TCP/IP Illustrated

Kevin R. Fall, Ph.D., has worked with TCP/IP for more than twenty-five years, and served on the Internet Architecture Board. He co-chairs the Internet Research Task Force’s Delay Tolerant Networking Research Group (DTNRG), which explores networking in extreme and performance-challenged environments. He is an IEEE Fellow.W. Richard Stevens, Ph.D. (1951-1999), was the pioneering author who taught a generation of network professionals the TCP/IP skills they’ve used to make the Internet central to everyday life. His best-selling books included all three volumes of TCP/IP Illustrated (Addison-Wesley), as well as UNIX Network Programming (Prentice Hall).

"What makes this book unique, in my estimation, is the level of detail and attention to history. It provides background and a sense for the ways in which solutions to networking problems have evolved. It is relentless in its effort to achieve precision and to expose remaining problem areas. For an engineer determined to refine and secure Internet operation or to explore alternative solutions to persistent problems, the insights provided by this book will be invaluable. The authors deserve credit for a thorough rendering of the technology of today's Internet." -Vint Cerf Praise for the First Edition of TCP/IP Illustrated, Volume 1: The Protocols ... "This is sure to be the bible for TCP/IP developers and users. Within minutes of picking up the text, I encountered several scenarios that had tripped up both my colleagues and myself in the past. Stevens reveals many of the mysteries once held tightly by the ever-elusive networking gurus. Having been involved in the implementation of TCP/IP for some years now, I consider this by far the finest text to date." -Robert A. Ciampa, network engineer, Synernetics, division of 3COM "While all of Stevens' books are readable and technically excellent, this new opus is awesome. Although many books describe the TCP/IP protocols, Stevens provides a level of depth and real-world detail lacking from the competition. He puts the reader inside TCP/IP using a visual approach and shows the protocols in action." -Steven Baker, networking columnist, Unix Review "TCP/IP Illustrated, Volume 1, is an excellent reference for developers, network administrators, or anyone who needs to understand TCP/IP technology. TCP/IP Illustrated is comprehensive in its coverage of TCP/IP topics, providing enough details to satisfy the experts while giving enough background and commentary for the novice." -Bob Williams, vice president, Marketing, NetManage, Inc. "... [T]he difference is that Stevens wants to show as well as tell about the protocols. His principal teaching tools are straightforward explanations, exercises at the ends of chapters, byte-by-byte diagrams of headers and the like, and listings of actual traffic as examples." -Walter Zintz, UnixWorld "Much better than theory only... W. Richard Stevens takes a multihost-based configuration and uses it as a travelogue of TCP/IP examples with illustrations. TCP/IP Illustrated, Volume 1, is based on practical examples that reinforce the theory-distinguishing this book from others on the subject, and making it both readable and informative." -Peter M. Haverlock, consultant, IBM TCP/IP Development "The diagrams he uses are excellent and his writing style is clear and readable. In sum, Stevens has made a complex topic easy to understand. This book merits everyone's attention. Please read it and keep it on your bookshelf." -Elizabeth Zinkann, sys admin "W. Richard Stevens has produced a fine text and reference work. It is well organized and very clearly written with, as the title suggests, many excellent illustrations exposing the intimate details of the logic and operation of IP, TCP, and the supporting cast of protocols and applications." -Scott Bradner, consultant, Harvard University OIT/NSD

