Network models: OSI and TCP/IP, switching and routing, IPv4/IPv6, ARP, TCP/UDP, flow and congestion control.

1. Network Models: OSI and TCP/IP

Computer networks are complex systems. To manage this complexity and promote interoperability between different vendors and technologies, standardized models are used. These models break down the networking process into a series of layers, each with specific functions. The two most prominent network models are the Open Systems Interconnection (OSI) model and the Transmission Control Protocol/Internet Protocol (TCP/IP) model.

1.1. The OSI Model

The OSI model, developed by the International Organization for Standardization (ISO), is a conceptual framework that standardizes the functions of a telecommunication or computing system in terms of abstraction layers. It consists of seven layers, each performing a distinct role in network communication. While not directly implemented as a protocol suite, it serves as a reference for understanding network functions.

1.1.1. The Seven Layers of the OSI Model (Top to Bottom)

1. Layer 7: Application Layer

   This is the layer closest to the end-user. It provides network services directly to user applications. Examples include protocols like HTTP (for web browsing), FTP (for file transfer), SMTP (for email), and DNS (for domain name resolution). It's responsible for identifying communication partners, determining resource availability, and synchronizing communication.

2. Layer 6: Presentation Layer

   This layer is concerned with the syntax and semantics of the information transmitted. It translates data between the application layer and the network format. Key functions include data encryption/decryption, data compression/decompression, and character code translation (e.g., ASCII to EBCDIC). It ensures that data sent by the application layer of one system can be understood by the application layer of another system.

3. Layer 5: Session Layer

   The session layer establishes, manages, and terminates communication sessions between applications. It handles dialog control (determining whether communication is one-way or two-way), synchronization (adding checkpoints to a data stream so that if a failure occurs, only the data after the last checkpoint needs to be retransmitted), and token management.

4. Layer 4: Transport Layer

   This layer provides reliable or unreliable data transfer services between end systems. Its primary responsibility is end-to-end communication. It segments data from the session layer into smaller units and reassembles them at the destination. Key protocols here are TCP (Transmission Control Protocol) for reliable, connection-oriented communication and UDP (User Datagram Protocol) for unreliable, connectionless communication. It also handles flow control and error control.

5. Layer 3: Network Layer

   The network layer is responsible for logical addressing and routing of data packets across the network. It determines the best path for data to travel from source to destination, potentially across multiple networks. Internet Protocol (IP) is the main protocol at this layer. It defines logical addresses (IP addresses) and handles packet forwarding.

6. Layer 2: Data Link Layer

   This layer provides reliable transit of data across a physical link. It takes packets from the network layer and encapsulates them into frames. It is responsible for physical addressing (MAC addresses), error detection and correction (within a single link), and flow control. It divides the bit stream from the physical layer into data frames. Examples include Ethernet and Wi-Fi (802.11).

7. Layer 1: Physical Layer

   This is the lowest layer and deals with the physical transmission of raw bit streams over a communication medium. It defines the physical characteristics of the network, such as voltage levels, pinouts, cable specifications, and transmission rates. It is concerned with the actual transmission and reception of individual bits. Examples include cables (like Ethernet cables), connectors, and network interface cards (NICs).

1.2. The TCP/IP Model

The TCP/IP model, also known as the Internet Protocol Suite, is the practical model upon which the Internet is built. It is simpler than the OSI model, with fewer layers. It is a protocol suite rather than just a reference model, meaning the protocols themselves are defined within the model.

1.2.1. The Four Layers of the TCP/IP Model (Top to Bottom)

1. Layer 4: Application Layer

   This layer combines the functions of the OSI model's Application, Presentation, and Session layers. It provides protocols that support user applications. Examples include HTTP, FTP, SMTP, DNS, TELNET.

2. Layer 3: Transport Layer

   This layer is similar to the OSI Transport Layer. It provides end-to-end communication services. The two main protocols are TCP (Transmission Control Protocol) for reliable, ordered delivery, and UDP (User Datagram Protocol) for faster, connectionless delivery.

