Data Communication & Computer Networks

Overview: How a Network Moves Data

Start with one message, for example a web page request. The application creates the message. The transport layer may split it into segments and number them. The network layer adds source and destination IP addresses and creates packets. The data-link layer adds hardware addresses and a frame check sequence, producing frames. The physical layer turns frames into bits and then into electrical, optical, or radio signals. Switches forward frames inside a local network using hardware addresses, while routers forward packets between networks using IP addresses. At the destination the process reverses: signals become bits, frames are checked and stripped, packets are routed to the right host, segments are reassembled in order, and the application receives the original message. Two ideas recur throughout. First, an address at one layer does not replace an address at another: IP addresses identify hosts across networks, while MAC addresses identify interfaces on a single link, and port numbers identify applications inside a host. Second, reliability can be built at different layers, but each mechanism costs bandwidth, delay, or complexity, so protocols choose the level of reliability their users actually need.

OSI & TCP/IP models

The OSI model has seven layers, from bottom to top: Physical, Data Link, Network, Transport, Session, Presentation, and Application. The Physical layer deals with bits, signalling, cables, connectors, and data rates: it moves raw bits, nothing more. The Data Link layer organises bits into frames, controls access to a shared medium, detects errors, and delivers frames between neighbours on the same link; switches and bridges work here. The Network layer delivers packets across multiple networks, using logical addressing and routing; routers work here. The Transport layer delivers segments end to end between processes, providing reliability, ordering, and flow control when required. The Session layer manages dialogues between applications, including establishing, maintaining, and ending sessions. The Presentation layer handles translation, encryption, and compression so that different systems can understand the same data. The Application layer provides network services directly to user programs, such as web browsing, mail, and file transfer. A useful memory aid is that the lower three layers are mainly about moving data, the upper three are mainly about the application, and transport bridges the two.

The TCP/IP model has four layers: Network Access (also called Link), Internet, Transport, and Application. The Network Access layer combines the OSI physical and data-link functions. The Internet layer corresponds to the OSI network layer and is built around IP. The Transport layer is TCP or UDP. The Application layer combines the OSI session, presentation, and application layers, and holds protocols such as HTTP, DNS, FTP, SMTP, and DHCP. TCP/IP won in practice because it was simpler, was tied to working implementations, and grew with the internet, while OSI remains the standard vocabulary for exams and for describing where a device or protocol sits. A repeater works at the physical layer, a hub also at the physical layer, a bridge and switch at the data link layer, a router at the network layer, and a gateway can operate up to the application layer. Encapsulation explains the names: data becomes a segment at transport, a packet at network, a frame at data link, and bits at physical. In TCP/IP, the same idea is often described as segment, packet, frame, and bits.

The physical layer must also handle how bits are represented and timed. Bandwidth is the capacity of a channel, throughput is the rate actually achieved, and latency includes propagation delay, transmission delay, queuing delay, and processing delay. Guided media include twisted pair, coaxial cable, and fibre-optic cable; unguided media include radio, microwave, and infrared. Fibre offers high bandwidth and immunity to electromagnetic interference but is harder to install and splice. Twisted pair is cheap and common for local networks but is limited in distance and bandwidth. The data-link layer then faces framing: the receiver must know where one frame ends and the next begins. Fixed-size framing is simple but wasteful for variable data; variable-size framing uses length fields or flag delimiters, with character or bit stuffing to keep a flag pattern from appearing inside the data by accident.

Routing, switching & protocols

Error detection starts from a simple fact: noise can flip bits, but the receiver cannot ask the sender what was intended unless extra information is present. Parity adds one redundant bit so that the total number of ones is even (even parity) or odd (odd parity). A single-bit error changes the parity and is detected, but a two-bit error leaves parity unchanged and escapes, and parity cannot say which bit is wrong. A checksum sums data words and sends the complement of the sum; the receiver recomputes it. A cyclic redundancy check, CRC, treats the data as a polynomial and divides it by a generator polynomial, sending the remainder; the receiver repeats the division and expects a zero remainder. CRC detects all single-bit errors, all burst errors shorter than the generator length, and most longer bursts, which is why it is used in Ethernet and many other links. Detection is not correction: on most links the receiver discards the bad frame and the sender retransmits after a timeout, using an acknowledgement scheme.

