Chapter 2

Application Layer

A note on the use of these Powerpoint slides:

We’re making these slides freely available to all (faculty, students, readers).
They’re in PowerPoint form so you see the animations; and can add, modify,
and delete slides (including this one) and slide content to suit your needs.
They obviously represent a lot of work on our part. In return for use, we only
ask the following: Computer
 If you use these slides (e.g., in a class) that you mention their source
(after all, we’d like people to use our book!) Networking: A Top
 If you post any slides on a www site, that you note that they are adapted
from (or perhaps identical to) our slides, and note our copyright of this Down Approach
material.
7th edition
Thanks and enjoy! JFK/KWR Jim Kurose, Keith Ross
Pearson/Addison Wesley
All material copyright 1996-2016
April 2016
J.F Kurose and K.W. Ross, All Rights Reserved
Application Layer 2-1
Chapter 2: outline
2.1 principles of network 2.5 P2P applications
applications 2.6 video streaming and
2.2 Web and HTTP content distribution
2.3 electronic mail networks
• SMTP, POP3, IMAP 2.7 socket programming
2.4 DNS with UDP and TCP

Application Layer 2-2

Electronic mail outgoing
message queue
user mailbox
Three major components: user
agent
 user agents
 mail servers mail user
server agent
 simple mail transfer
protocol: SMTP SMTP mail user
server agent

User Agent SMTP

 a.k.a. “mail reader” SMTP user
agent
 composing, editing, reading mail
server
mail messages user
 e.g., Outlook, Thunderbird, agent
iPhone mail client user
agent
 outgoing, incoming
messages stored on server
Application Layer 2-3
Electronic mail: mail servers
outgoing
message queue
mail servers: user
agent
user mailbox
 mailbox contains incoming
messages for user mail user
server
 message queue of outgoing agent

(to be sent) mail messages SMTP mail user

 SMTP protocol between server agent
mail servers to send email SMTP
messages user
• client: sending mail SMTP
agent
mail
server server
• server: receiving mail user
agent
server
user
agent

Application Layer 2-4

Electronic Mail: SMTP [RFC 2821]
 uses TCP to reliably transfer email message from
client to server, port 25
 direct transfer: sending server to receiving
server
 three phases of transfer
• handshaking (greeting)
• transfer of messages
• closure
 command/response interaction (like HTTP)
• response: status code and phrase

Application Layer 2-5

Scenario: Ahmad sends message to Ali
1) Ahmad uses UA to compose
message “to”
ali@yahoomail.com
2) Ahmad’s UA sends message
to his mail server; message
placed in message queue
3) client side of SMTP opens
TCP connection with Ali’s
mail server
4) SMTP client sends Ahmad’s
message over the TCP
connection
5) Ali’s mail server places the
message in Ali’s mailbox
6) Ali invokes his user agent to
read message

1 user mail user

mail agent
agent server server
2 3 6
4
5
Ahmad’s mail server Ali’s mail server
(HotMail!!) (Yahoo!!) Application Layer 2-6
Sample SMTP interaction
S: 220 yahoomail.com
C: HELO Hotmail.com
S: 250 Hello Hotmail.com, pleased to meet you
C: MAIL FROM: <ahmad@Hotmail.com>
S: 250 ahmad@Hotmail.com... Sender ok
C: RCPT TO: <ali@yahoomail.com>
S: 250 ali@yahoomail.com ... Recipient ok
C: DATA
S: 354 Enter mail, end with "." on a line by itself
C: Hi, How are you?
C: This is just a SMTP testing.
C: .
S: 250 Message accepted for delivery
C: QUIT
S: 221 yahoomail.com closing connection

Application Layer 2-7

SMTP: final words
 SMTP uses persistent
connections
• All the emails are sent over
a single TCP connection.
comparison with HTTP:
 HTTP: pull
 SMTP: push
 HTTP: each object
encapsulated in its own
response message
 SMTP: places all of the
message’s objects into
one message.
Application Layer 2-9
Mail message format

SMTP: protocol for

exchanging email messages header
blank
RFC 822: standard for text line
message format:
 header lines, e.g.,
• To: body
• From:
• Subject:
 Body: the “message”
• ASCII characters only