3. Layer 2: Internet Layer

   This layer is equivalent to the OSI Network Layer. Its primary function is to move packets from source to destination across one or more networks. The core protocol is the Internet Protocol (IP), which handles logical addressing (IP addresses) and routing. Other protocols at this layer include ICMP (Internet Control Message Protocol) and ARP (Address Resolution Protocol).

4. Layer 1: Network Access Layer

   This layer combines the functions of the OSI Physical and Data Link layers. It is concerned with all the physical aspects of sending and receiving data on the network medium. This includes the hardware addressing (MAC addresses), the physical transmission of bits, and the framing of data. Protocols like Ethernet, Wi-Fi, and PPP operate at this layer.

1.3. OSI vs. TCP/IP Model Comparison

While both models describe layered network architectures, they differ in several ways:

• Number of Layers: OSI has seven layers, while TCP/IP has four.
• Development: OSI is a conceptual model, while TCP/IP is a practical protocol suite.
• Layer Mapping: TCP/IP's Application layer combines OSI's Application, Presentation, and Session layers. TCP/IP's Network Access layer combines OSI's Physical and Data Link layers.
• Adoption: TCP/IP is the de facto standard for the Internet. OSI is widely used as a teaching and reference tool.

2. Switching and Routing

Switching and routing are fundamental processes in computer networks responsible for directing data traffic efficiently from its source to its destination. While both involve forwarding data, they operate at different levels and serve distinct purposes.

2.1. Switching

Switching is the process of forwarding data packets between different network segments or devices within a local area network (LAN). Switches operate primarily at the Data Link Layer (Layer 2) of the OSI model. They use MAC addresses to make forwarding decisions.

2.1.1. How Switches Work

• A switch maintains a MAC address table (also known as a CAM table or forwarding table).
• When a frame arrives at a switch port, the switch examines the source MAC address of the frame and records it in its MAC address table, associating it with the incoming port.
• The switch then examines the destination MAC address of the frame.
• If the destination MAC address is found in the table, the switch forwards the frame only to the port associated with that MAC address. This is called unicasting.
• If the destination MAC address is not in the table, or if it is a broadcast address (FF:FF:FF:FF:FF:FF), the switch floods the frame to all other ports except the one it arrived on. This is called broadcasting.
• If the destination MAC address is a multicast address, the switch forwards the frame to all ports that have subscribed to that multicast group.

Switches create separate collision domains for each port, significantly reducing collisions compared to older hubs and improving network performance. They create multiple simultaneous conversations, allowing devices to communicate without interfering with each other.

2.1.2. Types of Switching

• Cut-Through Switching: The switch forwards the frame as soon as it reads the destination MAC address, without waiting for the entire frame to arrive. This is faster but offers no error checking.
• Store-and-Forward Switching: The switch receives the entire frame, checks it for errors (e.g., using CRC - Cyclic Redundancy Check), and then forwards it. This is slower but more reliable.
• Fragment-Free Switching: A hybrid approach where the switch reads the first 64 bytes of the frame (which includes the MAC addresses and any control information) and then forwards it. This helps filter out runt frames (frames that are too short) but is faster than store-and-forward.

2.2. Routing

Routing is the process of selecting paths in a network along which to send network traffic. Routers operate primarily at the Network Layer (Layer 3) of the OSI model. They connect different networks (e.g., different LANs, or a LAN to the Internet) and use logical addresses (IP addresses) to make forwarding decisions.

2.2.1. How Routers Work

• Routers maintain routing tables that store information about network destinations and the best paths to reach them.
• When a packet arrives at a router, the router examines the destination IP address in the packet header.
• The router consults its routing table to find the best match for the destination IP address. The "best match" is typically the longest prefix match, meaning the route that specifies the most specific network for the destination.
• The router then forwards the packet to the next hop (another router or the final destination) along the determined path.
• Routers connect different broadcast domains. When a router receives a broadcast frame from one network, it does not forward it to other networks; it breaks the broadcast.

