Week 3: The Transport and Application Layers
Introduction to Detection and Incident Response
We are going to study the transport and application layers of networking in the third week of this course. By the time we conclude this module, you will be able to describe TCP ports, be able to identify the components that make up a TCP header, understand the differences between connection-oriented and connectionless protocols, and explain the methods through which TCP ensures data integrity.
Learning Objectives
- Describe TCP ports and sockets.
- Look into the components of a TCP header.
- Compare connection-oriented and connectionless services.
- Explain how TCP provides data integrity.
PRACTICE QUIZ: THE TRANSPORT LAYER
1. What ordering of TCP flags makes up the Three-way Handshake?
- FIN, FIN/ACK, ACK
- SYN, ACK, SYN, ACK
- SYN, ACK, FIN
- SYN, SYN/ACK, ACK (CORRECT)
Great work! A packet is sent with SYN set in order to initiate a session. This packet is to be answered with a packet containing both SYN and ACK set from the server’s side. The initiator ends up with sending another packet only with the ACK flag set to successfully close the handshake.
2. Transport layer protocols, like TCP and UDP, introduce the concept of a port. How many bits is a port field?
- 4 bits
- 8 bits
- 16 bits (CORRECT)
- 32 bits
Nice job! A TCP or UDP port is represented with a 16-bit number and hence can, in theory, have 65535 possible values (ranging from 0 to 65534).
3. Please select all valid TCP control flags.
- WAIT
- URG
- LISTEN
- ACK (CORRECT)
- CLOSE
- RST (CORRECT)
Awesome! ACK refers to Acknowledged and describes the event where data gets ensured to receive correctly.
You are spot-on! RST resets a connection when something goes wrong.
4. A device that blocks traffic that meets certain criteria is know as a ________.
- Hub
- Switch
- Firewall (CORRECT)
- Router
That’s right! A firewall is used to block certain defined types of traffic.
PRACTICE QUIZ: THE APPLICATION LAYER
1. Unlike our five-layer model, the OSI network model adds two more layers on top of the Application Layer. Select examples of these new layers below.
- The encryption layer
- The interconnection layer
- The compression layer
- The session layer (CORRECT)
- The presentation layer
Kudos, the session layer takes care of handling end-to-end delivery from the transport layer to the applications while also properly managing the communications and sessions.
Well done! What must be remembered of this presentation layer are the functions that go beyond data compression and encryption, and instead task themselves with taking care of formatting the data. This step will assure that, once the data is presented end-users, they will be readable or at least usable.
2. An example of something that operates at the application layer is:
- TCP
- A router
- A web browser (CORRECT)
- UDP
Wohoo! Web browsers and server operate at the application layer.
3. What’s the standard number for a TTL field?
- 8
- 16
- 32
- 64 (CORRECT)
Awesome! This can range from 0 to 255, although the preferred standard is 64.
GRADED QUIZ: THE TRANSPORT AND APPLICATION LAYER
1. If a TCP socket is ready and listening for incoming connections, it’s in the ______ state.
- ESTABLISHED
- CLOSE_WAIT
- SYN_SENT
- LISTEN (CORRECT)
The LISTEN state indicates that there is a connection-ready port willing to accept an incoming connection. This state is in common usage on servers, where services get ready to serve client requests.
2. The most common example of a connection-oriented protocol is _____
- UDP
- TCP (CORRECT)
- IP
Thank you! Although there are other examples of connection-oriented protocols, TCP is by far the most popular and widely known in terms of networking.
3. A 32-bit number that’s used to keep track of where you are in a sequence of TCP segments is known as a(n) ______ number.
- acknowledgement
- TCP
- address
- sequence (CORRECT)
Great work! You see, in TCP, a sequence number is attached to each TCP segment to maintain the order of data among segments so that it is all reassembled properly at destination. In other words, a sequence number ensures integrity and flow of the communication.
4. Application layer data lives in the _____ section of the transport layer protocol.
- data payload (CORRECT)
- header
- footer
- flags
Awesome! The payload section of one layer contains the content of the layer above it.
