计算机网络（第六版）

最新推荐文章于 2024-08-05 20:10:12 发布
最新推荐文章于 2024-08-05 20:10:12 发布
阅读量1.2w 收藏 102
点赞数 24
文章标签： 网络
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/u014704998/article/details/70859619
版权

本书是一本讲解计算机网络基础知识的教材，是一本理论书籍。

 

在将开篇讲了计算机网络的基本知识后，详述了五层的体系结构：物理层、数据链路层、网络层、运输层、应用层；

然后讲述了网络安全、音频/视频服务、无线网络与移动网络等概念；

最后描述了下一代因特网的情况。

 

 

本书结构

1 基本知识

1.1计算机网路与信息时代

21世纪重要特征是数字化、网络化、信息化，是一个以网络为核心的信息时代。

三网：电信网络、有线电视网络、计算机网络

计算机网络重要功能：连通性、共享

1.2因特网

1.2.1概念

网络-->互联网-->因特网

网络：若干节点和链接这些结点的链路组成。

互联网：网络和网络之间通过路由器互联起来。

因特网：世上最大的互联网。

主机：因特网上的计算机。

1.2.2发展

形成-->三级结构-->多层次ISP结构

三级结构：主干网、地区网、校园网（或企业网）

多层次ISP结构：用户通过因特网服务提供商接入因特网

 

1.3因特网组成

1.3.1边缘部分

边缘部分：所有主机。

边缘端系统通信方式：客户端-服务器方式、对等方式（P2P）（文件共享）。

1.3.2核心部分

核心部分：大量网络和连接这些网络的路由器。

路由器：实现分组交换的关键构件，其任务时转发收到的分组。

电路交换：建立连接-->通话-->释放连接

分组交换：

报文：需要发送的整块数据。

报文交换：整个报文先传到相邻结点，全部存储下来后查找转发表，转发到下一个结点。

分组：报文分成等长的数据段，然后在前面加上必要的控制信息（首部），即为分组。

分组交换：单个分组传送到相邻结点，存储下来后查找转发表，转发到下一个结点。

1.4计算机网络在我国的发展

1.5计算机网络的类别

1.5.1定义

一些互相连接的，自治的计算机的集合。

1.5.2类别

作用范围：广域网（WAN）、城域网（MAN）、局域网（LAN，如校园网、企业网）、个人局域网（PAN，WPAN）

使用者：公用网（电信公司建造的大型公众网）、专用网（不对外提供服务）

1.6网络性能

速率：主机在数字信道上传送数据的速率，单位bit/s。

带宽：通信线路传送数据的能力，一点到另一点的最高数据率，单位b/s

吞吐量：单位时间通过某个网络（或信道，接口）的数据量,单位b/s

时延：数据从网络的一端传送到另一端所需的时间。

发送时延：主机或路由器发送数据帧所需的时间

传播时延：电磁波在信道中传播一定距离需要花费的时间。

处理时延：主机或路由器在收到分组时要花费一定时间进行处理。

排队时延：分组进入路由器要先在输入队列中排队等待处理。

时延带宽积：传播时延*带宽，链路可以容纳多少个比特

往返时间RTT：发送数据到收到接收方的确认。

利用率：信道利用率、网络利用率

1.7计算机网络体系结构

1.7.1概念

体系结构：计算机网络的各层及其协议的集合。这个计算机网络及其构件所应完成的功能的精确定义。

体系结构是抽象的，而实现是具体的，是真正在运行的计算机硬件和软件。

网络协议：为进行网络中的数据交换而建立的规则、标准或约定

1.7.2OSI

OSI（OSI/RM）：Open systems interconnection referencemodel

开放系统互连基本参考模型

应用层、表示层、会话层、运输层、网络层、数据链路层、物理层

1.7.3五层体系结构

TCP/IP是一个四层体系结构：应用层、运输层、网际层、网络接口层。

五层：结合OSI和TCP/IP的优点，采用五层结构来讲解计算机网络的折中。

应用层：通过应用进程间的交互来完成特定网络应用。应用进程间通信和交互的规则。

运输层：为两个主机中进程之间的通信提供通用的数据传输服务（报文）。TCP、UDP

网络层：为分组交换网上的不同主机提供通信服务（分组）。IP层或网际层

数据链路层：IP数据报组装成帧，在两个相邻结点间的链路上传送。

物理层：传输比特数据。

1.7.4实体、协议、服务和服务访问点

实体：任何可以发送或接收信息的硬件或软件进程。

协议：控制两个对等实体（或多个）进行通信的规则的集合。

服务：在协议的控制下，两个对等实体间的通信使得本层能够向上一层提供服务。下面的协议对上面的实体是透明的。

服务访问点：同一系统中相邻两层的实体进行交互（交换信息）的地方。

1.7.5TCP/IP体系结构

主机（应用层、运输层、网际层、网络接口层）-->网络-->路由器（网际层、网络接口层）-->网络-->主机

2 物理层

2.1基本概念

物理层：考虑怎样在连接各种计算机的传输媒介上传输数据比特流。

特性：机械特性、电气特性、功能特性、过程特性。

2..2基础知识

2.2.1数据通信系统的模型

数据通信系统：源系统（发送端）、传输系统（传输网络）、目的系统（接收端）

模型：源点-->发送器-->传输系统-->接收器-->终点。

源点：源点设备（如pc键盘输入汉字）产生的传输数据。

发送器：数字比特流编码成可以在传输系统传输的信号（模拟信号），如调制器。

接收器：接收传输系统中传送过来的信号，并转换成被目的设备处理的信息。

终点：从接收器获取数字比特流，输出信息。

模拟信号（连续信号）

数字信号（离散信号）

2.2.2信道

信道：与电路并不等同，用来表示向某一方向传送信息的媒体。一条通信电路往往包含一条发送信道和一条接收信道。

通信的双方信息交互方式：单向通信（单工）、双向交替通信（半双工、不能同时发送）、双向同时通信（全双工）

编码方式：不归零制、归零制、曼切斯特编码、差分曼切斯特编码

带通调制方法：调幅（AM）、调频（FM）、调相（PM）

2.3物理层下面的传输媒体

2.3.1概念

传输媒体：传输媒介、传输介质，数据传输系统中在发送器和接收器之间的物理通路。

2.3.2导引型传输媒体

双绞线

同轴电缆：内导体（铜芯）、绝缘层、外导体屏蔽层（网状编织）、绝缘保护套层

光缆

2.3.3非导引型传输媒体

非导引型传输媒体：自由空间

方式：短波通信（高频通信）、微波通信（地面微波接力通信、卫星通信）

2.4信道复用技术

频分复用、时分复用、统计时分复用

波分复用：即光的频分复用

码分复用

2.5数字传输系统

2.6宽带接入

ADSL（非对称数字用户线）：用数字技术对现有的模拟电话用户线进行改造，使它能够承载宽带数字业务。

光纤同轴混合网（HFC网）：光纤结点连接光纤和同轴电缆（接入用户）。

FTTx技术：

FTTH：Fiber to theHome，光纤到户

FTTZ：光纤到小区

FTTB：光纤到大楼

FTTF：光纤到楼层

FTTO：光纤到办公室

FTTD：光纤到桌面

3 数据链路层

3.1使用点对点信道的数据链路层

3.1.1概念

  • 链路：从一个结点到相邻结点的一端物理线路，中间没有任何其他的交换结点。
  • 数据链路：物理线路+实现通信协议的硬件和软件（最常用方法：网络适配器，既包含硬件又有软件）。
  • 帧：点对点数据链路层的协议数据单元
  • 最大传送单元MTU：每一种链路层协议都规定了所能传送的帧的数据部分长度的上限

3.1.2三个基本问题

  • 封装成帧：在一段数据的前后分别添加首部和尾部，构成一个帧。
  • 透明传输：解决数据链路层错误地“找到帧的边界”，而丢弃部分数据。要解决这个问题，需使数据部分透明（实际存在的事物看起来不存在），可用字节填充或字符填充。
  • 差错检测：广泛采用循环冗余检验（CRC，cyclic Error Check）

3.2点对点协议PPP

3.2.1特点

（1）应满足的需求

简单、封装成帧、透明性、多种网络层协议（同一条物理链路上同时支持多种网络层协议）、多种类型链路、差错检测、检测连接状态、最大传送单元、网络层地址协商、数据压缩协商

（2）组成

一个将IP数据报封装到串行链路的方法。

一个用来建立、配置和测试数据链路连接的链路控制协议LCP。

一套网络控制协议NCP，其中每一个协议支持不同的网络层协议。

3.2.2帧格式

首部（FAC+协议）+IP数据报+尾部（检验序列FCS+F)

字节填充

零比特填充

3.2.3工作状态

链路静止（设备间无链路）-->链路建立（物理链路）-->鉴别（LCP链路）-->网络层协议(已鉴别的LCP）-->链路打开（已鉴别的LCP和NCP链路）-->链路终止

3.3使用广播信道的数据链路层

3.3.1局域网的数据链路层

局域网拓扑：星型网（集线器连接）、环形网、总线网

共享信道技术：静态划分信道（不适用与局域网）、动态媒体接入控制（又称多点接入，分为随机接入、受控接入）

适配器的作用：计算机与外界局域网的连接。主机箱中的网络接口板（卡），即网卡，现在叫适配器。

3.3.2CSMA/CD协议

  • 载波监听多点接入/碰撞检测
  • 多点接入：总线型网络上，许多计算机以多点接入的方式连接在一根总线上。
  • 载波监听：利用电子技术检测总线上有没有其他计算机也在发送。
  • 碰撞检测：边发送边监听，适配器边发送数据边检测信道上的信号电压变化情况，以判断自己在发送数据时其他站是否也在发送数据。
  • 要点：准备发送（封装）-->检测信道-->边发送边监听

3.4使用广播信道的以太网

3.4.1使用集线器的星型拓扑

以太网：用无源电缆作为总线来传送数据帧，并以曾经在历史上表示传播 电磁波的以太（Ether）来命名。

集线器：星型中心的可靠性非常高的设备

集线器特点：（1）使用集线器的以太网在逻辑上是一个总线网，使用CSMA/CD协议（适配器协议）；（2）多个接口的转发器；（3）工作在物理层，简单地转发比特流，不进行碰撞检测；（4）专门的芯片，进行自适应串音回波抵消。

3.4.2以太网的信道利用率

3.4.3以太网的MAC层

硬件地址：物理地址、MAC地址，固化在适配器中的ROM中的地址。

MAC帧格式：目的地址（6字节）+源地址（6字节）+类型字段（2字节）+数据（46~1500）+帧检验序列FCS（4字节）。

3.5扩展的以太网

3.5.1在物理层扩展以太网

以太网上的主机之间的距离不能太远，否则铜线传输信号会衰减到CSMA/CD不能正常工作。

使用工作在物理层的转发器来扩展以太网的地理覆盖范围。

3.5.2在数据链路层扩展以太网

网桥：工作在数据链路层，根据MAC帧的目的地址对收到的帧进行转发和过滤。使用网桥在数据链路层扩展以太网。

好处：（1）过滤通信量，增大吞吐量；（2）扩大了物理范围；（3）提高了可靠性；（4）可互联不同物理层、不同MAC子层和不同速率的以太网。

缺点：（1）增加了时延；（2）MAC子层中没有流量控制功能；（3）广播风暴（传播过多的广播信息而产生的网络拥塞）。

网桥在转发帧时，不改变帧的源地址。

透明网桥：即插即用设备，只要把网桥接入局域网，不用人工配置转发表网桥就能工作。

源路由网桥：

多接口网桥：以太网交换机，工作在数据链路层。一般网桥只有2-4个接口。

3.6高速以太网

高速以太网：速率达到或超过100Mb/s的以太网。

高速以太网技术：100BASE-T以太网、吉比特以太网、使用以太网进行宽带接入

4 网络层

4.1网络层提供的两种服务

虚电路服务：两个计算机通信时，建立一条虚拟的连接电路。可靠性由网络保证。

数据报服务：简单灵活、无连接、尽最大努力交付。可靠性由用户主机保证。

TCP/IP体系采用数据报服务。

4.2网际协议IP

与IP配套的三个协议：地址解析协议ARP、网际控制报文协议ICMP、网际组管理协议IGMP。

4.2.1虚拟互联网络

网路互联的中间设备：转发器（物理层）、网桥或桥接器（数据链路层）、路由器（网络层）、网关（网络层以上）

虚拟互联网络：由于参加互连的计算机网络都使用相同的网际协议IP，因此可以把互连以后的计算机网络看成一个虚拟互连网络（IP网），即在网络层上看起来好像是一个统一的网络，互联网。

