could increase the priority of client 1 by using a polling sequence such as 1, 2, 3, 1, 4, 5, 1, 6, 7, 1, 8, 9.
Typically, roll-call polling involves some waiting because the controller has to poll a client and then wait
for a response. The response might be an incoming message that was waiting to be sent, a negative
response indicating nothing is to be sent, or the full “time-out period” may expire because the client is
temporarily out of service (e.g., it is malfunctioning or the user has turned it off). Usually, a timer “times
out” the client after waiting several seconds without getting a response. If some sort of fail-safe time-out is
not used, the circuit poll might lock up indefinitely on an out-of-service client.
With hub polling (often called token passing), one device starts the poll and passes it to the next
computer on the multipoint circuit, which sends its message and passes the poll to the next. That
computer then passes the poll to the next, and so on, until it reaches the first computer, which restarts the
process again.
4.2.3 Relative Performance
Which media access control approach is best: controlled access or contention? There is no simple answer.
The key consideration is throughput—which approach will permit the most amount of user data to be
transmitted through the network.
In general, contention approaches work better than controlled approaches for small networks that have
low usage. In this case, each computer can transmit when necessary, without waiting for permission.
Because the usage is low, there is little chance of a collision. In contrast, computers in a controlled access
environment must wait for permission, so even if no other computer needs to transmit, they must wait for
the poll.


the poll.
The reverse is true for large networks with high usage: Controlled access works better. In high-volume
networks, many computers want to transmit, and the probability of a collision using contention is high.
Collisions are very costly in terms of throughput because they waste circuit capacity during the collision
and require both computers to retransmit later. Controlled access prevents collisions and makes more
efficient use of the circuit, and although response time does increase, it does so more gradually (Figure 4-
1).
The key to selecting the best access control technique is to find the crossover point between controlled and
contention. Although there is no one correct answer, because it depends on how many messages the
computers in the network transmit, most experts believe that the crossover point is often around 20
computers (lower for busy computers, higher for less-busy computers). For this reason, when we build
shared multipoint circuits like those often used in LANs or wireless LANs, we try to put no more than 20
computers on any one shared circuit.


FIGURE 4-1 Relative response times
4.3 ERROR CONTROL
Before learning the control mechanisms that can be implemented to protect a network from errors, you
should realize that there are human errors and network errors. Human errors, such as a mistake in
typing a number, usually are controlled through the application program. Network errors, such as those
that occur during transmission, are controlled by the network hardware and software.
There are two categories of network errors: corrupted data (data that have been changed) and lost data.
Networks should be designed to (1) prevent, (2) detect, and (3) correct both corrupted data and lost data.
We begin by examining the sources of errors and how to prevent them and then turn to error detection
and correction.
Network errors are a fact of life in data communications networks. Depending on the type of circuit, they
may occur every few hours, minutes, or seconds because of noise on the lines. No network can eliminate
all errors, but most errors can be prevented, detected, and corrected by proper design. Inter-Exchange
Carriers (IXCs) that provide data transmission circuits provide statistical measures specifying typical
error rates and the pattern of errors that can be expected on the circuits they lease. For example, the
error rate might be stated as 1 in 500,000, meaning there is 1 bit in error for every 500,000 bits
transmitted.
Normally, errors appear in bursts. In a burst error, more than 1 data bit is changed by the error-causing
condition. In other words, errors are not uniformly distributed in time. Although an error rate might be
stated as 1 in 500,000, errors are more likely to occur as 100 bits every 50,000,000 bits. The fact that


errors tend to be clustered in bursts rather than evenly dispersed is both good and bad. If the errors were
not clustered, an error rate of 1 bit in 500,000 would make it rare for 2 erroneous bits to occur in the same
character. Consequently, simple character-checking schemes would be effective at detecting errors. When
errors are more or less evenly distributed, it is not difficult to grasp the meaning even when the error rate
is high, as it is in this sentence (1 character in 20). But burst errors are the rule rather than the exception,
often obliterating 100 or more bits at a time. This makes it more difficult to recover the meaning, so more


reliance must be placed on error detection and correction methods. The positive side is that there are long
periods of error-free transmission, meaning that very few messages encounter errors.
4.3.1 Sources of Errors
Line noise and distortion can cause data communication errors. The focus in this section is on electrical
media such as twisted pair wire and coaxial cable because they are more likely to suffer from noise than
are optical media such as fiber-optic cable. In this case, noise is undesirable electrical signals (for fiber-
optic cable, it is undesirable light). Noise is introduced by equipment or natural disturbances, and it
degrades the performance of a communication circuit. Noise manifests itself as extra bits, missing bits, or
bits that have been “flipped” (i.e., changed from 1 to 0 or vice versa). Figure 4-2 summarizes the major
sources of error and ways to prevent them. The first six sources listed there are the most important; the
last three are more common in analog rather than digital circuits.
FIGURE 4-2 Sources of errors and ways to minimize them
White noise or Gaussian noise (the familiar background hiss or static on radios and telephones) is
caused by the thermal agitation of electrons and therefore is inescapable. Even if the equipment were
perfect and the wires were perfectly insulated from any and all external interference, there still would be
some white noise. White noise usually is not a problem unless it becomes so strong that it obliterates the
transmission. In this case, the strength of the electrical signal is increased so it overpowers the white
noise; in technical terms, we increase the signal-to-noise ratio.
Impulse noise (sometimes called spikes) is the primary source of errors in data communications. It is


heard as a click or a crackling noise and can last as long as 1/100 of a second. Such a click does not really
affect voice communications, but it can obliterate a group of data, causing a burst error. At 1.5 Mbps,
15,000 bits would be changed by a spike of 1/100 of a second. Some of the sources of impulse noise are
voltage changes in adjacent lines, lightning flashes during thunderstorms, fluorescent lights, and poor
connections in circuits.
Cross-talk occurs when one circuit picks up signals in another. A person experiences cross-talk during
telephone calls when she or he hears other conversations in the background. It occurs between pairs of
wires that are carrying separate signals, in multiplexed links carrying many discrete signals, or in
microwave links in which one antenna picks up a minute reflection from another antenna. Cross-talk
between lines increases with increased communication distance increased proximity of the two wires,
increased signal strength, and higher-frequency signals. Wet or damp weather can also increase cross-
talk. Like white noise, cross-talk has such a low signal strength that it normally is not bothersome.
Echoes are the result of poor connections that cause the signal to reflect back to the transmitting
equipment. If the strength of the echo is strong enough to be detected, it causes errors. Echoes, like cross-
talk and white noise, have such a low signal strength that they normally are not bothersome. Echoes can
also occur in fiber-optic cables when connections between cables are not properly aligned.
Attenuation is the loss of power a signal suffers as it travels from the transmitting computer to the
receiving computer. Some power is absorbed by the medium or is lost before it reaches the receiver. As the


medium absorbs power, the signal becomes weaker, and the receiving equipment has less and less chance
of correctly interpreting the data. This power loss is a function of the transmission method and circuit
medium. High frequencies lose power more rapidly than do low frequencies during transmission, so the
received signal can thus be distorted by unequal loss of its component frequencies. Attenuation increases
as frequency increases or as the diameter of the wire decreases.
Intermodulation noise is a special type of cross-talk. The signals from two circuits combine to form a
new signal that falls into a frequency band reserved for another signal. This type of noise is similar to
harmonics in music. On a multiplexed line, many different signals are amplified together, and slight
variations in the adjustment of the equipment can cause intermodulation noise. A maladjusted modem
may transmit a strong frequency tone when not transmitting data, thus producing this type of noise.
In general, errors are more likely to occur in wireless, microwave, or satellite transmission than in
transmission through cables. Therefore, error detection is more important when using radiated media
than guided media. Impulse noise is the most frequent cause of errors in today’s networks. Unfortunately,
as the next section describes, it could be very difficult to determine what caused this type of error.
4.3.2 Error Prevention
Obviously, error prevention is very important. There are many techniques to prevent errors (or at least
reduce them), depending on the situation. Shielding (protecting wires by covering them with an insulating
coating) is one of the best ways to prevent impulse noise, cross-talk, and intermodulation noise. Many
different types of wires and cables are available with different amounts of shielding. In general, the
greater the shielding, the more expensive the cable and the more difficult it is to install.


greater the shielding, the more expensive the cable and the more difficult it is to install.
Moving cables away from sources of noise (especially power sources) can also reduce impulse noise,
cross-talk, and intermodulation noise. For impulse noise, this means avoiding lights and heavy
machinery. Locating communication cables away from power cables is always a good idea. For cross-talk,
this means physically separating the cables from other communication cables.
Cross-talk and intermodulation noise is often caused by improper multiplexing. Changing multiplexing
techniques (e.g., from FDM [Frequency Division Multiplexing] to TDM [Time Division Multiplexing]) or
changing the frequencies or size of the guardbands in FDM can help.
Many types of noise (e.g., echoes, white noise) can be caused by poorly maintained equipment or poor
connections and splices among cables. This is particularly true for echo in fiber-optic cables, which is
almost always caused by poor connections. The solution here is obvious: Tune the transmission
equipment and redo the connections.
To avoid attenuation, telephone circuits have repeaters or amplifiers spaced throughout their length.
The distance between them depends on the amount of power lost per unit length of the transmission line.
An amplifier takes the incoming signal, increases its strength, and retransmits it on the next section of the
circuit. They are typically used on analog circuits such as the telephone company’s voice circuits. The
distance between the amplifiers depends on the amount of attenuation, although 1- to 10-mile intervals
are common. On analog circuits, it is important to recognize that the noise and distortion are also
amplified, along with the signal. This means some noise from a previous circuit is regenerated and
amplified each time the signal is amplified.
MANAGEMENT FOCUS 4-1
Finding the Source of Impulse Noise