Routing protocols (like RIP, OSPF, BGP) are used by routers to exchange information about network topology and learn about available paths.

2.3. Switching vs. Routing Summary

Feature	Switching	Routing
OSI Layer	Data Link (Layer 2)	Network (Layer 3)
Addressing Used	MAC Address	IP Address
Function	Connect devices within a single LAN	Connect different networks (LANs, WANs)
Decision Basis	MAC Address Table	Routing Table
Broadcast Domains	Operates within a single broadcast domain	Connects multiple broadcast domains
Speed	Generally faster (hardware-based lookups)	Generally slower (software-based lookups, more complex decisions)

3. IPv4 and IPv6

Internet Protocol (IP) is the core protocol responsible for addressing and routing packets of data across the Internet. There are two main versions in use: IPv4 and IPv6.

3.1. IPv4 (Internet Protocol version 4)

IPv4 is the dominant version of IP used today. It uses a 32-bit address scheme, providing approximately 4.3 billion unique IP addresses.

3.1.1. IPv4 Address Format

• An IPv4 address is represented as four decimal numbers (each ranging from 0 to 255), separated by dots. This is called dotted-decimal notation.
• Example: 192.168.1.10

3.1.2. IPv4 Address Classes

Historically, IPv4 addresses were divided into classes (A, B, C, D, E) based on the first octet. This classful addressing scheme led to significant address wastage.

Class	First Octet Range	Network ID	Host ID	Example
A	0-127	1 bit	24 bits	10.0.0.1
B	128-191	2 bits	16 bits	172.16.0.1
C	192-223	3 bits	8 bits	192.168.1.1
D	224-239	Multicast Addresses		224.0.0.1
E	240-255	Reserved for experimental use		255.255.255.255

Special Addresses:

• Loopback Address: 127.0.0.1 (used for testing network interfaces)
• Private IP Addresses: Ranges reserved for use within private networks (e.g., 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16). These are not routable on the public Internet and require NAT (Network Address Translation) to access external resources.
• Broadcast Address: The last address in a subnet (e.g., 192.168.1.255 for a typical Class C network) used to send data to all hosts on that subnet.

3.1.3. Subnetting

Subnetting is a technique used to divide a large IP network into smaller subnetworks. This improves network management, reduces network traffic, and conserves IP addresses. It involves using bits from the host portion of an IP address to create subnet IDs.

3.1.4. IPv4 Address Exhaustion

The primary limitation of IPv4 is the limited number of available addresses. The rapid growth of the Internet and the proliferation of connected devices have led to a severe shortage of IPv4 addresses.

3.2. IPv6 (Internet Protocol version 6)

IPv6 is the successor to IPv4, designed to address the limitations of IPv4, most notably the exhaustion of IP addresses. It uses a 128-bit address scheme.

3.2.1. IPv6 Address Format

• An IPv6 address is represented as eight groups of four hexadecimal digits, separated by colons.
• Example: 2001:0db8:85a3:0000:0000:8a2e:0370:7334

3.2.2. IPv6 Address Representation Rules

• Leading Zeros Omission: Leading zeros within a group can be omitted. E.g., 0db8 can be written as db8, and 0000 can be written as 0.
• Consecutive Zero Groups Compression: One or more consecutive groups of all zeros can be replaced by a double colon (::). This can only be done once in an address to avoid ambiguity.