互联网可以由多种异构网络互连组成。

4.2.2分类的IP地址

IP：整个因特网是一个单一的、抽象的网络。IP就是给因特网上的每一个主机（或路由器）的每一个接口分配一个在全世界范围是唯一的32位的标识符。

IP地址：：={<网络号>，<主机号>}

A类：0，8位网络号

B类：10,16位网络号

C类：110,24位网络号

D类：1110，多播地址

E类：1111，保留为今后使用

网络号

主机号

意义

0

0

本网络上的本主机

0

host-id

本网络上的某个主机

全1

全1

只在本网络上进行广播（各路由器均不转发）

Net-id

全1

对net-id上的所有主机进行广播

127

非全0或全1的任何数

作为本地环回测试之用

4.2.3IP地址与硬件地址

物理地址：是数据链路层和物理层使用的地址

IP地址：是网络层和以上各层使用的地址，是一种逻辑地址。

4.2.4地址解析协议ARP

ARP：根据机器的IP地址找到相应的硬件地址。解决同一局域网上的问题。

方法：在主机ARP高速缓存中存放一个从IP地址到硬件地址的映射表，这个映射表可以动态更新。

4.2.5IP数据报的格式

版本（4），首部长度（4），区分服务（8），总长度（16）

标识（16），标志（3），片偏移（13）

生存时间（8），协议（8），首部检验和（16）

源地址（32）

目的地址（32）

可选字段（长度可变），填充（）

数据部分（。。。。。。）

4.2.6IP层转发分组的流程

4.3划分子网和构造超网

4.3.1划分子网

子网划分的原因：（1）两级IP地址空间利用率有时很低（一个网络上的结点个数有限，则有些IP地址被浪费了）；（2）路由表太大（一个网络上的主机过多）；（3）两级IP地址不够灵活。

基本思路：

（1）一个拥有许多物理网络的单位，可将所属的物理网络划分成若干个子网。但这个单位对外仍表现为一个网络。

（2）两级的IP地址在本单位内变成了三级IP地址：：={<网络号>，<子网号>，<主机号>}

（3）从外面来的IP数据报仍会找到本单位的路由器，但是进来后，路由器按目的网络号和子网号找到目的子网，再把IP数据报交付个目的主机。

4.3.2子网掩码

子网划分：从主机号中分出几位来作为子网号。

两级IP（网络号+主机号）-->三级IP（网络号+子网号+主机号）

子网掩码：将网络号和子网号全部置为1，主机号为0，即为子网掩码。

默认子网掩码：即子网号位数为0时的子网掩码，即A，B，C类地址的默认子网掩码。

划分子网增加了灵活性，但减少了能够连接在网络上的主机总数。

4.3.3无分类编址CIDR（构成超网）

无分类的两级编址：IP地址：：={<网络前缀>，<主机号>}

无分类域间路由选择CIDR记法：128.14.34.7/20（无分类两级编址/网络前缀长度）

构成超网：CIDR地址块都包含了多个C类地址。

4.4网际控制报文协议ICMP

4.4.1ICMP报文种类

  • ICMP：允许主机或路由器报告差错情况和提供有关异常情况的报告。ICMP报文封装在IP数据报中。
  • 种类：ICMP差错报告报文，ICMP询问报文
  • ICMP差错报告报文共有五种：终点不可达，源点抑制（拥塞，请慢点），时间超过，参数问题，改变路由（重定向，请选择更好的路由）
  • ICMP询问报文：（1）回送请求和回答（你听得到吗，我听得到）；（2）时间戳请求和回答（几点了，32位时间戳）

4.4.2ICMP的应用举例

分组网间探测PING：测试两个主机间的连通性。应用层直接使用网络层的一个例子，没有通过运输层的TCP或UDP。

traceroute：跟踪一个分组从源点到终点的路径

4.5因特网的路由选择协议

4.5.1基本概念

理想的路由算法：正确完整，简单，能适应通信量和网络拓扑的变化（自适应性），稳定性，公平，最佳。

自治系统AS：因特网将整个互联网划分成许多较小的自治系统。一个AS对其他AS表现出的是一个单一的和一致的路由选择策略。

两大类路由选择协议：内部网关协议IGP（如RIP，OSPF），外部网关协议EGP（解决不同自治系统之间的选择信息传递，如BGP）

4.5.2内部网关协议RIP

RIP：路由信息协议，一种分布式的基于距离的向量路由选择协议。使用用户数据报UDP传送。

特点：（1）仅和相邻路由器交换信息；（2）交换的信息是本路由器所知道的全部信息，即自己的路由表；（3）按固定的时间间隔交换路由信息。

4.5.3内部网关协议OSPF

OSPF：开放最短路径优先。直接用IP数据报传送。

特点：（1）向本自治系统中所有路由器发送消息（洪泛法）；（2）发送的消息是与本路由器相邻的所有路由器的链路状态；（3）只有当链路状态发生变化时，路由器才向所有的路由器用洪泛法发送此消息。

五种分组类型：（1）问候；（2）数据库描述（介绍自己）；（3）链路状态请求；（4）链路状态更新；（5）链路状态确认。

4.5.4外部网关协议BGP

不使用内部网关协议的原因：（1）因特网规模太大，使得AS之间路由选择非常困难；（2）AS之间的路由选择必须考虑有关策略。

BGP：边界网关协议

4.5.5路由器的构成

路由器结构：路由选择、分组转发

路由选择：控制部分，核心构建是路由选择处理机。

分组转发：交换结构，一组输入端口、一组输出端口

交换结构：将数据端口的分组转发到输出端口，方式：（1）通过存储器；（2）通过总线；（3）通过互联网络。

4.6IP多播

4.6.1基本概念

多播：一对多的通信，只需发送一次，路由器复制成多个。

IP多播：在因特网上进行多播

4.6.2在局域网上进行硬件多播

4.6.3网际组管理协议IGMP和多播路由选择协议

IGMP：让连接在本地局域网上的多播路由器知道本局域网上是否有主机参加或退出了某个多播组。

多播路由选择协议转发的三种方式：（1）洪泛和剪除；（2）隧道技术；（3）基于核心的发现技术

4.7虚拟专用网VPN和网络地址转换NAT

4.7.1虚拟专用网VPN

本地地址：仅在本机构有效的IP地址，机构内部自行分配的IP地址。

全球地址：向因特网的管理机构申请全球唯一的IP地址。

专用地址：RFC指明，只能用于一个机构的内部通信，而不能用于和因特网上的主机通信。

三个专用地址块：（1）10.0.0.0/8，又称24位块；（2）172.16.0.0/12，又称20位块；（3）192.168.0.0/16，又称16位块。

专用互联网（本地互联网）：采用专用IP地址块的互联网络，简称专用网。

专用IP地址：可重用地址。

虚拟专用网VPN：利用公用的因特网作为本机构各专用网之间的通信载体。

实现：两个路由器（外部接口是合法全球IP地址）在因特网上建立一个隧道（传输的数据是加密的），将两个场所连成一个专用网。

内联网：两个场所的内部网络构成的虚拟专用网

外联网：有些外部机构（通常是合作伙伴）参加进来

远程接入VPN：外地工作的员工通过拨号接入因特网，而驻留在PC中的VPN软件可以在员工的PC和公司的主机之间建立VPN隧道。

4.7.2网络地址转换NAT

网络地址转换NAT：使内网主机能够与因特网上的主机通信。通过NAT路由器将其本地地址转换成全球IP地址。

5 运输层

5.1运输层协议概述

5.1.1进程间通信

通信的真正断点不是主机而是主机中的进程，端到端的通信时应用进程之间的通信。

运输层向高层用户屏蔽了下面网络核心的细节，它是应用进程看见的就是好像在两个运输层实体之间有一条端到端的逻辑通信信道。

运输层的重要功能：复用和分用。

5.1.2运输层的两个主要协议

用户数据报协议UDP，不需要先建立连接。

传输控制协议TCP，提供面向连接的服务。

5.1.3运输层的端口

端口：协议端口号，软件端口，应用层各种协议进程与运输实体进行层间交换的一种地址。

两类：服务器端使用的端口号（分为熟知端口号0~1023和登记端口号1024~49151）、客户端使用的端口号（仅在客户程序运行时才动态选择，短暂端口号）。

5.2用户数据报协议UDP

5.2.1概念

UDP：在IP数据报服务上增加了复用和分用以及差错检测功能。

特点：（1）无连接；（2）尽最大努力交付；（3）面向报文（直接报应用层的报文加上首部就交给IP层）；（4）没有拥塞控制；（5）支持一对一、一对多、多对一的交互通信；（6）首部开销小（8个字节）

5.2.2首部格式

源端口（2字节）

目的端口（2字节）

长度（2字节）

检验和（2字节）

5.3传输控制协议TCP概述

5.3.1主要特点

（1）面向连接的运输层协议

（2）每一条TCP连接只能由两个端点，只能是点对点的

（3）提供可靠交付

（4）提供全双工通信（两边能够同时发送接收，采用缓存）

（5）面向字节流（应用层报一个个大小不等的数据块交给TCP，TCP把它们看成一连串无结构的字节流）

5.3.2连接

TCP把连接作为最基本的抽象。

TCP连接的端点：套接字或插口，端口号拼接到IP地址即构成类套接字。

套接字socket=（IP地址：端口号）

每一条TCP连接唯一地被通信两端的两个端点所确定：

TCP连接：：={socket1，socket2}={（IP1：port1），（IP2：port2）}

5.4可靠传输的工作原理

5.4.1理想传输

（1）传输信道不产生差错

（2）不管发送方以多快的速度发送数据，接收方总是来得及处理收到的数据。

5.4.2停止等待协议

超时重传：发送方发送一个分组后，如果一段时间没有接到确认，就会把这个分组重发一次。

确认丢失和确认迟到：接收方会丢弃重复的分组，发送方不管迟到的确认。

流水线传输：为了提高传输效率，发送方可以不适用低效率的停止等待协议，而是采用流水线传输。

5.4.3连续ARQ协议

发送方维持一个发送窗口，每收到一个确认就向前滑动一个位置。接收方采用累积确认，即对按序到达的最后一个分组发送确认（接收到分组1-5，只发送5的确认）。

5.5TCP报文段的首部格式

源端口（2），目的端口（2）

序号（4）

确认号（4）

数据偏移（4位），保留（6位），控制位（6位：紧急URG，确认ACK，推送PSH，复位RST，同步SYN，终止FIN），窗口（2）

校验和（2），紧急指针（2，在URG=1时才有意义）

选项（可变，最长为40），填充

5.6TCP可靠传输的实现

5.6.1以字节为单位的滑动窗口

5.6.2超时重传时间的选择

自适应算法：计算报文段的往返时间RTT，累积得到平滑的往返时间RTTs，超时重传时间RTO略大于加权平均往返时间RTTs。

5.6.3选择确认SACK

5.7TCP的流量控制

5.7.1利用滑动窗口实现流量控制

流量控制：让发送方的发送速率不要太快，要让接收方来得及接收

滑动窗口机制控制：发送方的发送窗口不能超过接收方的接收窗口的数值。

5.7.2必须考虑传输效率

5.8TCP的拥塞控制

5.8.1一般原理

拥塞控制：防止过多的数据注入到网络中，这样可以使网络中的路由器或链路不致过载。

流量控制是点对点的通信量控制，拥塞控制是全局性的过程。

轻度拥塞：网络吞吐量明显小于理想吞吐量时

拥塞状态：随着提供的负载的增大，网络的吞吐量下降

死锁：提供的负载增大到某一数值时，网络的吞吐量下降到零，网络无法工作。

5.8.2几种拥塞控制方法

（1）慢开始

（2）拥塞避免

（3）快重传

（4）快恢复

5.8.3随机早期检测RED

5.9TCP的运输连接管理

5.9.1建立连接

三次握手

5.9.2释放连接

四次握手

5.9.3有限机状态

6 应用层

6.1域名解析系统

6.1.1概念

域名系统DNS：因特网使用的命名系统，用来把便于人们使用的机器名字转换成IP地址。

域名服务器程序：完成域名到IP地址的解析

域名服务器：运行域名服务器程序的机器

6.1.2因特网的域名结构

  • 顶级域名TLD：国家顶级域名nTLD（cn，us，uk），通用顶级域名gTLD（com公司企业，net网络服务机构，org非盈利性组织，int国际组织，edu美国专用的教育机构，gov美国政府部门，mil美国军事部门），基础结构域名（一个，arpa，用于反向域名解析）
  • 二级域名：由国家自行确定，我国：类别域名（ac科研机构，com企业，edu教育机构，gov政府机构，mil国防机构），行政区域名（bj北京市）