MANAGEMENT FOCUS 4-1
Finding the Source of Impulse Noise
Several years ago, the University of Georgia radio station received FCC (Federal Communications
Commission) approval to broadcast using a stronger signal. Immediately after the station started
broadcasting with the new signal, the campus backbone network (BN) became unusable because of
impulse noise. It took 2 days to link the impulse noise to the radio station, and when the radio
station returned to its usual broadcast signal, the problem disappeared.
However, this was only the first step in the problem. The radio station wanted to broadcast at full


strength, and there was no good reason for why the stronger broadcast should affect the BN in this
way. After 2 weeks of effort, the problem was discovered. A short section of the BN ran above ground
between two buildings. It turned out that the specific brand of outdoor cable we used was
particularly tasty to squirrels. They had eaten the outer insulating coating off of the cable, making it
act like an antenna to receive the radio signals. The cable was replaced with a steel-coated armored
cable so the squirrels could not eat the insulation. Things worked fine when the radio station
returned to its stronger signal.
Repeaters are commonly used on digital circuits. A repeater receives the incoming signal, translates it into
a digital message, and retransmits the message. Because the message is recreated at each repeater, noise,
and distortion from the previous circuit are not amplified. This provides a much cleaner signal and results
in a lower error rate for digital circuits.
4.3.3 Error Detection
It is possible to develop data transmission methodologies that give very high error-detection
performance. The only way to do error detection is to send extra data with each message. These error-
detection data are added to each message by the data link layer of the sender based on some mathematical
calculations performed on the message (in some cases, error-detection methods are built into the
hardware itself). The receiver performs the same mathematical calculations on the message it receives and
matches its results against the error-detection data that were transmitted with the message. If the two
match, the message is assumed to be correct. If they don’t match, an error has occurred.
In general, the larger the amount of error-detection data sent, the greater the ability to detect an error.
However, as the amount of error-detection data is increased, the throughput of useful data is reduced,


because more of the available capacity is used to transmit these error-detection data and less is used to
transmit the actual message itself. Therefore, the efficiency of data throughput varies inversely as the
desired amount of error detection is increased.
Three well-known error-detection methods are parity checking, checksum, and cyclic redundancy
checking.
Parity Checking
One of the oldest and simplest error-detection methods is parity. With this technique, one additional bit
is added to each byte in the message. The value of this additional parity bit is based on the number of 1s
in each byte transmitted. This parity bit is set to make the total number of 1s in the byte (including the
parity bit) either an even number or an odd number. Figure 4-3 gives an example.
A little thought will convince you that any single error (a switch of a 1 to a 0, or vice versa) will be detected
by parity, but it cannot determine which bit was in error. You will know an error occurred, but not what
the error was. But if two bits are switched, the parity check will not detect any error. It is easy to see that
parity can detect errors only when an odd number of bits have been switched; any even number of errors
cancel one another out. Therefore, the probability of detecting an error, given that one has occurred, is
only about 50%. Many networks today do not use parity because of its low error-detection rate. When
parity is used, protocols are described as having odd parity or even parity.


FIGURE 4-3 Using parity for error detection
Checksum
With the checksum technique, a checksum (typically 1 byte) is added to the end of the message. The
checksum is calculated by adding the decimal value of each character in the message, dividing the sum by
255, and using the remainder as the checksum. The receiver calculates its own checksum in the same way
and compares it with the transmitted checksum. If the two values are equal, the message is presumed to
contain no errors. The use of checksum detects close to 95% of the errors for multiple-bit burst errors.
Cyclic Redundancy Check
One of the most popular error-checking schemes is the cyclic redundancy check (CRC). It adds 8, 16,
24, or 32 bits to the message. With CRC, a message is treated as one long binary number, which is divided
by a preset number, and the remainder is used as the CRC code. The preset number is chosen so that the
remainder will be either 8 bits, 16 bits, 24 bits, or 32 bits. The receiving hardware divides the received
message by the same preset number, which generates a remainder. The receiving hardware checks if the
received CRC matches the locally generated remainder. If it does not, the message is assumed to be in
error. In practice, the CRC algorithm is implemented using binary logic on a bit-by-bit basis to simplify
memory requirements.
CRC performs quite well. The most commonly used CRC codes are CRC-16 (a 16-bit version), CRC-CCITT
(another 16-bit version), and CRC-32 (a 32-bit version). The probability of detecting an error is 100% for
all errors of the same length as the CRC or less. For example, CRC-16 is guaranteed to detect errors if 16 or


fewer bits are affected. If the burst error is longer than the CRC, then CRC is not perfect but is close to it.
CRC-16 will detect about 99.998% of all burst errors longer than 16 bits, whereas CRC-32 will detect about
99.99999998% of all burst errors longer than 32 bits.
4.3.4 Error Correction via Retransmission
Once an error has been detected, it must be corrected. The simplest, most effective, least expensive, and
most commonly used method for error correction is retransmission. Interestingly, the transport layer
(layer 3) is responsible for retransmission, and we will discuss the details of it in Chapter 5.
4.3.5 Forward Error Correction
Forward error correction uses codes containing sufficient redundancy to prevent errors by detecting
and correcting them at the receiving end without retransmission of the original message. The redundancy,
or extra bits required, varies with different schemes. It ranges from a small percentage of extra bits to
100% redundancy, with the number of error-detecting bits roughly equaling the number of data bits. One


of the characteristics of many error-correcting codes is that there must be a minimum number of error-
free bits between bursts of errors.
Forward error correction is commonly used in satellite transmission. A round trip from the earth station
to the satellite and back includes a significant delay. Error rates can fluctuate depending on the condition
of equipment, sunspots, or the weather. Indeed, some weather conditions make it impossible to transmit
without some errors, making forward error correction essential. Compared with satellite equipment costs,
the additional cost of forward error correction is insignificant.
TECHNICAL FOCUS 4-1
How Forward Error Correction Works
To see how error-correcting codes work, consider the example of a forward error-checking code in
Figure 4-4, called a Hamming code, after its inventor, R. W. Hamming. This code is a very simple
approach, capable of correcting 1-bit errors. More sophisticated techniques (e.g., Reed–Solomon)
are commonly used today, but this will give you a sense of how they work.
The Hamming code associates even parity bits with unique combinations of data bits. With a 4-data-
bit code as an example, a character might be represented by the data-bit configuration 1010. Three
parity bits, P1, P2, and P4, are added, resulting in a 7-bit code, shown in the upper half of Figure 4-6.
Notice that the data bits (D3, D5, D6, D7) are 1010 and the parity bits (P1, P2, P4) are 101.
As depicted in the upper half of Figure 4-6, parity bit P1 applies to data bits D3, D5, and D7. Parity bit


P2 applies to data bits D3, D6, and D7. Parity bit P4 applies to data bits D5, D6, and D7. For example,
in which D3, D5, D6, D7 = 1010, P1 must equal 1 because there is only a single 1 among D3, D5, and D7
and parity must be even. Similarly, P2 must be 0 because D3 and D6 are 1s. P4 is 1 because D6 is the
only 1 among D5, D6, and D7.
Now, assume that during the transmission, data bit D7 is changed from a 0 to a 1 by line noise.
Because this data bit is being checked by P1, P2, and P4, all three parity bits now show odd parity
instead of the correct even parity. D7 is the only data bit that is monitored by all three parity bits;
therefore, when D7 is in error, all three parity bits show an incorrect parity. In this way, the receiving
equipment can determine which bit was in error and reverse its state, thus correcting the error
without retransmission.
The lower half of the figure is a table that determines the location of the bit in error. A 1 in the table
means that the corresponding parity bit indicates a parity error. Conversely, a 0 means that the
parity check is correct. These 0s and 1s form a binary number that indicates the numeric location of
the erroneous bit. In the previous example, P1, P2, and P4 checks all failed, yielding 111, or a decimal
7, the subscript of the erroneous bit.
4.3.6 Error Control in Practice


7, the subscript of the erroneous bit.
4.3.6 Error Control in Practice
In the Open Systems Interconnection (OSI) model (see Chapter 1), error control is defined to be a layer-2
function—it is the responsibility of the data link layer. However, in practice, we have moved away from
this. Most network cables—especially LAN cables—are very reliable, and errors are far less common than
they were in the 1980s.
Therefore, most data link layer software used in LANs (i.e., Ethernet) is configured to detect errors, but
not correct them. Any time a packet with an error is discovered, it is simply discarded. Wireless LANs and
some Wide Area Networks (WANs), where errors are more likely, still perform both error detection and
error correction.
The implication from this is that error correction must be performed at higher layers (see Chapter 5,
Section 5.3.3, for more information). This is commonly done by the transport layer using continuous
automatic repeat reQuest (ARQ), as we shall see in the next chapter. The transport layer must be


able to detect lost packets (i.e., those that have been discarded) and request the sender to retransmit
them.
FIGURE 4-4 Hamming code for forward error correction
4.4 DATA LINK PROTOCOLS
In this section, we outline several commonly used data link layer protocols, which are summarized in
Figure 4-5. Here, we focus on message delineation, which indicates where a message starts and stops, and
the various parts or fields within the message. For example, you must clearly indicate which part of a
message or packet of data is the error-control portion; otherwise, the receiver cannot use it properly to
determine if an error has occurred. The data link layer performs this function by adding a PDU to the
packet it receives from the network layer. This PDU is called a frame.


