What comes to the lecture devoted to transport protocols these are protocols operating in the fourth
and the fifth layers of the office I model this module will be devoted to the risks connected to these
protocols and the ways of mitigating them.
The fourth layer or transport layer consists of two protocols widely using computer protocol networks.
These are the TCAP and UDP protocols.
What they're responsible for bi directional communication however they differ in how they work and then
the function that they perform.
Why do we need the transport layer above the network layer.
One host can run more than one program on one network service.
This is usually so frequently used in email client Internet messenger cetera simultaneously all of them
work on the same host all of them will be identified by the same sender IP.
There must be a way then to differentiate the packets.
There must be a way to direct responses to corresponding programs.
Your e-mails shouldn't be received by the web browser and Web sites by the messenger.
This is where the transport layer and the TCAP and UDP protocols come into play.
These protocols allow us to unambiguously identify communication endpoints where sockets individual
sockets consist of an IP address a name of a transfer layer protocol such as TZP or UDP and a port number
one port can only be used by one program at a time.
It's more convenient when a given service is permanently assigned to a given port.
Therefore it's customary that low port numbers lower than 1024 are assigned to specific services.
For example an HDTV server listens on port 80 for TCAP client requests and port four for three is used
by each TTP as protocol.
This is only a convention nothing obliges the packet sender or receiver to use specific ports.
And that's why network firewalls that filter traffic on the basis of port number are easy to get through.
This is also the reason why many network traffic monitoring tools can be deceived.
If port 80 is used for communications with the use of a protocol other than TTP monitoring systems may
not analyze the data and over it such data is either completely ignored or just a couple of the first
characters from the data section get analyzed.
That's why a program called Gnutella which used to be used in peer to peer networks added get to the
beginning of each data packet.
The program just as with many others runs on port 80 having come across such a piece of data.
Many network intrusion detection systems and firewalls didn't analyze the packets further.
Thus we know already what sockets are.
Let's get back to the TCAP
stands for transmission control protocol.
The name means that the task of the protocol is to guarantee data delivery.
If you transfer some data through TZP even if you use an unreliable link and unreliable lower layer
protocols the client will get the data nevertheless.
In order to achieve that the TCAP uses sessions to transfer data.
Therefore you have to establish a session first.
This involves sequence number synchronization thanks to that the receiver will be able to detect that
some packets were lost in such a case the receiver may request a retransmission because TCAP uses sessions
for data transfer.
It can guarantee a successful delivery.
Moreover the protocol guarantees that the data is received in the same sequence it's sent.
This is achieved thanks to the sliding window mechanism.
The mechanism involves data buffer and each packet contains the information about the offset and data
flowed that must be accounted for in the buffer.
There are two terms connected with TCAP.
The most important is establishing or initiating a session is called hand-shaking.
Usually it's implemented as a three way hand-shaking
the next is transmission of packets through a sliding window of flow control.
The second protocol used in the transport layer is called UDP or user datagram protocol.
This is a stateless connection list protocol which means it does not guarantee a successful data delivery.
That's why UDP is used much less frequently than TZP UDP is mostly used in local networks to transfer
small amounts of data which can fit easily into the ethernet frame.
This can include DNS server queries the response is also so concise that it can be contained in one
packet.