Using these rules, the example address can be shortened:

• 2001:db8:85a3:0000:0000:8a2e:0370:7334 (leading zeros omitted)
• 2001:db8:85a3::8a2e:370:7334 (consecutive zero groups compressed)

3.2.3. Types of IPv6 Addresses

• Unicast: Identifies a single network interface.
• Global Unicast: Routable on the Internet.
• Link-Local: Used only on a single network link (e.g., fe80::/10).
• Unique Local: Similar to IPv4 private addresses, used within a site (e.g., fc00::/7).
• Multicast: Identifies a group of network interfaces (e.g., ff00::/8).
• Anycast: Identifies a set of network interfaces, typically belonging to different nodes. A packet sent to an anycast address is delivered to one of the interfaces, usually the "nearest" one according to routing protocols.
• Loopback Address: ::1
• Unspecified Address: :: (used when a host doesn't know its own address)

3.2.4. Benefits of IPv6

• Vastly Larger Address Space: Solves the IPv4 address exhaustion problem.
• Simplified Header: More efficient packet processing.
• Improved Security: IPsec is mandatory in IPv6 (though optional in practice).
• No NAT Required: Each device can have a unique global IP address, simplifying network design and peer-to-peer communication.
• Autoconfiguration: Stateless address autoconfiguration (SLAAC) allows devices to configure their IP addresses without a DHCP server.
• Better Support for Mobile Devices: Mobile IP is integrated more efficiently.

4. ARP (Address Resolution Protocol)

ARP is a crucial protocol in the Internet Protocol suite used to discover the link layer address (MAC address) associated with a given Internet layer address (IPv4 address). It operates at the boundary between the Network Layer (Layer 3) and the Data Link Layer (Layer 2).

4.1. How ARP Works

Imagine Host A wants to send an IP packet to Host B on the same local network. Host A knows Host B's IP address but needs its MAC address to create the Ethernet frame.

1. ARP Request: Host A broadcasts an ARP request message onto the local network. This message essentially asks, "Who has IP address [Host B's IP]? Tell [Host A's IP]." The request includes Host A's own MAC address so Host B knows where to send the reply.
2. ARP Reply: All hosts on the local network receive the broadcast ARP request. Each host checks if the requested IP address matches its own IP address. If it does not match, the host discards the request. If it matches (i.e., Host B receives the request), Host B sends back an ARP reply message directly to Host A (unicast). This reply contains Host B's IP address and its corresponding MAC address.
3. ARP Cache: Upon receiving the ARP reply, Host A adds an entry to its ARP cache (a table storing IP-to-MAC address mappings). This cache is used to avoid sending ARP requests for hosts it has recently communicated with.
4. Frame Creation: Host A now uses Host B's MAC address as the destination MAC address in the Ethernet frame and sends the IP packet encapsulated within this frame.

4.2. ARP Cache

The ARP cache is a temporary storage on each host that maps IP addresses to MAC addresses. Entries in the cache have a limited lifetime (typically a few minutes) to ensure that changes in the network topology are eventually reflected.

4.3. ARP Message Types

• ARP Request: Sent to discover the MAC address of a known IP address. The destination MAC address is all ones (FF:FF:FF:FF:FF:FF).
• ARP Reply: Sent in response to an ARP request, providing the MAC address for the requested IP address. The destination MAC address is the MAC address of the host that sent the ARP request.
• ARP Gratuitous: A host might send an ARP announcement without being prompted by a request. This is often done when a host boots up or changes its IP address, to update the ARP caches of other devices on the network. It can also be used to detect duplicate IP addresses.
• ARP Probe: Used in IPv6 Neighbor Discovery Protocol (NDP) for address resolution and duplicate address detection.

4.4. Relation to IPv6

In IPv6, the functionality of ARP is replaced by the Neighbor Discovery Protocol (NDP), which is part of the ICMPv6 protocol. NDP uses ICMPv6 messages like Neighbor Solicitation and Neighbor Advertisement to perform address resolution and other network management tasks.

5. TCP and UDP

Transmission Control Protocol (TCP) and User Datagram Protocol (UDP) are the two primary transport layer protocols used in the Internet Protocol suite. They provide different services for applications communicating over a network. Both operate at the Transport Layer (Layer 4) of the OSI model and use port numbers to identify specific applications on a host.

5.1. TCP (Transmission Control Protocol)

TCP is a connection-oriented, reliable, and ordered transport protocol. It provides a stream of data to applications.