FIGURE 4-5 Protocol summary
4.4.1 Asynchronous Transmission
Asynchronous transmission is often referred to as start–stop transmission because the transmitting
computer can transmit a character whenever it is convenient, and the receiving computer will accept that
character. It is typically used on point-to-point full-duplex circuits (i.e., circuits that have only two
computers on them), so media access control is not a concern. If you use VT100 protocol or connect to a
UNIX or Linux computer using Telnet, chances are you are using asynchronous transmission.
With asynchronous transmission, each character is transmitted independently of all other characters. To
separate the characters and synchronize transmission, a start bit and a stop bit are put on the front and
back of each individual character. For example, if we are using 7-bit ASCII with even parity, the total
transmission is 10 bits for each character (1 start bit, 7 bits for the letter, 1 parity bit, and 1 stop bit).
The start bit and stop bit are the opposite of each other. Typically, the start bit is a 0 and the stop bit is a 1.
There is no fixed distance between characters because the terminal transmits the character as soon as it is
typed, which varies with the speed of the typist. The recognition of the start and stop of each message
(called synchronization) takes place for each individual character because the start bit is a signal that
tells the receiver to start sampling the incoming bits of a character so the data bits can be interpreted into
their proper character structure. A stop bit informs the receiver that the character has been received and
resets it for recognition of the next start bit.
When the sender is waiting for the user to type the next character, no data are sent; the communication


circuit is idle. This idle time really is artificial—some signal always must be sent down the circuit. For
example, suppose that we are using a unipolar digital signaling technique where +5 volts indicates a 1 and
0 volts indicates a 0 (see Chapter 3). Even if we send 0 volts, we are still sending a signal, a 0 in this case.
Asynchronous transmission defines the idle signal (the signal that is sent down the circuit when no data
are being transmitted) as the same as the stop bit. When the sender finishes transmitting a letter and is
waiting for more data to send, it sends a continuous series of stop bits. Figure 4-6 shows an example of
asynchronous transmission. Some older protocols have two stop bits instead of the traditional single stop
bit. The use of both a start bit and a stop bit is changing; some protocols have eliminated the stop bit
altogether.
4.4.2 Synchronous Transmission
With synchronous transmission, all the letters or data in one group of data are transmitted at one
time as a block of data. This block of data is called a frame. For example, a terminal or a personal
computer will save all the keystrokes typed by the user and transmit them only when the user presses a
special “transmit” key. In this case, the start and end of the entire frame must be marked, not the start and
end of each letter. Synchronous transmission is often used on both point-to-point and multipoint circuits.
For multipoint circuits, each packet must include a destination address and a source address, and media
access control is important.


FIGURE 4-6 Asynchronous transmission. ASCII = United States of America Standard Code for
Information Interchange
The start and end of each frame (synchronization) sometimes are established by adding synchronization
characters (SYN) to the start of the frame. Depending on the protocol, there may be anywhere from one to
eight SYN characters. After the SYN characters, the transmitting computer sends a long stream of data
that may contain thousands of bits. Knowing what code is being used, the receiving computer counts off
the appropriate number of bits for the first character, assumes that this is the first character, and passes it
to the computer. It then counts off the bits for the second character, and so on.
In summary, asynchronous data transmission means each character is transmitted as a totally
independent entity with its own start and stop bits to inform the receiving computer that the character is
beginning and ending. Synchronous transmission means that whole blocks of data are transmitted as
frames after the sender and the receiver have been synchronized.
There are many protocols for synchronous transmission. We discuss four commonly used synchronous
data link protocols.
Synchronous Data Link Control
Synchronous data link control (SDLC) is a mainframe protocol developed by IBM in 1972 that is still in
use today. It uses a controlled-access media access protocol. If you use a 3270 protocol, you’re using
SDLC.
Figure 4-7 shows a typical SDLC frame. Each SDLC frame begins and ends with a special bit pattern
(01111110), known as the flag. The address field identifies the destination. The length of the address field
is usually 8 bits but can be set at 16 bits; all computers on the same network must use the same length.
The control field identifies the kind of frame that is being transmitted, either information or supervisory.


The control field identifies the kind of frame that is being transmitted, either information or supervisory.
An information frame is used for the transfer and reception of messages, frame numbering of contiguous
frames, and the like. A supervisory frame is used to transmit acknowledgments (ACKs) and negative
acknowledgment (NAKs). The message field is of variable length and is the user’s message. The frame
check sequence field is a 32-bit CRC code (some older versions use a 16-bit CRC).
High-Level Data Link Control
High-level data link control (HDLC) is a formal standard developed by the ISO often used in WANs.
HDLC is essentially the same as SDLC, except that the address and control fields can be longer. HDLC
also has several additional benefits that are beyond the scope of this book, such as a larger sliding
window for continuous ARQ. It uses a controlled-access media access protocol. One variant, Link
Access Protocol-Balanced (LAP-B), uses the same structure as HDLC but is a scaled-down version of
HDLC (i.e., provides fewer of those benefits mentioned that are “beyond the scope of this book”). A
version of HDLC called Cisco HDLC (cHDLC) includes a network protocol field. cHDLC and HDLC have
gradually replaced SDLC.
Ethernet
Ethernet is a very popular LAN protocol, conceived by Bob Metcalfe in 1973 and developed jointly by
Digital, Intel, and Xerox in the 1970s. Since then, Ethernet has been further refined and developed into a
formal standard called IEEE 802.3ac. There are several versions of Ethernet in use today. Ethernet uses
a contention media access protocol.


There are several standard versions of Ethernet. Figure 4-8 shows an Ethernet 803.3ac frame. The frame
starts with a 7-byte preamble, which is a repeating pattern of ones and zeros (10101010). This is followed
by a start of frame delimiter, which marks the start of the frame. The destination address specifies the
receiver, whereas the source address specifies the sender. The length indicates the length in 8-bit bytes of
the message portion of the frame. The VLAN tag field is an optional 4-byte address field used by virtual
LANs (VLANs), which are discussed in Chapter 7. The Ethernet frame uses this field only when VLANs are
in use; otherwise, the field is omitted, and the length field immediately follows the source address field.
When the VLAN tag field is in use, the first 2 bytes are set to the number 24,832 (hexadecimal 81-00),
which is obviously an impossible packet length. When Ethernet sees this length, it knows that the VLAN
tag field is in use. When the length is some other value, it assumes that VLAN tags are not in use and that
the length field immediately follows the source address field. The DSAP and SSAP are used to pass control
information between the sender and the receiver. These are often used to indicate the type of network
layer protocol the packet contains (e.g., TCP/IP or IPX/SPX, as described in Chapter 5). The control field
is used to hold the frame sequence numbers and ACKs and NAKs used for error control, as well as to
enable the data link layers of communicating computers to exchange other control information. The last 2
bits in the first byte are used to indicate the type of control information being passed and whether the


bits in the first byte are used to indicate the type of control information being passed and whether the
control field is 1 or 2 bytes (e.g., if the last 2 bits of the control field are 11, then the control field is 1 byte in
length). In most cases, the control field is 1-byte long. The maximum length of the message is about 1,500
bytes. The frame ends with a CRC-32 frame check sequence used for error detection.
FIGURE 4-7 SDLC (synchronous data link control) frame layout
FIGURE 4-8a Ethernet 802.3ac frame layout
Ethernet II is another commonly used version of Ethernet. Like SDLC, it uses a preamble to mark the
start of the frame. It has the same source and destination address format as Ethernet 802.3ac. The type
field is used to specify an ACK frame or the type of network layer packet the frame contains (e.g., IP). The
data and frame check sequence fields are the same as Ethernet 802.3ac. Ethernet II has an unusual way of
marking the end of a frame. It uses bipolar signaling to send 1s (positive voltage) and 0s (negative voltage)
(see Chapter 3). When the frame ends, the sending computer transmits no signal for 96 bits (i.e., neither a
0 nor a 1). After these 96 bits have been on no signal, the sending computer then transmits the next frame,
which starts with a preamble, and so on. It is possible that in the time that the computer is sending no
signal, some other computer could jump in and begin transmitting. In fact, this 96-bit pause is designed
to prevent any one computer from monopolizing the circuit. Figure 4-8 shows an Ethernet II frame.


Newer versions of these two types of Ethernet permit jumbo frames with up to 9,000 bytes of user data in
the message field. Some vendors are experimenting with super jumbo frames that can hold up to 64,000
bytes. Jumbo frames are common for some types of Ethernet such as gigabit Ethernet (see Chapter 6).
Point-to-Point Protocol
Point-to-Point Protocol (PPP) was developed in the early 1990s and is often used in WANs. It is
designed to transfer data over a point-to-point circuit but provides an address so that it can be used on
multipoint circuits. Figure 4-9 shows the basic layout of a PPP frame, which is very similar to an SDLC or
HDLC frame. The frame starts with a flag and has a 1-byte address (which is not used on point-to-point
circuits). The control field is typically not used. The protocol field indicates what type of data packet the
frame contains (e.g., an IP packet). The data field is variable in length and may be up to 1,500 bytes. The
frame check sequence is usually a CRC-16 but can be a CRC-32. The frame ends with a flag.


