The OSI Seven-Layer Model

As shown in Figure 2.1, the OSI reference model is built, bottom to top, in the following order: physical, data link, network, transport, session, presentation, and application. The physical layer is classified as Layer 1, and the top layer of the model, the application layer, is Layer 7.

Each layer of the OSI model has a specific function. The following sections describe the function of each layer, starting with the physical layer and working up the model.

Session Layer (Layer 5)

The session layer is responsible for managing and controlling the synchronization of data between applications on two devices. It does this by establishing, maintaining, and breaking sessions. Whereas the transport layer is responsible for setting up and maintaining the connection between the two nodes, the session layer performs the same function on behalf of the application. Protocols that operate at the session layer include NetBIOS, Network File System (NFS), and Server Message Block (SMB).

Comparing OSI to the Four-Layer TCP/IP Model

The OSI model does a fantastic job outlining how networking should occur and the responsibility of each layer. However, TCP/IP also has a reference model and has to perform the same functionality with only four layers. Figure 2.2 shows how these four layers line up with the seven layers of the OSI model.

The network interface layer in the TCP/IP model is sometimes referred to as the network access or link layer, and this is where Ethernet, FDDI, or any other physical technology can run. The Internet layer is where IP runs (along with ICMP and others). The transport layer is where TCP and its counterpart UDP operate. The application layer enables any number of protocols to be plugged in, such as HTTP, SMTP, Simple Network Management Protocol (SNMP), DNS, and many others.

Identifying the OSI Layers at Which Various Network Components Operate

When you understand the OSI model, you can relate network connectivity devices to the appropriate layer of the OSI model. Knowing at which OSI layer a device operates enables you to better understand how it functions on the network. Table 2.2 identifies various network devices and maps them to the OSI model.

Data Encapsulation/Decapsulation and OSI

As data moves down the model (and through the devices on that host), it is encapsulated with a header added to the beginning and a trailer to the end. Once the data arrives at the receiving host, it moves up the model (and through the devices) and is decapsulated in that the header and trailer are stripped off as it moves up.

In the encapsulation/decapsulation process, each layer on the receiving host does the opposite of what was done at that layer on the sending host: the receiving host’s network layer, for example, strips off what was added by the network layer on the sending host. Table 2.3 shows what encapsulation/decapsulation occurs at each of the layers of the OSI model.

It should be noted that the Physical layer (Layer 1) does not appear in Table 2.3 because it does not add or remove anything, but sends what it has (on the sending host) and receives what comes to it (on the receiving host).

It should also be noted that the unit of data worked with at each layer of the model (such as a frame at layer 2 or a packet at layer 3) is called a protocol data unit (PDU).

Connection-Oriented Protocols Versus Connectionless Protocols

Before getting into the characteristics of the various network protocols and protocol suites, you must first identify the difference between connection-oriented and connectionless protocols.

In a connection-oriented communication, data delivery is guaranteed. The sending device resends any packet that the destination system does not receive. Communication between the sending and receiving devices continues until the transmission has been verified. Because of this, connection-oriented protocols have a higher overhead and place greater demands on bandwidth.

In contrast to connection-oriented communication, connectionless protocols such as User Datagram Protocol (UDP) offer only a best-effort delivery mechanism. Basically, the information is just sent; there is no confirmation that the data has been received. If an error occurs in the transmission, there is no mechanism to resend the data, so transmissions made with connectionless protocols are not guaranteed. Connectionless communication requires far less overhead than connection-oriented communication, so it is popular in applications such as streaming audio and video, where a small number of dropped packets might not represent a significant problem.

Internet Protocol

Internet Protocol (IP), which is defined in RFC 791, is the protocol used to transport data from one node on a network to another. IP is connectionless, which means that it doesn’t guarantee the delivery of data; it simply makes its best effort to do so. To ensure that transmissions sent via IP are completed, a higher-level protocol such as TCP is required.

In addition to providing best-effort delivery, IP also performs fragmentation and reassembly tasks for network transmissions. Fragmentation is necessary because the maximum transmission unit (MTU) size is limited in IP. In other words, network transmissions that are too big to traverse the network in a single packet must be broken into smaller chunks and reassembled at the other end. Another function of IP is addressing. IP addressing is a complex subject. Refer to Chapter 3, “Addressing, Routing, and Switching,” for a complete discussion of IP addressing.

Transmission Control Protocol

Transmission Control Protocol (TCP), which is defined in RFC 793, is a connection-oriented transport layer protocol. Being connection-oriented means that TCP establishes a mutually acknowledged session between two hosts before communication takes place. TCP provides reliability to IP communications. Specifically, TCP adds features such as flow control, sequencing, and error detection and correction. For this reason, higher-level applications that need guaranteed delivery use TCP rather than its lightweight and connectionless brother, UDP.