• Foreword xxvPreface to the Second Edition xxviiAdapted Preface to the First Edition xxxiiiChapter 1: Introduction 11.1 Architectural Principles 2 1.2 Design and Implementation 81.3 The Architecture and Protocols of the TCP/IP Suite 131.4 Internets, Intranets, and Extranets 191.5 Designing Applications 201.6 Standardization Process 221.7 Implementations and Software Distributions 241.8 Attacks Involving the Internet Architecture 251.9 Summary 261.10 References 28Chapter 2: The Internet Address Architecture 312.1 Introduction 31 2.2 Expressing IP Addresses 322.3 Basic IP Address Structure 342.4 CIDR and Aggregation 462.5 Special-Use Addresses 502.6 Allocation 622.7 Unicast Address Assignment 652.8 Attacks Involving IP Addresses 702.9 Summary 712.10 References 72Chapter 3: Link Layer 793.1 Introduction 79 3.2 Ethernet and the IEEE 802 LAN/MAN Standards 803.3 Full Duplex, Power Save, Autonegotiation, and 802.1X Flow Control 943.4 Bridges and Switches 983.5 Wireless LANs—IEEE 802.11(Wi-Fi) 1113.6 Point-to-Point Protocol (PPP) 1303.7 Loopback 1453.8 MTU and Path MTU 1483.9 Tunneling Basics 1493.10 Attacks on the Link Layer 1543.11 Summary 1563.12 References 157Chapter 4: ARP: Address Resolution Protocol 1654.1 Introduction 165 4.2 An Example 1664.3 ARP Cache 1694.4 ARP Frame Format 1704.5 ARP Examples 1714.6 ARP Cache Timeout 1744.7 Proxy ARP 1744.8 Gratuitous ARP and Address Conflict Detection (ACD) 1754.9 The arp Command 1774.10 Using ARP to Set an Embedded Device’s IPv4 Address 1784.11 Attacks Involving ARP 1784.12 Summary 1794.13 References 179Chapter 5: The Internet Protocol (IP) 1815.1 Introduction 181 5.2 IPv4 and IPv6 Headers 1835.3 IPv6 Extension Headers 1945.4 IP Forwarding 2085.5 Mobile IP 2155.6 Host Processing of IP Datagrams 2205.7 Attacks Involving IP 2265.8 Summary 2265.9 References 228Chapter 6: System Configuration: DHCP and Autoconfiguration 2336.1 Introduction 233 6.2 Dynamic Host Configuration Protocol (DHCP) 2346.3 Stateless Address Autoconfiguration (SLAAC) 2766.4 DHCP and DNS Interaction 2856.5 PPP over Ethernet (PPPoE) 2866.6 Attacks Involving System Configuration 2926.7 Summary 2926.8 References 293Chapter 7: Firewalls and Network Address Translation (NAT) 2997.1 Introduction 299 7.2 Firewalls 3007.3 Network Address Translation (NAT) 3037.4 NAT Traversal 3167.5 Configuring Packet-Filtering Firewalls and NATs 3347.6 NAT for IPv4/IPv6 Coexistence and Transition 3397.7 Attacks Involving Firewalls and NATs 3457.8 Summary 3467.9 References 347Chapter 8: ICMPv4 and ICMPv6: Internet Control Message Protocol 3538.1 Introduction 353 8.2 ICMP Messages 3558.3 ICMP Error Messages 3618.4 ICMP Query/Informational Messages 3808.5 Neighbor Discovery in IPv6 3958.6 Translating ICMPv4 and ICMPv6 4248.7 Attacks Involving ICMP 4288.8 Summary 4308.9 References 430Chapter 9: Broadcasting and Local Multicasting (IGMP and MLD) 4359.1 Introduction 435 9.2 Broadcasting 4369.3 Multicasting 4419.4 The Internet Group Management Protocol (IGMP) and Multicast Listener Discovery Protocol (MLD) 4519.5 Attacks Involving IGMP and MLD 4699.6 Summary 4709.7 References 471Chapter 10: User Datagram Protocol (UDP) and IP Fragmentation 47310.1 Introduction 473 10.2 UDP Header 