Application Layer 2-10

Mail access protocols
user
mail access user
SMTP SMTP protocol
agent agent
(e.g., POP,
IMAP)

sender’s mail receiver’s mail

server server

 SMTP: delivery/storage to receiver’s server

 mail access protocol: retrieval from server
• POP: Post Office Protocol [RFC 1939]: authorization,
download
• IMAP: Internet Mail Access Protocol [RFC 1730]: more
features, including manipulation of stored messages on
server

Application Layer 2-11

 POP3 protocol
S: +OK POP3 server ready
C: user ali
authorization phase S:
C:
+OK
pass student
 client commands: S: +OK user successfully logged on
• user: declare username
• pass: password C: list
S: 1 498
 server responses
S: 2 912
• +OK S: .
• -ERR C: retr 1
transaction phase, client: S:
S:
<message 1 contents>
.
 list: list message numbers C: dele 1
 retr: retrieve message by C: retr 2
number S: <message 1 contents>
 dele: delete S: .
 quit C: dele 2
C: quit
After processing quit command, the POP3 server S: +OK POP3 server signing off
enters update phase and removes deleted
messages from the mailbox.
Application Layer 2-12
 POP3 (more) and IMAP
more about POP3
 POP3 uses port 110
 POP3 in default mode deletes the
read message, unless the settings are
changed.)
• It means User cannot re-read e-
mail if he changes client
 POP3 “download-and-keep”: copies
of messages on different clients
IMAP
 IMAP uses port 993
 keeps all messages in one place: at
server
 allows user to organize messages
in folders
 keeps user state across sessions:
• names of folders and mappings
between message IDs and
folder name
Application Layer 2-13
Chapter 2: outline
2.1 principles of network 2.5 P2P applications
applications 2.6 video streaming and
2.2 Web and HTTP content distribution
2.3 electronic mail networks
• SMTP, POP3, IMAP 2.7 socket programming
2.4 DNS with UDP and TCP

Application Layer 2-14

DNS: domain name system
people: many identifiers: Domain Name System:
• SSN, name, passport #  distributed database
Internet hosts, routers: implemented in hierarchy of
• IP address (32 bit) - many name servers
used for addressing  application-layer protocol: hosts,
datagrams name servers communicate to
• “name”, e.g., resolve names (address/name
www.yahoo.com - translation)
used by humans • note: core Internet function,
Q: how to map between IP implemented as application-
layer protocol
address and name, and
vice versa ? • complexity at network’s
“edge”

Application Layer 2-15

Bigger Picture of DNS Operation

2
3
4

8 6
1
7

Application Layer 2-16

 DNS: services, structure
DNS services why not centralize DNS?
 hostname to IP address translation  single point of failure
 host aliasing  traffic volume
• canonical, alias names  distant centralized database
 mail server aliasing, e.g.,  maintenance
someone@yahoo.com instead
of someone@mail.yahoo.com A: doesn‘t scale!
 load distribution
• replicated Web servers:
many IP addresses correspond
to one name
 DNS is built over UDP

Application Layer 2-17

DNS: a distributed, hierarchical database
Root DNS Servers

… …

com DNS servers org DNS servers edu DNS servers

pbs.org poly.edu umass.edu

yahoo.com amazon.com
DNS servers DNS serversDNS servers
DNS servers DNS servers

client wants IP for www.amazon.com; 1st approximation:

 client queries root server to find com DNS server
 client queries .com DNS server to get amazon.com DNS server
 client queries amazon.com DNS server to get IP address for
www.amazon.com

Application Layer 2-18

 DNS: root name servers
 contacted by local name server that can not resolve name
 root name server:
• contacts authoritative name server if name mapping not known
• gets mapping
• returns mapping to local name server

c. Cogent, Herndon, VA (5 other sites)

d. U Maryland College Park, MD k. RIPE London (17 other sites)
h. ARL Aberdeen, MD
j. Verisign, Dulles VA (69 other sites ) i. Netnod, Stockholm (37 other sites)

e. NASA Mt View, CA m. WIDE Tokyo

f. Internet Software C. (5 other sites)
Palo Alto, CA (and 48 other
sites)

a. Verisign, Los Angeles CA

13 logical root name
(5 other sites)
b. USC-ISI Marina del Rey, CA
“servers” worldwide
l. ICANN Los Angeles, CA •each “server” replicated
(41 other sites)
g. US DoD Columbus, many times
OH (5 other sites)