6.1.3域名服务器

  • 根域名服务器：最高层次的域名服务器，知道所有的顶级域名服务器的域名和IP地址。
  • 顶级域名服务器：负责管理在顶级域名服务器注册的所有二级域名。
  • 权限域名服务器：负责一个区的域名服务器。
  • 本地域名服务器：默认域名服务器
  • 域名解析过程：（1）主机向本地域名服务器的查询一般是采用递归查询（如果不知道，我帮你问问）；（2）本地域名服务器向根域名服务器的查询通常是采用迭代查询（如果不知道，你应该去问那个谁）。

6.2文件传输协议

6.2.1FTP概述

FTP：文本传输协议，因特网上使用最广的文件传输协议。

6.2.2基本工作原理

网络环境的一项基本应用：将文件从一台计算机复制到另一台计算机。

原理：

服务器端：主进程（接收新请求），从属进程（处理单个请求，分为控制进程和数据传输进程）

客户端：用户界面，控制进程，数据传输进程

6.2.3简单文件传送协议TFTP

原理：使用客户-服务器方式，使用UDP数据报，有自己的差错改正措施。

优点：（1）可用于UDP环境；（2）所占内存小。

6.3远程终端协议TELNET

TELNET：远程终端协议，终端仿真协议，将用户击键传到远地主机，感觉像是键盘和显示器直接连在远地主机上。

网络虚拟终端NVT：TELNET两端的系统不一样，之间的数据和命名的转换通过NVT格式（用户格式<-->NVT格式<-->远地系统格式）。

6.4万维网WWW

6.4.1概述

万维网：一个大规模的、联机式的信息储藏所。分布式超媒体系统，是超文本系统的扩充。

超文本：包含指向其他文档链接的文本。是万维网的基础。

超媒体：相比超文本，处理包含文本信息，还包含图像、声音、动画、活动视频等。

万维网客户程序：浏览器

万维网服务器：万维网文档所驻留的主机（运行服务器程序）

统一资源定位符URL：Uniform Resource Locator，标志万维网上的各种文档，并使每一个文档在整个因特网的范围内具有唯一的标识符URL。

超文本传送协议HTTP：万维网客户程序与万维网服务器程序之间的交互遵守的严格协议。

超文本标记语言HTML：使链接到的不同风格的万维网文档在主机上显示出来。

6.4.2统一资源定位符URL

  • URL：用来表示从因特网上得到的资源位置和访问这些资源的方法。不区分大小写
  • 组成：<协议>://<主机>:<端口>/<路径>
  • http默认端口号：80
  • 主页：省略默认端口号，省略文件的路径项，如清华大学主页：http://www.tsinghua.edu.cn
  • 主页情况一般是：（1）一个www服务器的最高级别页面；（2）某一组织或部门的一个定制的页面或目录；（3）由一个人自己设计的描述他本人情况的WWW页面。

6.4.3超文本传送协议HTTP

HTTP：定义了浏览器（万维网客户进程）怎样向万维网服务器请求万维网文档，以及服务器怎样把文档传给浏览器。面向事务的应用层协议。

操作过程（以HTTP/1.0为例）：

（1）浏览器分析链接指向页面的URL；

（2）浏览器向DNS请求解析IP地址

（3）DNS解析出IP地址

（4）浏览器与服务器建立TCP链接

（5）浏览器发出取文件命令

（6）服务器给出响应，传送文件

（7）释放TCP连接

（8）浏览器显示页面文本。

代理服务器：网络实体，万维网高速缓存，把最近的一些请求和响应暂存在本地磁盘中，当新请求到达时，如果本地有暂存，直接响应。

HTTP两类报文：请求报文，响应报文

报文结构：（1）开始行（用来区分请求报文和响应报文）；（2）首部行（用来说明浏览器、服务器或报文主体的一些信息）；（3）实体主体（请求报文通常不用，响应报文有些不用）

Cookie：HTTP服务器和客户之间传递的状态信息。

Cookie工作过程：

（1）用户张三浏览使用Cookie的网站，该网站服务器为张三产生唯一识别码，在响应文档中添加Set-cookie：识别码。

（2）张三浏览器在特定的Cookie文件中添加一行，记录服务器主机名和识别码

（3）张三继续浏览这个网站，取出识别码，HTTP请求报文中添加Cookie：识别码

（4）用户收到有识别码的请求，即可跟踪用户张三在该网站的活动。服务器并不需要知道用户姓名和其他信息。

6.4.4万维网的文档

HTML：一种制作万维网页面的标准语言，消除了不同计算机之间信息交流的障碍。

HTML文档：HTML把各种标签嵌入到万维网页面中，这样就构成类HTML文档。

XML：Extensible Markup Language，可扩展标记语言，用于标记电子文件，使其具有结构性的标记语言，可用来标记数据、定义数据类型，是一种允许用户对自己的标记语言进行定义的源语言。

XHTML：可扩展超文本标记语言

CSS：Cascading Style Sheets，层叠样式表，一种样式表语言，用于为HTML文档定义布局。HTML用于结构化内容，CSS用于格式化结构化内容（即字体，颜色，边距等）。

动态万维网文档：

静态文档：创作完成之后，用户浏览过程中，内容不会改变。

动态文档：文档内容在浏览器访问万维网服务器时才由应用程序动态创建。

CGI：Common GatewayInterface，通用网关接口，一种标准，定义了动态文档应如何创建，输入数据应如何提供给应用程序，以及输出结果应如何使用。

活动万维网文档

两种技术用于浏览器屏幕显示连续更新：服务器推送，活动文档

服务器推送：所有工作都由服务器完成，服务器不断地运行与动态文档相关联的应用程序，定期更新信息，并发送更新过的文档。

活动文档：所有工作都交给浏览器端。浏览器请求一个活动文档，服务器返回一段活动文档程序副本，使该程序副本在浏览器执行。（如applet小程序）

6.4.5万维网的信息检索系统

  • 搜索引擎：当用户不知道所需信息时，在万维网中用来进行搜索的工具。
  • 两类搜索引擎：全文检索，分类目录
  • 全文搜索搜索引擎：纯技术性的检索工具，通过搜索软件（如Spider）到因特网上各网站收集信息，按一定规则建立在线数据库供用户查询。如Google，百度。
  • 分类目录搜索引擎：不采集网站的任何信息，利用各网站向搜索引擎提交的网站信息填写关键词和网站描述等信息，经过人工审核后，输入到分类目录的数据库中，供用户查询。如雅虎，雅虎中国，新浪，搜狐，网易。
  • 垂直搜索引擎：针对某一特定领域、特定人群或某一特点需求提供搜索服务。
  • 元搜索引擎：把用户提交的检索请求发送给多个独立的搜索引擎上去搜索，并把检索结果集中统一处理，以统一的格式提供给用户，因此是搜索引擎之上的搜索引擎。
  • Google搜索技术特点：PageRank（网页排名）

6.4.6博客、微博和轻博

博客（blog）：万维网日志（web log）的简称。

网络日志：个人撰写并在因特网上发布的、属于网络共享的个人日记。

微博：微型博客，微博客，只记录片段、碎语，三言两语，现场记录，发发感慨，晒晒心情，永远只针对一个问题进行回答。

轻博：轻博客，介于博客（倾向于表达）和微博（倾向于社交和传播）之间的网络服务，同样为用户提供生成内容表达自己的平台。

6.5电子邮件

6.5.1概述

  • 电子邮件：因特网上使用最多的和用户最受欢迎的一种应用。发送-->邮箱-->读取。
  • 电子邮件系统三个构件：用户代理、邮件服务器、邮件发送协议和邮件读取协议
  • 用户代理：用户与电子邮件系统的接口，大多数情况下式运行在用户PC的一个程序。如Outlook Express，Foxmail
  • 用户代理四个功能：（1）撰写；（2）显示；（3）处理；（4）通信。
  • 邮件服务器使用的两种不同协议：（1）用户代理发送到邮件服务器或服务器之间发送邮件的协议，如SMTP（简单邮件传送协议）；（2）用户代理从邮件服务器读取邮件的协议，如邮局协议POP3。
  • 邮件传输：全程TCP连接。
  • 电子邮件地址：用户名@邮件服务器的域名

6.5.2简单邮件传送协议SMTP

客户-服务器方式

建立连接-->邮件传送-->连接释放

6.5.3电子邮件的信息格式

格式：信封+内容

内容：首部（To，Subject主题，Cc复写副本，Bcc暗送，From，Date，Reply-To），主体

6.5.4邮件读取协议POP3和IMAP

邮局协议POP：客户-服务器方式，服务器把邮件送到后，就把它删除（POP3会保留一段时间），邮件到了本地。

IMAP：internetMessage Access Protocol，网际报文存取协议，客户-服务器方式，建立连接后，用户在自己PC上就可以操作邮件服务器的邮箱，是一个联机协议。

6.5.5基于万维网的电子邮件

万维网电子邮件：存储在网上的电子邮件，如Gmail，Hotmail，Yahoo!Mail，163，sina

协议：邮件服务器之间（如162-->sina）采用SMTP，用户浏览器与邮件服务器之间发送与接收采用HTTP。

6.5.6通用因特网邮件扩充MIME

MIME：为解决SMTP的缺点而提出，没有改动或取代SMTP，继续使用原来的邮件格式，但增加了邮件主体的结构，并定义了传送非ASCII码的编码规则。

6.6动态主机配置协议DHCP

协议配置：在协议软件中给参数赋值的动作。

连接到因特网的计算机的协议软件需要配置的项目包括：（1）IP地址；（2）子网掩码；（3）默认路由器的IP地址；（4）域名服务器的IP地址。

DHCP：Dynamic HostConfiguration Protocol，自动协议配置方法，提供即插即用联网。

6.7简单网络管理协议SNMP

6.7.1网络管理基本概念

网络管理：简称网管，包括对硬件、软件和人力的使用、综合与协调，以便对网络资源进行监视、测试、配置、分析、评价和控制，这样就能以合理的价格满足网络的一些需求，以实时运行性能、服务质量等。

管理站：管理器，是整个网络管理系统的核心，通常是个有着良好图形界面的高性能工作站，并由网络管理员直接操作和控制。

SNMP：简单网络管理协议，客户-服务器方式

基本原理：若要管理某个对象，就必然会给该对象添加一些软件或硬件，但这种“添加”必须对原有对象的影响尽量小些。

SNMP网络管理三部分组成：SNMP本身，管理信息结构SMI，管理信息库MIB

6.7.2管理信息结构SMI

功能：规定（1）被管对象应怎样命名；（2）用来存储被管对象的数据类型有哪些种；（3）在网络上传送的管理数据应如何编码。

6.7.3管理信息库MIB

管理信息：在因特网的网管框架中被管对象的集合。

管理信息库MIB：被管对象构成一个虚拟的信息存储器

6.7.4SNMP的协议数据单元和报文

6.8应用进程跨越网络的通信

6.8.1系统调用和应用编程接口

系统调用：在应用程序和操作系统之间传递控制权

应用编程接口API：应用程序调用系统调用的接口

套接字接口：TCP/IP协议软件已被驻留在操作系统中，TCP/IP标准没有规定TCP/IP协议软件应如何实现接口细节，套接字接口是一种著名的API。

6.8.2几种常用的系统调用

连接建立（bind,listen,accept,connect），数据传送阶段（send,recv），连接释放（close）。

系统调用使用顺序例子：

客户端： socket-->connect-->send-->recv-->close

服务器端：socket-->bind-->listen-->accept-->recv-->send-->close

7 网络安全

7.1概述

7.1.1计算机网络面临的安全性威胁

  • 两类：被动攻击，主动攻击
  • 被动攻击：截获，流量分析，攻击者从网络上窃听他人的通信内容
  • 主动攻击：（1）篡改：攻击者故意篡改网络上传送的报文；（2）恶意程序：计算机病毒，蠕虫，特洛伊木马，逻辑炸弹；（3）拒绝服务：攻击者向因特网上的某个服务器不停地发送大量分组，使因特网或服务器无法提供正常服务。