User Datagram Protocol

User Datagram Protocol (UDP), which is defined in RFC 768, is the brother of TCP. Like TCP, UDP is a transport protocol, but the big difference is that UDP does not guarantee delivery like TCP does. In a sense, UDP is a “fire-and-forget” protocol; it assumes that the data sent will reach its destination intact. The checking of whether data is delivered is left to upper-layer protocols. UDP operates at the transport layer of the OSI model.

Unlike TCP, with UDP no session is established between the sending and receiving hosts, which is why UDP is called a connectionless protocol. The upshot of this is that UDP has much lower overhead than TCP. A TCP packet header has 14 fields, whereas a UDP packet header has only 4 fields. Therefore, UDP is much more efficient than TCP. In applications that don’t need the added features of TCP, UDP is much more economical in terms of bandwidth and processing effort.

Internet Control Message Protocol

Internet Control Message Protocol (ICMP), which is defined in RFC 792, is a protocol that works with the IP layer to provide error checking and reporting functionality. In effect, ICMP is a tool that IP uses in its quest to provide best-effort delivery.

ICMP can be used for a number of functions. Its most common function is probably the widely used and incredibly useful ping utility, which can send a stream of ICMP echo requests to a remote host. If the host can respond, it does so by sending echo reply messages back to the sending host. In that one simple process, ICMP enables the verification of the protocol suite configuration of both the sending and receiving nodes and any intermediate networking devices.

However, ICMP’s functionality is not limited to the use of the ping utility. ICMP also can return error messages such as “Destination unreachable” and “Time exceeded.” (The former message is reported when a destination cannot be contacted and the latter when the time to live [TTL] of a datagram has been exceeded.)

In addition to these and other functions, ICMP performs source quench. In a source quench scenario, the receiving host cannot handle the influx of data at the same rate as the data is sent. To slow down the sending host, the receiving host sends ICMP source quench messages, telling the sender to slow down. This action prevents packets from dropping and having to be re-sent.

ICMP is a useful protocol. Although ICMP operates largely in the background, the ping utility makes it one of the most valuable of the protocols discussed in this chapter.

IPSec

The IP Security (IPSec) protocol is designed to provide secure communications between systems. This includes system-to-system communication in the same network, as well as communication to systems on external networks. IPSec is an IP layer security protocol that can both encrypt and authenticate network transmissions. In a nutshell, IPSec is composed of two separate protocols: Authentication Header (AH) and Encapsulating Security Payload (ESP). AH provides the authentication and integrity checking for data packets, and ESP provides encryption services.

Using both AH and ESP, data traveling between systems can be secured, ensuring that transmissions cannot be viewed, accessed, or modified by those who should not have access to them. It might seem that protection on an internal network is less necessary than on an external network; however, much of the data you send across networks has little or no protection, allowing unwanted eyes to see it.

IPSec provides three key security services:

• Data verification: Verifies that the data received is from the intended source

• Protection from data tampering: Ensures that the data has not been tampered with or changed between the sending and receiving devices

• Private transactions: Ensures that the data sent between the sending and receiving devices is unreadable by any other devices

IPSec operates at the network layer of the Open Systems Interconnection (OSI) reference model and provides security for protocols that operate at the higher layers. Thus, by using IPSec, you can secure practically all TCP/IP-related communications.

Generic Routing Encapsulation

Generic Routing Encapsulation (GRE) is a Cisco-created tunneling protocol. It is an encapsulating protocol used to wrap data and securely send it across VPNs and Point-to-Point (or point-to-multipoint) links.

File Transfer Protocol

As its name suggests, File Transfer Protocol (FTP) provides for the uploading and downloading of files from a remote host running FTP server software. As well as uploading and downloading files, FTP enables you to view the contents of folders on an FTP server and rename and delete files and directories if you have the necessary permissions. FTP, which is defined in RFC 959, uses TCP as a transport protocol to guarantee delivery of packets.

FTP has weak security mechanisms used to authenticate users. However, rather than create a user account for every user, you can configure FTP server software to accept anonymous logons. When you do this, the username is anonymous, and the password normally is the user’s email address. Most FTP servers that offer files to the general public operate in this way. Even when logins are used, FTP is still considered insecure in today’s environment. SFTP/SSH should be used in its place in almost every scenario.

