1.1 (OSI) model layers and encapsulation concepts

Question 1

Open Systems Interconnection Reference Model (OSI) Data Types

Answer 1

1) Physical (Bits)
2) Data Link (Frames)
3) Network (Packets)
4) Transport (Segments)
5) Session (Data)
6) Presentation (Data)
7) Application (Data)

Question 2

Layer 1 - The Physical Layer

Answer 2

• The physics of the network
  – Signaling, cabling, connectors
  – This layer isn’t about protocols
• You have a physical layer problem.”
  – Fix your cabling, punch-downs, etc.
  – Run loopback tests, test/replace cables,
  swap adapter cards

Question 3

Layer 2 - Data Link Layer

Answer 3

• The basic network “language
  – The foundation of communication
  at the data link layer
• Data Link Control (DLC) protocols
  – MAC (Media Access Control) address on Ethernet
• The “switching” layer

Question 4

Layer 3 - The Network Layer

Answer 4

*The “routing” layer
* Internet Protocol (IP)
* Fragments frames to traverse different networks

Question 5

Layer 4 - Transport Layer

Answer 5

• The “post office” layer
  – Parcels and letters
• TCP (Transmission Control Protocol) and
  UDP (UserDatagram Protocol)

Question 6

Layer 5 - Session Layer

Answer 6

• Communication management between devices
  – Start, stop, restart
• Half-duplex, full-duplex
• Control protocols, tunneling protocols

Question 7

Layer 6 - Presentation Layer

Answer 7

• Character encoding
• Application encryption
• Often combined with the Application Layer

Question 8

Layer 7 - Application Layer

Answer 8

• The layer we see - HTTP, FTP, DNS, POP3

Question 9

OSI Layers

Answer 9

1) Physical (Bits)
-Signaling, cabling, connectors (Cable, NIC, Hub)
2) Data Link (Frames)
-Theswitching layer (Frame, MAC address, EUI-­‐48,EUI-­‐64, Switch)
3) Network (Packets)
-The routing layer (IP address,router, packet)
4) Transport (Segments)
The“post office” layer (TCP segment, UDP datagram)
5) Session (Data)
Communication between devices (Control protocols, tunneling protocols)
6) Presentation (Data)
Encoding and encryption (SSL/TLS)
7) Application (Data)
“The layer we see” – Google Mail, Twitter, Facebook, etc.

Question 10

What is IP Fragmentation?

Answer 10

Fragments are always in multiples of 8 because of the
number of fragmentation offset bits in the IP header

Question 11

Encapsulation and decapsulation

Answer 11

As data moves through the OSI layers it is Encapsulated (moving from layer 7 to 1) or Decapsulated (moving from layer 1 to 7.)

Different layers have different communication methods and by using encapsulation the data is “tagged” are added and removed as needed to sort the data accordingly.

Ex. If I live in an appartment, and I said I’m in building 6 on the 5th story in apartment 22 the appartment number would just be 6522. By the same token, if someone said I live in appartment 8521 I would know that they live in building 8, floor 5, apt 21. by adding these “tags” of information it allows for the system to move data accordingly while limiting overhead.

Question 12

Transmitting data

Answer 12

Transmission units
– A different group of data at different OSI layers
* Ethernet operates on a frame of data
– It doesn’t care what’s inside
* IP operates on a packet of data
– Inside is TCP or UDP, but IP doesn’t really care
* TCP or UDP
– TCP segment
– UDP datagram

Question 13

TCP flags

Answer 13

• The header describes or identifies the payload
  – Here’s what you’re about to see…
• The TCP header contains important control information
  – Includes a set of bits called TCP flags
• The flags control the payload
  – SYN - Synchronize sequence numbers
  – PSH - Push the data to the application without
  buffering
  – RST - Reset the connection
  – FIN - Last packet from the sender

Question 14

Maximum Transmission Unit (MTU)

Answer 14

• Maximum IP packet to transmit
  – But not fragment
• Fragmentation slows things down
  – Losing a fragment loses an entire packet
  – Requires overhead along the path
• Difficult to know the MTU all the way through the path
  – Automated methods are often inaccurate
  – Especially when ICMP is filtered

Question 15

Troubleshooting MTU

Answer 15

• MTU sizes are usually configured once
  – Based on the network infrastructure
  and don’t change often
• A significant concern for tunneled traffic
  – The tunnel may be smaller than
  your local Ethernet segment
• What if you send packets with Don’t Fragment (DF) set?
  – Routers will respond back and tell you to fragment
  – Hope you get the ICMP message!
• Troubleshoot using ping
  – Ping with DF and force a maximum size of 1472 bytes
  1500 bytes - 8 byte ICMP header
• 20 bytes IP address = 1472 bytes
  – Windows: ping -f -l 1472 8.8.8.8

Question 16

Encapsulation By Layer

Answer 16

Layer 1: null
Layer 2: MAC (Frame Header)
Layer 3: IP (IP Header)
Layer 4: TCP/UDP (TCP/UDP Header)
Layers 5-7: HTTPS, IMAP, SSH (App Data)

Question 17

SYN Flag

Answer 17

Synchronization Flag:
Used to synchronize the connection during the three-way handshake.

Question 18

Layer 1 (Physical): How Bits are Represented

Answer 18

Electric voltage (copper) or light (fiber)

Current State:
0 volts = 0
+/- 5 volts = 1

Transition Modulation: If it changed during the clock cycle, then a 1 is represented (otherwise 0)

Question 19

ACK Flag

Answer 19

Acknowledgement Flag:
Used during the three-way handshake, but is also used to acknowledge the receipt of packets.

Question 20

FIN Packet

Answer 20

Finished Packet:
Used to tear down the virtual connections created using the three-way handshake and the SYN flag.

Always appears when the last packets are exchanged between a client/server & host is ready to shutdown the connection.

Question 21

RST Flag

Answer 21

Reset Flag:
Used when a client or server receives a packet that it was not expecting during the current connection.

Question 22

PSH Flag

Answer 22

Push Flag:
Used to ensure that the data is given priority and is processed at the sending or receiving ends.

Question 23

URG Flag

Answer 23

Urgent Flag:
Like the Push flag, identifies incoming data as urgent.

PSH is used by sender to indicate data with a high priority.

URG is sent to tell the recipient to process immediately & ignore anything else in the queue.

Question 24

EtherType Field

Answer 24

Used to indicate which protocol is encapsulated in the payload of the frame.

Layer 4 = Source/destination ports
Layer 3 = Source/destination IPs
Layer 2 = Source/destination MACs