网络与网际互联

NetworkingandInternetworking3.1Introduction3.2Typesofnetwork3.3Networkprinciples3.4Internetprotocols3.5SummaryDistributedsystemsuselocalareanetworks,wideareanetworksandinternetworksforcommunication.Theperformance,reliability,scalability,mobilityandqualityofservicecharacteristicsoftheunderlyingnetworksimpactthebehaviourofdistributedsystemsandhenceaffecttheirdesign.Changesinuserrequirementshaveresultedintheemergenceofwirelessnetworksandofhigh-performancenetworkswithqualityofserviceguarantees.2Theprinciplesonwhichcomputernetworksarebasedincludeprotocollayering,packetswitching,routinganddatastreaming.Internetworkingtechniquesenableheterogeneousnetworkstobeintegrated.TheInternetisthemajorexample;itsprotocolsarealmostuniversallyusedindistributedsystems.33.1IntroductionThenetworksusedindistributedsystemsarebuiltfromavarietyoftransmissionmedia,includingwire,cable,fibreandwirelesschannels;hardwaredevices,includingrouters,switches,bridges,hubs,repeatersandnetworkinterfaces;andsoftwarecomponents,includingprotocolstacks,communicationhandlersanddrivers.Theresultingfunctionalityandperformanceavailabletodistributedsystemandapplicationprogramsisaffectedbyallofthese.3.1IntroductionWeshallrefertothecollectionofhardwareandsoftwarecomponentsthatprovidethecommunicationfacilitiesforadistributedsystemasacommunicationsubsystem.Thecomputersandotherdevicesthatusethenetworkforcommunicationpurposesarereferredtoashosts.Thetermnodeisusedtorefertoanycomputerorswitchingdeviceattachedtoanetwork.3.1IntroductionTheInternetisasinglecommunicationsubsystemprovidingcommunicationbetweenallofthehoststhatareconnectedtoit.TheInternetisconstructedfrommanysubnets.Asubnetisaunitofrouting(deliveringdatafromonepartoftheInternettoanother);itisacollectionofnodesthatcanallbereachedonthesamephysicalnetwork.TheInternet’sinfrastructureincludesanarchitectureandhardwareandsoftwarecomponentsthateffectivelyintegratediversesubnetsintoasingledatacommunicationservice.3.1IntroductionThischapterisintendedtoprovideanintroductoryoverviewofcomputernetworkingwithreferencetothecommunicationrequirementsofdistributedsystems.Intheremainderofthissectionwediscussthecommunicationrequirementsofdistributedsystems.WegiveanoverviewofnetworktypesinSection3.2andanintroductiontonetworkingprinciplesinSection3.3.Section3.4dealsspecificallywiththeInternet.ThechapterconcludeswithdetailedcasestudiesontheEthernet,IEEE802.11(WiFi)andBluetoothnetworkingtechnologiesinSection.1NetworkingissuesfordistributedsystemsEarlycomputernetworksweredesignedtomeetafew,relativelysimpleapplicationrequirements.Networkapplicationssuchasfiletransfer,remotelogin,electronicmailandnewsgroupsweresupported.Thesubsequentdevelopmentofdistributedsystemswithsupportfordistributedapplicationprogramsaccessingsharedfilesandotherresourcessetahigherstandardofperformancetomeettheneedsofinteractiveapplications.3.1.1NetworkingissuesfordistributedsystemsMorerecently,followingthegrowthandcommercializationoftheInternetandtheemergenceofmanynewmodesofuse,morestringentrequirementsforreliability,scalability,mobility,securityandqualityofservicehaveemerged.Inthissection,wedefineanddescribethenatureofeachoftheserequirements.PerformanceThenetworkperformanceparametersthatareofprimaryinterestforourpurposesarethoseaffectingthespeedwithwhichindividualmessagescanbetransferredbetweentwointerconnectedcomputers.Thesearethelatencyandthepointto-pointdatatransferrate:LatencyDatatransferrateFollowingfromthesedefinitions,thetimerequiredforanetworktotransferamessagecontaininglengthbitsbetweentwocomputersis:Messagetransmissiontime=latency