In addition to being popular as a mechanism for distributing files to the general public over networks such as the Internet, FTP can also be used by organizations that need to frequently exchange large files with other people or organizations. Such a system can be used when the files being exchanged are larger than can be easily accommodated using email. A number of apps/programs are available that simplify the process. For example, FileZilla is a cross-platform graphical FTP, SFTP, and FTPS file management tool for Windows, Linux, macOS, and more (more information on FileZilla can be found at https://sourceforge.net/projects/filezilla/).

All the common network operating systems offer FTP server capabilities; however, whether you use them depends on whether you need FTP services. All popular workstation operating systems offer FTP client functionality, although it is common to use third-party utilities such as FileZilla (mentioned earlier), CuteFTP, or SmartFTP instead. By default, FTP operates on ports 20 and 21.

FTP assumes that files uploaded or downloaded are straight text (that is, ASCII) files. If the files are not text, which is likely, the transfer mode must be changed to binary. With sophisticated FTP clients, such as CuteFTP, the transition between transfer modes is automatic. With more basic utilities, you must manually perform the mode switch.

Unlike some of the other protocols discussed in this chapter that perform tasks transparent to the user, FTP is an application layer service frequently called upon. Therefore, it can be useful to know some of the commands supported by FTP. If you use a client such as CuteFTP, you might never need to use these commands, but they are useful to know in case you use a command-line FTP client. Table 2.4 lists some of the most commonly used FTP commands.

Secure Shell

Created by students at the Helsinki University of Technology, Secure Shell (SSH) is a secure alternative to Telnet. SSH provides security by encrypting data as it travels between systems. This makes it difficult for hackers using packet sniffers and other traffic-detection systems. It also provides more robust authentication systems than Telnet.

Two versions of SSH are available: SSH1 and SSH2. Of the two, SSH2 is considered more secure. The two versions are incompatible. If you use an SSH client program, the server implementation of SSH that you connect to must be the same version. By default, SSH operates on port 22.

Although SSH, like Telnet, is associated primarily with UNIX and Linux systems, implementations of SSH are available for all commonly used computing platforms, including Windows and macOS.

Secure File Transfer Protocol

One of the big problems associated with FTP is that it is considered unsecure. Even though simple authentication methods are associated with FTP, it is still susceptible to relatively simple hacking approaches. In addition, FTP transmits data between sender and receiver in an unencrypted format. By using a packet sniffer, a hacker could easily copy packets from the network and read the contents. In today’s high-security computing environments, you need a more robust solution.

That solution is the Secure File Transfer Protocol (SFTP), which, based on Secure Shell (SSH) technology, provides robust authentication between sender and receiver. It also provides encryption capabilities, which means that even if packets are copied from the network, their contents remain hidden from prying eyes.

SFTP is implemented through client and server software available for all commonly used computing platforms. SFTP uses port 22 (the same port SSH uses) for secure file transfers.

Telnet

Telnet, which is defined in RFC 854, is a virtual terminal protocol. It enables sessions to be opened on a remote host, and then commands can be executed on that remote host. For many years, Telnet was the method by which clients accessed multiuser systems such as mainframes and minicomputers. It also was the connection method of choice for UNIX systems. Today, Telnet is still used to access routers and other managed network devices. By default, Telnet operates on port 23.

One of the problems with Telnet is that it is not secure. As a result, remote session functionality is now almost always achieved by using alternatives such as SSH.

Simple Mail Transfer Protocol

Simple Mail Transfer Protocol (SMTP), which is defined in RFC 821, is a protocol that defines how mail messages are sent between hosts. SMTP uses TCP connections to guarantee error-free delivery of messages. SMTP is not overly sophisticated and requires that the destination host always be available. For this reason, mail systems spool incoming mail so that users can read it later. How the user then reads the mail depends on how the client accesses the SMTP server. The default port used by SMTP is 25.

Domain Name System (DNS)

Domain Name System (DNS)—also known as Domain Name Service—resolves hostnames, such as www.pearsonitcertification.com, to IP addresses, such as 168.146.67.180. By default, DNS operates on port 53 and it constitutes one of the few network services that CompTIA wants you to know quite a bit about. As such, it is discussed in more detail in the third section of this chapter.

Dynamic Host Configuration Protocol (DHCP)

Dynamic Host Configuration Protocol (DHCP) is defined in RFC 2131. It enables ranges of IP addresses, known as scopes, or predefined groups of addresses within address pools to be defined on a system running a DHCP server application. When another system configured as a DHCP client is initialized, it asks the server for an address and is leased one. By default, DHCP uses ports 67 and 68. Figure 2.3 shows an example of a configuration interface for DHCP on a SOHO router.