47410.3 UDP Checksum 47510.4 Examples 47810.5 UDP and IPv6 48110.6 UDP-Lite 48710.7 IP Fragmentation 48810.8 Path MTU Discovery with UDP 49310.9 Interaction between IP Fragmentation and ARP/ND 49610.10 Maximum UDP Datagram Size 49710.11 UDP Server Design 49810.12 Translating UDP/IPv4 and UDP/IPv6 Datagrams 50510.13 UDP in the Internet 50610.14 Attacks Involving UDP and IP Fragmentation 50710.15 Summary 50810.16 References 508Chapter 11: Name Resolution and the Domain Name System (DNS) 51111.1 Introduction 511 11.2 The DNS Name Space 51211.3 Name Servers and Zones 51611.4 Caching 51711.5 The DNS Protocol 51811.6 Sort Lists, Round-Robin, and Split DNS 56511.7 Open DNS Servers and DynDNS 56711.8 Transparency and Extensibility 56711.9 Translating DNS from IPv4 to IPv6 (DNS64) 56811.10 LLMNR and mDNS 56911.11 LDAP 57011.12 Attacks on the DNS 57111.13 Summary 57211.14 References 573Chapter 12: TCP: The Transmission Control Protocol (Preliminaries) 57912.1 Introduction 579 12.2 Introduction to TCP 58412.3 TCP Header and Encapsulation 58712.4 Summary 59112.5 References 591Chapter 13: TCP Connection Management 59513.1 Introduction 595 13.2 TCP Connection Establishment and Termination 59513.3 TCP Options 60513.4 Path MTU Discovery with TCP 61213.5 TCP State Transitions 61613.6 Reset Segments 62513.7 TCP Server Operation 63113.8 Attacks Involving TCP Connection Management 64013.9 Summary 64213.10 References 643Chapter 14: TCP Timeout and Retransmission 64714.1 Introduction 647 14.2 Simple Timeout and Retransmission Example 64814.3 Setting the Retransmission Timeout (RTO) 65114.4 Timer-Based Retransmission 66414.5 Fast Retransmit 66714.6 Retransmission with Selective Acknowledgments 67114.7 Spurious Timeouts and Retransmissions 67714.8 Packet Reordering and Duplication 68214.9 Destination Metrics 68514.10 Repacketization 68614.11 Attacks Involving TCP Retransmission 68714.12 Summary 68814.13 References 689Chapter 15: TCP Data Flow and Window Management 69115.1 Introduction 691 15.2 Interactive Communication 69215.3 Delayed Acknowledgments 69515.4 Nagle Algorithm 69615.5 Flow Control and Window Management 70015.6 Urgent Mechanism 71915.7 Attacks Involving Window Management 72315.8 Summary 72315.9 References 724Chapter 16: TCP Congestion Control 72716.1 Introduction 727 16.2 The Classic Algorithms 73016.3 Evolution of the Standard Algorithms 73916.4 Handling Spurious RTOs—the Eifel Response Algorithm 74416.5 An Extended Example 74516.6 Sharing Congestion State 76716.7 TCP Friendliness 76816.8 TCP in High-Speed Environments 77016.9 Delay-Based Congestion Control 77716.10 Buffer Bloat 78116.11 Active Queue Management and ECN 78216.12 Attacks Involving TCP Congestion Control 78516.13 Summary 78616.14 References 788Chapter 17: TCP Keepalive 79317.1 Introduction 793 17.2 Description 79517.3 Attacks Involving TCP Keepalives 80217.4 Summary 80217.5 References 803Chapter 18: Security: EAP, IPsec, TLS, DNSSEC, and DKIM 80518.1 Introduction 805 18.2 Basic Principles of Information Security 80618.3 Threats to Network Communication 80718.4 Basic Cryptography and Security Mechanisms 80918.5 Certificates, Certificate Authorities (CAs), and PKIs 82118.6 TCP/IP Security Protocols and Layering 83218.7 Network Access Control: 802.1X, 802.1AE, EAP, and PANA 83318.8 Layer 3 IP Security (IPsec) 84018.9 Transport Layer Security (TLS and DTLS) 87618.10 DNS Security (DNSSEC) 89418.11 DomainKeys Identified Mail (DKIM) 91518.12 Attacks on Security Protocols 91818.13 Summary 91918.14 References 922Glossary of Acronyms 933Index 963