FIGURE 4-8b Ethernet II frame layout
FIGURE 4-9 PPP frame layout
A Day in the Life: Network Support Technician
When a help call arrives at the help desk, the help desk staff (first-level support) spends up to 10
minutes attempting to solve the problem. If they can’t, then the problem is passed to the second-
level support, the network support technician.
A typical day in the life of a network support technician starts by working on computers from the day
before. Troubleshooting usually begins with a series of diagnostic tests to eliminate hardware
problems. The next step, for a laptop, is to remove the hard disk and replace it with a hard disk
containing a correct standard image. If the computer passes those tests, then the problem is usually
the software. Then the fun begins.
Once a computer has been fixed, it is important to document all the hardware and/or software
changes to help track problem computers or problem software. Sometimes, a problem is new but
relatively straightforward to correct once it has been diagnosed. In this case, the technician will
change the standard support process followed by the technicians working at the help desk to catch
the problem before it is escalated to the network support technicians. In other cases, a new entry is
made into the organization’s technical support knowledge base so that if another technician (or user)
encounters the problem, it is easier for him or her to diagnose and correct the problem. About 10% of
the network technician’s time is spent documenting solutions to problems.
Network support technicians also are the ones who manage new inventory and set up and configure
new computers as they arrive from the manufacturer. In addition, they are responsible for deploying
new software and standard desktop images across the network. Many companies also set aside
standard times for routine training; in our case, every Friday, several hours are devoted to regular


standard times for routine training; in our case, every Friday, several hours are devoted to regular
training.
Source: With thanks to Doug Strough.
4.5 TRANSMISSION EFFICIENCY
One objective of a data communication network is to move the highest possible volume of accurate
information through the network. The higher the volume, the greater the resulting network’s efficiency
and the lower the cost. Network efficiency is affected by characteristics of the circuits such as error rates
and maximum transmission speed, as well as by the speed of transmitting and receiving equipment, the
error-detection and control methodology, and the protocol used by the data link layer.
Each protocol we discussed uses some bits or bytes to delineate the start and end of each message and to
control error. These bits and bytes are necessary for the transmission to occur, but they are not part of the
message. They add no value to the user, but they count against the total number of bits that can be


transmitted.
Each communication protocol has both information bits and overhead bits. Information bits are those
used to convey the user’s meaning. Overhead bits are used for purposes such as error checking and
marking the start and end of characters and packets. A parity bit used for error checking is an overhead
bit because it is not used to send the user’s data; if you did not care about errors, the overhead error
checking bit could be omitted and the users could still understand the message.
Transmission efficiency is defined as the total number of information bits (i.e., bits in the message
sent by the user) divided by the total bits in transmission (i.e., information bits plus overhead bits). For
example, let’s calculate the transmission efficiency of asynchronous transmission. Assume that we are
using 7-bit ASCII. We have 1 bit for parity, plus 1 start bit and 1 stop bit. Therefore, there are 7 bits of
information in each letter, but the total bits per letter is 10 (7 + 3). The efficiency of the asynchronous
transmission system is 7 bits of information divided by 10 total bits or 70%.
In other words, with asynchronous transmission, only 70% of the data rate is available for the user; 30% is
used by the transmission protocol. If we have a communication circuit using a dial-up modem receiving
56 Kbps, the user sees an effective data rate (or throughput) of 39.2 Kbps. This is very inefficient.
We can improve efficiency by reducing the number of overhead bits in each message or by increasing the
number of information bits. For example, if we remove the stop bits from the asynchronous transmission,
efficiency increases to or 77.8%. The throughput of a dial-up modem at 56 Kbps would increase 43.6


Kbps, which is not great but is at least a little better.
The same basic formula can be used to calculate the efficiency of synchronous transmission. For example,
suppose that we are using SDLC. The number of information bits is calculated by determining how many
information characters are in the message. If the message portion of the frame contains 100 information
characters and we are using an 8-bit code, then there are 100 × 8 = 800 bits of information. The total
number of bits is the 800 information bits plus the overhead bits that are inserted for delineation and
error control. Figure 4-9 shows that SDLC has a beginning flag (8 bits), an address (8 bits), a control field
(8 bits), a frame check sequence (assume that we use a CRC-32 with 32 bits), and an ending flag (8 bits).
This is a total of 64 overhead bits; thus, efficiency is 800/(800 + 64) = 92.6%. If the circuit provides a
data rate of 56 Kbps, then the effective data rate available to the user is about 51.9 Kbps.
This example shows that synchronous networks usually are more efficient than asynchronous networks
and that some protocols are more efficient than others. The longer the message (1,000 characters as
opposed to 100), the more efficient the protocol. For example, suppose that the message in the SDLC
example contained 1,000 bytes. The efficiency here would be 99.2% or 8000/(8000 + 64), giving an
effective data rate of about 55.6 Kbps.
The general rule is that the larger the message field, the more efficient the protocol. So why not have
10,000-byte or even 100,000-byte packets to really increase the efficiency? The answer is that anytime a


frame is received containing an error, the entire frame must be retransmitted. Thus, if an entire file is sent
as one large packet (e.g., 100 K) and 1 bit is received in error, all 100,000 bytes must be sent again.
Clearly, this is a waste of capacity. Furthermore, the probability that a frame contains an error increases
with the size of the frame; larger frames are more likely to contain errors than are smaller ones, simply
because of the laws of probability.
Thus, in designing a protocol, there is a trade-off between large and small frames. Small frames are less
efficient but are less likely to contain errors and cost less (in terms of circuit capacity) to retransmit if
there is an error (Figure 4-10).
Throughput is the total number of information bits received per second, after taking into account the
overhead bits and the need to retransmit frames containing errors. Generally speaking, small frames
provide better throughput for circuits with more errors, whereas larger frames provide better throughput
in less-error-prone networks. Fortunately, in most real networks, the curve shown in Figure 4-10 is very
flat on top, meaning that there is a range of frame sizes that provide almost optimum performance. Frame
sizes vary greatly among different networks, but the ideal frame size tends to be between 2,000 and
10,000 bytes.


FIGURE 4-10 Frame size effects on throughput
So why are the standard sizes of Ethernet frames about 1,500 bytes? Because Ethernet was standardized
many years ago when errors were more common. Jumbo and super jumbo frame sizes emerged from
higher speed, highly error-free fiber-optic networks.
MANAGEMENT FOCUS 4-2
Sleuthing for the Right Frame Size
Optimizing performance in a network, particularly a client-server network, can be difficult because
few network managers realize the importance of the frame size. Selecting the right—or the wrong—
frame size can have greater effects on performance than anything you might do to the server.
Standard Commercial, a multinational tobacco and agricultural company, noticed a decrease in
network performance when they upgraded to a new server. They tested the effects of using frame
sizes between 500 bytes and 32,000 bytes. In their tests, a frame size of 512 bytes required a total of
455,000 bytes transmitted over their network to transfer the test messages. In contrast, the 32,000-
byte frames were far more efficient, cutting the total data by 44% to 257,000 bytes.
However, the problem with 32,000-byte frames was a noticeable response time delay because
messages were saved until the 32,000-byte frames were full before transmitting.
The ideal frame size depends on the specific application and the pattern of messages it generates.
For Standard Commercial, the ideal frame size appeared to be between 4,000 and 8,000 bytes.
Unfortunately, not all network software packages enable network managers to fine-tune frame sizes
in this way.
Source: Adapted from “Sleuthing for the Right Packet Size,” Info-World, January 16, 1995.


4.6 IMPLICATIONS FOR CYBER SECURITY
One of the main responsibilities of the data link layer is to determine who can transmit at what time and
ensure that the message is delivered to the correct computer. The data link layer uses the MAC address
(a.k.a. physical address) to recognize the source and destination addresses (see Figures 4-8a and 4-8b) of
two computers that communicate with each other. If you want to allow only certain computers to connect
to your network, you can use MAC address filtering. MAC address filtering will create a list of MAC
addresses that are allowed to connect to a Wi-Fi network or to a switch in corporate networks. This
feature allows for some degree of security.
However, MAC address filtering can offer a false sense of security because of MAC address spoofing. The
MAC address is assigned to a computer network interface card in a factory and is therefore hardcoded on
the network interface card (NIC) and cannot be changed. MAC address spoofing is a software-enabled
technique that can change the hardcoded MAC address to any MAC address and thus overcome MAC
address filtering. There are many tutorials on how to spoof a MAC address; here is one that does a good
job explaining it: https://www.youtube.com/watch?v=ePtCvwmNhb4. Keep in mind that while MAC
address spoofing is not illegal, what you do with it may be.
SUMMARY
Media Access Control Media access control refers to controlling when computers transmit. There
are three basic approaches. With roll-call polling, the server polls client computers to see if they have
data to send; computers can transmit only when they have been polled. With hub polling or token
passing, the computers themselves manage when they can transmit by passing a token to one other;
no computer can transmit unless it has the token. With contention, computers listen and transmit


no computer can transmit unless it has the token. With contention, computers listen and transmit
only when no others are transmitting. In general, contention approaches work better for small
networks that have low levels of usage, whereas polling approaches work better for networks with
high usage.
Sources and Prevention of Error Errors occur in all networks. Errors tend to occur in groups (or
bursts) rather than 1 bit at a time. The primary sources of errors are impulse noises (e.g., lightning),
cross-talk, echo, and attenuation. Errors can be prevented (or at least reduced) by shielding the
cables; moving cables away from sources of noise and power sources; using repeaters (and, to a lesser
extent, amplifiers); and improving the quality of the equipment, media, and their connections.
Error Detection and Correction All error-detection schemes attach additional error-detection
data, based on a mathematical calculation, to the user’s message. The receiver performs the same
calculation on incoming messages, and if the results of this calculation do not match the error-
detection data on the incoming message, an error has occurred. Parity, checksum, and CRC are the
most common error-detection schemes. The most common error-correction technique is simply to
ask the sender to retransmit the message until it is received without error. A different approach,
forward error correction, includes sufficient information to allow the receiver to correct the error in
most cases without asking for a retransmission.
Message Delineation Message delineation means to indicate the start and end of a message.
Asynchronous transmission uses start and stop bits on each letter to mark where they begin and end.
Synchronous techniques (e.g., SDLC, HDLC, Ethernet, PPP) group blocks of data together into
frames that use special characters or bit patterns to mark the start and end of entire messages.


frames that use special characters or bit patterns to mark the start and end of entire messages.
Transmission Efficiency and Throughput Every protocol adds additional bits to the user’s
message before sending it (e.g., for error detection). These bits are called overhead bits because they
add no value to the user; they simply ensure correct data transfer. The efficiency of a transmission
protocol is the number of information bits sent by the user divided by the total number of bits
transferred (information bits plus overhead bits). Synchronous transmission provides greater
efficiency than does asynchronous transmission. In general, protocols with larger frame sizes provide
greater efficiency than do those with small frame sizes. The drawback to large frame sizes is that they
are more likely to be affected by errors and thus require more retransmission. Small frame sizes are
therefore better suited to error-prone circuits, and large frames to error-free circuits.