Trivial File Transfer Protocol

A variation on FTP is Trivial File Transfer Protocol (TFTP), which is also a file transfer mechanism. However, TFTP does not have the security capability or the level of functionality that FTP has. TFTP, which is defined in RFC 1350, is most often associated with simple downloads, such as those associated with transferring firmware to a device such as a router and booting diskless workstations.

Another feature that TFTP does not offer is directory navigation. Whereas in FTP, commands can be executed to navigate and manage the file system, TFTP offers no such capability. TFTP requires that you request not only exactly what you want but also the particular location. Unlike FTP, which uses TCP as its transport protocol to guarantee delivery, TFTP uses UDP. By default, TFTP operates on port 69.

Hypertext Transfer Protocol

Hypertext Transfer Protocol (HTTP), which is defined in RFC 2068, is the protocol that enables text, graphics, multimedia, and other material to be downloaded from an HTTP server. HTTP defines what actions can be requested by clients and how servers should answer those requests.

In a practical implementation, HTTP clients (that is, web browsers) make requests on port 80 in an HTTP format to servers running HTTP server applications (that is, web servers). Files created in a special language such as Hypertext Markup Language (HTML) are returned to the client, and the connection is closed.

Today, HTTP over port 80 is considered insecure and often replaced by HTTPS (over port 443). Both HTTP and HTTPS use a uniform resource locator (URL) to determine what page should be downloaded from the remote server. The URL contains the type of request (for example, http:// or https://), the name of the server contacted (for example, www.microsoft.com or just microsoft.com since the web portion is the default), and optionally the page requested (for example, /support). The result is the syntax that Internet-savvy people are familiar with: https://support.microsoft.com/.

Network Time Protocol (NTP)

Network Time Protocol (NTP), which is defined in RFC 958, is the part of the TCP/IP protocol suite that facilitates the communication of time between systems. NTP operates over UDP port 123.

Post Office Protocol Version 3/Internet Message Access Protocol Version 4

Both Post Office Protocol Version 3 (POP3), which is defined in RFC 1939, and Internet Message Access Protocol Version 4 (IMAP4), the latest version of which is defined in RFC 1731, are mechanisms for downloading, or pulling, email from a server. They are necessary because although the mail is transported around the network via SMTP, users cannot always immediately read it, so it must be stored in a central location. From this location, it needs to be downloaded or retrieved, which is what POP3 and IMAP4 enable you to do.

POP3 and IMAP4 are popular, and many people access email through applications that are POP3 and IMAP4 clients. The default port for POP3 is 110, and for IMAP4, the default port is 143.

One of the problems with POP3 is that the password used to access a mailbox is transmitted across the network in clear text. This means that if people want to, they could determine your POP3 password with relative ease. This is an area in which IMAP4 offers an advantage over POP3. It uses a more sophisticated authentication system, which makes it more difficult for people to determine a password.

Simple Network Management Protocol

The Simple Network Management Protocol (SNMP) uses port 161 to send data and port 162 to receive it. It enables network devices to communicate information about their state to a central system. It also enables the central system to pass configuration parameters to the devices.

Components of SNMP

In an SNMP configuration, a central system known as a manager acts as the central communication point for all the SNMP-enabled devices on the network. On each device to be managed and monitored via SNMP, software called an SNMP agent is set up and configured with the manager’s IP address. Depending on the configuration, the SNMP manager then communicates with and retrieves information from the devices running the SNMP agent software. In addition, the agent can communicate the occurrence of certain events to the SNMP manager as they happen. These messages are known as traps. Figure 2.4 shows how an SNMP system works.

As Figure 2.4 illustrates, there are a number of components to SNMP. The following discussion looks at the management system, the agents, the management information base, and communities.

Lightweight Directory Access Protocol

Lightweight Directory Access Protocol (LDAP) is a protocol that provides a mechanism to access and query directory services systems. LDAP uses port 389. In the context of the Network+ exam, these directory services systems are most likely to be UNIX/Linux based or Microsoft Active Directory based. Although LDAP supports command-line queries executed directly against the directory database, most LDAP interactions are via utilities such as an authentication program (network logon) or locating a resource in the directory through a search utility.

Hypertext Transfer Protocol Secure

One of the downsides of using HTTP is that HTTP requests are sent in clear text. For some applications, such as e-commerce, this method to exchange information is unsuitable—a more secure method is needed. The solution is Hypertext Transfer Protocol Secure (HTTPS), which encrypts the information sent between the client and host (changing the port from 80 to 443). The data is encrypted using Transport Layer Security (TLS) or, formerly, Secure Sockets Layer (SSL). The protocol is therefore also referred to as HTTP over TLS, or HTTP over SSL.

