemon, or local application.

Severity levels, from most to least serious, are:

• Emergency
• Alert
• Critical
• Error
• Warning
• Notice
• Informational
• Debug

Advantages: Centralized auditing, troubleshooting, event correlation, monitoring, and preservation of logs even if a device fails.

Limitations of traditional UDP Syslog: Messages can be lost, reordered, forged, or read in transit. Reliable transport, authentication, encryption, synchronized clocks, access control, and protected storage should therefore be used where required.

TELNET is an application-layer protocol for interactive remote terminal access. It normally uses TCP port 23.

Architecture and operation:

• A TELNET client establishes a TCP connection with a TELNET server.
• User keystrokes are transmitted to the remote system.
• The remote host executes commands and returns terminal output.
• TELNET defines a Network Virtual Terminal (NVT) to provide a common representation between different terminal types.
• Client and server negotiate options through control commands such as WILL, WON'T, DO, and DON'T.

Security weaknesses:

• Usernames and passwords are transmitted as plaintext.
• Commands and output are not encrypted.
• TELNET does not provide strong server authentication or integrity protection.
• Attackers can sniff traffic, steal credentials, or conduct man-in-the-middle attacks.

TELNET has therefore largely been replaced by SSH, which provides encrypted communication, integrity checking, and stronger authentication.

An electronic mail system uses several cooperating components:

• Mail User Agent (MUA): Allows a user to compose, send, receive, organize, and read messages.
• Mail Submission Agent (MSA): Accepts outgoing mail from an authenticated user.
• Mail Transfer Agent (MTA): Relays messages between mail servers, generally using SMTP.
• Mail Delivery Agent (MDA): Places received mail in the recipient's mailbox.
• Mailbox or message store: Retains messages until users access them.
• DNS MX record: Identifies the destination domain's mail server.

Typical message path:

1. The sender composes a message using an MUA.
2. The MUA submits it to an MSA or MTA using SMTP.
3. The sending server queries DNS for the recipient domain's MX record.
4. SMTP transfers the message to the destination mail server.
5. The MDA stores it in the recipient's mailbox.
6. The recipient reads or synchronizes mail using IMAP, POP3, or webmail.

A message contains an envelope, headers such as From, To, and Subject, and a body. MIME enables attachments and non-ASCII content.

SMTP, POP3, and IMAP perform different e-mail functions:

Comparison:

• SMTP is used for outgoing transfer, while POP3 and IMAP are used for mailbox access.
• POP3 is simple and suitable for offline access from a primary device.
• IMAP is better for users accessing the same mailbox from multiple devices.
• IMAP can fetch headers or selected message sections without downloading everything.
• TLS should be used to protect credentials and message data in transit.

Thus, a typical mail system uses SMTP to send messages and IMAP or POP3 to retrieve them.

Multipurpose Internet Mail Extensions (MIME) extends the original Internet mail format so that messages can carry non-ASCII text, images, audio, video, application files, and multiple body parts.

Important MIME headers:

• MIME-Version: Indicates the MIME specification version.
• Content-Type: Identifies the media type, such as text/html, image/png, or application/pdf.
• Content-Transfer-Encoding: States how content is encoded for safe transmission, such as Base64 or quoted-printable.
• Content-Disposition: Indicates whether content should appear inline or as an attachment and may specify a filename.

Multipart messages:

• multipart/mixed combines text and attachments.
• multipart/alternative supplies representations such as plain text and HTML.
• A unique boundary separates individual body parts.

For example, binary attachment bytes are commonly converted to Base64 text before SMTP transmission. The receiver reads the MIME headers, decodes each part, and presents or saves the content using the appropriate application.

File Transfer Protocol (FTP) transfers files between a client and server over TCP. Its distinguishing feature is the use of separate control and data connections.

Connections:

• The control connection normally uses server TCP port 21 and carries commands and replies.
• A separate data connection carries directory listings and file contents.

Active mode:

1. The client opens the control connection to port 21.
2. The client tells the server which client-side port should receive data.
3. The server normally initiates the data connection from TCP port 20 to the client.
4. Client-side firewalls or NAT devices may block this incoming connection.

Passive mode:

1. The client requests passive operation.
2. The server provides an address and a temporary port.
3. The client initiates the data connection to that server port.
4. It works more effectively with client-side NAT and firewalls.

FTP supports authentication, directory navigation, file upload, download, and transfer-type selection. Standard FTP sends credentials and data without encryption; FTPS adds TLS, while SFTP is a different protocol operating through SSH.