+length⁄datatransferrateTheaboveequationisvalidformessageswhoselengthdoesnotexceedamaximumthatisdeterminedbytheunderlyingnetworktechnology.Longermessageshavetobesegmentedandthetransmissiontimeisthesumofthetimesforthesegments.Thetotalsystembandwidthofanetworkisameasureofthroughput–thetotalvolumeoftrafficthatcanbetransferredacrossthenetworkinagiventime.Inmanylocalareanetworktechnologies,suchasEthernet,thefulltransmissioncapacityofthenetworkisusedforeverytransmissionandthesystembandwidthisthesameasthedatatransferrate.ScalabilityComputernetworksareanindispensablepartoftheinfrastructureofmodernsocieties.InFigure1.6weshowedthegrowthinthenumberofhostcomputersandwebserversconnectedtotheInternetovera12-yearperiodendingin2005.Thegrowthsincethenhasbeensorapidanddiversethatitisdifficulttofindrecentreliablestatistics.ThepotentialfuturesizeoftheInternetiscommensuratewiththepopulationoftheplanet.Itisrealistictoexpectittoincludeseveralbillionnodesandhundredsofmillionsofactivehosts.SecurityChapter11setsouttherequirementsandtechniquesforachievingsecurityindistributedsystems.Thefirstlevelofdefenceadoptedbymostorganizationsistoprotectitsnetworksandthecomputersattachedtothemwithafirewall.Afirewallcreatesaprotectionboundarybetweentheorganization’sintranetandtherestoftheInternet.Thepurposeofthefirewallistoprotecttheresourcesinallofthecomputersinsidetheorganizationfromaccessbyexternalusersorprocessesandtocontroltheuseofresourcesoutsidethefirewallbyusersinsidetheorganization.MobilityMobiledevicessuchaslaptopcomputersandInternet-capablemobilephonesaremovedfrequentlybetweenlocationsandreconnectedatconvenientnetworkconnectionpointsorevenusedwhileonthemove.Wirelessnetworksprovideconnectivitytosuchdevices,buttheaddressingandroutingschemesoftheInternetweredevelopedbeforetheadventofthesemobiledevicesandarenotwelladaptedtotheirneedforintermittentconnectiontomanydifferentsubnets.TheInternet’smechanismshavebeenadaptedandextendedtosupportmobility,buttheexpectedfuturegrowthintheuseofmobiledeviceswilldemandfurtherdevelopment.3.2TypesofnetworkHereweintroducethemaintypesofnetworkthatareusedtosupportdistributedsystems:personalareanetworks,localareanetworks,wideareanetworks,metropolitanareanetworksandthewirelessvariantsofthem.InternetworkssuchastheInternetareconstructedfromnetworksofallthesetypes.Figure3.1showstheperformancecharacteristicsofthevarioustypesofnetworkdiscussedbelow.Personalareanetworks(PANs)Localareanetworks(LANs)Wideareanetworks(WANs)Metropolitanareanetworks(MANs)Wirelesslocalareanetworks(WLANs)Wirelessmetropolitanareanetworks(WMANs)Wirelesswideareanetworks(WWANs)InternetworksNetworkerrors3.3Networkprinciples3.3.1Packettransmission3.3.2Datastreaming3.3.3Switchingschemes3.3.4Protocols3.3.5Routing3.3.6Congestioncontrol3.3.7Internetworking3.3.3SwitchingschemesBroadcastCircuitswitchingPacketswitchingFramerelay3.3.4ProtocolsThetermprotocolisusedtorefertoawell-knownsetofrulesandformatstobeusedforcommunicationbetweenprocessesinordertoperformagiventask.Thedefinitionofaprotocolhastwoimportantpartstoit:•aspecificationofthesequenceofmessagesthatmustbeexchanged;•aspecificationoftheformatofthedatainthemessages.3.3.5RoutingThedeliveryofpacketstotheirdestinationsinanetworksuchastheoneshowninFigure3.7isthecollectiveresponsibilityoftherouterslocatedatconnectionpoints.UnlessthesourceanddestinationhostsareonthesameLAN,thepackethastobetransmittedinaseriesofhops,passingthroughrouternodes.Thedeterminationofroutesforthetransmissionofpacketstotheirdestinationsistheresponsibilityofaroutingalgorithmimplementedbyaprograminthenetworklayerateachnode.