For HTTPS to be used, both the client and server must support it. All popular browsers now support HTTPS, as do web server products, such as Microsoft Internet Information Services (IIS), Apache, and almost all other web server applications that provide sensitive applications. When you access an application that uses HTTPS, the URL starts with https rather than http—for example, https://www.mybankonline.com.

Server Message Block

Server Message Block (SMB) is used on a network for providing access to resources such as files, printers, ports, and so on that are running on Windows. If you were wanting to connect Linux-based hosts to Windows-shared printers, for example, you would need to implement support for SMB; it runs, by default, on port 445.

One of the most common ways of implementing SMB support is by running Samba.

Syslog

Most UNIX/Linux-based systems include the capability to write messages (either directly or through applications) to log files via syslog. This can be done for security or management reasons and provides a central means by which devices that otherwise could not write to a central repository can easily do so (often by using the logger utility). The default port is 514.

SMTP TLS

SMTP TLS, more commonly known as SMTPS (Simple Mail Transfer Protocol Secure) uses transport layer security (TLS) to provide authentication of the communication partners along with data integrity and confidentiality by wrapping SMTP data in TLS. This is similar to how HTTPS wraps HTTP data inside TLS. The default port is 587.

LDAPS

Lightweight Directory Access Protocol over SSL (LDAPS), also known as Secure LDAP, adds an additional layer of security to LDAP. It operates at port 636 and differs from LDAP in two ways: (1) upon connection, the client and server establish a TLS session before any LDAP messages are transferred (without a start operation) and (2) the LDAPS connection must be closed if TLS closes.

IMAP over SSL

When security is added to IMAP, through the use of SSL/TLS, the default port changes from 143 to 993.

POP3 over SSL

When security is added to POP3, through the use of SSL/TLS, the default port changes from 110 to 995.

SQL, SQLnet, and MySQL

The SQL database server uses port 1433 by default, while Oracle’s SQLnet uses port 1521 and the default port for MySQL is 3306. The most common language used to speak to databases is Structured Query Language (SQL). SQL allows queries to be configured in real time and passed to database servers. This flexibility causes a major vulnerability when it isn’t implemented securely.

Remote Desktop Protocol

Remote Desktop Protocol (RDP) is used in a Windows environment for remote connections. It operates, by default, on port 3389. Remote Desktop Services (RDS, formerly known as Terminal Services) provides a way for a client system to connect to a server, such as Windows Server, and, by using RDP, operate on the server as if it were a local client application. Such a configuration is known as thin client computing, whereby client systems use the resources of the server instead of their local processing power.

Windows Server products and recent Windows client systems have built-in support for remote connections using the Windows program Remote Desktop Connection. The underlying protocol used to manage the connection is RDP. RDP is a low-bandwidth protocol used to send mouse movements, keystrokes, and bitmap images of the screen on the server to the client computer. RDP does not actually send data over the connection—only screenshots and client keystrokes.

Session Initiation Protocol

Long-distance calls are expensive, in part because it is costly to maintain phone lines and employ technicians to keep those phones ringing. Voice over IP (VoIP) provides a cheaper alternative for phone service. VoIP technology enables regular voice conversations to occur by traveling through IP packets and via the Internet. VoIP avoids the high cost of regular phone calls by using the existing infrastructure of the Internet. No monthly bills or expensive long-distance charges are required. But how does it work?

Like every other type of network communication, VoIP requires protocols to make the magic happen. For VoIP, one such protocol is Session Initiation Protocol (SIP), which is an application layer protocol designed to establish and maintain multimedia sessions, such as Internet telephony calls. This means that SIP can create communication sessions for such features as audio/videoconferencing, online gaming, and person-to-person conversations over the Internet. SIP does not operate alone; it uses TCP or UDP as a transport protocol. Remember, TCP enables guaranteed delivery of data packets, whereas UDP is a fire-and-forget transfer protocol. The default ports for SIP are 5060 and 5061.

Understanding Port Functions

As protocols were mentioned in this chapter, the default ports were also given. Each TCP/IP or application has at least one default port associated with it. When a communication is received, the target port number is checked to determine which protocol or service it is destined for. The request is then forwarded to that protocol or service. For example, consider HTTPS, whose assigned port number is 443. When a web browser forms a request for a secure web page, that request is sent to port 443 on the target system. When the target system receives the request, it examines the port number. When it sees that the port is 443, it forwards the request to the web server application.