The four protocols differ in transport, complexity, and security:

• FTP: Uses TCP, normally ports 21 and 20 or negotiated data ports. It supports authentication, directory operations, and reliable file transfer, but standard FTP is unencrypted.
• TFTP: Uses UDP port 69 and provides very simple file transfer without normal user authentication or directory browsing. It is often used for device booting and configuration transfers on trusted networks.
• FTPS: FTP secured with TLS. It can use explicit TLS negotiation on port 21 or implicit TLS, commonly on port 990. It retains FTP's separate control and data channels.
• SFTP: SSH File Transfer Protocol. It operates over a single SSH connection, commonly TCP port 22, and provides encrypted file access, authentication, and file-management functions.

Key distinction: FTPS is an extension of FTP, whereas SFTP is a separate SSH-based protocol. SFTP is often easier to pass through firewalls because it normally uses one encrypted connection.

The World Wide Web (WWW) is a distributed hypermedia system that provides interlinked resources over the Internet.

Principal elements:

• Web browser: A client that requests resources and renders HTML, CSS, images, and other content.
• Web server: Stores or dynamically generates resources and responds to client requests.
• URL: Identifies a resource using components such as scheme, host, port, path, query, and fragment.
• DNS: Resolves the URL's host name into an IP address.
• HTTP or HTTPS: Defines request and response exchanges between clients and servers.
• HTML and hyperlinks: Structure documents and connect resources.

Working:

1. The user enters a URL or selects a hyperlink.
2. The browser parses the URL and checks local caches.
3. DNS resolves the host name.
4. The browser establishes a transport connection; HTTPS additionally establishes TLS security.
5. It sends an HTTP request for the resource.
6. The server returns a status code, headers, and possibly a response body.
7. The browser parses the document and requests referenced resources.
8. It constructs and renders the page and may execute scripts.

The Web therefore operates mainly through a client-server model, while caches, proxies, and content delivery networks improve performance and scalability.

HTTP request format:

• Request line: Contains method, request target, and HTTP version.
• Headers: Carry metadata such as host, accepted content types, authorization, cookies, and cache directives.
• Blank line: Separates headers from the optional body.
• Body: May carry form data, JSON, or uploaded content.

HTTP response format:

• Status line: Contains HTTP version, status code, and reason phrase where applicable.
• Headers: Describe server, media type, content length, caching, cookies, and related information.
• Blank line and optional body: Carry the returned representation or error details.

Common methods:

• GET: Retrieves a representation.
• POST: Submits data for processing or creates subordinate resources.
• PUT: Creates or replaces a resource at a known URI.
• PATCH: Partially modifies a resource.
• DELETE: Removes a resource.
• HEAD: Returns headers without the response body.

Status-code classes:

• 1xx: Informational
• 2xx: Successful, such as 200 OK
• 3xx: Redirection, such as 301 Moved Permanently
• 4xx: Client error, such as 404 Not Found
• 5xx: Server error, such as 500 Internal Server Error

HTTP transfers web messages without inherently encrypting or authenticating them. HTTPS is HTTP carried over TLS, commonly using TCP port 443, and provides:

• Confidentiality: Prevents passive reading of traffic.
• Integrity: Detects unauthorized modification.
• Authentication: Certificates normally authenticate the server and can optionally authenticate clients.

Persistent connections: Multiple HTTP request-response exchanges can reuse a transport connection, reducing repeated connection setup and latency.

Statelessness: Each HTTP request is logically independent; the server is not required to remember earlier requests. Applications add state through sessions or tokens.

Cookies: Small name-value data items set by a server and returned by a browser for matching requests. They support sessions and preferences. Security attributes include Secure, HttpOnly, and SameSite.

Caching: Browsers and intermediary caches store responses to reduce delay, bandwidth use, and server load. Headers such as Cache-Control, Expires, ETag, and Last-Modified control freshness and validation.

HTTPS protects data in transit, but it does not by itself guarantee that a website is trustworthy or that endpoints are free from malware.

Simple Network Management Protocol (SNMP) is an application-layer protocol used to monitor and manage network devices.

Architecture:

• Managed device: A router, switch, server, printer, or other monitored system.
• Agent: Software on the managed device that collects local information and communicates with the manager.
• SNMP manager or Network Management System (NMS): Queries agents, changes permitted settings, stores data, and displays alerts.
• Management Information Base (MIB): A logical database of managed objects identified by hierarchical Object Identifiers (OIDs).
• Structure of Management Information (SMI): Defines naming rules, data types, and encoding conventions for managed objects.