Flow control stops a fast sender overwhelming a slow receiver. In stop-and-wait, the sender transmits one frame and waits for an acknowledgement before sending the next. It is simple and correct, but inefficient on links with long propagation delay, because the channel idles while the sender waits. The sliding window generalises it: the sender may have several unacknowledged frames outstanding, up to the window size, and the receiver advertises how much buffer space remains. Go-Back-N retransmits the whole window from the first lost frame, while selective repeat retransmits only the lost frames but needs more buffer and logic at the receiver. Window size is also limited by sequence numbers: with n-bit sequence numbers, Go-Back-N can use at most 2 to the power n minus 1 outstanding frames, otherwise an acknowledgement becomes ambiguous. On a shared medium, medium access control decides who may transmit. Pure ALOHA lets stations transmit whenever they like and retransmits after collisions; slotted ALOHA restricts transmissions to time slots and roughly doubles efficiency. CSMA listens before transmitting, and CSMA/CD, used in classic Ethernet, also detects collisions and backs off for a random time. Modern switched Ethernet largely avoids collisions by giving each station its own switch port and using full duplex, but the CSMA/CD idea is still examined. Ethernet frames carry destination and source MAC addresses, a type field, data, and a CRC. ARP maps a known IP address to an unknown MAC address on the local network by broadcasting a request: who has this IP address, and the owner replies with its MAC address. RARP and DHCP later reverse or automate address assignment.

The network layer is where internetworking happens. IPv4 addresses are 32 bits, written as four decimal octets, and divided into network and host parts. Classes A, B, and C are historical, but modern routing uses classless addressing, CIDR, where a prefix length such as /26 states how many bits belong to the network part. Subnetting borrows host bits to create smaller networks. For a /26, 32 minus 26 leaves 6 host bits, giving 64 addresses in total and 62 usable hosts, because the all-zero address is the network address and the all-ones address is the broadcast address. Subnet masks are written in the same dotted form: /26 is 255.255.255.192. IPv6 addresses are 128 bits, written in hexadecimal groups, and were introduced because IPv4 addresses were running out and because IPv6 simplifies headers, supports autoconfiguration, and builds in support for extension headers and, in principle, security. IPv6 has no broadcast address in the IPv4 sense; it uses multicast and anycast instead. NAT lets many private hosts share one public address by rewriting addresses and ports at the border router; it conserves public addresses but breaks true end-to-end connectivity and complicates some protocols.

Routing algorithms decide the next hop for each packet. Distance-vector routing, exemplified by RIP, has each router tell its neighbours its distance to every destination; routers update by taking the minimum over neighbours. It is simple but slow to converge and can suffer the count-to-infinity problem, where bad news about a failed link circulates and increments slowly; split horizon and poison reverse reduce the problem. Link-state routing, exemplified by OSPF, has each router learn the full topology by flooding link-state advertisements and then run Dijkstra shortest-path algorithm locally. It converges faster and avoids count-to-infinity, but needs more memory and processing and careful flooding. Routing inside one autonomous system uses interior protocols such as RIP and OSPF; routing between autonomous systems uses BGP, a path-vector protocol. Switching is the local counterpart: a switch learns MAC addresses from source addresses in incoming frames, builds a forwarding table, and forwards each frame only to the port where the destination lives, flooding only when the destination is unknown or the frame is broadcast.