5. How many bits are used to direct traffic to specific services running on a networked computer?
- 12
- 32
- 8
- 16 (CORRECT)
Thanks! You’re absolutely right! A port is a 16-bit number that helps directing traffic to specific services or applications running on a networked computer, so they can communicate properly with devices and services.
6. A user requests an unencrypted webpage from a web server running on a computer, listening on the Internet Protocol address 10.1.1.150. What will be the socket address?
- 10.1.1.150:21
- 10.1.1.150:80 (CORRECT)
- 10.1.1.150.21
- 10.1.1.150.80
You got it! That’s right! The socket address 10.1.1.150:80 is just one way to refer to the particular IP address (10.1.1.150), which works as a reference to the port number (80). Port 80 is mostly known for not encrypted web traffic (HTTP), and the port number indexed immediately after it usually infers the destination service or application.
7. A connection has been terminated and no communication is possible. What is the Transmission Control Protocol (TCP) socket state?
- FINISHED
- CLOSE_WAIT
- CLOSED (CORRECT)
- FIN_WAIT
Woohoo! True! CLOSED in a TCP socket is a state that says that the connection has been totally established and now can be terminated without further communication between both ends. The two ends have gone through the whole TCP four-way handshake and released all resources associated with this connection.
8. A device receives a Transmission Control Protocol (TCP) packet. The device understands where the actual data payload begins. Which portion of the TCP header provides this information?
- Checksum
- Data offset (CORRECT)
- Sequence number
- Acknowledgement number
Great work! Yes, that’s right! The data offset field in the TCP header actually indicates the length of the TCP header in 32-bit words. It ensures that the receiving network device knows from where to start when it is reading an actual data payload and can read and process any incoming data properly.
9. Which field in a Transmission Control Protocol (TCP) header is not typically used in modern networking?
- Sequence number
- Checksum
- Acknowledgement number
- Urgent pointer (CORRECT)
Right on! Correct! Originally, the urgent pointer field of the TCP header was intended for use in marking particular data segments so that they would get higher priority treatment. The feature is now obsolete and not widely used in modern networking, and the urgent flag is seldom associated with actual uses. Today, most applications favor application-level methods over dealing with urgent data.
10. How many bits are in the checksum field in a Transmission Control Protocol (TCP) header?
- 4
- 8
- 16 (CORRECT)
- 12
Great work! Right! The checksum field is a special 16-bit field that checks whether the integrity of a TCP segment has been preserved during transmission. To accomplish this, it applies a calculation of the checksum on the user data and TCP header, and if the result is mismatched between the two ends – generally, at the receiving end; an error will be pronounced and initially prompts the retransmission.
11. Connection-oriented protocols protect against dropped data by forming connections and using what type of constant stream?
- Acknowledgements (CORRECT)
- Checks
- Approvals
- Verifiers
Woohoo! This is right! That’s what connection-oriented protocols, for example, TCP, provide: reliability by means of a stream of acknowledgments (ACKs). For every segment that gets sent over the network, the other side reports to the sender back that it has been successfully received. The sender is entitled to ask for a retransmit of that data if any gets lost or garbled due to lack of ACKs, ensuring data integrity and complete delivery.
12. In which scenario should you use the User Datagram Protocol (UDP)?
- When you make a phone call
- When you are using instant messaging with a co-worker
- When you are sending an email
- When you are streaming a video (CORRECT)
Great work! Using a connectionless protocol, such as UDP, for streaming video will decrease the amount of traffic, thereby increasing the speed of the connection.
13. You are sending a very fount of information that you need the listening program to respond to immediately. Which Transmission Control Protocol (TCP) flag will be used?
- RST
- PSH (CORRECT)
- ACK
- URG
You nailed it! The PSH flag will be used to push the information immediately.
14. A device involved in a Transmission Control Protocol (TCP) connection is ready to close the connection. The other device in the connection agrees. What has occured?