KEY TERMS
access request
acknowledgment (ACK)
amplifiers
asynchronous transmission
attenuation
Automatic Repeat reQuest (ARQ)
burst error
checksum
contention
continuous ARQ
controlled access
cross-talk
cyclic redundancy check (CRC)
echo
efficiency
error detection
error prevention
error rates
Ethernet (IEEE 802.3)
even parity
forward error correction
frame
Gaussian noise
Hamming code
high-level data link control (HDLC)
hub polling
impulse noise
information bits
intermodulation noise
line noise
Link Access Protocol-Balanced (LAP-B)
logical link control [LLC] sublayer
media access control
media access control [MAC] sublayer
MAC address
MAC address filtering
MAC address spoofing
negative acknowledgment (NAKs)


odd parity
overhead bits
parity bit
parity check
Point-to-Point Protocol (PPP)
polling
repeater
repeaters
roll-call polling
sliding window
start bit
stop bit
synchronization
synchronous transmission
throughput
token passing
transmission efficiency
white noise
QUESTIONS
1. What does the data link layer do?
2. What is media access control, and why is it important?
3. Under what conditions is media access control unimportant?
4. Compare and contrast roll-call polling, hub polling (or token passing), and contention.
5. Which is better, controlled access or contention? Explain.
6. Define two fundamental types of errors.
7. Errors normally appear in _____, which is when more than 1 data bit is changed by the error-
causing condition.
8. Is there any difference in the error rates of lower-speed lines and higher-speed lines?
9. Briefly define noise.
10. Describe four types of noise. Which one is likely to pose the greatest problem to network managers?
11. How do amplifiers differ from repeaters?
12. What are the three ways of reducing errors and the types of noise they affect?
13. Describe three approaches to detecting errors, including how they work, the probability of detecting
an error, and any other benefits or limitations.
14. Briefly describe how even parity and odd parity work.
15. Briefly describe how checksum works.
16. How does CRC work?
17. How does forward error-correction work? How is it different from other error-correction methods?
18. Under what circumstances is forward error correction desirable?


19. Briefly describe how continuous ARQ works.
20. Which is the simplest (least sophisticated) protocol described in this chapter? How does it work?
21. Describe the frame layouts for SDLC, Ethernet, and PPP.
22. What is transmission efficiency?
23. How do information bits differ from overhead bits?
24. Are stop bits necessary in asynchronous transmission? Explain by using a diagram.
25. During the 1990s, there was intense competition between two technologies (10-Mbps Ethernet and
16-Mbps token ring) for the LAN market. Ethernet was promoted by a consortium of vendors,
whereas token ring was primarily an IBM product, even though it was standardized. Ethernet won,
and no one talks about token ring anymore. Token ring used a hub-polling-based approach. Outline a
number of reasons why Ethernet might have won.
Hint: The reasons were both technical and business.
26. Under what conditions does a data link layer protocol need an address?
27. Are large frame sizes better than small frame sizes? Explain.
28. What media access control technique does your class use?
29. Show how the word “HI” would be sent using asynchronous transmission using even parity (make
assumptions about the bit patterns needed). Show how it would be sent using Ethernet.
EXERCISES
A. Draw how a series of four separate messages would be successfully sent from one computer to
another if the first message were transferred without error, the second were initially transmitted with
an error, the third were initially lost, and the ACK for the fourth were initially lost.
B. How efficient would a 6-bit code be in asynchronous transmission if it had 1 parity bit, 1 start bit, and
2 stop bits? (Some old equipment uses 2 stop bits.)


2 stop bits? (Some old equipment uses 2 stop bits.)
C. What is the transmission rate of information bits (TRIB) if you use ASCII (8 bits plus 1 parity bit), a
1,000-character frame, 56 Kbps modem transmission speed, 20 control characters per frame, an
error rate of 1%, and a 30-millisecond turnaround time? What is the TRIB if you add a half-second
delay to the turnaround time because of satellite delay?
D. Search the Web to find a software vendor that sells a package that supports each of the following
protocols: SDLC, HDLC, Ethernet, and PPP (i.e., one package that supports SDLC, another [or the
same] for HDLC, and so on).
E. Investigate the network at your organization (or a service offered by an IXC) to find out the average
error rates.
F. What is the efficiency if a 100-byte file is transmitted using Ethernet? A 10,000-byte file?
G. What is the propagation delay on a circuit using a LEO satellite orbiting 500 miles above the earth if
the speed of the signal is 186,000 miles per second? If the satellite is 22,000 miles above the earth?
H. Suppose that you are going to connect the computers in your house or apartment. What media would
you use? Why? Would this change if you were building a new house?
MINICASES
I. Smith, Smith, Smith, and Smith Smith, Smith, Smith, and Smith is a regional accounting firm
that is putting up a new headquarters building. The building will have a backbone network that
connects eight LANs (two on each floor). The company is very concerned with network errors. What
advice would you give regarding the design of the building and network cable planning that would


advice would you give regarding the design of the building and network cable planning that would
help reduce network errors?


II. Worldwide Charity Worldwide Charity is a charitable organization whose mission is to improve
education levels in developing countries. In each country where it is involved, the organization has a
small headquarters and usually 5–10 offices in outlying towns. Staff members communicate with one
another via email on older computers donated to the organization. Because Internet service is not
reliable in many of the towns in these countries, the staff members usually phone headquarters and
use a very simple Linux email system that uses a server-based network architecture. They also upload
and download files. What range of frame sizes is likely to be used?
III. Industrial Products Industrial Products is a small light-manufacturing firm that produces a
variety of control systems for heavy industry. It has a network that connects its office building and
warehouse that has functioned well for the last year, but over the past week, users have begun to
complain that the network is slow. Clarence Hung, the network manager, did a quick check of the
number of orders over the past week and saw no real change, suggesting that there has been no major
increase in network traffic. What would you suggest that Clarence do next?
IV. Alpha Corp. Alpha Corp. is trying to decide the size of the connection it needs to the Internet. The
company estimates that it will send and receive a total of about 1,000 emails per hour and that each
email message is about 1,500 bytes in size. The company also estimates that it will send and receive a
total of about 3,000 Web pages per hour and that each page is about 40,000 bytes in size. (1) Without
considering transmission efficiency, how large an Internet connection would you recommend in
terms of bits per second (assuming that each byte is 8 bits in length)? (2) Assuming they use a


synchronous data link layer protocol with an efficiency of about 90%, how large an Internet
connection would you recommend? (3) Suppose that Alpha wants to be sure that its Internet
connection will provide sufficient capacity the next 2 years. How large an Internet connection would
you recommend?
TECH UPDATES
In every chapter, we will offer a couple of ideas to investigate.
Topic A: MAC Address Filtering
MAC address filtering enforces access control and is used to enhance the security of not only wireless
networks but also wired networks. How can one set up MAC address filtering on a home wireless router?
Provide a step-by-step tutorial on how to do this. Show, that when you implement MAC address filtering
only computers that are listed can access the network. Investigate whether MAC address filtering is done
on large networks. For example, you could talk to a network administrator (e.g., at your college or
university) and ask them whether they use MAC address filtering and why.
Topic B: ARP Spoofing
ARP spoofing is a technique that allows an attacker to gain access to a network that he/she would not be
able to access otherwise. But, how difficult is it to change a MAC address (in software)? Create a step-by-
step tutorial on how to change a computer’s MAC address. What would one have to do to change the MAC
address on an iPhone? Have fun!
Deliverables
Your job will be to prepare a presentation/video (7–10 minutes long) that addresses the topic and
provides information on the following items:
1. Title Slide
2. Short description of the topic
3. Main players—these could be people, processes, software, hardware, etc.
4. How it works—use a lot of pictures and be as technical as possible; create this part as a tutorial so that
your audience can follow along


your audience can follow along
5. How does it relate to material covered in class so far (and in the future)


6. Additional material/books/links where to learn more about this topic
7. Credits
8. List of References
9. Memo addressed to your professor describing all of the above information
HANDS-ON ACTIVITY 4A
Capturing Packets on Your Network
In this chapter, we discussed several data link layer protocols, such as SDLC and Ethernet. The objective
of this activity is for you to see the data link layer frames in action on your network.
Wireshark is one of the many tools that permit users to examine the frames in their network. It is called a
packet sniffer because it enables you to see inside the frames and packets that your computer sends, as
well as the frames and packets sent by other users on your LAN. In other words, you can eavesdrop on the
other users on your LAN to see what websites they visit and even the email they send. We don’t
recommend using it for this reason, but it is important that you understand that someone else could be
using Ethereal to sniff your packets to see and record what you are doing on the Internet.
1. Use your browser to connect to www.wireshark.org and download and install the Wireshark software.
2. When you start Wireshark, you will see a screen like that in Figure 4-11, minus the two smaller
windows on top.
a. Click Capture
b. Click Interfaces
c. Click the Capture button beside your Wireshark connection (wireless LAN or traditional LAN).
3. Wireshark will capture all packets moving through your LAN. To make sure you have something to
see, open your Web browser and visit one or two websites. After you have captured packets for 30–60
seconds, return to Wireshark and click Stop.


FIGURE 4-11 Capturing packets with Wireshark
4. Figure 4-12 shows the packets captured on my home network. The top window in Wireshark displays
the complete list of packets in chronological order. Each packet is numbered; I’ve scrolled the
window, so the first packet shown is packet 11. Wireshark lists the time, the source IP address, the
destination IP address, the protocol, and some additional information about each packet. The IP
addresses will be explained in more detail in the next chapter.
For the moment, look at packet number 16, the second HTTP packet from the top. I’ve clicked on this
packet, so the middle window shows the inside of the packet. The first line in this second window says the
frame (or packet if you prefer) is 1091 bytes long. It contains an Ethernet II packet, an Internet Protocol
(IP) packet, a Transmission Control Protocol (TCP) packet, and a Hypertext Transfer Protocol (HTTP)
packet. Remember in Chapter 1 that Figure 1-4 described how each packet was placed inside another
packet as the message moved through the layers and was transmitted.
Click on the plus sign (+) in front of the HTTP packet to expand it. Wireshark shows the contents of the
HTTP packet. By reading the data inside the HTTP packet, you can see that this packet was an HTTP
request to my.yahoo.com that contained a cookie. If you look closely, you’ll see that the sending computer
was a Tablet PC—that’s some of the optional information my Web browser (Internet Explorer) included in
the HTTP header.
The bottom window in Figure 4-12 shows the exact bytes that were captured. The section highlighted in
gray shows the HTTP packet. The numbers on the left show the data in hexadecimal format, whereas the


data on the right show the text version. The data before the highlighted section are the TCP packet.


