"The Linux Gazette...making Linux just a little more fun!"

Protocols on top of Protocols: It's Protocols ALL THE WAY DOWN!

From Alicia Romero on Mon, 11 Oct 1999

Hello my name is Alicia; I'm a student looking for help

I have a class of networking and there is one thing I don't get the Questions is What protocol is use typically by UNIX to connect to a network using TCP/IP?

Can you help me ??

It sounds like you are underestimate how much you don't get.

TCP/IP IS a set of networking protocols!

The question you ask, answers itself. UNIX uses the TCP/IP suite of protocols for almost all of its networking. IP (internet protocol) is the lower portion of the suite. TCP (transport control protocol), UDP (unreliable datagram protocol), ICMP (internetwork control messaging protocol), and other protocols work over IP.

IP packets have source and destination IP addresses. TCP packets add source and destination ports, sequence numbers, and options/flags to support flow control, acknowledgement and handshaking. UDP packet headers lack some of features of TCP packets, so they are different variations of an IP packet. ICMP packets (which are used by the 'ping' and some versions of the 'traceroute' commands) have headers that are different from UDP and TCP.

In addition to TCP, UDP, and ICMP there are also some other protocols that ride directly over IP (for example GRE, a routing encapsulation protocol).

Other (applications level) protocols are built over TCP and UDP. (ICMP is used for very specific operations, so protocols aren't generally built over that)(*).

• (An aquaintance who's wired into the black hat scene once told me about a kernel hack that implemented a "stealth telnet and file transfer protocol" by using the normally unused data payload portion of ICMP packets. This would require kernel modules or patches since normally ICMP packets are not routed to user space applications. I'm not sure if this story is apocryphal. If not it makes for a scary way for crackers to traverse many "naive" packet filtering schemes.)

So, protocols like telnet, HTTP, and FTP are implemented over TCP while protocols like SNMP, syslog and FSP(*) are implemented over UDP.

• (a fairly obscure file sharing protocol, which used to be particularly popular among purveyors of "warez" -- pirated software)

Some services use UDP and TCP. For example SMB uses hybrid protocols over both. DNS uses UDP for normal name resolution and uses TCP for "zone transfers" (updating secondary authority servers).

• (Another, mythical stealth communications tool apparently uses DNS/UDP packets with "magic" domain names as the communications mechanism. That's even scarier since there are lots of sites that block ICMP while there are fewer that would block DNS).

So, you have applications protocols over transport protocols. Under the IP layer you have network layer protocols like ethernet CSMA/CD, token ring, ARCnet, etc. Under that you have media layer (physical) protocols which describe the wires, fibres, voltages, frequences and modulation parameters of the signals that actually carry all of these protocols.

So, your question is a bit confusing. It's like asking:

What driver does a bus driver use to drive a bus?

UNIX and Linux predominantly use TCP/IP for most of their applications protocols. Connecting UNIX to a network involves running many protocols over the TCP/IP suite.

It's worth noting that Linux and some other forms of UNIX also offer support for some other transport protocols like Novell's IPX/SPX, Apple's DDP and DEC's DECnet (Pathworks) protocols.

All of this material should have been covered in the first day of any decent computer networking class. (Except for the references to FSP, and those mythical/apocryphal "stealth" protocols, of course).

Consider taking a better course, getting better text books to study on your own, or something --- because it sounds like this one is just not doing it for you.

Copyright © 1999, James T. Dennis
Published in The Linux Gazette Issue 48 December 1999

HTML transformation by of Starshine Technical Services, http://www.starshine.org/

					1	2	3	5
				5	6	7	8	9
10	11	12	13	14	15	16	17	18
19	20	21	22	23	24	25	26	27
28	29	30	31	32	33	34	35	36
37	38	39	40	41	42	43	44	45
46	47	48	49	50	51	52	53	54
55			56			57