Application Layer 2-19

TLD, authoritative servers
top-level domain (TLD) servers:
• responsible for com, org, net, edu, aero, jobs, museums,
and all top-level country domains, e.g.: uk, fr, ca, jp
• Network Solutions maintains servers for .com TLD
• Educause for .edu TLD
authoritative DNS servers:
• organization’s own DNS server(s), providing
authoritative hostname to IP mappings for organization’s
named hosts
• can be maintained by organization or service provider

Application Layer 2-20

 Local DNS name server
 does not strictly belong to hierarchy
 each ISP (residential ISP, company, university) has one
• also called “default name server”
 when host makes DNS query, query is sent to its
local DNS server
• has local cache of recent name-to-address translation pairs
(but may be out of date!)
• acts as proxy, forwards query into hierarchy

Application Layer 2-21

DNS name root DNS server
resolution example
2
 host at cis.poly.edu 3
TLD DNS server
wants IP address for 4
gaia.cs.umass.edu
5
local DNS server
iterated query: dns.poly.edu

 contacted server 7 6
1 8
replies with name of
server to contact
authoritative DNS server
 “I don’t know this dns.cs.umass.edu
name, but ask this requesting host
server” Client: poly.edu

Webserver: cs.umass.edu

Application Layer 2-22

DNS name root DNS server
resolution example
2 3
recursive query: 7
6
 puts burden of name TLD DNS
server
resolution on
contacted name local DNS server
dns.poly.edu
server 5 4

 heavy load at upper 1 8

levels of hierarchy
authoritative DNS server
dns.cs.umass.edu
requesting host
Client: poly.edu

Webserver: cs.umass.edu

Application Layer 2-23

 DNS: caching, updating records
 once (any) name server learns mapping, it caches
mapping
• cache entries timeout (disappear) after some time (TTL)
• TLD servers typically cached in local name servers
• thus root name servers not often visited
 cached entries may be out-of-date
• if name host changes IP address, may not be known Internet-
wide until all TTLs expire

Application Layer 2-24

DNS records
DNS: distributed database storing resource records (RR)
RR format: (name, value, type, ttl)

type=A type=CNAME
 name is hostname  name is alias name for some
 value is IP address “canonical” (the real) name
type=NS  www.ibm.com is really
• name is domain (e.g., servereast.backup2.ibm.com
foo.com)  value is canonical name
• value is hostname of
authoritative name type=MX (mail exchanger)
server for this domain  value is name of mailserver
associated with name

Application Layer 2-25

 DNS protocol, messages
 query and reply messages, both with same message
format 2 bytes 2 bytes

message header identification flags

 identification: 16 bit # for # questions # answer RRs

query, reply to query uses
# authority RRs # additional RRs
same #
 flags: questions (variable # of questions)
 query(0) or reply(1)
 recursion desired answers (variable # of RRs)
 recursion available
 reply is authoritative (whether authority (variable # of RRs)
DNS Server is authoritative server.
Sometimes there is intermediate DNS
server which isn’t authoritative) additional info (variable # of RRs)

Application Layer 2-27

DNS protocol, messages

2 bytes 2 bytes

identification flags

# questions # answer RRs

# authority RRs # additional RRs

name, type fields

questions (variable # of questions)
for a query
RRs in response answers (variable # of RRs)
to query
records of other
authority (variable # of RRs)
authoritative servers
additional “helpful” additional info (variable # of RRs)
info that may be used
Application Layer 2-28
Inserting records into DNS
 example: new startup “Network Utopia”
 Register name networkuptopia.com at DNS registrar (e.g.,
Network Solutions)
• provide names, IP addresses of authoritative name server
(primary and secondary)
• registrar inserts two RRs into .com TLD server:
(networkutopia.com, dns1.networkutopia.com, NS)
(dns1.networkutopia.com, 212.212.212.1, A)
 In authoritative server add
• type A record for www.networkuptopia.com, e.g.,
• networkutopia.com,212.212.212.4, A
• type MX record for mail.networkutopia.com, e.g.,
• networkutopia.com, mail.networkutopia.com, MX
Application Layer 2-29
Attacking DNS
DDoS attacks redirect attacks
 bombard root servers  man-in-middle
with traffic • Intercept queries
• not successful to date  DNS poisoning
• traffic filtering  Send bogus replies to
• local DNS servers cache DNS server, which
IPs of TLD servers, caches
allowing root server
bypass
 bombard TLD servers

Application Layer 2-30