FIGURE 4-12 Analyzing packets with Wireshark
From Chapter 2, you know that the client sends an HTTP request packet to request a Web page, and the
Web server sends back an HTTP response packet. Packet number 25 in the top window in Figure 4-12 is
the HTTP response sent back to my computer by the Yahoo! server. You can see that the destination IP
address in my HTTP request is the source IP address of this HTTP packet.
5. Figure 4-12 also shows what happens when you click the plus sign (+) in front of the Ethernet II
packet to expand it. You can see that this Ethernet packet has a destination address and source
address (e.g., 00:02:2d:85:cb:e0).
Deliverables
1. List the layer 2, 3, 4, and 5 PDUs that are used in your network to send a request to get a Web
page.
2. List the source and destination Ethernet addresses on the message.
3. What value is in the Ethernet type field in this message? Why?


CHAPTER 5
NETWORK AND TRANSPORT LAYERS
The network and transport layers are responsible for moving messages from end to end in a network.
They are so closely tied together that they are usually discussed together. The transport layer (layer 4)
performs three functions: linking the application layer to the network, segmenting (breaking long
messages into smaller packets for transmission), and session management (establishing an end-to-end
connection between the sender and receiver). The network layer (layer 3) performs two functions: routing
(determining the next computer to which the message should be sent to reach the final destination) and
addressing (finding the address of that next computer). There are several standard transport and network
layer protocols that specify how packets are to be organized, in the same way that there are standards for
data link layer packets. However, only one set of protocols is in widespread use today: the Internet
Protocol Suite, commonly called Transmission Control Protocol/Internet Protocol (TCP/IP). This chapter
takes a detailed look at how TCP/IP and the other protocols in the Internet Protocol Suite work.
OBJECTIVES
Be aware of the TCP/IP protocols
Be familiar with linking to the application layer, segmenting, and session management
Be familiar with addressing
Be familiar with routing
Understand how TCP/IP works
OUTLINE
5.1 Introduction
5.2 Transport and Network Layer Protocols
5.2.1 Transmission Control Protocol (TCP)
5.2.2 Internet Protocol (IP)
5.3 Transport Layer Functions
5.3.1 Linking to the Application Layer
5.3.2 Segmenting
5.3.3 Session Management
5.4 Addressing
5.4.1 Assigning Addresses
5.4.2 Address Resolution
5.5 Routing
5.5.1 Types of Routing
5.5.2 Routing Protocols


5.5.1 Types of Routing
5.5.2 Routing Protocols
5.5.3 Multicasting
5.5.4 The Anatomy of a Router
5.6 TCP/IP Example
5.6.1 Known Addresses


5.6.2 Unknown Addresses
5.6.3 TCP Connections
5.6.4 TCP/IP and Network Layers
5.7 Implications for Cyber Security
Summary
5.1 INTRODUCTION
The transport and network layers are so closely tied together that they are almost always discussed
together. For this reason, we discuss them in the same chapter. Transmission Control Protocol/Internet
Protocol (TCP/IP) is the most commonly used set of transport and network layer protocols, so this
chapter focuses on TCP/IP.
The transport layer links the application software in the application layer with the network and is
responsible for the end-to-end delivery of the message. The transport layer accepts outgoing messages
from the application layer (e.g., Web, email, and so on, as described in Chapter 2) and segments them for
transmission. Figure 5-1 shows the application layer software producing a Simple Mail Transfer Protocol
(SMTP) packet that is split into two smaller TCP segments by the transport layer. The Protocol Data Unit
(PDU) at the transport layer is called a segment. The network layer takes the messages from the
transport layer and routes them through the network by selecting the best path from computer to
computer through the network (and adds an IP packet). The data link layer adds an Ethernet frame and
instructs the physical layer hardware when to transmit. As we saw in Chapter 1, each layer in the network
has its own set of protocols that are used to hold the data generated by higher layers, much like a set of
matryoshka (nested Russian dolls).
The network and transport layers also accept incoming messages from the data link layer and organize
them into coherent messages that are passed to the application layer. For example, as in Figure 5-1, a large
email message might require several data link layer frames to transmit. The transport layer at the sender


email message might require several data link layer frames to transmit. The transport layer at the sender
would break the message into several smaller segments and give them to the network layer to route, which
in turn gives them to the data link layer to transmit. The network layer at the receiver would receive the
individual packets from the data link layer, process them, and pass them to the transport layer, which
would reassemble them into the one email message before giving it to the application layer.


FIGURE 5-1 Message transmission using layers. SMTP = Simple Mail Transfer Protocol; HTTP =
Hypertext Transfer Protocol; IP = Internet Protocol; TCP = Transmission Control Protocol
In this chapter, we provide a brief look at the transport and network layer protocols, before turning our
attention to how TCP/IP works. We first examine the transport layer functions. Addressing and routing
are performed by the transport and network layers working together, so we will discuss them together
rather than separate them according to which part is performed by the transport layer and which by the
network layer.
5.2 TRANSPORT AND NETWORK LAYER PROTOCOLS
There are different transport/network layer protocols, but one family of protocols, the Internet Protocol
Suite, dominates. Each transport and network layer protocol performs essentially the same functions, but
each is incompatible with the others unless there is a special device to translate between them. In this
chapter, we focus on TCP/IP. A good overview of protocols, at all layers, is available at
www.protocols.com.
The Transmission Control Protocol/Internet Protocol (TCP/IP) was developed for the U.S.
Department of Defense’s Advanced Research Project Agency network (ARPANET) by Vinton Cerf and Bob
Kahn in 1974. TCP/IP is the transport/network layer protocol used on the Internet. It is the world’s most
popular protocol set, used by almost all backbone networks (BNs) and WANs. TCP/IP allows reasonably
efficient and error-free transmission. Because it performs error checking, it can send large files across
sometimes unreliable networks with great assurance that the data will arrive uncorrupted. TCP/IP is
compatible with a variety of data link protocols, which is one reason for its popularity.


As the name implies, TCP/IP has two parts. TCP is the transport layer protocol that links the application
layer to the network layer. It performs segmenting: breaking the data into smaller PDUs called segments,
numbering them, ensuring that each segment is reliably delivered, and putting them in the proper order
at the destination. IP is the network layer protocol and performs addressing and routing. IP software is
used at each of the intervening computers through which the message passes; it is IP that routes the
message to the final destination. The TCP software needs to be active only at the sender and the receiver
because TCP is involved only when data comes from or goes to the application layer.
5.2.1 Transmission Control Protocol (TCP)
A typical TCP segment has a 192-bit header (24 bytes) of control information (Figure 5-2). Among other
fields, it contains the source and destination port identifier. The destination port tells the TCP software at
the destination to which application layer program the application layer packet should be sent, whereas
the source port tells the receiver which application layer program the packet is from. The TCP segment
also provides a sequence number so that the TCP software at the destination can assemble the segments
into the correct order and make sure that no segments have been lost.
FIGURE 5-2 Transmission Control Protocol (TCP) segment. ACK = Acknowledgment; CRC = Cyclical
Redundancy Check
The options field is optional and rarely used. Therefore, this results in a 20-byte-long TCP header. The
header length field is used to tell the receiver how long the TCP packet is—that is, whether the options
field is included.
The Internet Protocol Suite has a second type of transport layer protocol called User Datagram
Protocol (UDP). UDP PDUs are called datagrams. Typically, UDP is used when the sender needs to


send a single small packet to the receiver (e.g., for a domain name service (DNS) request, which we
discuss later in this chapter). When there is only one small packet to be sent, the transport layer doesn’t
need to worry about segmenting the outgoing messages or reassembling them upon receipt, so the
transmission can be faster. A UDP datagram has only four fields (8 bytes of over-head) plus the
application layer packet: source port, destination port, length, and a CRC-16. Unlike TCP, UDP does not
check for lost messages, so occasionally a UDP datagram is lost and the message must be resent.
Interestingly, it is not the transport layer that decides whether TCP or UDP is going to be used. This
decision is left to the engineer who is writing the application.
5.2.2 Internet Protocol (IP)
The Internet Protocol (IP) is the network layer protocol. Network layer PDUs are called packets. Two
forms of IP are currently in use. The older form is IP version 4 (IPv4), which also has a 192-bit header (24
bytes) (Figure 5-3). This header contains the source and destination addresses, packet length, and packet
number. Similar to the TCP header, the options field is rarely used, and therefore, the header is usually 20
bytes long.
IP version 4 is being replaced by IPv6, which has a 320-bit header (40 bytes) (Figure 5-4). The primary
reason for the increase in the packet size is an increase in the address size from 32 bits to 128 bits. IPv6’s
simpler packet structure makes it easier to perform routing and supports a variety of new approaches to
addressing and routing.
The development of the IPv6 came about because IP addresses were being depleted on the Internet. IPv4


has a 4-byte address field, which means that there is a theoretical maximum of about 4.2 billion
addresses. However, about 500 million of these addresses are reserved and cannot be used, and the way
addresses were assigned in the early days of the Internet means that a small number of companies
received several million addresses, even when they didn’t need all of them. With the increased growth in
Internet users and the explosion in mobile Internet devices, current estimates project that we will run out
of IPv4 addresses sometime in 2011.