7.1.2内容

（1）保密性：为用户提供安全可靠的保密通信

（2）安全协议的设计

（3）访问控制：存取或接入控制

7.1.3一般的数据加密模型

明文-->密钥+加密算法-->密文-->传送-->密文-->解密算法+密钥-->明文

7.2两类密码体制

对称密钥密码体制：加密密钥和解密密钥是相同的，如DES，IDEA

公钥密钥体制：加密与解密密钥不同，加密密钥（公钥）是向公众公开的，解密密钥（私钥）是保密的，

7.3数字签名

三点功能：（1）报文鉴别；（2）报文完整性；（3）不可否认。

采用公钥体系

7.4鉴别

鉴别：验证通信的双方的确是自己所要通信的对象，而不是其他冒充者。

两种：报文鉴别，实体鉴别

报文鉴别方法：报文摘要MD

7.5密钥分配

7.6因特网使用的安全协议

7.6.1网络层安全协议

IPsec

7.6.2运输层安全协议

安全套接字层SSL（Secure Socket Layer）

运输层安全TLS（Transport Layer Security）

7.6.3应用层的安全协议

7.7系统安全：防火墙和入侵检测

7.7.1防火墙

防火墙：一种访问控制技术，通过严格控制进出网络边界的分组，禁止任何不必要的通信，从而减少潜在入侵的发生，尽可能降低这类安全威胁所带来的安全风险。

防火墙：一种特殊编程的路由器，安装在一个网店和网络的其余部分之间，目的是实施访问控制策略。

两类技术：（1）分组过滤路由器；（2）应用网关，也称代理服务器

7.7.2入侵检测系统

IDS：IntrusionDetection System，入侵检测系统。

方法：（1）基于特征的入侵检测，维护一个所有已知攻击标志性特征的数据库；（2）基于异常的入侵检测。

8 因特网上的音频/视频服务

8.1概述

多媒体信息特点：（1）信息量大；（2）传输时，对时延和时延抖动均有较高的要求（边传边放）

三种音频/视频服务：（1）流式存储音频/视频，边下载边播放；（2）流式实况音频/视频，边录制边播放；（3）交互式音频/视频，实时交互式通信。

8.2流式存储音频/视频

8.2.1具有元文件的万维网服务器

元文件：非常小的文件，描述或指明其他文件的一些重要信息。

8.2.2媒体播放器

媒体服务器：流式服务器

8.2.3实时流式协议RTSP

8.3交互式音频/视频

IP电话

8.4改进“尽最大努力交付”的服务

9 无线网络和移动网络

9.1无线局域网WLAN

两类：（1）有固定基础设施（基站）；（2）无固定基础设施

9.2无线个人区域网WPAN

WPAN：在个人工作地方把属于个人使用的电子设备（便携式电脑，平板等）用无线技术连接起来自组网络，如蓝牙

9.3无线城域网WMAN

9.4蜂窝移动通信网

10 下一代因特网

10.1下一代网际协议IPv6（IPng）

10.2多协议标记交换MPLS

10.3P2P应用

媛媛家的程序员
关注
计算机网络教程 第6版
qq_35414977的博客
12-11 2384
以传输信息为基础目的用通信线路和通信设备将多个计算机连接起来的计算机系统的集合网络：把许多计算机连接在一起互联网络：把许多网络连接在一起互联网/因特网边缘部分核心部分发展的三个阶段单个网络三级结构的互联网主干网地区网校园网（企业网）多层次 ISP 结构的互联网标准化工作分组转发路由选择虚拟电路网络：提供面向连接服务的网络ATM 网络帧中继网络X.25 网络组成源主机和目的主机之间的路径VC 号，该路径上的每段链路的号码该路径上的每台路由器中的转发表表项。
关于《计算机网络（第七版）》的总结
云中朝颜的博客
11-11 2650
计算机网络 明天就要考了，今天就一边写一边总结，当做复习。 第一章 互联网的两个基本特点：连通性和共享。 互联网的组成：边缘部分：就是我们所使用的的主机。核心部分：网络和路由器。（这其实和我们城市相反，核心反而不住“人”，哈哈） 边缘部分：客户-服务器方式，对等连接方式（两者既是服务端也是客户） 核心部分：交换方式：电路交换（一定面向连接），报文交换，分组交换（就是将报文细分然后连续发送） 计算机...
计算机网络（谢希仁第六版）
09-28
①由作者本人（谢希仁）编写的PPT学习材料。 ②@版本 计算机网络（第 6 版）课件电子工业出版社 2012 年
《计算机网络（第六版）》全套电子课件
06-25
共10个PPT，比较全面系统地介绍了计算机网络的发展和原理体系结构、物理层、数据链路层(包括局域网)、网络层、运输层、应用层、网络安全、因特网上的音频／视频服务、无线网络和移动网络，以及下一代因特网等内容。
计算机网络知识汇总（超详细整理）从零基础入门到精通，看完这一篇就够了
最新发布
wananxuexihu的博客
08-05 3316
为了准备期末考试，同时也是为了之后复习方便，特对计算机网络的知识进行了整理。本篇内容大部分是来源于我们老师上课的ppt。而我根据自己的理解，将老师的PPT整理成博文的形式以便大家复习查阅，同时对于一些不是很清楚的地方，我去查阅了相关资料进行补充，当然也会有少部分个人看法夹带其中来帮助大家理解。应评论要求这里放上本文的思维导图以供大家更好的查看网络边缘:位于互联网边缘与互联网相连的计算机和其他设备,如桌面计算机、移动计算机、服务器、其他智能终端设备网络核心。
计算机网络第六版答案
06-14
Computer Networking: A Top-Down Approach, 6th Edition Solutions to Review Questions and Problems Version Date: May 2012 This document contains the solutions to review questions and problems for the 5th edition of Computer Networking: A Top-Down Approach by Jim Kurose and Keith Ross. These solutions are being made available to instructors ONLY. Please do NOT copy or distribute this document to others (even other instructors). Please do not post any solutions on a publicly-available Web site. We’ll be happy to provide a copy (up-to-date) of this solution manual ourselves to anyone who asks. Acknowledgments: Over the years, several students and colleagues have helped us prepare this solutions manual. Special thanks goes to HongGang Zhang, Rakesh Kumar, Prithula Dhungel, and Vijay Annapureddy. Also thanks to all the readers who have made suggestions and corrected errors. All material © copyright 1996-2012 by J.F. Kurose and K.W. Ross. All rights reserved Chapter 1 Review Questions There is no difference. Throughout this text, the words “host” and “end system” are used interchangeably. End systems include PCs, workstations, Web servers, mail servers, PDAs, Internet-connected game consoles, etc. From Wikipedia: Diplomatic protocol is commonly described as a set of international courtesy rules. These well-established and time-honored rules have made it easier for nations and people to live and work together. Part of protocol has always been the acknowledgment of the hierarchical standing of all present. Protocol rules are based on the principles of civility. Standards are important for protocols so that people can create networking systems and products that interoperate. 1. Dial-up modem over telephone line: home; 2. DSL over telephone line: home or small office; 3. Cable to HFC: home; 4. 100 Mbps switched Ethernet: enterprise; 5. Wifi (802.11): home and enterprise: 6. 3G and 4G: wide-area wireless. HFC bandwidth is shared among the users. On the downstream channel, all packets emanate from a single source, namely, the head end. Thus, there are no collisions in the downstream channel. In most American cities, the current possibilities include: dial-up; DSL; cable modem; fiber-to-the-home. 7. Ethernet LANs have transmission rates of 10 Mbps, 100 Mbps, 1 Gbps and 10 Gbps. 8. Today, Ethernet most commonly runs over twisted-pair copper wire. It also can run over fibers optic links. 9. Dial up modems: up to 56 Kbps, bandwidth is dedicated; ADSL: up to 24 Mbps downstream and 2.5 Mbps upstream, bandwidth is dedicated; HFC, rates up to 42.8 Mbps and upstream rates of up to 30.7 Mbps, bandwidth is shared. FTTH: 2-10Mbps upload; 10-20 Mbps download; bandwidth is not shared. 10. There are two popular wireless Internet access technologies today: Wifi (802.11) In a wireless LAN, wireless users transmit/receive packets to/from an base station (i.e., wireless access point) within a radius of few tens of meters. The base station is typically connected to the wired Internet and thus serves to connect wireless users to the wired network. 3G and 4G wide-area wireless access networks. In these systems, packets are transmitted over the same wireless infrastructure used for cellular telephony, with the base station thus being managed by a telecommunications provider. This provides wireless access to users within a radius of tens of kilometers of the base station. 11. At time t0 the sending host begins to transmit. At time t1 = L/R1, the sending host completes transmission and the entire packet is received at the router (no propagation delay). Because the router has the entire packet at time t1, it can begin to transmit the packet to the receiving host at time t1. At time t2 = t1 + L/R2, the router completes transmission and the entire packet is received at the receiving host (again, no propagation delay). Thus, the end-to-end delay is L/R1 + L/R2. 12. A circuit-switched network can guarantee a certain amount of end-to-end bandwidth for the duration of a call. Most packet-switched networks today (including the Internet) cannot make any end-to-end guarantees for bandwidth. FDM requires sophisticated analog hardware to shift signal into appropriate frequency bands. 13. a) 2 users can be supported because each user requires half of the link bandwidth. b) Since each user requires 1Mbps when transmitting, if two or fewer users transmit simultaneously, a maximum of 2Mbps will be required. Since the available bandwidth of the shared link is 2Mbps, there will be no queuing delay before the link. Whereas, if three users transmit simultaneously, the bandwidth required will be 3Mbps which is more than the available bandwidth of the shared link. In this case, there will be queuing delay before the link. c) Probability that a given user is transmitting = 0.2 d) Probability that all three users are transmitting simultaneously = = (0.2)3 = 0.008. Since the queue grows when all the users are transmitting, the fraction of time during which the queue grows (which is equal to the probability that all three users are transmitting simultaneously) is 0.008. 14. If the two ISPs do not peer with each other, then when they send traffic to each other they have to send the traffic through a provider ISP (intermediary), to which they have to pay for carrying the traffic. By peering with each other directly, the two ISPs can reduce their payments to their provider ISPs. An Internet Exchange Points (IXP) (typically in a standalone building with its own switches) is a meeting point where multiple ISPs can connect and/or peer together. An ISP earns its money by charging each of the the ISPs that connect to the IXP a relatively small fee, which may depend on the amount of traffic sent to or received from the IXP. 15. Google's private network connects together all its data centers, big and small. Traffic between the Google data centers passes over its private network rather than over the public Internet. Many of these data centers are located in, or close to, lower tier ISPs. Therefore, when Google delivers content to a user, it often can bypass higher tier ISPs. What motivates content providers to create these networks? First, the content provider has more control over the user experience, since it has to use few intermediary ISPs. Second, it can save money by sending less traffic into provider networks. Third, if ISPs decide to charge more money to highly profitable content providers (in countries where net neutrality doesn't apply), the content providers can avoid these extra payments. 16. The delay components are processing delays, transmission delays, propagation delays, and queuing delays. All of these delays are fixed, except for the queuing delays, which are variable. 17. a) 1000 km, 1 Mbps, 100 bytes b) 100 km, 1 Mbps, 100 bytes 18. 10msec; d/s; no; no 19. a) 500 kbps b) 64 seconds c) 100kbps; 320 seconds 20. End system A breaks the large file into chunks. It adds header to each chunk, thereby generating multiple packets from the file. The header in each packet includes the IP address of the destination (end system B). The packet switch uses the destination IP address in the packet to determine the outgoing link. Asking which road to take is analogous to a packet asking which outgoing link it should be forwarded on, given the packet’s destination address. 21. The maximum emission rate is 500 packets/sec and the maximum transmission rate is 350 packets/sec. The corresponding traffic intensity is 500/350 =1.43 > 1. Loss will eventually occur for each experiment; but the time when loss first occurs will be different from one experiment to the next due to the randomness in the emission process. 22. Five generic tasks are error control, flow control, segmentation and reassembly, multiplexing, and connection setup. Yes, these tasks can be duplicated at different layers. For example, error control is often provided at more than one layer. 23. The five layers in the Internet protocol stack are – from top to bottom – the application layer, the transport layer, the network layer, the link layer, and the physical layer. The principal responsibilities are outlined in Section 1.5.1. 24. Application-layer message: data which an application wants to send and passed onto the transport layer; transport-layer segment: generated by the transport layer and encapsulates application-layer message with transport layer header; network-layer datagram: encapsulates transport-layer segment with a network-layer header; link-layer frame: encapsulates network-layer datagram with a link-layer header. 25. Routers process network, link and physical layers (layers 1 through 3). (This is a little bit of a white lie, as modern routers sometimes act as firewalls or caching components, and process Transport layer as well.) Link layer switches process link and physical layers (layers 1 through2). Hosts process all five layers. 26. a) Virus Requires some form of human interaction to spread. Classic example: E-mail viruses. b) Worms No user replication needed. Worm in infected host scans IP addresses and port numbers, looking for vulnerable processes to infect. 27. Creation of a botnet requires an attacker to find vulnerability in some application or system (e.g. exploiting the buffer overflow vulnerability that might exist in an application). After finding the vulnerability, the attacker needs to scan for hosts that are vulnerable. The target is basically to compromise a series of systems by exploiting that particular vulnerability. Any system that is part of the botnet can automatically scan its environment and propagate by exploiting the vulnerability. An important property of such botnets is that the originator of the botnet can remotely control and issue commands to all the nodes in the botnet. Hence, it becomes possible for the attacker to issue a command to all the nodes, that target a single node (for example, all nodes in the botnet might be commanded by the attacker to send a TCP SYN message to the target, which might result in a TCP SYN flood attack at the target). 