The Transport Layer

 Here, we're discussing how individual computer programs will communicate with each other. We network computers together to send data from programs running the data on these computers to send stuff to each other. The transport layer allows traffic to be delivered to specific applications and the application layer allows these people to communicate in a way they understand. We should listen to connection-oriented and connectionless protocols and subsequently explain how TCP is used to ensure data integrity. 

The transport layer is responsible for lots of important functions for reliable computer networking. These include multiplexing and demultiplexing. We do this through error checking and data verification. We can describe what multiplexing and demultiplexing are and how they are. We'll be able to identify the differences between TCP and UDP, explain the 3-way handshake, and understand how TCP flags are used in this process. Multiplexing means nodes on a layer have the ability to direct traffic between many different receiving services. Demultiplexing is delivering traffic to the same receiving service.

The transport layer handles multiplexing and demultiplexing through ports which are 16 bit numbers used to direct traffic to specific services running on a networked computer. A server waits for asking of the data, while a client is a program that accepts or asks for this data. Port 80 is the traditional port for HTTP, or unencrypted web traffic. Ports are denoted with a colon in the IP address such as 10.1.1.100:80 and when written this way it's know as a socket address or socket number. The same device can be running in FTP, or File Transfer Protocol, and this is an older method used for transferring files from one computer to another, traditionally listening on Port 21. If you want to establish a connection to an FTP server running on the same IP that our web server is running on, direct traffic to 10.1.1.100:21. A single server can host almost all the applications for a business like file servers etc. This is all possible because of multiplexing and demultiplexing. 

Now we want to dissect a TCP segment and we might have to analyze network traffic closely to troubleshoot. An IP datagram encapsulates a TCP segment. An ethernet frame has a payload section which is the entire content of the IP datagram. The IP datagram has a payload section which is made up of a TCP segment, which is made up of a TCP header and a data section, which is just another payload area from where the application places its data. TCP headers are split into lots of fields split into lots of information.

Source Ports are high-numbered ports chosen from a special section of ports known as ephemeral ports and are required to keep lots of outgoing connections separate. A source port is needed that the computer making an original request can send the data to the source that's actually requesting it. When a web server responds to the request to view a webpage, the response is received by a word processor. 

The sequence number is a 32-bit number used to keep track of where in a sequence of TCP segments this one is expected to be. Ethernet frames are limited in size but we need to split many parts. The sequence number is used to keep track of segment of data. The acknowledgement number is the number of the next expected segment. The Data Offset field is a 4-bit number that communicates the length of the TCP header for this segment. Then, we have 6 bits reserved for the 6 TCP control flags. The next field is a 16-bit number known as the TCP window, specifying the range of sequence numbers that might be sent before an acknowledgement is required. TCP is super reliant of acknowledgements, done to see that all expected data is received. Then, there's a 16-bit checksum, and is calculated across the entire segment and compared to the header to make sure there was no data lost. The urgent pointer field is used in conjunction with one of the TCP control flags to point out particular segments that might be more important than others. The urgent pointer field is used in conjunction with one of the TCP control flags to point out particular segments that might be more important than others. The options field is rarely used but is sometimes used for more complicated control protocols, and then padding, and data payload, that begins at the expected location. 

As a protocol, TCP establishes connections used to send long chains of segmented data. The protocols that are lower are IP and ethernet, used to send individual packets of data. You need to understand exactly how things works to debug issues where network traffic may not behave in an expected manner. The way TCP establishes a connection is thorough the use of different TCP control flags used in a very specific order. Let's first define the 6 TCP control flags. 

The first flag is known as URG. Here, a value of 1 indicates the segment is considered urgent and that the urgent pointer field has more data about this. This feature of TCP has never really had widespread adoption. ACK is acknowledged. A value of one in this field means that the acknowledgment number field should be examined. The third flag, PSH, is short for push, meaning that the transmitting device wants the receiving device to push currently buffered data to the application on the receiving end as soon as possible. A buffer is a computing technique where a certain amount of data is held somewhere or being sent somewhere else.  TCP can deliver more meaningful chunks of data to the buffer waiting for it. Push flags help send a very small amount of information that has the push flag responding to immediately. The fourth flag is reset which means that one of the sides in a TCP connection hasn't been able to properly recover from a series of missing or malformed segments. Another flag, SYN, is used when first establishing a TCP connection and makes sure the receiving end knows to examine the sequence number field. FIN is finish, and when this flag is set to one it means the transmitting computer doesn't have any more data to send and that the connection can be closed. 

Let's, for example, have 2 computers. First, computer A sends a TCP segment to computer B with SYN flag on. This is Computer A's way of saying "Let's establish a connection". Computer B then responds with a TCP segment where both the SYN and ACK flags are set. Finally, computer A responds with the ACK flag sent which just means "I acknowledge your acknowledgment). This method is so famous that it has a nickname, the three-way handshake. A handshake is a way for two devices to ensure that they're speaking the same protocol and will be able to understand each other. Once the three-way handshake is complete, the TCP connection is established and computer A can establish whatever it wants to computer B, and vice versa. A TCP connection in this state is operated in full duplex. Each segment should respond with an ACK field. A four-way handshake happens in order to close the TCP connection. 

When ready to close the connection, computer B sends a FIN flag, which the other computer acknowledges with an ACK flag. Then, if this computer is ready to close the connection, it will send a FIN flag, which is then responded to with an ACK flag. 

The next that we want to discuss are TCP socket states, which are an instantiation of an end-point in a potential TCP connection. An instantiation is the actual implementation of something defined elsewhere and TCP sockets require actual programs to instantiate them. You only get responses if programs have opened sockets on a particular port.

TCP sockets can exists in lots of states. LISTEN means that a TCP socket is ready and listening for incoming connections. You'd see this exclusively on the server side. SYN_SENT is a synchronization request has been sent but the connection hasn't been established yet. SYN_RECIEVED happens when a socket previously in a LISTEN state has received a synchronization request and sent a SYN/ACK back. It hasn't received the final ACK from the client yet, as you see this on the server side only.

ESTABLISHED is when the TCP connection is in working order and both sides are free to send each other data. You'd see this state on both the client and server-side of a connection. This would be true of all the socket states. FIN_WAIT means that a FIN has been sent, but the corresponding ACK from the other end hasn't been received yet. CLOSE_WAIT means that the connection has been closed at the TCP layer, but that the application that opened the socket hasn't released its hold on the socket yet. CLOSED is when the connection has been fully terminated and that no further communication is possible. TCP is universal since TCP does things in the exact same way. Make sure to check out the socket state definitions for the systems that you are working with.

A connection-oriented protocol establishes a connection and uses this to ensure that all data has been properly transmitted. A connection at the transport layer means that every segment of data sent is acknowledged. Connection is very important because the internet is a vast and busy place and lots of things can go wrong when trying to get data from point A to point B, and even minor crosstalk can be enough to make a cyclical redundancy check fail. A bit is just an electrical signal within the lowestlevel. Pure congestion might cause router to drop traffic or a construction company can jump a cable from firing 2 ISPs. IP and ethernet uses checksums to ensure all the data is correct. That's entirely up to the transport layer protocol. It's up to TCP to determine when to resend specific packets of data. TCP expects an ACK for every bit of data it sends and is in the best position to know what data successfully delivers and can resend a segment if needed. While TCP can send all segments, they may not always arrive at that order. It doesn't matter if segments are slightly out of order, since sequence numbers allow the data to be put back together in the right order. There's a lot of overhead with connection-oriented protocols, send connection, acknowledge, tear the connection down, etc.

 You can contrast this with connectionless protocols with the most common type being UDP. UDP doesn't rely on connections, and you just set a destination port and send the packet. A great example is streaming video. For the best viewing experience, hope that every single frame makes it to the viewer, and a video is pretty watchable with some frames, which can result in a higher quality video in UDP.  This is because you'll be sending more of the bandwidth for actual data transfers. 

A Firewall is a device that blocks traffic that meets certain criteria, a critical concept for keeping a network secure. They can operate at lots of different layers in the network, performing inspections of application traffic, and blocks ranges of IP addresses, most commonly used at the transportation layer, which allows them to block traffic at certain ports while allowing them at other ports. Let's imagine a small business network, with one server which holds services. This server can serve as the fire server for a confidential document. A firewall can allow anyone to sent traffic to the port, or block access from other ports. Sometimes, they are independent network devices. The functionality of a router and firewall can act as the same device. All major Operating Systems have firewalls.