Arouterexchangesinformationaboutthenetworkwithitsneighbouringnodesbysendingasummaryofitsroutingtableusingarouterinformationprotocol(RIP).TheRIPactionsperformedatarouteraredescribedinformallyasfollows:1.Periodically,andwheneverthelocalroutingtablechanges,sendthetable(inasummaryform)toallaccessibleneighbours.Thatis,sendanRIPpacketcontainingacopyofthetableoneachnon-faultyoutgoinglink.2.Whenatableisreceivedfromaneighbouringrouter,ifthereceivedtableshowsaroutetoanewdestination,orabetter(lower-cost)routetoanexistingdestination,updatethelocaltablewiththenewroute.Ifthetablewasreceivedonlinknanditgivesadifferentcostthanthelocaltableforaroutethatbeginswithlinkn,replacethecostinthelocaltablewiththenewcost.Thisisdonebecausethenewtablewasreceivedfromarouterthatisclosertotherelevantdestinationandisthereforealwaysmoreauthoritativeforroutesthatpassthroughit.3.3.6CongestioncontrolThecapacityofanetworkislimitedbytheperformanceofitscommunicationlinksandswitchingnodes.Whentheloadatanyparticularlinkornodeapproachesitscapacity,queueswillbuildupathoststryingtosendpacketsandatintermediatenodesholdingpacketswhoseonwardtransmissionisblockedbyothertraffic.Iftheloadcontinuesatthesamehighlevel,thequeueswillcontinuetogrowuntiltheyreachthelimitofavailablebufferspace.Oncethisstateisreachedatanode,thenodehasnooptionbuttodropfurtherincomingpackets.Aswehavealreadynoted,theoccasionallossofpacketsatthenetworklevelisacceptableandcanberemediedbyretransmissioninitiatedathigherlevels.Butiftherateofpacketlossandretransmissionreachesasubstantiallevel,theeffectonthethroughputofthenetworkcanbedevastating.Insteadofallowingpacketstotravelthroughthenetworkuntiltheyreachovercongestednodes,wheretheywillhavetobedropped,itwouldbebettertoholdthematearliernodesuntilthecongestionisreduced.Thiswillresultinincreaseddelaysforpacketsbutwillnotsignificantlydegradethetotalthroughputofthenetwork.Congestioncontrolisthenamegiventotechniquesthataredesignedtoachievethis.3.3.7InternetworkingTherearemanynetworktechnologieswithdifferentnetwork-,link-andphysical-layerprotocols.Tobuildanintegratednetwork(aninternetwork)wemustintegratemanysubnets,eachofwhichisbasedononeofthesenetworktechnologies.Tomakethispossible,thefollowingareneeded:1.aunifiedinternetworkaddressingschemethatenablespacketstobeaddressedtoanyhostconnectedtoanysubnet;2.aprotocoldefiningtheformatofinternetworkpacketsandgivingrulesaccordingtowhichtheyarehandled;3.interconnectingcomponentsthatroutepacketstotheirdestinationsintermsofinternetworkaddresses,transmittingthepacketsusingsubnetswithavarietyofnetworktechnologies.3.4Internetprotocols3.4.1IPaddressing3.4.2TheIPprotocol3.4.3IProuting3.4.4IPversion63.4.5MobileIP3.4.6TCPandUDP3.4.7Domainnames3.4.8Firewalls3.4.1IPaddressingPerhapsthemostchallengingaspectofthedesignoftheInternetprotocolswastheconstructionofschemesfornamingandaddressinghostsandforroutingIPpacketstotheirdestinations.Theschemeusedforassigninghostaddressestonetworksandthecomputersconnectedtothemhadtosatisfythefollowingrequirements:•Itmustbeuniversal–anyhostmustbeabletosendpacketstoanyotherhostintheInternet.