5.1.1. Key Features of TCP

• Connection-Oriented: TCP establishes a connection between the sender and receiver before data transfer begins, using a three-way handshake. It also terminates the connection gracefully.
• Reliable Data Transfer: TCP guarantees that data sent will arrive at the destination without errors and in the correct order. It achieves this through:
  • Sequence Numbers: Each byte of data is assigned a sequence number, allowing the receiver to reassemble data in the correct order.
  • Acknowledgments (ACKs): The receiver sends acknowledgments back to the sender to confirm receipt of data.
  • Retransmission: If the sender does not receive an ACK within a certain timeout period, it assumes the data was lost and retransmits it.
• Ordered Data Delivery: The receiver uses sequence numbers to ensure that data is delivered to the application in the same order it was sent. Out-of-order segments are buffered until the missing segments arrive.
• Flow Control: TCP prevents a fast sender from overwhelming a slow receiver. The receiver advertises its available buffer space (receive window size), and the sender adjusts its sending rate accordingly.
• Congestion Control: TCP attempts to prevent network congestion by adjusting the sending rate based on perceived network conditions (e.g., packet loss, round-trip time).
• Full-Duplex Communication: Data can be sent and received simultaneously.

5.1.2. TCP Three-Way Handshake (Connection Establishment)

This process ensures both sender and receiver are ready to communicate.

1. SYN: The client sends a SYN (Synchronize) segment to the server, indicating a request to establish a connection. It includes an initial sequence number (ISN).
2. SYN-ACK: The server receives the SYN, allocates resources, and sends back a SYN-ACK segment. This segment acknowledges the client's SYN (ACK number = client's ISN + 1) and includes the server's own ISN.
3. ACK: The client receives the SYN-ACK, acknowledges the server's SYN (ACK number = server's ISN + 1), and sends an ACK segment back to the server. The connection is now established.

5.1.3. TCP Connection Termination

This involves a four-way handshake to ensure all data has been sent and acknowledged. Either side can initiate termination by sending a FIN (Finish) segment.

5.1.4. TCP Use Cases

TCP is used for applications where reliability and ordered delivery are critical:

• Web Browsing (HTTP, HTTPS)
• Email (SMTP, POP3, IMAP)
• File Transfer (FTP, SFTP)
• Secure Shell (SSH)

5.2. UDP (User Datagram Protocol)

UDP is a connectionless, unreliable, and unordered transport protocol. It provides a simpler, faster way to send data.

5.2.1. Key Features of UDP

• Connectionless: UDP does not establish a connection before sending data. It simply sends datagrams (packets) to the destination.
• Unreliable Data Transfer: UDP does not guarantee delivery, order, or error-free transmission. There are no sequence numbers, acknowledgments, or retransmissions built into UDP itself.
• Unordered Data Delivery: Datagrams may arrive out of order, or not at all.
• No Flow Control: UDP sends data as fast as the application provides it, potentially leading to packet loss if the receiver or network cannot keep up.
• No Congestion Control: UDP does not inherently react to network congestion.
• Lightweight: UDP has a much smaller header than TCP, resulting in less overhead and faster transmission.
• Datagram-Oriented: Data is sent in discrete messages (datagrams).

5.2.2. UDP Use Cases

UDP is suitable for applications where speed is more important than perfect reliability, or where reliability is handled at the application layer:

• Streaming Media: Video and audio streaming (e.g., VoIP, online gaming) where occasional packet loss is acceptable and low latency is crucial.
• DNS (Domain Name System): For quick lookups, although applications may use TCP for zone transfers.
• DHCP (Dynamic Host Configuration Protocol): Used for obtaining IP addresses.
• TFTP (Trivial File Transfer Protocol): A simple file transfer protocol.