SNMP commonly uses UDP port 161 for requests and responses and UDP port 162 for traps or informs.

A manager can read counters such as interface octets and errors, modify authorized configuration values, and receive asynchronous event notifications. This enables fault, configuration, performance, and availability monitoring.

Major SNMP operations:

• GetRequest: Reads one or more managed objects.
• GetNextRequest: Retrieves the next OID and supports traversal of a MIB tree.
• GetBulkRequest: Efficiently retrieves multiple values; introduced in SNMPv2.
• SetRequest: Changes a writable managed object.
• Response: Returns requested data, confirmation, or an error.
• Trap: Sends an unacknowledged asynchronous notification from agent to manager.
• InformRequest: Sends a notification that requires acknowledgment.

Version comparison:

• SNMPv1: Basic monitoring and control with community-string authentication; limited security and data types.
• SNMPv2c: Adds improved error handling, 64-bit counters, GetBulk, and Inform operations, but still uses insecure plaintext community strings.
• SNMPv3: Adds user-based security with authentication, integrity, optional encryption, timeliness protection, and access control.

SNMPv3 security levels include noAuthNoPriv, authNoPriv, and authPriv. For production networks, SNMPv3 with authentication and privacy is preferred, together with restricted management access and strong credentials.

Internet Protocol Security (IPSec) is a suite of protocols that secures IP packets at the network layer. It can provide confidentiality, integrity, data-origin authentication, and anti-replay protection.

Authentication Header (AH):

• Provides integrity, origin authentication, and anti-replay protection.
• Does not encrypt user data.
• Protects selected IP-header fields and the payload.
• Its protection of header fields makes it less compatible with address translation.

Encapsulating Security Payload (ESP):

• Primarily provides confidentiality through encryption.
• Can also provide integrity, authentication, and anti-replay protection.
• It is more widely deployed than AH.

Transport mode:

• Protects the payload of the original IP packet.
• The original IP header remains visible.
• Commonly associated with host-to-host protection.

Tunnel mode:

• Protects the entire original IP packet by encapsulating it inside a new IP packet.
• A new outer header is added for routing.
• Commonly used for gateway-to-gateway and remote-access VPNs.

IPSec uses Security Associations (SAs) to define algorithms, keys, lifetimes, modes, and related parameters.

A Virtual Private Network (VPN) creates a protected logical connection across an untrusted network such as the Internet. It allows users or networks to communicate as though they were connected through a private infrastructure.

Remote-access VPN:

• Connects an individual user's device to an organization's VPN gateway.
• Commonly used by employees working from home or while traveling.
• Usually requires client authentication and may require VPN software.

Site-to-site VPN:

• Connects entire networks through VPN gateways.
• Commonly links branch offices to headquarters.
• End systems may not need to run VPN software because gateways handle protection.

Tunneling process:

1. The VPN endpoint encapsulates an original packet inside another packet.
2. Cryptographic algorithms may encrypt the protected content.
3. Integrity and authentication mechanisms detect modification and verify the peer.
4. The outer packet crosses the public network.
5. The destination VPN endpoint verifies, decrypts, and decapsulates it.

VPN technologies include IPSec, TLS-based VPNs, and other secure tunneling systems. VPN security depends on strong authentication, safe key management, secure endpoints, correct configuration, and timely software updates.

A firewall is a security system that monitors and controls traffic between network zones according to an established policy.

Firewall types:

• Packet-filtering firewall: Examines fields such as source and destination address, protocol, and port. It is fast but has limited application awareness.
• Stateful-inspection firewall: Tracks connection state and permits packets belonging to valid sessions. It provides better context than stateless filtering.
• Circuit-level gateway: Validates transport sessions and relays connections without deeply inspecting application content.
• Application proxy firewall: Terminates client connections and creates separate server connections. It can inspect application commands and content but may add delay.
• Next-generation firewall (NGFW): Combines stateful inspection with application identification, user awareness, intrusion prevention, URL filtering, and sometimes malware detection or TLS inspection.

Common policy principles:

• Apply default deny where practical.
• Permit only required services.
• Separate networks into security zones.
• Log significant allowed and denied traffic.
• Regularly review rules and remove obsolete entries.

A firewall reduces exposure but cannot replace endpoint security, secure application design, authentication, monitoring, and user awareness.