Internet Protocol version 6 uses a 16-byte-long address, which provides a theoretical maximum of 3.4 ×
1038 addresses—more than enough for the foreseeable future. IPv4 uses decimals to express addresses
(e.g., 128.192.55.72), but IPv6 uses hexadecimal (base 16) like Ethernet to express addresses, which makes
it slightly more confusing to use. Addresses are eight sets of 2-byte numbers (e.g.,
2001:0890:0600:00d1:0000:0000:abcd:f010), but because this can be long to write, there is a IPv6
“compressed notation” that eliminates the leading zeros within each block and blocks that are all zeros.
So, the preceding IPv6 address could also be written as 2001:890:600:d1: :abcd:f010.
FIGURE 5-3 Internet Protocol (IP) packet (version 4). CRC = Cyclical Redundancy Check
FIGURE 5-4 Internet Protocol (IP) packet (version 6)
Adoption of IPv6 has been slow. Most organizations have not felt the need to change because IPv6
provides few benefits other than the larger address space and requires their staff to learn a whole new
protocol. In most cases, the shortage of addresses on the Internet doesn’t affect organizations that already
have Internet addresses, so there is little incentive to convert to IPv6. Most organizations that implement
IPv6 also run IPv4, and IPv6 is not backward-compatible with IPv4, which means that all network devices
must be changed to understand both IPv4 and IPv6. The cost of this conversion, along with the few
benefits it provides to organizations that do convert, has led a number of commentators to refer to this as


the IPv6 “mess.” To encourage the move to IPv6, the U.S. government required all of its agencies to
convert to IPv6 on their WANs and BNs by June 2008, but the change was not completed on time.
The size of the message field depends on the data link layer protocol used. TCP/IP is commonly combined
with Ethernet. Ethernet has a maximum packet size of 1,492 bytes, so the maximum size of a TCP message
field if IPv4 is used is 1,492 − 24 (the size of the TCP header) − 24 (the size of the IPv4 header) = 1,444.
5.3 TRANSPORT LAYER FUNCTIONS
The transport layer links the application software in the application layer with the network and is
responsible for segmenting large messages into smaller ones for transmission and for managing the
session (the end-to-end delivery of the message). One of the first issues facing the application layer is to
find the numeric network address of the destination computer. Different protocols use different methods
to find this address. Depending on the protocol—and which expert you ask—finding the destination
address can be classified as a transport layer function, a network layer function, a data link layer function,
or an application layer function with help from the operating system. In all honesty, understanding how
the process works is more important than memorizing how it is classified. The next section discusses
addressing at the network layer and transport layer. In this section, we focus on three unique functions
performed by the transport layer: linking the application layer to the network layer, segmenting, and
session management.
5.3.1 Linking to the Application Layer
Most computers have many application layer software packages running at the same time. Users often
have Web browsers, email programs, and word processors in use at the same time on their client


have Web browsers, email programs, and word processors in use at the same time on their client
computers. Similarly, many servers act as Web servers, mail servers, FTP servers, and so on. When the
transport layer receives an incoming message, the transport layer must decide to which application
program it should be delivered. It makes no sense to send a Web page request to email server software.
With TCP, each application layer software package has a unique port address. Any message sent to a
computer must tell TCP (the transport layer software) the application layer port address that is to receive


the message. Therefore, when an application layer program generates an outgoing message, it tells the
TCP software its own port address (i.e., the source port address) and the port address at the
destination computer (i.e., the destination port address). These two port addresses are placed in the
first two fields in the TCP segment (see Figure 5-2).
Port addresses can be any 16-bit (2-byte) number. So, how does a client computer sending a Web request
to a Web server know what port address to use for the Web server? Simple. On the Internet, all port
addresses for popular services such as the Web, email, and FTP have been standardized. Anyone using a
Web server should set up the Web server with a port address of 80, which is called the well-known port.
Web browsers, therefore, automatically generate a port address of 80 for any Web page you click on. FTP
servers use port 21, Telnet 23, SMTP 25, and so on. Network managers are free to use whatever port
addresses they want, but if they use a nonstandard port number, then the application layer software on
the client must specify the correct port number.
FIGURE 5-5 Linking to application layer services
Figure 5-5 shows a user running three applications on the client (Internet Explorer, Outlook, and
RealPlayer), each of which has been assigned a different port number, called a temporary port number
(1027, 1028, and 1029, respectively). Each of these can simultaneously send and receive data to and from
different servers and different applications on the same server. In this case, we see a message sent by
Internet Explorer on the client (port 1027) to the Web server software on the xyz.com server (port 80). We


also see a message sent by the mail server software on port 25 to the email client on port 1028. At the
same time, the RealPlayer software on the client is sending a request to the music server software (port
554) at 123.com.
5.3.2 Segmenting
Some messages or blocks of application data are small enough that they can be transmitted in one frame
at the data link layer. However, in other cases, the application data in one “message” are too large and
must be broken into several frames (e.g., Web pages, graphic images). As far as the application layer is
concerned, the message should be transmitted and received as one large block of data. However, the data
link layer can transmit only messages of certain lengths. It is therefore up to the sender’s transport layer
to break the data into several smaller segments that can be sent by the data link layer across the circuit. At


the other end, the receiver’s transport layer must receive all these separate segments and recombine them
into one large message.
Segmenting means to take one outgoing message from the application layer and break it into a set of
smaller segments for transmission through the network. It also means to take the incoming set of smaller
segments from the network layer and reassemble them into one message for the application layer.
Depending on what the application layer software chooses, the incoming packets can be either delivered
one at a time or held until all packets have arrived and the message is complete. Web browsers, for
example, usually request delivery of packets as they arrive, which is why your screen gradually builds a
piece at a time. Most email software, conversely, usually requests that messages be delivered only after all
packets have arrived and TCP has organized them into one intact message, which is why you usually don’t
see email messages building screen by screen.
The TCP is also responsible for ensuring that the receiver has actually received all segments that have
been sent. TCP therefore uses continuous automatic repeat request (ARQ) (see also Chapter 4).
One of the challenges at the transport layer is deciding how big to make the segments. Remember, we
discussed packet sizes in Chapter 4. When transport layer software is set up, it is told what size segments
it should use to make best use of its own data link layer protocols (or it chooses the default size of 536).
However, it has no idea what size is best for the destination. Therefore, the transport layer at the sender
negotiates with the transport layer at the receiver to settle on the best segment sizes to use. This
negotiation is done by establishing a TCP connection between the sender and receiver.
5.3.3 Session Management
A session can be thought of as a conversation between two computers. When the sending computer


A session can be thought of as a conversation between two computers. When the sending computer
wants to send a message to the receiver, it usually starts by establishing a session with that computer. The
sender transmits the segments in sequence until the conversation is done, and then the sender ends the
session. This approach to session management is called connection-oriented messaging.
Sometimes, the sender only wants to send one short information message or a request. In this case, the
sender may choose not to start a session but just send the one quick message and move on. This approach
is called connectionless messaging.
Connection-Oriented Messaging
Connection-oriented messaging sets up a TCP connection (also called a session) between the sender
and receiver. To establish a connection, the transport layer on both the sender and the receiver must send
a SYN (synchronize) and receive a ACK (acknowledgement) segment. This process starts with the sender
(usually a client) sending a SYN to the receiver (usually a server). The server responds with an ACK for the
sender’s/client’s SYN and then sends its own SYN. SYN is usually a randomly generated number that
identifies a packet. The last step is when the client sends an ACK for the server’s SYN. This is called the
three-way handshake. This process also contains the segment size negotiation and is responsible for error
correction via retransmission (described in Chapter 4).
Once the connection is established, the segments flow between the sender and the receiver. In case of an
error, the receiver simply asks the sender to retransmit the message until it is received without an error.
TCP calls this Automatic Repeat reQuest (ARQ). There are two types of ARQ: stop-and-wait and
continuous.
Stop-and-Wait ARQ


continuous.
Stop-and-Wait ARQ
With stop-and-wait ARQ, the sender stops and waits for a response from the receiver after each data
packet. After receiving a packet, the receiver sends either an acknowledgment (ACK), if the packet was
received without error, or a negative acknowledgment (NAK), if the message contained an error. If it
is an NAK, the sender resends the previous message. If it is an ACK, the sender continues with the next
message. Stop-and-wait ARQ is by definition a half-duplex transmission technique (Figure 5-6).


FIGURE 5-6 Stop-and-wait ARQ (Automatic Repeat reQuest). ACK = Acknowledgment; NAK = Negative
Acknowledgment
Continuous ARQ
With continuous ARQ, the sender does not wait for an acknowledgment after sending a message; it
immediately sends the next one. Although the messages are being transmitted, the sender examines the
stream of returning acknowledgments. If it receives a NAK, the sender retransmits the needed messages.
The packets that are retransmitted maybe only those containing an error (called Selective-Repeat ARQ
or Link Access Protocol for Modems [LAP-M]) or maybe the first packet with an error and all those
that followed it (called Go-Back-N ARQ). LAP-M is better because it is more efficient.
Continuous ARQ is by definition a full-duplex transmission technique because both the sender and the
receiver are transmitting simultaneously. (The sender is sending messages, and the receiver is sending
ACKs and NAKs.) Figure 5-7 illustrates the flow of messages on a communication circuit using continuous
ARQ. Continuous ARQ is sometimes called sliding window because of the visual imagery the early
network designers used to think about continuous ARQ. Visualize the sender having a set of messages to
send in memory stacked in order from first to last. Now imagine a window that moves through the stack
from first to last. As a message is sent, the window expands to cover it, meaning that the sender is waiting
for an ACK for the message. As an ACK is received for a message, the window moves forward, dropping
the message out of the bottom of the window, indicating that it has been sent and received successfully.
Continuous ARQ is also important in providing flow control, which means ensuring that the computer
sending the message is not transmitting too quickly for the receiver. For example, if a client computer was


sending information too quickly for a server computer to store a file being uploaded, the server might run
out of memory to store the file. By using ACKs and NAKs, the receiver can control the rate at which it


receives information. With stop-and-wait ARQ, the receiver does not send an ACK until it is ready to
receive more packets. In continuous ARQ, the sender and receiver usually agree on the size of the sliding
window. Once the sender has transmitted the maximum number of packets permitted in the sliding
window, it cannot send any more packets until the receiver sends an ACK.
FIGURE 5-7 Continuous ARQ (Automatic Repeat reQuest). ACK = Acknowledgment; NAK = Negative
Acknowledgment