28. Trudy can pretend to be Bob to Alice (and vice-versa) and partially or completely modify the message(s) being sent from Bob to Alice. For example, she can easily change the phrase “Alice, I owe you $1000” to “Alice, I owe you $10,000”. Furthermore, Trudy can even drop the packets that are being sent by Bob to Alice (and vise-versa), even if the packets from Bob to Alice are encrypted. Chapter 1 Problems Problem 1 There is no single right answer to this question. Many protocols would do the trick. Here's a simple answer below: Messages from ATM machine to Server Msg name purpose -------- ------- HELO Let server know that there is a card in the ATM machine ATM card transmits user ID to Server PASSWD User enters PIN, which is sent to server BALANCE User requests balance WITHDRAWL User asks to withdraw money BYE user all done Messages from Server to ATM machine (display) Msg name purpose -------- ------- PASSWD Ask user for PIN (password) OK last requested operation (PASSWD, WITHDRAWL) OK ERR last requested operation (PASSWD, WITHDRAWL) in ERROR AMOUNT sent in response to BALANCE request BYE user done, display welcome screen at ATM Correct operation: client server HELO (userid) --------------> (check if valid userid) <------------- PASSWD PASSWD --------------> (check password) <------------- AMOUNT WITHDRAWL --------------> check if enough $ to cover withdrawl (check if valid userid) <------------- PASSWD PASSWD --------------> (check password) <------------- AMOUNT WITHDRAWL --------------> check if enough $ to cover withdrawl <------------- BYE Problem 2 At time N*(L/R) the first packet has reached the destination, the second packet is stored in the last router, the third packet is stored in the next-to-last router, etc. At time N*(L/R) + L/R, the second packet has reached the destination, the third packet is stored in the last router, etc. Continuing with this logic, we see that at time N*(L/R) + (P-1)*(L/R) = (N+P-1)*(L/R) all packets have reached the destination. Problem 3 a) A circuit-switched network would be well suited to the application, because the application involves long sessions with predictable smooth bandwidth requirements. Since the transmission rate is known and not bursty, bandwidth can be reserved for each application session without significant waste. In addition, the overhead costs of setting up and tearing down connections are amortized over the lengthy duration of a typical application session. b) In the worst case, all the applications simultaneously transmit over one or more network links. However, since each link has sufficient bandwidth to handle the sum of all of the applications' data rates, no congestion (very little queuing) will occur. Given such generous link capacities, the network does not need congestion control mechanisms. Problem 4 Between the switch in the upper left and the switch in the upper right we can have 4 connections. Similarly we can have four connections between each of the 3 other pairs of adjacent switches. Thus, this network can support up to 16 connections. We can 4 connections passing through the switch in the upper-right-hand corner and another 4 connections passing through the switch in the lower-left-hand corner, giving a total of 8 connections. Yes. For the connections between A and C, we route two connections through B and two connections through D. For the connections between B and D, we route two connections through A and two connections through C. In this manner, there are at most 4 connections passing through any link. Problem 5 Tollbooths are 75 km apart, and the cars propagate at 100km/hr. A tollbooth services a car at a rate of one car every 12 seconds. a) There are ten cars. It takes 120 seconds, or 2 minutes, for the first tollbooth to service the 10 cars. Each of these cars has a propagation delay of 45 minutes (travel 75 km) before arriving at the second tollbooth. Thus, all the cars are lined up before the second tollbooth after 47 minutes. The whole process repeats itself for traveling between the second and third tollbooths. It also takes 2 minutes for the third tollbooth to service the 10 cars. Thus the total delay is 96 minutes. b) Delay between tollbooths is 8*12 seconds plus 45 minutes, i.e., 46 minutes and 36 seconds. The total delay is twice this amount plus 8*12 seconds, i.e., 94 minutes and 48 seconds. Problem 6 a) seconds. b) seconds. c) seconds. d) The bit is just leaving Host A. e) The first bit is in the link and has not reached Host B. f) The first bit has reached Host B. g) Want km. Problem 7 Consider the first bit in a packet. Before this bit can be transmitted, all of the bits in the packet must be generated. This requires sec=7msec. The time required to transmit the packet is sec= sec. Propagation delay = 10 msec. The delay until decoding is 7msec + sec + 10msec = 17.224msec A similar analysis shows that all bits experience a delay of 17.224 msec. Problem 8 a) 20 users can be supported. b) . c) . d) . We use the central limit theorem to approximate this probability. Let be independent random variables such that . “21 or more users” when is a standard normal r.v. Thus “21 or more users” . Problem 9 10,000 Problem 10 The first end system requires L/R1 to transmit the packet onto the first link; the packet propagates over the first link in d1/s1; the packet switch adds a processing delay of dproc; after receiving the entire packet, the packet switch connecting the first and the second link requires L/R2 to transmit the packet onto the second link; the packet propagates over the second link in d2/s2. Similarly, we can find the delay caused by the second switch and the third link: L/R3, dproc, and d3/s3. Adding these five delays gives dend-end = L/R1 + L/R2 + L/R3 + d1/s1 + d2/s2 + d3/s3+ dproc+ dproc To answer the second question, we simply plug the values into the equation to get 6 + 6 + 6 + 20+16 + 4 + 3 + 3 = 64 msec. Problem 11 Because bits are immediately transmitted, the packet switch does not introduce any delay; in particular, it does not introduce a transmission delay. Thus, dend-end = L/R + d1/s1 + d2/s2+ d3/s3 For the values in Problem 10, we get 6 + 20 + 16 + 4 = 46 msec. Problem 12 The arriving packet must first wait for the link to transmit 4.5 *1,500 bytes = 6,750 bytes or 54,000 bits. Since these bits are transmitted at 2 Mbps, the queuing delay is 27 msec. Generally, the queuing delay is (nL + (L - x))/R. Problem 13 The queuing delay is 0 for the first transmitted packet, L/R for the second transmitted packet, and generally, (n-1)L/R for the nth transmitted packet. Thus, the average delay for the N packets is: (L/R + 2L/R + ....... + (N-1)L/R)/N = L/(RN) * (1 + 2 + ..... + (N-1)) = L/(RN) * N(N-1)/2 = LN(N-1)/(2RN) = (N-1)L/(2R) Note that here we used the well-known fact: 1 + 2 + ....... + N = N(N+1)/2 It takes seconds to transmit the packets. Thus, the buffer is empty when a each batch of packets arrive. Thus, the average delay of a packet across all batches is the average delay within one batch, i.e., (N-1)L/2R. Problem 14 The transmission delay is . The total delay is Let . Total delay = For x=0, the total delay =0; as we increase x, total delay increases, approaching infinity as x approaches 1/a. Problem 15 Total delay . Problem 16 The total number of packets in the system includes those in the buffer and the packet that is being transmitted. So, N=10+1. Because , so (10+1)=a*(queuing delay + transmission delay). That is, 11=a*(0.01+1/100)=a*(0.01+0.01). Thus, a=550 packets/sec. Problem 17 There are nodes (the source host and the routers). Let denote the processing delay at the th node. Let be the transmission rate of the th link and let . Let be the propagation delay across the th link. Then . Let denote the average queuing delay at node . Then . Problem 18 On linux you can use the command traceroute www.targethost.com and in the Windows command prompt you can use tracert www.targethost.com In either case, you will get three delay measurements. For those three measurements you can calculate the mean and standard deviation. Repeat the experiment at different times of the day and comment on any changes. Here is an example solution: Traceroutes between San Diego Super Computer Center and www.poly.edu The average (mean) of the round-trip delays at each of the three hours is 71.18 ms, 71.38 ms and 71.55 ms, respectively. The standard deviations are 0.075 ms, 0.21 ms, 0.05 ms, respectively. In this example, the traceroutes have 12 routers in the path at each of the three hours. No, the paths didn’t change during any of the hours. Traceroute packets passed through four ISP networks from source to destination. Yes, in this experiment the largest delays occurred at peering interfaces between adjacent ISPs. Traceroutes from www.stella-net.net (France) to www.poly.edu (USA). The average round-trip delays at each of the three hours are 87.09 ms, 86.35 ms and 86.48 ms, respectively. The standard deviations are 0.53 ms, 0.18 ms, 0.23 ms, respectively. In this example, there are 11 routers in the path at each of the three hours. No, the paths didn’t change during any of the hours. Traceroute packets passed three ISP networks from source to destination. Yes, in this experiment the largest delays occurred at peering interfaces between adjacent ISPs. Problem 19 An example solution: Traceroutes from two different cities in France to New York City in United States In these traceroutes from two different cities in France to the same destination host in United States, seven links are in common including the transatlantic link. In this example of traceroutes from one city in France and from another city in Germany to the same host in United States, three links are in common including the transatlantic link. Traceroutes to two different cities in China from same host in United States Five links are common in the two traceroutes. The two traceroutes diverge before reaching China Problem 20 Throughput = min{Rs, Rc, R/M} Problem 21 If only use one path, the max throughput is given by: . If use all paths, the max throughput is given by . Problem 22 Probability of successfully receiving a packet is: ps= (1-p)N. The number of transmissions needed to be performed until the packet is successfully received by the client is a geometric random variable with success probability ps. Thus, the average number of transmissions needed is given by: 1/ps . Then, the average number of re-transmissions needed is given by: 1/ps -1. Problem 23 Let’s call the first packet A and call the second packet B. If the bottleneck link is the first link, then packet B is queued at the first link waiting for the transmission of packet A. So the packet inter-arrival time at the destination is simply L/Rs. If the second link is the bottleneck link and both packets are sent back to back, it must be true that the second packet arrives at the input queue of the second link before the second link finishes the transmission of the first packet. That is, L/Rs + L/Rs + dprop = L/Rs + dprop + L/Rc Thus, the minimum value of T is L/Rc  L/Rs . Problem 24 40 terabytes = 40 * 1012 * 8 bits. So, if using the dedicated link, it will take 40 * 1012 * 8 / (100 *106 ) =3200000 seconds = 37 days. But with FedEx overnight delivery, you can guarantee the data arrives in one day, and it should cost less than $100. Problem 25 160,000 bits 160,000 bits The bandwidth-delay product of a link is the maximum number of bits that can be in the link. the width of a bit = length of link / bandwidth-delay product, so 1 bit is 125 meters long, which is longer than a football field s/R Problem 26 s/R=20000km, then R=s/20000km= 2.5*108/(2*107)= 12.5 bps Problem 27 80,000,000 bits 800,000 bits, this is because that the maximum number of bits that will be in the link at any given time = min(bandwidth delay product, packet size) = 800,000 bits. .25 meters Problem 28 ttrans + tprop = 400 msec + 80 msec = 480 msec. 20 * (ttrans + 2 tprop) = 20*(20 msec + 80 msec) = 2 sec. Breaking up a file takes longer to transmit because each data packet and its corresponding acknowledgement packet add their own propagation delays. Problem 29 Recall geostationary satellite is 36,000 kilometers away from earth surface. 