•Itmustbeefficientinitsuseoftheaddressspace–itisimpossibletopredicttheultimatesizeoftheInternetandthenumberofnetworkandhostaddresseslikelytoberequired.Theaddressspacemustbecarefullypartitionedtoensurethataddresseswillnotrunout.In1978–82,whenthespecificationsfortheTCP/IPprotocolswerebeingdeveloped,provisionfor232orapproximately4billionaddressablehosts(aboutthesameasthepopulationoftheworldatthattime)wasconsideredadequate.Thisjudgementhasprovedtobeshort-sighted,fortworeasons:–TherateofgrowthoftheInternethasfaroutstrippedallpredictions.–Theaddressspacehasbeenallocatedandusedmuchlessefficientlythanexpected.•Theaddressingschememustlenditselftothedevelopmentofaflexibleandefficientroutingscheme,buttheaddressesthemselvescannotcontainverymuchoftheinformationneededtorouteapackettoitsdestination.TodaytheoverwhelmingmajorityofInternettrafficcontinuestousetheIPversion4addressandpacketformatdefinedthreedecadesago.TheschemeassignsanIPaddresstoeachhostintheInternet–a32-bitnumericidentifiercontaininganetworkidentifier,whichuniquelyidentifiesoneofthesubnetworksintheInternet,andahostidentifier,whichuniquelyidentifiesthehost’sconnectiontothatnetwork.ItistheseaddressesthatareplacedinIPpacketsandusedtoroutethemtotheirdestinations.ThedesignadoptedfortheInternetaddressspaceisshowninFigure3.15.These32-bitInternetaddresses,containinganetworkidentifierandhostidentifier,areusuallywrittenasasequenceoffourdecimalnumbersseparatedbydots.Eachdecimalnumberrepresentsoneofthefourbytes,oroctets,oftheIPaddress.ThepermissiblevaluesforeachclassofnetworkaddressareshowninFigure.2TheIPprotocolTheIPprotocoltransmitsdatagramsfromonehosttoanother,ifnecessaryviaintermediaterouters.ThefullIPpacketformatisrathercomplex,butFigure3.17Figure3.17IPpacketlayoutIPaddressofsourceIPaddressofdestinationdataheaderupto64kilobytesshowsthemaincomponents.Thereareseveralheaderfields,notshowninthediagram,thatareusedbythetransmissionandroutingalgorithms.TheIPlayerputsIPdatagramsintonetworkpacketssuitablefortransmissionintheunderlyingnetwork(whichmight,forexample,beanEthernet).WhenanIPdatagramislongerthantheMTUoftheunderlyingnetwork,itisbrokenintosmallerpacketsatthesourceandreassembledatitsfinaldestination.Packetscanbefurtherbrokenuptosuittheunderlyingnetworksencounteredduringthejourneyfromsourcetodestination.(Eachpackethasafragmentidentifiertoenableout-of-orderfragmentstobecollected.)3.4.3IProutingTheIPlayerroutespacketsfromtheirsourcetotheirdestination.EachrouterintheInternetimplementsIP-layersoftwaretoprovidearoutingalgorithm.RIP-1,thefirstroutingalgorithmusedintheInternet,isaversionofthedistance-vectoralgorithmdescribedinSection3.3.5.RIP-2(describedinRFC1388[Malkin1993])wasdevelopedfromittoaccommodateseveraladditionalrequirements,includingclasslessinterdomainrouting,bettermulticastroutingandtheneedforauthenticationofRIPpacketstopreventattacksontherouters.DefaultroutesUptonow,ourdiscussionofroutingalgorithmshassuggestedthateveryroutermaintainsafullroutingtableshowingtheroutetoeverydestination(subnetordirectlyconnectedhost)intheInternet.AtthecurrentscaleoftheInternetthisisclearlyinfeasible(thenumberofdestinationsisprobablyalreadyinexcessof1millionandstillgrowingveryrapidly).Twopossiblesolutionstothisproblemcometomind,andbothhavebeenadoptedinanefforttoalleviatetheeffectsoftheInternet’sgrowth.ThefirstsolutionistoadoptsomeformoftopologicalgroupingofIPaddresses.Priorto1993,nothingcouldbeinferredfromanIPaddressaboutitslocation.In1993,aspartofthemovetosimplifyandeconomizeontheallocationofIPaddressesthatisdiscussedbelowunderCIDR,thedecisionwastakenthatforfutureallocations,thefollowingregionallocationswouldbeapplied:Addressesto55areinEuropeAddressesto55areinNorthAmericaAddressesto55areinCentralandSouthAmericaAddressesto55areinAsiaandthePacificBecausethesegeographicalregionsalsocorrespondtowell-definedtopologicalregionsintheInternetandjustafewgatewayroutersprovideaccesstoeachregion,thisenablesasubstantialsimplificationofroutingtablesforthoseaddressranges.Forexample,arouteroutsideEuropecanhaveasingletableentryfortherangeofaddressesto55thatsendsallIPpacketswithdestinationsinthatrangeonthesameroutetothenearestEuropeangatewayrouter.Butnotethatbeforethedateofthatdecision,IPaddresseswereallocatedlargelywithoutregardtotopologyorgeography.Manyofthoseaddressesarestillinuse,andthe1993decisiondoesnothingtoreducethescaleofroutingtableentriesforthoseaddresses.Thesecondsolutiontotheroutingtablesizeexplosionprobemissimplerandveryeffective.Itisbasedontheobservationthattheaccuracyofroutinginformationcanberelaxedformostroutersaslongassomekeyrouters(thoseclosesttothebackbonelinks)haverelativelycompleteroutingtables.Therelaxationtakestheformofadefaultdestinationentryinroutingtables.ThedefaultentryspecifiesaroutetobeusedforallIPpacketswhosedestinationsarenotincludedintheroutingtable.Toillustratethis,considerFigures3.7and3.8andsupposethattheroutingtablefornodeCisalteredtoshow:

ThusnodeCisignorantofnodesAandD.Itwillrouteallpacketsaddressedtothemvialink5toE.Whatistheconsequence?PacketsaddressedtoDwillreachtheirdestinationwithoutlossofefficiencyinrouting,butpacketsaddressedtoAwillmakeanextrahop,passingthroughEandBontheway.Ingeneral,theuseofdefaultroutingstradesroutingefficiencyfortablesize.Butinsomecases,especiallywherearouterisonaspur,sothatalloutwardmessagesmustpassthroughasinglepoint,thereisnolossofefficiency.ThedefaultroutingschemeisheavilyusedinInternetrouting;nosinglerouterholdsroutestoalldestinationsintheInternet.RoutingonalocalsubnetPacketsaddressedtohostsonthesamenetworkasthesenderaretransmittedtothedestinationhostinasinglehop,usingthehostidentifierpartoftheaddresstoobtaintheaddressofthedestinationhostontheunderlyingnetwork.TheIPlayersimplyusesARPtogetthenetworkaddressofthedestinationandthenusestheunderlyingnetworktotransmitthepackets.IftheIPlayerinthesendingcomputerdiscoversthatthedestinationisonadifferentnetwork,itmustsendthemessagetoalocalrouter.ItusesARPtogetthenetworkaddressofthegatewayorrouterandthenusestheunderlyingnetworktotransmitthepackettoit.GatewaysandroutersareconnectedtotwoormorenetworksandtheyhaveseveralInternetaddresses,oneforeachnetworktowhichtheyareattached.Classlessinterdomainrouting(CIDR)TheshortageofIPaddressesreferredtoinSection3.4.1ledtotheintroductionin1996ofthisschemeforallocatingaddressesandmanagingtheentriesinroutingtables.ThemainproblemwasascarcityofClassBaddresses–thoseforsubnetswithmorethan255hostsconnected.PlentyofClassCaddresseswereavailable.TheCIDRsolutionforthisproblemistoallocateabatchofcontiguousClassCaddressestoasubnetrequiringmorethan255addresses.TheCIDRschemealsomakesitpossibletosubdivideaClassBaddressspaceforallocationtomultiplesubnets.3.4.4IPversion6AmorepermanentsolutiontotheaddressinglimitationsofIPv4wasalsopursued,andthisledtothedevelopmentandadoptionofanewversionoftheIPprotocolwithsubstantiallylargeraddresses.TheIETFnoticedthepotentialproblemsarisingfromthe32-bitaddressesofIPv4asearlyas1990andinitiatedaprojecttodevelopanewversionoftheIPprotocol.IPv6wasadoptedbytheIETFin1994andastrategyformigrationtoitwasrecommended.Figure3.19showsthelayoutofIPv6headers.Wedonotproposetocovertheirconstructionindetailhere.Addressspace:IPv6addressesare128bits(16bytes)long.Thisprovidesforatrulyastronomicalnumberofaddressableentities:2128,orapproximately3u1038.Tanenbaumcalculatesthatthisissufficienttoprovide7u1023IPaddressespersquaremetreacrosstheentiresurfaceoftheEarth.TheIPv6addressspaceispartitioned.Wecannotdetailthepartitioninghere,buteventheminorpartitionsarefarlargerthanthetotalIPv4space.Routingspeed:ThecomplexityofthebasicIPv6headerandtheprocessingrequiredateachnodearereduced.Nochecksumisappliedtothepacketcontent(payload),andnofragmentationcanoccuronceapackethasbegunitsjourney.Theformerisconsideredacceptablebecauseerrorscanbedetectedathigherlevels(TCPdoesincludeacontentchecksum),andthelatterisachievedbysupportingamechanismfordeterminingthesmallestMTUbeforeapacketistransmitted.Multicastandanycast:BothIPv4andIPv6includesupportforthetransmissionofIPpacketstomultiplehostsusingasingleaddress(onethatisintherangereservedforthepurpose).TheIProutersarethenresponsibleforroutingthepackettoallofthehoststhathavesubscribedtothegroupidentifiedbytherelevantaddress.3.4.6TCPandUDPTCPandUDPprovidethecommunicationcapabilitiesoftheInternetinaformthatisusefulforapplicationprograms.Applicationdevelopersmightwishforothertypesoftransportservice,forexampletoprovidereal-timeguaranteesorsecurity,butsuchserviceswouldgenerallyrequiremoresupportinthenetworklayerthanIPv4provides.TCPandUDPcanbeviewedasafaithfulreflectionattheapplicationprogramminglevelofthecommunicationfacilitiesthatIPv4hastooffer.Chapter4describesthecharacteristicsofbothTCPandUDPfromthepointofviewofdistributedprogramdevelopers.Hereweshallbequitebrief,describingonlythefunctionalitythattheyaddtoIP.Useofports:Thefirstcharacteristictonoteisthat,whereasIPsupportscommunicationbetweenpairsofcomputers(identifiedbytheirIPaddresses),TCPandUDP,astransportprotocols,mustprovideprocess-to-processcommunication.Thisisaccomplishedbytheuseofports.Portnumbersareusedforaddressingmessagestoprocesseswithinaparticularcomputerandarevalidonlywithinthatcomputer.Aportnumberisa16-bitinteger.OnceanIPpackethasbeendeliveredtothedestinationhost,theTCP-orUDP-layersoftwaredispatchesittoaprocessviaaspecificportatthathost.UDPfeatures:

