(a) As we have seen, the Internet layer of TCP/IP has two protocols – IPv4 and I

Question

(a) As we have seen, the Internet layer of TCP/IP has two protocols – IPv4 and IPv6. The transport layer provides two main protocols TCP and UDP (along with some special-purpose, minor protocols). But these are for very different reasons. Why are the Internet and Transport layers very different in providing two protocols?

(b) Since UDP does very little that is different from IP, why do we even have a transport layer such as UDP?

(c) Describe how DDoS attacks may be mounted against TCP and UDP services. In what way will being connection oriented be different for TCP and UDP?

Explanation / Answer

a)

Transport layer handles port numbers, TCP, UDP, layer 4 PDU's and it's the first step in encapsulating and segmenting data in order to send it across the network. Protocols used in Transport layer are
TCP(Transmission Control Protocol)
UDP(User Datagram Protocol )
SCTP(Stream Control Transmission Protocol)

Network handles ip routing and delivery of data packets across the network. Protocols used in network layer(internet) are
IP(Internet Protocol)
ICMP(Internet Control Message Protocol)
IGMP(Internet Group Message Protocol)
RARP(Reverse Address Resolution Protocol)
ARP(Address Resolution Protocol)
Flow mechanism in both the layers vary due to the folloing reasons. This is why protocols are different in transport layer and network layer.

1). Flow control is a TCP mechanism for handling the size of the packet in order to prevent packet loss and retransmision, congestion control is another thing. Network layer doesn't decide anything, it simply tries to send your package over a network, if it fails, it will notify the upper layer about this problem and then
the application or user should decide what to do).

2). TCP enables a threeway handshake mechanism to start a session, afterwards each packet is market with a counter and the receiver acknowledges receipt of senders package. In case he doesn't acknowledge, TCP resends that lost package. Networking layer will only forward packets and won't make any decisions
regarding traffic control or packet ordering.

b) USER DATAGRAM PROTOCOL(UDP):

The User Datagram Protocol (UDP) is a transport layer protocol defined for the usage of the IP network layer protocol.The service provided by UDP is an unreliable service that provides no guarantee for delivery and no protection from duplication.

Besides it has a main advantage of reducing overhead from using the protocol and services.It provides a minimal, unreliable, best-effort, message-passing transport to applications and upper-layer protocols.It also doesnot establish end-to-end connections between communicating end systems.

It is as a tunneling protocol, where a tunnel endpoint encapsulates the packets of another protocol inside UDP datagrams and transmits them to another tunnel endpoint, which decapsulates the UDP datagrams and forwards the original packets contained in the payload.

The above mentioned are some of the reasons why we use UDP though it is different from IP.

c)DDOS ATTACKS:

DDoS(Distributed Denial of Service) attack is a malicious attempt to make an online service unavailable to users, usually by temporarily interrupting or suspending the services of its hosting server.

This DDoS attack uses for the maximum advantage of a protocol called User Datagram Protocol (UDP), in which this type of attack floods random ports on a remote host with numerous UDP packets, causing the host to repeatedly check for the application listening at that port, and reply with an ICMP Destination Unreachable packet.This process is called as UDP flood.

A SYN flood DDoS attack exploits a known weakness in the TCP connection sequence which in general is a three-way handshake wherein a SYN request to initiate a TCP connection with a host must be answered by a SYN-ACK response from that host, and then confirmed by an ACK response from the requester. In a SYN flood scenario, the requester sends multiple SYN requests, but either does not respond to the host’s SYN-ACK response, or sends the SYN requests from a spoofed IP address.This process is called SYN flood.

Related Questions

Navigate

• Browse (All)
• Browse #
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.