150 msec 1,500,000 bits 600,000,000 bits Problem 30 Let’s suppose the passenger and his/her bags correspond to the data unit arriving to the top of the protocol stack. When the passenger checks in, his/her bags are checked, and a tag is attached to the bags and ticket. This is additional information added in the Baggage layer if Figure 1.20 that allows the Baggage layer to implement the service or separating the passengers and baggage on the sending side, and then reuniting them (hopefully!) on the destination side. When a passenger then passes through security and additional stamp is often added to his/her ticket, indicating that the passenger has passed through a security check. This information is used to ensure (e.g., by later checks for the security information) secure transfer of people. Problem 31 Time to send message from source host to first packet switch = With store-and-forward switching, the total time to move message from source host to destination host = Time to send 1st packet from source host to first packet switch = . . Time at which 2nd packet is received at the first switch = time at which 1st packet is received at the second switch = Time at which 1st packet is received at the destination host = . After this, every 5msec one packet will be received; thus time at which last (800th) packet is received = . It can be seen that delay in using message segmentation is significantly less (almost 1/3rd). Without message segmentation, if bit errors are not tolerated, if there is a single bit error, the whole message has to be retransmitted (rather than a single packet). Without message segmentation, huge packets (containing HD videos, for example) are sent into the network. Routers have to accommodate these huge packets. Smaller packets have to queue behind enormous packets and suffer unfair delays. Packets have to be put in sequence at the destination. Message segmentation results in many smaller packets. Since header size is usually the same for all packets regardless of their size, with message segmentation the total amount of header bytes is more. Problem 32 Yes, the delays in the applet correspond to the delays in the Problem 31.The propagation delays affect the overall end-to-end delays both for packet switching and message switching equally. Problem 33 There are F/S packets. Each packet is S=80 bits. Time at which the last packet is received at the first router is sec. At this time, the first F/S-2 packets are at the destination, and the F/S-1 packet is at the second router. The last packet must then be transmitted by the first router and the second router, with each transmission taking sec. Thus delay in sending the whole file is To calculate the value of S which leads to the minimum delay, Problem 34 The circuit-switched telephone networks and the Internet are connected together at "gateways". When a Skype user (connected to the Internet) calls an ordinary telephone, a circuit is established between a gateway and the telephone user over the circuit switched network. The skype user's voice is sent in packets over the Internet to the gateway. At the gateway, the voice signal is reconstructed and then sent over the circuit. In the other direction, the voice signal is sent over the circuit switched network to the gateway. The gateway packetizes the voice signal and sends the voice packets to the Skype user.   Chapter 2 Review Questions The Web: HTTP; file transfer: FTP; remote login: Telnet; e-mail: SMTP; BitTorrent file sharing: BitTorrent protocol Network architecture refers to the organization of the communication process into layers (e.g., the five-layer Internet architecture). Application architecture, on the other hand, is designed by an application developer and dictates the broad structure of the application (e.g., client-server or P2P). The process which initiates the communication is the client; the process that waits to be contacted is the server. No. In a P2P file-sharing application, the peer that is receiving a file is typically the client and the peer that is sending the file is typically the server. The IP address of the destination host and the port number of the socket in the destination process. You would use UDP. With UDP, the transaction can be completed in one roundtrip time (RTT) - the client sends the transaction request into a UDP socket, and the server sends the reply back to the client's UDP socket. With TCP, a minimum of two RTTs are needed - one to set-up the TCP connection, and another for the client to send the request, and for the server to send back the reply. One such example is remote word processing, for example, with Google docs. However, because Google docs runs over the Internet (using TCP), timing guarantees are not provided. a) Reliable data transfer TCP provides a reliable byte-stream between client and server but UDP does not. b) A guarantee that a certain value for throughput will be maintained Neither c) A guarantee that data will be delivered within a specified amount of time Neither d) Confidentiality (via encryption) Neither SSL operates at the application layer. The SSL socket takes unencrypted data from the application layer, encrypts it and then passes it to the TCP socket. If the application developer wants TCP to be enhanced with SSL, she has to include the SSL code in the application. A protocol uses handshaking if the two communicating entities first exchange control packets before sending data to each other. SMTP uses handshaking at the application layer whereas HTTP does not. The applications associated with those protocols require that all application data be received in the correct order and without gaps. TCP provides this service whereas UDP does not. When the user first visits the site, the server creates a unique identification number, creates an entry in its back-end database, and returns this identification number as a cookie number. This cookie number is stored on the user’s host and is managed by the browser. During each subsequent visit (and purchase), the browser sends the cookie number back to the site. Thus the site knows when this user (more precisely, this browser) is visiting the site. Web caching can bring the desired content “closer” to the user, possibly to the same LAN to which the user’s host is connected. Web caching can reduce the delay for all objects, even objects that are not cached, since caching reduces the traffic on links. Telnet is not available in Windows 7 by default. to make it available, go to Control Panel, Programs and Features, Turn Windows Features On or Off, Check Telnet client. To start Telnet, in Windows command prompt, issue the following command > telnet webserverver 80 where "webserver" is some webserver. After issuing the command, you have established a TCP connection between your client telnet program and the web server. Then type in an HTTP GET message. An example is given below: Since the index.html page in this web server was not modified since Fri, 18 May 2007 09:23:34 GMT, and the above commands were issued on Sat, 19 May 2007, the server returned "304 Not Modified". Note that the first 4 lines are the GET message and header lines inputed by the user, and the next 4 lines (starting from HTTP/1.1 304 Not Modified) is the response from the web server. FTP uses two parallel TCP connections, one connection for sending control information (such as a request to transfer a file) and another connection for actually transferring the file. Because the control information is not sent over the same connection that the file is sent over, FTP sends control information out of band. The message is first sent from Alice’s host to her mail server over HTTP. Alice’s mail server then sends the message to Bob’s mail server over SMTP. Bob then transfers the message from his mail server to his host over POP3. 17. Received: from 65.54.246.203 (EHLO bay0-omc3-s3.bay0.hotmail.com) (65.54.246.203) by mta419.mail.mud.yahoo.com with SMTP; Sat, 19 May 2007 16:53:51 -0700 Received: from hotmail.com ([65.55.135.106]) by bay0-omc3-s3.bay0.hotmail.com with Microsoft SMTPSVC(6.0.3790.2668); Sat, 19 May 2007 16:52:42 -0700 Received: from mail pickup service by hotmail.com with Microsoft SMTPSVC; Sat, 19 May 2007 16:52:41 -0700 Message-ID: Received: from 65.55.135.123 by by130fd.bay130.hotmail.msn.com with HTTP; Sat, 19 May 2007 23:52:36 GMT From: "prithula dhungel" To: prithula@yahoo.com Bcc: Subject: Test mail Date: Sat, 19 May 2007 23:52:36 +0000 Mime-Version: 1.0 Content-Type: Text/html; format=flowed Return-Path: prithuladhungel@hotmail.com Figure: A sample mail message header Received: This header field indicates the sequence in which the SMTP servers send and receive the mail message including the respective timestamps. In this example there are 4 “Received:” header lines. This means the mail message passed through 5 different SMTP servers before being delivered to the receiver’s mail box. The last (forth) “Received:” header indicates the mail message flow from the SMTP server of the sender to the second SMTP server in the chain of servers. The sender’s SMTP server is at address 65.55.135.123 and the second SMTP server in the chain is by130fd.bay130.hotmail.msn.com. The third “Received:” header indicates the mail message flow from the second SMTP server in the chain to the third server, and so on. Finally, the first “Received:” header indicates the flow of the mail messages from the forth SMTP server to the last SMTP server (i.e. the receiver’s mail server) in the chain. Message-id: The message has been given this number BAY130-F26D9E35BF59E0D18A819AFB9310@phx.gbl (by bay0-omc3-s3.bay0.hotmail.com. Message-id is a unique string assigned by the mail system when the message is first created. From: This indicates the email address of the sender of the mail. In the given example, the sender is “prithuladhungel@hotmail.com” To: This field indicates the email address of the receiver of the mail. In the example, the receiver is “prithula@yahoo.com” Subject: This gives the subject of the mail (if any specified by the sender). In the example, the subject specified by the sender is “Test mail” Date: The date and time when the mail was sent by the sender. In the example, the sender sent the mail on 19th May 2007, at time 23:52:36 GMT. Mime-version: MIME version used for the mail. In the example, it is 1.0. Content-type: The type of content in the body of the mail message. In the example, it is “text/html”. Return-Path: This specifies the email address to which the mail will be sent if the receiver of this mail wants to reply to the sender. This is also used by the sender’s mail server for bouncing back undeliverable mail messages of mailer-daemon error messages. In the example, the return path is “prithuladhungel@hotmail.com”. With download and delete, after a user retrieves its messages from a POP server, the messages are deleted. This poses a problem for the nomadic user, who may want to access the messages from many different machines (office PC, home PC, etc.). In the download and keep configuration, messages are not deleted after the user retrieves the messages. This can also be inconvenient, as each time the user retrieves the stored messages from a new machine, all of non-deleted messages will be transferred to the new machine (including very old messages). Yes an organization’s mail server and Web server can have the same alias for a host name. The MX record is used to map the mail server’s host name to its IP address. You should be able to see the sender's IP address for a user with an .edu email address. But you will not be able to see the sender's IP address if the user uses a gmail account. It is not necessary that Bob will also provide chunks to Alice. Alice has to be in the top 4 neighbors of Bob for Bob to send out chunks to her; this might not occur even if Alice provides chunks to Bob throughout a 30-second interval. Recall that in BitTorrent, a peer picks a random peer and optimistically unchokes the peer for a short period of time. Therefore, Alice will eventually be optimistically unchoked by one of her neighbors, during which time she will receive chunks from that neighbor. The overlay network in a P2P file sharing system consists of the nodes participating in the file sharing system and the logical links between the nodes. There is a logical link (an “edge” in graph theory terms) from node A to node B if there is a semi-permanent TCP connection between A and B. An overlay network does not include routers. Mesh DHT: The advantage is in order to a route a message to the peer (with ID) that is closest to the key, only one hop is required; the disadvantage is that each peer must track all other peers in the DHT. Circular DHT: the advantage is that each peer needs to track only a few other peers; the disadvantage is that O(N) hops are needed to route a message to the peer that is closest to the key. 25. File Distribution Instant Messaging Video Streaming Distributed Computing With the UDP server, there is no welcoming socket, and all data from different clients enters the server through this one socket. With the TCP server, there is a welcoming socket, and each time a client initiates a connection to the server, a new socket is created. Thus, to support n simultaneous connections, the server would need n+1 sockets. For the TCP application, as soon as the client is executed, it attempts to initiate a TCP connection with the server. If the TCP server is not running, then the client will fail to make a connection. For the UDP application, the client does not initiate connections (or attempt to communicate with the UDP server) immediately upon execution Chapter 2 Problems Problem 1 a) F b) T c) F d) F e) F Problem 2 Access control commands: USER, PASS, ACT, CWD, CDUP, SMNT, REIN, QUIT. Transfer parameter commands: PORT, PASV, TYPE STRU, MODE. Service commands: RETR, STOR, STOU, APPE, ALLO, REST, RNFR, RNTO, ABOR, DELE, RMD, MRD, PWD, LIST, NLST, SITE, SYST, STAT, HELP, NOOP. Problem 3 Application layer protocols: DNS and HTTP Transport layer protocols: UDP for DNS; TCP for HTTP Problem 4 The document request was http://gaia.cs.umass.edu/cs453/index.html. The Host : field indicates the server's name and /cs453/index.html indicates the file name. The browser is running HTTP version 1.1, as indicated just before the first pair. The browser is requesting a persistent connection, as indicated by the Connection: keep-alive. This is a trick question. This information is not contained in an HTTP message anywhere. So there is no way to tell this from looking at the exchange of HTTP messages alone. One would need information from the IP datagrams (that carried the TCP segment that carried the HTTP GET request) to answer this question. Mozilla/5.0. The browser type information is needed by the server to send different versions of the same object to different types of browsers. Problem 5 The status code of 200 and the phrase OK indicate that the server was able to locate the document successfully. The reply was provided on Tuesday, 07 Mar 2008 12:39:45 Greenwich Mean Time. The document index.html was last modified on Saturday 10 Dec 2005 18:27:46 GMT. There are 3874 bytes in the document being returned. The first five bytes of the returned document are : <!doc. The server agreed to a persistent connection, as indicated by the Connection: Keep-Alive field Problem 6 Persistent connections are discussed in section 8 of RFC 2616 (the real goal of this question was to get you to retrieve and read an RFC). Sections 8.1.2 and 8.1.2.1 of the RFC indicate that either the client or the server can indicate to the other that it is going to close the persistent connection. It does so by including the connection-token "close" in the Connection-header field of the http request/reply. HTTP does not provide any encryption services. (From RFC 2616) “Clients that use persistent connections should limit the number of simultaneous connections that they maintain to a given server. A single-user client SHOULD NOT maintain more than 2 connections with any server or proxy.” Yes. (From RFC 2616) “A client might have started to send a new request at the same time that the server has decided to close the "idle" connection. From the server's point of view, the connection is being closed while it was idle, but from the client's point of view, a request is in progress.” Problem 7 The total amount of time to get the IP address is . Once the IP address is known, elapses to set up the TCP connection and another elapses to request and receive the small object. The total response time is Problem 8 . . Problem 9 The time to transmit an object of size L over a link or rate R is L/R. The average time is the average size of the object divided by R:  = (850,000 bits)/(15,000,000 bits/sec) = .0567 sec The traffic intensity on the link is given by =(16 requests/sec)(.0567 sec/request) = 0.907. Thus, the average access delay is (.0567 sec)/(1 - .907)  .6 seconds. The total average response time is therefore .6 sec + 3 sec = 3.6 sec. The traffic intensity on the access link is reduced by 60% since the 60% of the requests are satisfied within the institutional network. Thus the average access delay is (.0567 sec)/[1 – (.4)(.907)] = .089 seconds. The response time is approximately zero if the request is satisfied by the cache (which happens with probability .6); the average response time is .089 sec + 3 sec = 3.089 sec for cache misses (which happens 40% of the time). So the average response time is (.6)(0 sec) + (.4)(3.089 sec) = 1.24 seconds. Thus the average response time is reduced from 3.6 sec to 1.24 sec. Problem 10 Note that each downloaded object can be completely put into one data packet. Let Tp denote the one-way propagation delay between the client and the server. First consider parallel downloads using non-persistent connections. Parallel downloads would allow 10 connections to share the 150 bits/sec bandwidth, giving each just 15 bits/sec. Thus, the total time needed to receive all objects is given by: (200/150+Tp + 200/150 +Tp + 200/150+Tp + 100,000/150+ Tp ) + (200/(150/10)+Tp + 200/(150/10) +Tp + 200/(150/10)+Tp + 100,000/(150/10)+ Tp ) = 7377 + 8*Tp (seconds) Now consider a persistent HTTP connection. The total time needed is given by: (200/150+Tp + 200/150 +Tp + 200/150+Tp + 100,000/150+ Tp ) + 10*(200/150+Tp + 100,000/150+ Tp ) =7351 + 24*Tp (seconds) Assuming the speed of light is 300*106 m/sec, then Tp=10/(300*106)=0.03 microsec. Tp is therefore negligible compared with transmission delay. Thus, we see that persistent HTTP is not significantly faster (less than 1 percent) than the non-persistent case with parallel download. Problem 11 Yes, because Bob has more connections, he can get a larger share of the link bandwidth. Yes, Bob still needs to perform parallel downloads; otherwise he will get less bandwidth than the other four users. Problem 12 Server.py from socket import * serverPort=12000 serverSocket=socket(AF_INET,SOCK_STREAM) serverSocket.bind(('',serverPort)) serverSocket.listen(1) connectionSocket, addr = serverSocket.accept() while 1: sentence = connectionSocket.recv(1024) print 'From Server:', sentence, '\n' serverSocket.close() Problem 13 The MAIL FROM: in SMTP is a message from the SMTP client that identifies the sender of the mail message to the SMTP server. The From: on the mail message itself is NOT an SMTP message, but rather is just a line in the body of the mail message. Problem 14 SMTP uses a line containing only a period to mark the end of a message body. HTTP uses “Content-Length header field” to indicate the length of a message body. No, HTTP cannot use the method used by SMTP, because HTTP message could be binary data, whereas in SMTP, the message body must be in 7-bit ASCII format. Problem 15 MTA stands for Mail Transfer Agent. A host sends the message to an MTA. The message then follows a sequence of MTAs to reach the receiver’s mail reader. We see that this spam message follows a chain of MTAs. An honest MTA should report where it receives the message. Notice that in this message, “asusus-4b96 ([58.88.21.177])” does not report from where it received the email. Since we assume only the originator is dishonest, so “asusus-4b96 ([58.88.21.177])” must be the originator. Problem 16 UIDL abbreviates “unique-ID listing”. When a POP3 client issues the UIDL command, the server responds with the unique message ID for all of the messages present in the user's mailbox. This command is useful for “download and keep”. By maintaining a file that lists the messages retrieved during earlier sessions, the client can use the UIDL command to determine which messages on the server have already been seen. Problem 17 a) C: dele 1 C: retr 2 S: (blah blah … S: ………..blah) S: . C: dele 2 C: quit S: +OK POP3 server signing off b) C: retr 2 S: blah blah … S: ………..blah S: . C: quit S: +OK POP3 server signing off C: list S: 1 498 S: 2 912 S: . C: retr 1 S: blah ….. S: ….blah S: . C: retr 2 S: blah blah … S: ………..blah S: . C: quit S: +OK POP3 server signing off Problem 18 For a given input of domain name (such as ccn.com), IP address or network administrator name, the whois database can be used to locate the corresponding registrar, whois server, DNS server, and so on. NS4.YAHOO.COM from www.register.com; NS1.MSFT.NET from ww.register.com Local Domain: www.mindspring.com Web servers : www.mindspring.com 207.69.189.21, 207.69.189.22, 207.69.189.23, 207.69.189.24, 207.69.189.25, 207.69.189.26, 207.69.189.27, 207.69.189.28 Mail Servers : mx1.mindspring.com (207.69.189.217) mx2.mindspring.com (207.69.189.218) mx3.mindspring.com (207.69.189.219) mx4.mindspring.com (207.69.189.220) Name Servers: itchy.earthlink.net (207.69.188.196) scratchy.earthlink.net (207.69.188.197) www.yahoo.com Web Servers: www.yahoo.com (216.109.112.135, 66.94.234.13) Mail Servers: a.mx.mail.yahoo.com (209.191.118.103) b.mx.mail.yahoo.com (66.196.97.250) c.mx.mail.yahoo.com (68.142.237.182, 216.39.53.3) d.mx.mail.yahoo.com (216.39.53.2) e.mx.mail.yahoo.com (216.39.53.1) f.mx.mail.yahoo.com (209.191.88.247, 68.142.202.247) g.mx.mail.yahoo.com (209.191.88.239, 206.190.53.191) Name Servers: ns1.yahoo.com (66.218.71.63) ns2.yahoo.com (68.142.255.16) ns3.yahoo.com (217.12.4.104) ns4.yahoo.com (68.142.196.63) ns5.yahoo.com (216.109.116.17) ns8.yahoo.com (202.165.104.22) ns9.yahoo.com (202.160.176.146) www.hotmail.com Web Servers: www.hotmail.com (64.4.33.7, 64.4.32.7) Mail Servers: mx1.hotmail.com (65.54.245.8, 65.54.244.8, 65.54.244.136) mx2.hotmail.com (65.54.244.40, 65.54.244.168, 65.54.245.40) mx3.hotmail.com (65.54.244.72, 65.54.244.200, 65.54.245.72) mx4.hotmail.com (65.54.244.232, 65.54.245.104, 65.54.244.104) Name Servers: ns1.msft.net (207.68.160.190) ns2.msft.net (65.54.240.126) ns3.msft.net (213.199.161.77) ns4.msft.net (207.46.66.126) ns5.msft.net (65.55.238.126) d) The yahoo web server has multiple IP addresses www.yahoo.com (216.109.112.135, 66.94.234.13) e) The address range for Polytechnic University: 128.238.0.0 – 128.238.255.255 f) An attacker can use the whois database and nslookup tool to determine the IP address ranges, DNS server addresses, etc., for the target institution. By analyzing the source address of attack packets, the victim can use whois to obtain information about domain from which the attack is coming and possibly inform the administrators of the origin domain. Problem 19 The following delegation chain is used for gaia.cs.umass.edu a.root-servers.net E.GTLD-SERVERS.NET ns1.umass.edu(authoritative) First command: dig +norecurse @a.root-servers.net any gaia.cs.umass.edu ;; AUTHORITY SECTION: edu. 172800 IN NS E.GTLD-SERVERS.NET. edu. 172800 IN NS A.GTLD-SERVERS.NET. edu. 172800 IN NS G3.NSTLD.COM. edu. 172800 IN NS D.GTLD-SERVERS.NET. edu. 172800 IN NS H3.NSTLD.COM. edu. 172800 IN NS L3.NSTLD.COM. edu. 172800 IN NS M3.NSTLD.COM. edu. 172800 IN NS C.GTLD-SERVERS.NET. Among all returned edu DNS servers, we send a query to the first one. dig +norecurse @E.GTLD-SERVERS.NET any gaia.cs.umass.edu umass.edu. 172800 IN NS ns1.umass.edu. umass.edu. 172800 IN NS ns2.umass.edu. umass.edu. 172800 IN NS ns3.umass.edu. Among all three returned authoritative DNS servers, we send a query to the first one. dig +norecurse @ns1.umass.edu any gaia.cs.umass.edu gaia.cs.umass.edu. 21600 IN A 128.119.245.12 The answer for google.com could be: a.root-servers.net E.GTLD-SERVERS.NET ns1.google.com(authoritative) Problem 20 We can periodically take a snapshot of the DNS caches in the local DNS servers. The Web server that appears most frequently in the DNS caches is the most popular server. This is because if more users are interested in a Web server, then DNS requests for that server are more frequently sent by users. Thus, that Web server will appear in the DNS caches more frequently. For a complete measurement study, see: Craig E. Wills, Mikhail Mikhailov, Hao Shang “Inferring Relative Popularity of Internet Applications by Actively Querying DNS Caches”, in IMC'03, October 27­29, 2003, Miami Beach, Florida, USA Problem 21 Yes, we can use dig to query that Web site in the local DNS server. For example, “dig cnn.com” will return the query time for finding cnn.com. If cnn.com was just accessed a couple of seconds ago, an entry for cnn.com is cached in the local DNS cache, so the query time is 0 msec. Otherwise, the query time is large. Problem 22 For calculating the minimum distribution time for client-server distribution, we use the following formula: Dcs = max {NF/us, F/dmin} Similarly, for calculating the minimum distribution time for P2P distribution, we use the following formula: Where, F = 15 Gbits = 15 * 1024 Mbits us = 30 Mbps dmin = di = 2 Mbps Note, 300Kbps = 300/1024 Mbps. Client Server N 10 100 1000 u 300 Kbps 7680 51200 512000 700 Kbps 7680 51200 512000 2 Mbps 7680 51200 512000 Peer to Peer N 10 100 1000 u 300 Kbps 7680 25904 47559 700 Kbps 7680 15616 21525 2 Mbps 7680 7680 7680 Problem 23 Consider a distribution scheme in which the server sends the file to each client, in parallel, at a rate of a rate of us/N. Note that this rate is less than each of the client’s download rate, since by assumption us/N ≤ dmin. Thus each client can also receive at rate us/N. Since each client receives at rate us/N, the time for each client to receive the entire file is F/( us/N) = NF/ us. Since all the clients receive the file in NF/ us, the overall distribution time is also NF/ us. Consider a distribution scheme in which the server sends the file to each client, in parallel, at a rate of dmin. Note that the aggregate rate, N dmin, is less than the server’s link rate us, since by assumption us/N ≥ dmin. Since each client receives at rate dmin, the time for each client to receive the entire file is F/ dmin. Since all the clients receive the file in this time, the overall distribution time is also F/ dmin. From Section 2.6 we know that DCS ≥ max {NF/us, F/dmin} (Equation 1) Suppose that us/N ≤ dmin. Then from Equation 1 we have DCS ≥ NF/us . But from (a) we have DCS ≤ NF/us . Combining these two gives: DCS = NF/us when us/N ≤ dmin. (Equation 2) We can similarly show that: DCS =F/dmin when us/N ≥ dmin (Equation 3). Combining Equation 2 and Equation 3 gives the desired result. Problem 24 Define u = u1 + u2 + ….. + uN. By assumption us <= (us + u)/N Equation 1 Divide the file into N parts, with the ith part having size (ui/u)F. The server transmits the ith part to peer i at rate ri = (ui/u)us. Note that r1 + r2 + ….. + rN = us, so that the aggregate server rate does not exceed the link rate of the server. Also have each peer i forward the bits it receives to each of the N-1 peers at rate ri. The aggregate forwarding rate by peer i is (N-1)ri. We have (N-1)ri = (N-1)(usui)/u = (us + u)/N Equation 2 Let ri = ui/(N-1) and rN+1 = (us – u/(N-1))/N In this distribution scheme, the file