5.3. TCP vs. UDP Comparison

Feature	TCP	UDP
Connection Type	Connection-Oriented	Connectionless
Reliability	Reliable (guaranteed delivery)	Unreliable (best-effort delivery)
Ordering	Ordered delivery	Unordered delivery
Speed	Slower (due to overhead)	Faster (less overhead)
Header Size	20 bytes (minimum)	8 bytes
Flow Control	Yes	No
Congestion Control	Yes	No
Use Cases	Web, Email, File Transfer, SSH	Streaming, VoIP, DNS, DHCP

6. Flow Control and Congestion Control

These are two essential mechanisms used in computer networks to manage the amount of data being transmitted, ensuring efficient and stable network operation. While related, they address different problems.

6.1. Flow Control

Flow control is a mechanism to prevent a fast sender from overwhelming a slow receiver. It ensures that the sender does not transmit data faster than the receiver can process and buffer it. This is primarily a point-to-point issue between two communicating devices.

6.1.1. Flow Control Mechanisms

• Sliding Window Protocol (used by TCP): This is the most common flow control mechanism. The receiver advertises a "receive window" size, indicating how much buffer space it currently has available. The sender can only send up to that amount of unacknowledged data. As the receiver acknowledges data, the window "slides" forward, allowing the sender to transmit more.
• Stop-and-Wait: A simpler, less efficient method where the sender transmits one frame and then waits for an acknowledgment before sending the next.

Flow control operates at the Transport Layer (e.g., TCP) and Data Link Layer.

6.2. Congestion Control

Congestion control is a mechanism to prevent and mitigate network congestion. Network congestion occurs when the amount of traffic on a network exceeds its capacity, leading to packet loss, increased delay, and reduced throughput. Unlike flow control, which is about the capacity of the receiver, congestion control is about the capacity of the network itself.

6.2.1. How Congestion Occurs

• Multiple senders transmitting data simultaneously to the same destination or through the same bottleneck link.
• Routers experiencing high traffic loads, causing their buffers to fill up and eventually drop packets.
• Increased Round-Trip Time (RTT) as packets take longer to traverse the congested network.

6.2.2. Congestion Control Mechanisms (Primarily TCP)

TCP employs sophisticated algorithms for congestion control, aiming to utilize available network bandwidth without causing excessive congestion. Key concepts include:

• Congestion Window (cwnd): A sender-side limit on the amount of unacknowledged data it can have in transit. This window size is dynamically adjusted based on perceived network conditions.
• Slow Start: When a connection begins, TCP starts with a small congestion window (e.g., 1-10 MSS - Maximum Segment Size) and exponentially increases it for each acknowledgment received. This allows the sender to quickly probe for available bandwidth.
• Congestion Avoidance: Once the congestion window reaches a certain threshold (slow start threshold), TCP switches to a more conservative, linear increase in the window size for each acknowledgment. This aims to fill the network pipe without causing congestion.
• Congestion Detection: TCP detects congestion primarily through:
  • Packet Loss: Indicated by a timeout (sender doesn't receive an ACK within a set time) or by receiving duplicate ACKs (three duplicate ACKs often signal that a segment has been lost).
• Congestion Reaction: When congestion is detected:
  • Timeout: The congestion window is drastically reduced (often back to 1 MSS), and the slow start threshold is set to half the current window size.
  • Duplicate ACKs: The congestion window is reduced by half (Fast Recovery), and the slow start threshold is set to this new value. The sender then enters congestion avoidance.
• Fast Retransmit: Allows the sender to retransmit a lost segment without waiting for a timeout, typically triggered by receiving three duplicate ACKs.

6.3. Flow Control vs. Congestion Control Summary

Aspect	Flow Control	Congestion Control
Purpose	Prevent sender from overwhelming receiver.	Prevent network overload and packet loss.
Scope	Point-to-point (Sender <-> Receiver).	End-to-end (Sender <-> Network <-> Receiver).
Problem Addressed	Receiver's buffer capacity.	Network link/router capacity.
Primary Mechanism (TCP)	Receive Window advertised by receiver.	Congestion Window (cwnd) managed by sender.
Layer	Transport Layer, Data Link Layer.	Primarily Transport Layer (TCP).