TCP/IP has 65,535 ports available, with 0 to 1023 labeled as the well-known ports. Although a detailed understanding of the 65,535 ports is not necessary for the Network+ exam, you need to understand the numbers of some well-known ports. Network administration often requires you to specify port assignments when you work with applications and configure services. Table 2.5 shows some of the most common port assignments.

Domain Name Service (DNS)

DNS performs an important function on TCP/IP-based networks. It resolves hostnames, such as www.quepublishing.com, to IP addresses, such as 209.202.161.67. Such a resolution system makes it possible for people to remember the names of and refer to frequently used hosts using easy-to-remember hostnames rather than hard-to-remember IP addresses. By default, DNS operates on port 53.

In the days before the Internet, the network that was to become the Internet used a text file called HOSTS to perform name resolution. The HOSTS file was regularly updated with changes and distributed to other servers. Following is a sample of some entries from a HOSTS file:

Click here to view code image

192.168.3.45 server1 s1 #The main file and print server
192.168.3.223 Mail mailserver #The email server
127.0.0.1 localhost

As you can see, the host’s IP address is listed, along with the corresponding hostname. You can add to a HOSTS file aliases of the server names, which in this example are s1 and mailserver. All the entries must be added manually, and each system to perform resolutions must have a copy of the file.

Even when the Internet was growing at a relatively slow pace, such a mechanism was both cumbersome and prone to error. It was obvious that as the network grew, a more automated and dynamic method of performing name resolution was needed. DNS became that method.

DNS solves the problem of name resolution by offering resolution through servers configured to act as name servers. The name servers run DNS server software, which enables them to receive, process, and reply to requests from systems that want to resolve hostnames to IP addresses. Systems that ask DNS servers for a hostname-to-IP address mapping are called resolvers or DNS clients. Figure 2.5 shows the DNS resolution process. In this example, the client asks to reach the first server at mycoltd.com; the router turns to the DNS server for an IP address associated with that server; and after the address is returned, the client can establish a connection.

Because the DNS namespace (which is discussed in the following section) is large, a single server cannot hold all the records for the entire namespace. As a result, there is a good chance that a given DNS server might not resolve the request for a certain entry. In this case, the DNS server asks another DNS server if it has an entry for the host.

To speed up resolution, the client will often store the results of resolution locally (in the browser quite often) so that it does not have to query again if the same resolution needs to be done. This is known as DNS caching, and this is also done by caching nameservers (also known as recursive nameservers). Since it is possible that values change (a different IP address issued to a host than it previously had), caches typically come with TTL (time to live) values and time out after a while.

The DNS Namespace

DNS operates in the DNS namespace. This space has logical divisions hierarchically organized. At the top level are domains such as .com (commercial) and .edu (education), as well as domains for countries, such as .uk (United Kingdom) and .de (Germany). Below the top level are subdomains or second-level domains associated with organizations or commercial companies, such as Red Hat and Microsoft. Within these domains, hosts or other subdomains can be assigned. For example, the server ftp.redhat.com would be in the redhat.com domain. Figure 2.6 shows a DNS hierarchical namespace.

The lower domains are largely open to use in whatever way the domain name holder sees fit. However, the top-level domains are relatively closely controlled. Table 2.6 lists a selection of the most widely used top-level DNS domain names. Recently, a number of top-level domains were added, mainly to accommodate the increasing need for hostnames. While root DNS servers directly answer requests for records in the root zone, and answer other requests, they also return lists of the authoritative name servers for the top-level domain (TLD) being sought.

*In addition to country-specific domains, many countries have created subdomains that follow roughly the same principles as the original top-level domains (such as co.uk and gov.nz).

Although the assignment of domain names is supposed to conform to the structure shown in Table 2.6, the assignment of names is not as closely controlled as you might think. It’s not uncommon for some domain names to be used for other purposes, such as .org or .net being used for business.

Two other words often used with DNS queries are iterative and recursive. An iterative lookup is one in which the client just keeps querying the server. A recursive lookup is one in which the server does not have the answer the client is looking for and forwards the request on to another DNS server in search of the answer. To use a silly analogy, an iterative lookup would be similar to asking your mother every five minutes if you can go outside and getting the same “no” answer over and over, while a recursive lookup would be her telling you to go ask your father.

Types of DNS Entries

Although the most common entry in a DNS database is an A (address) record, which maps a hostname to an IP address, DNS can hold numerous other types of entries as well. Some are the MX record, which can map entries that correspond to mail exchanger systems, and CNAME (canonical record name), which can create alias records for a system. A system can have an A record and then multiple CNAME entries for its aliases. A DNS table with all these types of entries might look like this:

Click here to view code image

fileserve.mycoltd.com IN A 192.168.33.2
email.mycoltd.com IN A 192.168.33.7
fileprint.mycoltd.com IN CNAME fileserver.mycoltd.com
mailer.mycoltd.com IN MX 10 email.mycoltd.com

As you can see, rather than map to an actual IP address, the CNAME and MX record entries map to another host, which DNS in turn can resolve to an IP address.