At the transport layer, TCP is connection-oriented, reliable, ordered, and byte-stream based, while UDP is connectionless, unreliable, and message based. TCP establishes a connection with a three-way handshake: the client sends SYN, the server replies SYN-ACK, and the client sends ACK; connection teardown uses FIN exchanges. Reliability comes from sequence numbers, acknowledgements, retransmission timers, and checksums. Flow control uses the receiver advertised window, and congestion control uses slow start, congestion avoidance, fast retransmit, and fast recovery: the sender probes for available capacity and backs off when loss suggests congestion. UDP skips all of this, so it is faster and simpler and is used where occasional loss is acceptable or where the application handles reliability itself, such as DNS queries, streaming, and real-time media. Port numbers identify the application: well-known ports include 80 for HTTP, 443 for HTTPS, 53 for DNS, 25 for SMTP, 21 for FTP, and 67 and 68 for DHCP. The application layer then provides the services themselves. DNS translates names to IP addresses through a hierarchy of root, top-level, and authoritative servers, with resolvers caching answers. HTTP is the request-response protocol of the web; HTTPS adds TLS encryption over the same model. FTP transfers files over separate control and data connections. SMTP sends mail between servers, while POP and IMAP let users retrieve it. DHCP automates address assignment, handing out an IP address, subnet mask, gateway, and DNS servers, typically through discover, offer, request, and acknowledgement messages.

Network security basics

Security in networks rests on four goals: confidentiality, so only authorised parties read data; integrity, so data is not altered unnoticed; authentication, so parties are who they claim to be; and availability, so services keep working. Cryptography provides the first three. In symmetric cryptography, the same secret key encrypts and decrypts; it is fast and suitable for bulk data, but the key must be shared securely beforehand, and a network of many users needs many keys. In asymmetric cryptography, each party has a public key anyone may use to encrypt, and a private key only the owner holds to decrypt; key distribution becomes easy, but the mathematics is slower, so in practice systems use asymmetric methods to exchange a symmetric session key and then use the symmetric key for the bulk data. The classic asymmetric example is RSA: choose two large primes, multiply them to form the modulus, derive a public exponent and a private exponent that are inverses under the relevant modular arithmetic, publish the public pair, and keep the private exponent secret. Security rests on the difficulty of factoring the modulus back into its primes. A digital signature reverses the roles: the sender encrypts a hash of the message with the private key, and anyone can verify it with the public key, proving both the sender and that the message was not changed. A hash function itself produces a fixed-size digest; a good hash is one-way and collision-resistant, so finding two different messages with the same digest is infeasible. A message authentication code adds a shared secret to a hash so the receiver can also be sure of the sender.

A firewall is a barrier between a trusted internal network and an untrusted external network. Packet-filtering firewalls inspect headers such as source, destination, port, and protocol and allow or deny packets by rule; they are fast but cannot understand application content and are hard to configure correctly. Stateful firewalls track the state of connections and allow return traffic only for connections that were legitimately opened. Application-level gateways and proxies inspect traffic at higher layers and can enforce finer policy but add latency. A VPN creates an encrypted tunnel over a public network so that remote users or offices can communicate as if on a private network; tunnelling protocols encapsulate and encrypt the inner packets. Wireless security has its own history: WEP used a short key and a weak initialisation-vector scheme and is now considered broken; WPA improved key handling, and WPA2 and WPA3 use stronger encryption and authentication and should be preferred. Common attacks must be recognised by name and mechanism. Eavesdropping intercepts traffic; a man-in-the-middle attacker sits between two parties and relays or alters messages; spoofing forges a source address or identity; a denial-of-service attack floods a target so legitimate users cannot get service, and a distributed version uses many compromised machines. Phishing tricks users into revealing credentials, SQL injection and cross-site scripting attack web applications rather than the network itself, and malware such as worms spreads across networks without user action. Defence is layered: encryption for confidentiality, authentication for identity, firewalls and intrusion detection for boundaries, patching for known flaws, and user education for social engineering. No single mechanism covers all four security goals, and exam questions often test exactly that distinction.

OSI model versus TCP/IP model

TCP versus UDP

Symmetric versus asymmetric cryptography

Distance-vector versus link-state routing