UDPisalmostatransport-levelreplicaofIP.AUDPdatagramisencapsulatedinsideanIPpacket.Ithasashortheaderthatincludesthesourceanddestinationportnumbers(thecorrespondinghostaddressesarepresentintheIPheader),alengthfieldandachecksum.UDPoffersnoguaranteeofdelivery.WehavealreadynotedthatIPpacketsmaybedroppedbecauseofcongestionornetworkerror.UDPaddsnoadditionalreliabilitymechanismsexceptthechecksum,whichisoptional.Ifthechecksumfieldisnon-zero,thereceivinghostcomputesacheckvaluefromthepacketcontentsandcomparesitwiththereceivedchecksum;packetsforwhichtheydonotmatcharedropped.TCPfeatures:TCPprovidesamuchmoresophisticatedtransportservice.Itprovidesreliabledeliveryofarbitrarilylongsequencesofbytesviastream-basedprogrammingabstraction.ThereliabilityguaranteeentailsthedeliverytothereceivingprocessofallofthedatapresentedtotheTCPsoftwarebythesendingprocess,inthesameorder.TCPisconnection-oriented.Beforeanydataistransferred,thesendingandreceivingprocessesmustcooperateintheestablishmentofabidirectionalcommunicationchannel.Theconnectionissimplyanend-to-endagreementtoperformreliabledatatransmission;intermediatenodessuchasroutershavenoknowledgeofTCPconnections,andtheIPpacketsthattransferthedatainaTCPtransmissiondonotnecessarilyallfollowthesameroute.TheTCPlayerincludesadditionalmechanisms(implementedoverIP)tomeetthereliabilityguarantees.Theseare:Sequencing:ATCPsendingprocessdividesthestreamintoasequenceofdatasegmentsandtransmitsthemasIPpackets.AsequencenumberisattachedtoeachTCPsegment.Itgivesthebytenumberwithinthestreamforthefirstbyteofthesegment.Thereceiverusesthesequencenumberstoorderthereceivedsegmentsbeforeplacingthemintheinputstreamatthereceivingprocess.Flowcontrol:Thesendertakescarenottooverwhelmthereceiverortheinterveningnodes.Thisisachievedbyasystemofsegmentacknowledgements.Wheneverareceiversuccessfullyreceivesasegment,itrecordsitssequencenumber.Fromtimetotimethereceiversendsanacknowledgementtothesender,givingthesequencenumberofthehighest-numberedsegmentinitsinputstreamtogetherwithawindowsize.Retransmission:Thesenderrecordsthesequencenumbersofthesegmentsthatitsends.Whenitreceivesanacknowledgementitnotesthatthesegmentsweresuccessfullyreceived,anditmaythendeletethemfromitsoutgoingbuffers.Ifanysegmentisnotacknowledgedwithinaspecifiedtimeout,thesenderretransmitsit.Buffering:Theincomingbufferatthereceiverisusedtobalancetheflowbetweenthesenderandthereceiver.Ifthereceivingprocessissuesreceiveoperationsmoreslowlythanthesenderissuessendoperations,thequantityofdatainthebufferwillgrow.Usuallyitisextractedfromthebufferbeforeitbecomesfull,butultimatelythebuffermayoverflow,andwhenthathappensincomingsegmentsaresimplydroppedwithoutrecordingtheirarrival.Theirarrivalisthereforenotacknowledgedandthesenderisobligedtoretransmitthem.Checksum:Eachsegmentcarriesachecksumcoveringtheheaderandthedatainthesegment.Ifareceivedsegmentdoesnotmatchitschecksum,thesegmentisdropped.3.4.8FirewallsAlmostallorganizationsneedInternetconnectivityinordertoprovideservicestotheircustomersandotherexternalusersandtoenabletheirinternaluserstoacces