DNS Records

Each DNS name server maintains information about its zone, or domain, in a series of records, known as DNS resource records. There are several DNS resource records; each contains information about the DNS domain and the systems within it. These records are text entries stored on the DNS server. Some of the DNS resource records include the following:

• Start of Authority (SOA): This is a record of information containing data on DNS zones and other DNS records. A DNS zone is the part of a domain for which an individual DNS server is responsible. Each zone contains a single SOA record.

• Name Server (NS): This record stores information that identifies the name servers in the domain that store information for that domain.

• Service Locator (SRV): This is a generalized service location record, used for newer protocols instead of creating protocol-specific records such as MX.

• Canonical Name (CNAME): This record stores additional hostnames, or aliases, for hosts in the domain. A CNAME specifies an alias or nickname for a canonical hostname record in a Domain Name Service (DNS) database. CNAME records give a single computer multiple names (aliases).

• Pointer (PTR): This record is a pointer to the canonical name, which is used to perform a reverse DNS lookup, in which case the name is returned when the query originates with an IP address.

• IPv6 Address (AAAA): This record stores information for IPv6 (128-bit) addresses. It is most commonly used to map hostnames to an IP address for a host.

• IPv4 Address (A): This record stores information for IPv4 (32-bit) addresses. It is most commonly used to map hostnames to an IP address for a host.

• Text (TXT): This field was originally created to carry human-readable text in a DNS record, but that purpose has long since passed. Today, it is more common that it holds machine-readable data, such as SPF (Sender Policy Framework) and DKIM (DomainKeys Identified Mail).

• Mail Exchange (MX): This record stores information about where mail for the domain should be delivered.

DNS in a Practical Implementation

In a real-world scenario, whether you use DNS is almost a nonissue. If you have Internet access, you will most certainly use DNS, but you are likely to use the DNS facilities of your Internet service provider (ISP) rather than have your own internal DNS server—this is known as external DNS. However, if you operate a large, complex, multiplatform network, you might find that internal DNS servers are necessary. The major network operating system vendors know that you might need DNS facilities in your organization, so they include DNS server applications with their offerings, making third-party/cloud-hosted DNS a possibility. Google, for example, offers Cloud DNS, which is “low latency, high availability and is a cost-effective way to make your applications and services available to your users” (for more information, see https://cloud.google.com/dns/).

It is common practice for workstations to be configured with the IP addresses of two DNS servers for fault tolerance (configured via the Alternate Configuration tab in Windows, for example). The importance of DNS, particularly in environments in which the Internet is heavily used, cannot be overstated. If DNS facilities are not accessible, the Internet effectively becomes unusable, unless you can remember the IP addresses of all your favorite sites.

Domain Name System Security Extensions (DNSSEC) is a suite of IETF specifications for securing certain kinds of information provided by DNS. As it was originally designed, DNS did not include any security features. DNSSEC not only adds security features to DNS but is also designed to be backward compatible.

Dynamic Host Configuration Protocol

One method to assign IP addresses to hosts is to use static addressing. This process involves manually assigning an address from those available to you and allowing the host to always use that address. The problems with this method include the difficulty in managing addresses for a multitude of machines and efficiently and effectively issuing them.

DHCP, which is defined in RFC 2131, enables ranges of IP addresses, known as scopes or predefined groups of addresses within address pools to be defined on a system running a DHCP server application. When another system configured as a DHCP client is initialized, it asks the server for an address. If all things are as they should be, the server assigns an address from the scope to the client for a predetermined amount of time, known as the lease or lease time.

At various points during the TTL of the lease time (normally the 50 percent and 85 percent points), the client attempts to renew the lease from the server. If the server cannot perform a renewal, the lease expires at 100 percent, and the client stops using the address.

In addition to an IP address and the subnet mask, the DHCP server can supply many other pieces of information; however, exactly what can be provided depends on the DHCP server implementation. In addition to the address information, the default gateway is often supplied, along with DNS information.

In addition to having DHCP supply a random address from the scope, you can configure scope options, such as having it supply a specific address to a client. Such an arrangement is known as a reservation (see Figure 2.7). Reservations are a means by which you can still use DHCP for a system but at the same time guarantee that it always has the same IP address. When based on the MAC address, this is known as MAC reservations. DHCP can also be configured for exclusions, also called IP exclusions. In this scenario, certain IP addresses are not given out to client systems.