is broken into N+1 parts. The server sends bits from the ith part to the ith peer (i = 1, …., N) at rate ri. Each peer i forwards the bits arriving at rate ri to each of the other N-1 peers. Additionally, the server sends bits from the (N+1) st part at rate rN+1 to each of the N peers. The peers do not forward the bits from the (N+1)st part. The aggregate send rate of the server is r1+ …. + rN + N rN+1 = u/(N-1) + us – u/(N-1) = us Thus, the server’s send rate does not exceed its link rate. The aggregate send rate of peer i is (N-1)ri = ui Thus, each peer’s send rate does not exceed its link rate. In this distribution scheme, peer i receives bits at an aggregate rate of Thus each peer receives the file in NF/(us+u). (For simplicity, we neglected to specify the size of the file part for i = 1, …., N+1. We now provide that here. Let Δ = (us+u)/N be the distribution time. For i = 1, …, N, the ith file part is Fi = ri Δ bits. The (N+1)st file part is FN+1 = rN+1 Δ bits. It is straightforward to show that F1+ ….. + FN+1 = F.) The solution to this part is similar to that of 17 (c). We know from section 2.6 that Combining this with a) and b) gives the desired result. Problem 25 There are N nodes in the overlay network. There are N(N-1)/2 edges. Problem 26 Yes. His first claim is possible, as long as there are enough peers staying in the swarm for a long enough time. Bob can always receive data through optimistic unchoking by other peers. His second claim is also true. He can run a client on each host, let each client “free-ride,” and combine the collected chunks from the different hosts into a single file. He can even write a small scheduling program to make the different hosts ask for different chunks of the file. This is actually a kind of Sybil attack in P2P networks. Problem 27 Peer 3 learns that peer 5 has just left the system, so Peer 3 asks its first successor (Peer 4) for the identifier of its immediate successor (peer 8). Peer 3 will then make peer 8 its second successor. Problem 28 Peer 6 would first send peer 15 a message, saying “what will be peer 6’s predecessor and successor?” This message gets forwarded through the DHT until it reaches peer 5, who realizes that it will be 6’s predecessor and that its current successor, peer 8, will become 6’s successor. Next, peer 5 sends this predecessor and successor information back to 6. Peer 6 can now join the DHT by making peer 8 its successor and by notifying peer 5 that it should change its immediate successor to 6. Problem 29 For each key, we first calculate the distances (using d(k,p)) between itself and all peers, and then store the key in the peer that is closest to the key (that is, with smallest distance value). Problem 30 Yes, randomly assigning keys to peers does not consider the underlying network at all, so it very likely causes mismatches. Such mismatches may degrade the search performance. For example, consider a logical path p1 (consisting of only two logical links): ABC, where A and B are neighboring peers, and B and C are neighboring peers. Suppose that there is another logical path p2 from A to C (consisting of 3 logical links): ADEC. It might be the case that A and B are very far away physically (and separated by many routers), and B and C are very far away physically (and separated by many routers). But it may be the case that A, D, E, and C are all very close physically (and all separated by few routers). In other words, a shorter logical path may correspond to a much longer physical path. Problem 31 If you run TCPClient first, then the client will attempt to make a TCP connection with a non-existent server process. A TCP connection will not be made. UDPClient doesn't establish a TCP connection with the server. Thus, everything should work fine if you first run UDPClient, then run UDPServer, and then type some input into the keyboard. If you use different port numbers, then the client will attempt to establish a TCP connection with the wrong process or a non-existent process. Errors will occur. Problem 32 In the original program, UDPClient does not specify a port number when it creates the socket. In this case, the code lets the underlying operating system choose a port number. With the additional line, when UDPClient is executed, a UDP socket is created with port number 5432 . UDPServer needs to know the client port number so that it can send packets back to the correct client socket. Glancing at UDPServer, we see that the client port number is not “hard-wired” into the server code; instead, UDPServer determines the client port number by unraveling the datagram it receives from the client. Thus UDP server will work with any client port number, including 5432. UDPServer therefore does not need to be modified. Before: Client socket = x (chosen by OS) Server socket = 9876 After: Client socket = 5432 Problem 33 Yes, you can configure many browsers to open multiple simultaneous connections to a Web site. The advantage is that you will you potentially download the file faster. The disadvantage is that you may be hogging the bandwidth, thereby significantly slowing down the downloads of other users who are sharing the same physical links. Problem 34 For an application such as remote login (telnet and ssh), a byte-stream oriented protocol is very natural since there is no notion of message boundaries in the application. When a user types a character, we simply drop the character into the TCP connection. In other applications, we may be sending a series of messages that have inherent boundaries between them. For example, when one SMTP mail server sends another SMTP mail server several email messages back to back. Since TCP does not have a mechanism to indicate the boundaries, the application must add the indications itself, so that receiving side of the application can distinguish one message from the next. If each message were instead put into a distinct UDP segment, the receiving end would be able to distinguish the various messages without any indications added by the sending side of the application. Problem 35 To create a web server, we need to run web server software on a host. Many vendors sell web server software. However, the most popular web server software today is Apache, which is open source and free. Over the years it has been highly optimized by the open-source community. Problem 36 The key is the infohash, the value is an IP address that currently has the file designated by the infohash.   Chapter 3 Review Questions Call this protocol Simple Transport Protocol (STP). At the sender side, STP accepts from the sending process a chunk of data not exceeding 1196 bytes, a destination host address, and a destination port number. STP adds a four-byte header to each chunk and puts the port number of the destination process in this header. STP then gives the destination host address and the resulting segment to the network layer. The network layer delivers the segment to STP at the destination host. STP then examines the port number in the segment, extracts the data from the segment, and passes the data to the process identified by the port number. The segment now has two header fields: a source port field and destination port field. At the sender side, STP accepts a chunk of data not exceeding 1192 bytes, a destination host address, a source port number, and a destination port number. STP creates a segment which contains the application data, source port number, and destination port number. It then gives the segment and the destination host address to the network layer. After receiving the segment, STP at the receiving host gives the application process the application data and the source port number. No, the transport layer does not have to do anything in the core; the transport layer “lives” in the end systems. For sending a letter, the family member is required to give the delegate the letter itself, the address of the destination house, and the name of the recipient. The delegate clearly writes the recipient’s name on the top of the letter. The delegate then puts the letter in an envelope and writes the address of the destination house on the envelope. The delegate then gives the letter to the planet’s mail service. At the receiving side, the delegate receives the letter from the mail service, takes the letter out of the envelope, and takes note of the recipient name written at the top of the letter. The delegate then gives the letter to the family member with this name. No, the mail service does not have to open the envelope; it only examines the address on the envelope. Source port number y and destination port number x. An application developer may not want its application to use TCP’s congestion control, which can throttle the application’s sending rate at times of congestion. Often, designers of IP telephony and IP videoconference applications choose to run their applications over UDP because they want to avoid TCP’s congestion control. Also, some applications do not need the reliable data transfer provided by TCP. Since most firewalls are configured to block UDP traffic, using TCP for video and voice traffic lets the traffic though the firewalls. Yes. The application developer can put reliable data transfer into the application layer protocol. This would require a significant amount of work and debugging, however. Yes, both segments will be directed to the same socket. For each received segment, at the socket interface, the operating system will provide the process with the IP addresses to determine the origins of the individual segments. For each persistent connection, the Web server creates a separate “connection socket”. Each connection socket is identified with a four-tuple: (source IP address, source port number, destination IP address, destination port number). When host C receives and IP datagram, it examines these four fields in the datagram/segment to determine to which socket it should pass the payload of the TCP segment. Thus, the requests from A and B pass through different sockets. The identifier for both of these sockets has 80 for the destination port; however, the identifiers for these sockets have different values for source IP addresses. Unlike UDP, when the transport layer passes a TCP segment’s payload to the application process, it does not specify the source IP address, as this is implicitly specified by the socket identifier. Sequence numbers are required for a receiver to find out whether an arriving packet contains new data or is a retransmission. To handle losses in the channel. If the ACK for a transmitted packet is not received within the duration of the timer for the packet, the packet (or its ACK or NACK) is assumed to have been lost. Hence, the packet is retransmitted. A timer would still be necessary in the protocol rdt 3.0. If the round trip time is known then the only advantage will be that, the sender knows for sure that either the packet or the ACK (or NACK) for the packet has been lost, as compared to the real scenario, where the ACK (or NACK) might still be on the way to the sender, after the timer expires. However, to detect the loss, for each packet, a timer of constant duration will still be necessary at the sender. The packet loss caused a time out after which all the five packets were retransmitted. Loss of an ACK didn’t trigger any retransmission as Go-Back-N uses cumulative acknowledgements. The sender was unable to send sixth packet as the send window size is fixed to 5. When the packet was lost, the received four packets were buffered the receiver. After the timeout, sender retransmitted the lost packet and receiver delivered the buffered packets to application in correct order. Duplicate ACK was sent by the receiver for the lost ACK. The sender was unable to send sixth packet as the send win
【计算机网络第六版（谢希仁）】网络要点总结
热门推荐
ARRAYLI_博客
04-19 1万+
一、网络分层                OSI 七层模型、TCP/IP 四层模型、五层模型图：      OSI 七层模型：           1、 物理层：主要定义物理标准，如网线的接口类型、光纤的接口类型、各种介质的传输速率等。它的主要作用是传输比特流（就是由1、0转化为电流强弱来进行传输， 到大目的地后在转化为 1、0，也就是我们常说的数模转换与模数转换）。这一层的数据叫比
谢希仁《计算机网络》（第6版）含视频
01-20
谢希仁《计算机网络》（第6版）含视频，有需要学习计算机网络或者考研计算机网络的朋友可以看下，如百度网盘链接失效，请留言或者留下邮箱索取
计算机网络第六版中英答案
09-14
《计算机网络第六版中英答案》是一份涵盖了计算机网络领域重要知识的学习资源，适用于学习者进行自我检测和深入理解。这份资料包含两部分主要内容：英文第六版的答案和中文版的习题解答，旨在帮助读者全面掌握计算机...
计算机网络第六版谢希仁视频教程.txt
10-09
计算机网络第六版谢希仁视频教程
计算机网络原理：自顶向下方法第六版中英文版本及英文课后答案
09-28
计算机网络原理：自顶向下方法第六版中英文版本及英文课后答案
计算机网络（谢希仁第六版）.zip
10-16
找工作，面试时看这个PPT最好了，讲的比较好。
计算机网络自顶向下第六版课后答案
01-21
计算机网络自顶向下第六版课后答案，英文答案。
计算机网络第六版谢希仁课件
01-03
计算机网络第六版课件谢希仁对于老师和学生学习计算机网络的好帮手
计算机网络自顶向下方法(第六版) 答案
08-16
计算机网络自顶向下方法(第六版)对应的答案 Solutions to Review Questions and Problems
谢希仁计算机网络第六版光盘内容
11-09
谢希仁计算机网络的第六版光盘内容，光盘中包含以下五部分内容。 1. 电子教案。 本课件共10个Powerpoint文件（每章一个）。教师可根据教学要求自由修改此教案（增加或删减内容），但不能自行出版销售。 对于电子...
计算机网络第六版知识点总结.pdf
11-23
计算机网络第六版知识点总结.pdf
计算机网络第六版谢希仁编著-ppt课件.ppt
07-04
计算机网络第六版谢希仁编著-ppt课件 本资源是关于计算机网络的PPT课件，版本为第六版，由谢希仁编著。课件涵盖了计算机网络的应用层相关知识，包括域名系统（DNS）、文件传送协议（FTP）、远程终端协议（TELNET）...
计算机网络第六版答案解析
"计算机网络第六版答案提供了对计算机网络基础概念的详细解答，涵盖了从网络服务、交换技术到因特网历史、标准制定以及网络分类等多个方面的内容。" 计算机网络是信息技术的重要组成部分，它通过连接多台计算机实现...
评论 4
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值