- Three-way handshake
- Four-way handshake (CORRECT)
- Handshake
- Two-way handshake
Awesome! A four-way handshake occurs at the conclusion of the session, which refers primarily to the TCP connection termination process.
15. Ports 1024-49151 are known as ______ ports.
- system
- registered (CORRECT)
- destination
- source
Yep! Registered ports are used by less common applications.Generally, registered ports are application-orientated, meaning that applications can be registered to use ports within this range of 1024 to 49151 on an ad hoc basis.
16. If the transmitting device would like for the receiving device to push currently buffered data to the application on the receiving end immediately, it would set the ____ flag.
- SYN
- ACK
- PSH (CORRECT)
- FIN
You nailed it! It’s a flag of PSH (Push), which tells the terminal that it should see data immediately without waiting for more. Rather, it is pushed up into the application layer immediately.
17. The sequence of SYN, SYN/ACK, and ACK packets is known as the _________.
- three-way handshake (CORRECT)
- four-way handshake
- two-way handshake
- high five
Nice work! That series of flags is used to establish every TCP connection.
18. Which field in a Transmission Control Protocol (TCP) header provides the next expected segment?
- Acknowledgement number (CORRECT)
- Checksum
- Sequence number
- Data offset
Well done! The acknowledgment number makes an indication of the sequence number of the next anticipated segment but signifies that all data up to that point has been successfully received.
19. A communication between two devices is over the maximum limit of an ethernet frame size. The Transmission Control Protocol (TCP) splits up the data into segments. Which field in the header helps keep track of the many segments?
- Sequence number (CORRECT)
- Checksum
- Acknowledgement number
- Urgent pointer
Nice job! The sequence number keeps track of where a segment lies in a sequence of TCP packets. Data is reassembled in the correct order at the receiving end.
20. A communication sent through Transmission Control Protocol (TCP) arrives out of order. What allows the data to be put back together in the correct order?
- Preamble
- Acknowledgement number
- Sequence numbers (CORRECT)
- Checksum
Well done! Straightforwardly put, the sequence numbers allow reassembling data in the correct order as they give information regarding the position of every piece of that overall stream.
21. How many Transmission Control Protocol (TCP) control flags are there?
- 5
- 7
- 8
- 6 (CORRECT)
You got it! There are 6 TCP control flags.
22. What does a value of one in an ACK control flag represent?
- There is one more packet to be transmitted.
- The acknowledgement number field should be examined. (CORRECT)
- It is the first transmission.
- There is one packet to deliver.
Woohoo! The bit in the ACK flag field may also have a value of one, indicating that the acknowledgment number field is to be considered for validation of data receipt.
23. A Transmission Control Protocol (TCP) connection is established and two devices ensure that they’re speaking the same protocol. What has occurred?
- Four-way handshake
- Three-way handshake (CORRECT)
- Two-way handshake
- Handshake
You nailed it! The three connections are done through sending SYN, SYN/ACK and ACK. This occurs always when the TCP connection is made so it can synchronize and acknowledge the connection between the client and server.
24. The checksum doesn’t compute for a packet sent at the Internet Protocol (IP) level. What will happen to the data?
- It will be sent, but may be out of order.
- The data will be sent back to the sending node with an error.
- The data will be discarded. (CORRECT)
- The data will be resent.
Correct! If a checksum fails at the level of Ethernet, data is simply thrown away. Higher layers like TCP are the ones to detect that the lower layer gave up on the data, and they should also then request a retransmission of that data.
25. HTTP is an example of a(n) ______ layer protocol.
- transport
- data-link
- application (CORRECT)
- network
You got it! It’s a widely known fact that there are a number of application layer protocols, among which HTTP is one of the most commonly used documents for use on the web.
26. The OSI network model has _____ layers.
- three
- five
- six
- seven (CORRECT)
Good! Unlike our model, which focuses on five layers, the OSI model has seven layers.
27. The concept of taking traffic that’s all aimed at the same node and delivering it to the proper receiving service is known as _________.