When the transmission is complete, the session is terminated using a four-way handshake. Because the
TCP/IP connection is a full-duplex connection, each side of the session has to terminate the connection
independently. The sender (i.e., the client) will start by sending with a FIN to inform the receiver (i.e., the
server) that is finished sending data. The server acknowledges the FIN sending an ACK. Then the server
sends a FIN to the client. The connection is successfully terminated when the server receives the ACK for
its FIN.
Connectionless Messaging
Connectionless messaging means each packet is treated separately and makes its own way through
the network. Unlike connection-oriented routing, no connection is established. The sender simply sends
the packets as separate, unrelated entities, and it is possible that different packets will take different
routes through the network, depending on the type of routing used and the amount of traffic. Because
packets following different routes may travel at different speeds, they may arrive out of sequence at their
destination. The sender’s network layer, therefore, puts a sequence number on each packet, in addition to
information about the message stream to which the packet belongs. The network layer must reassemble
them in the correct order before passing the message to the application layer.
The Internet Protocol Suite can operate either as connection-oriented or connectionless. When
connection-oriented messaging is desired, TCP is used. When connectionless messaging is desired, the
TCP segment is replaced with a UDP packet. The UDP header is much smaller than the TCP header (only
8 bytes).
Connectionless is most commonly used when the application data or message can fit into one single
message. One might expect, for example, that because Hypertext Transfer Protocol (HTTP) requests are
often very short, they might use UDP connectionless rather than TCP connection-oriented messaging.


often very short, they might use UDP connectionless rather than TCP connection-oriented messaging.
However, HTTP always uses TCP. All of the application layer software we have discussed so far uses TCP
(HTTP, SMTP, FTP, Telnet). UDP is most commonly used for control messages such as addressing (DHCP
[Dynamic Host Configuration Protocol], discussed later in this chapter), routing control messages (RIP
[Routing Information Protocol], discussed later in this chapter), and network management (SNMP
[Simple Network Management Protocol], discussed in Chapter 12).
Quality of Service
Quality of Service (QoS) routing is a special type of connection-oriented messaging in which different
connections are assigned different priorities. For example, video-conferencing requires fast delivery of
packets to ensure that the images and voices appear smooth and continuous; they are very time
dependent because delays in routing seriously affect the quality of the service provided. Email packets,
conversely, have no such requirements. Although everyone would like to receive an email as fast as
possible, a 10-second delay in transmitting an email message does not have the same consequences as a
10-second delay in a videoconferencing packet.
With QoS routing, different classes of service are defined, each with different priorities. For example, a
packet of videoconferencing images would likely get higher priority than would an SMTP packet with an
email message and thus be routed first. When the transport layer software attempts to establish a
connection (i.e., a session), it specifies the class of service that connection requires. Each path through the
network is designed to support a different number and mix of service classes. When a connection is
established, the network ensures that no connections are established that exceed the maximum number of
that class on a given circuit.
QoS routing is common in certain types of networks (e.g., ATM, as discussed in Chapter 8). The Internet


provides several QoS protocols that can work in a TCP/IP environment. Resource Reservation
Protocol (RSVP) and Real-Time Streaming Protocol (RTSP) both permit application layer
software to request connections that have certain minimum data transfer capabilities. As one might
expect, RTSP is geared toward audio/video streaming applications, whereas RSVP is more for general
purposes.
Both QoS protocols, RSVP and RTSP, are used to create a connection (or session) and request a certain
minimum guaranteed data rate. Once the connection has been established, they use the Real-Time
Transport Protocol (RTP) to send packets across the connection. RTP contains information about the


sending application, a packet sequence number, and a timestamp so that the data in the RTP packet can
be synchronized with other RTP packets by the application layer software if needed.
With a name like Real-Time Transport Protocol, one would expect RTP to replace TCP and UDP at the
transport layer. It does not. Instead, RTP is combined with UDP. (If you read the previous paragraph
carefully, you noticed that RTP does not provide source and destination port addresses.) This means that
each real-time packet is first created using RTP and then surrounded by a UDP datagram, before being
handed to the IP software at the network layer.
5.4 ADDRESSING
Before you can send a message, you must know the destination address. It is extremely important to
understand that each computer has several addresses, each used by a different layer. One address is used
by the data link layer, another by the network layer, and still another by the application layer.
When users work with application software, they typically use the application layer address. For example,
in Chapter 2, we discussed application software that used Internet addresses (e.g., www.indiana.edu).
This is an application layer address (or a server name). When a user types an Internet address into a
Web browser, the request is passed to the network layer as part of an application layer packet formatted
using the HTTP protocol (Figure 2-11) (see Chapter 2).
FIGURE 5-8 Types of addresses
The network layer software, in turn, uses a network layer address. The network layer protocol used on
the Internet is IP, so this Web address (www.indiana.edu) is translated into an IP address that is 4 bytes
long when using IPv4 (e.g., 129.79.127.4) (Figure 5-8). This process is similar to using a phone book to go


from someone’s name to his or her phone number.
The network layer then determines the best route through the network to the final destination. Based on
this routing, the network layer identifies the data link layer address of the next computer to which the
message should be sent. If the data link layer is running Ethernet, then the network layer IP address
would be translated into an Ethernet address. Chapter 3 shows that Ethernet addresses are 6 bytes in
length, so a possible address might be 00-0F-00-81-14-00 (Ethernet addresses are usually expressed in
hexadecimal) (Figure 5-8). Data link layer addresses are needed only on multipoint circuits that have
more than one computer on them. For example, many WANs are built with point-to-point circuits that
use Point-to-Point Protocol (PPP) as the data link layer protocol. These networks do not have data link
layer addresses.
5.4.1 Assigning Addresses
In general, the data link layer address is permanently encoded in each network card, which is why the data
link layer address is also commonly called the physical address or the media access control (MAC)
address. This address is part of the hardware (e.g., Ethernet card) and should never be changed.
Hardware manufacturers have an agreement that assigns each manufacturer a unique set of permitted
addresses, so even if you buy hardware from different companies, it will never have the same address.
Whenever you install a network card into a computer, it immediately has its own data link layer address
that uniquely identifies it from every other computer in the world.


Network layer addresses are generally assigned by software. Every network layer software package usually
has a configuration file that specifies the network layer address for that computer. Network managers can
assign any network layer addresses they want. It is important to ensure that every computer on the same
network has a unique network layer address so that every network has a standards group that defines
what network layer addresses can be used by each organization.
Application layer addresses (such as Internet domain names or Windows device names) are also assigned
by a software configuration file. Virtually all servers have an application layer address, but most client
computers do not. This is because it is important for users to easily access servers and the information
they contain, but there is usually little need for someone to access someone else’s client computer. As with
network layer addresses, network managers can assign any application layer address they want, but a
network standards group must approve Internet domain names to ensure that no two computers on the
Internet have the same name. Network layer addresses and Internet domain names go hand in hand, so
the same standards group usually assigns both (e.g., www.indiana.edu at the application layer means
129.79.78.4 at the network layer). It is possible to have several Internet names for the same computer. For
example, one of the Web servers in the Kelley School of Business at Indiana University is called both
www.kelley.indiana.edu and www.kelley.iu.edu.
MANAGEMENT FOCUS 5-1
Final Countdown for IPv4
The address space for IPv4 was depleted on September 24, 2015. There are no more IPv4 addresses
left to be assigned. The American Registry for Internet Numbers (ARIN), which is in charge of the
IPv4 address space, is ready to help organizations that need IPv4 addresses. ARIN created a service


that allows organizations to transfer IPv4 addresses they don’t need to another organization. If a
transfer is not available, organizations will be put on a waiting list. The reality, however, we have
reached the inevitable end of IPv4, also called the “IPcalypse” by the supporters of IPv6, who can’t
wait for the world to convert to IPv6.
Source: Adapted from American Registry for Internet Numbers. www.arin.net.
Internet Addresses
No one is permitted to operate a computer on the Internet unless he or she uses approved addresses.
ICANN (Internet Corporation for Assigned Names and Numbers) is responsible for managing
the assignment of network layer addresses (i.e., IP addresses) and application layer addresses (e.g.,
www.indiana.edu). ICANN sets the rules by which new domain names (e.g., .com, .org, .ca, .uk) are
created and IP address numbers are assigned to users. ICANN also directly manages a set of Internet
domains (e.g., .com, .org, .net) and authorizes private companies to become domain name registrars for
those domains. Once authorized, a registrar can approve requests for application layer addresses and
assign IP numbers for those requests. This means that individuals and organizations wishing to register
an Internet name can use any authorized registrar for the domain they choose, and different registrars are
permitted to charge different fees for their registration services. Many registrars are authorized to issue
names and addresses in the ICANN managed domains, as well as domains in other countries (e.g., .ca, .uk,
.au).
Several application layer addresses and network layer addresses can be assigned at the same time. IP
addresses are often assigned in groups so that one organization receives a set of numerically similar
addresses for use on its computers. For example, Indiana University has been assigned the set of


addresses for use on its computers. For example, Indiana University has been assigned the set of
application layer addresses that end in indiana.edu and iu.edu and the set of IP addresses in the 129.79.x.x
range (i.e., all IP addresses that start with the numbers 129.79).
The IP protocol defines the address space that can be used on the Internet. The address space is the total
number of addresses available. In general, if a protocol uses N bits to define an address, the available
space is 2N (because each bit can be either 1 or 0). Specifically, IPv4 uses 32 bits (4 bytes) to define an
address, and therefore, the number of available addresses is 232 = 4,294, 967,296 or approximately 4.3