The advantages of using DHCP are numerous. First, administrators do not need to manually configure each system. Second, human error, such as the assignment of duplicate IP addresses, is eliminated. Third, DHCP removes the need to reconfigure systems if they move from one subnet to another, or if you decide to make a wholesale change in the IP addressing structure. The downsides are that DHCP traffic is broadcast based and thus generates network traffic—albeit a small amount. Finally, the DHCP server software must be installed and configured on a server, which can place additional processor load (again, minimal) on that system. From an administrative perspective, after the initial configuration, DHCP is about as maintenance-free as a service can get, with only occasional monitoring normally required.

The DHCP Process

To better understand how DHCP works, spend a few minutes looking at the processes that occur when a DHCP-enabled client connects to the network. When a system configured to use DHCP comes onto the network, it broadcasts a special packet that looks for a DHCP server. This packet is known as the DHCPDISCOVER packet. The DHCP server, which is always on the lookout for DHCPDISCOVER broadcasts, picks up the packet and compares the request with the scopes it has defined. If it finds that it has a scope for the network from which the packet originated, it chooses an address from the scope, reserves it, and sends the address, along with any other information, such as the lease duration, to the client. This is known as the DHCPOFFER packet. Because the client still does not have an IP address, this communication is also achieved via broadcast. By default, DHCP operates on ports 67 and 68.

When the client receives the offer, it looks at the offer to determine if it is suitable. If more than one offer is received, which can happen if more than one DHCP server is configured, the offers are compared to see which is best. Best in this context can involve a variety of criteria but normally is the length of the lease. When the selection process completes, the client notifies the server that the offer has been accepted, through a packet called a DHCPREQUEST packet. At this point the server finalizes the offer and sends the client an acknowledgment. This last message, which is sent as a broadcast, is known as a DHCPACK packet. After the client system receives the DHCPACK, it initializes the TCP/IP suite and can communicate on the network.

DHCP and DNS Suffixes

In DNS, suffixes define the DNS servers to be used and the order in which to use them. DHCP settings can push a domain suffix search list to DNS clients. When such a list is specifically given to a client, the client uses only that list for name resolution. With Linux clients, this can occur by specifying entries in the resolve.conf file.

DHCP Relays and IP Helpers

On a large network, the DHCP server can easily get bogged down trying to respond to all the requests. To make the job easier, DHCP relays help make the job easier. A DHCP relay is nothing more than an agent on the router that acts as a go-between for clients and the server. This feature is useful when working with clients on different subnets, because a client cannot communicate directly with the server until it has the IP configuration information assigned to it.

One level above DHCP relay is IP helper. These two terms are often used as synonyms, but they are not; a better way to think of it is with IP helper being a superset DHCP relay. IP helper will, by default, forward broadcasts for DHCP/BOOTP, TFTP, DNS, TACACS/TACACS+, the time service, and the NetBIOS name/datagram service (ports 137–139). You can disable the additional traffic (or add more), but by default IP helper will do more than a DHCP relay.

Network Time Protocol

Network Time Protocol (NTP) is one of the oldest Internet protocols in current use. It is the part of the TCP/IP protocol suite that facilitates the communication of time between systems. NTP operates over UDP port 123. The idea is that one system configured as a time provider transmits time information to other systems that can be both time receivers and time providers for other systems.

Time synchronization is important in today’s IT environment because of the distributed nature of applications. Two good examples of situations in which time synchronization is important are email and directory services systems. In each of these cases, having time synchronized between devices is important because without it there would be no way to keep track of changes to data and applications.

NTP uses a hierarchical, semi-layered system of time sources wherein each level of the hierarchy is termed a stratum. Each stratum/level is assigned a number starting with zero for the reference clock at the top and incrementing from there with the number representing the distance from the reference clock: this means that a server synchronized to a stratum n server runs at stratum n + 1. This numbering is used to prevent cyclical dependencies in the hierarchy, but stratum is not always an indication of quality or reliability. It is possible to find a stratum server with a higher number (for example, 3) that is of higher quality than a stratum 2 time source.

In many environments, external time sources such as radio clocks, Global Positioning System (GPS) devices, and Internet-based time servers are used as sources of NTP time. In others, the system’s BIOS clock is used. Regardless of what source is used, the time information is communicated between devices by using NTP.

NTP server and client software is available for a variety of platforms and devices. If you want a way to ensure time synchronization between devices, look to NTP as a solution.