- multiplexing
- demultiplexing (CORRECT)
- routing
- encapsulation
You got it! Demultiplexing offers an easy and applicable approach to accurately deliver traffic from various services to appropriate processes or applications on the same node.
28. Which field in a Transmission Control Protocol (TCP) header is chosen from ephemeral ports?
- Destination port
- Source port (CORRECT)
- Sequence number
- Acknowledgement number
You nailed it! A source port is usually a high-numbered port; it is one of the ephemeral ports and temporarily used for a session or connection.
29. How many bits are reserved for the Transmission Control Protocol (TCP) flags?
- 10
- 6 (CORRECT)
- 8
- 4
Correct! 6 bits are reserved for the 6 TCP control flags.
30. Which Transmission Control Protocol (TCP) flag is used to make sure the receiving end knows how to examine the sequence number field?
- URG
- ACK
- PSH
- SYN (CORRECT)
Correct! Using SYN when establishing a TCP connection is meant for synchronizing sequence numbers between sender and receiver protected so that at each side it has its own mechanism to determine the right tracking mechanism and acknowledgement or not.
31. Ports 1 – 1023 are known as ______ ports.
- system (CORRECT)
- registered
- destination
- source
Yep! System ports are used for very well-known services.
32. The transport layer handles multiplexing and demultiplexing through what type of device?
- Hubs
- Switches
- Routers
- Ports (CORRECT)
Great! Transport layer multiplexes and demultiplexes data by using ports to direct it to the correct application or process on both the sender’s and receiver’s systems.
33. What port does the File Transfer Protocol (FTP) typically listen on?
- 443
- 21 (CORRECT)
- 25
- 80
Well done! FTP typically listens on port 21.
34. The instantiation of an endpoint in a potential TCP connection is known as a ______.
- socket (CORRECT)
- port
- sequence number
- TCP segment
Great work! A socket acts as the interface that links networking stack of an operating system to applications and enables network communication by allowing them to send and receive data.
35. A Transmission Control Protocol (TCP) connection is in working order and both sides can send each other data. What is the TCP socket state?
- SYN_RECEIVED
- ESTABLISHED (CORRECT)
- LISTEN
- SYN_SENT
Yep! The ESTABLISHED state indicates the successful establishment of a TCP connection, allowing free exchange of data between both sides.
36. The concept of taking traffic that’s all aimed at the same node and delivering it to the proper receiving service is known as _________.
- multiplexing
- demultiplexing (CORRECT)
- routing
- encapsulation
Awesome! By means of demultiplexing, various services can be routed to their respective applications or processes in use by the same node through fairly straightforward means such as port numbers.
37. One side in a Transmission Control Protocol (TCP) connection has not been able to properly recover from a series of malformed segments. Which Transmission Control Protocol (TCP) flag will be used?
- FIN
- SYN (CORRECT)
- RST
- PSH
Great work! The TCP SYN flag is used when initiating a TCP connection, which is to synchronize sequence numbers between the two parties so that both know how to order the flow of data.
38. A connection, at which layer, implies that every segment of data sent is acknowledged?
- Data link
- Transport (CORRECT)
- Network
- Application
Great! At the transport layer particularly in TCP, connection means that each segment goes and gets acknowledged at the receiving end, thus making it a reliable connection due to the confirmation and retransmission process.
39. Ports that are generally used to establish outbound connections are known as ______ ports.
- System
- reserved
- ephemeral (CORRECT)
- registered
Nice job! The exact ports in use depend on the operating system, all of which are part of a range called ephemeral ports – those used transiently for the duration of a session or connection.
40. A network has the ability to direct traffic toward all of the receiving services. What provides this ability in the transport layer?
- Socket address
- File Transfer
- Multiplexing (CORRECT)
- Demultiplexing
Right on! Multiplexing serves to transport signals, through employing ports on the server node, to different recipients within the network transport layer and thus, makes an application for certain delivery of data to the application or process, associated with this port.