To help reinforce the concepts of various protocols being
used at various layers, let's go ahead and open up Wireshark.
Wireshark is an example of a protocol analyzer
that captures packets and then helps
to decode them so that we can see them and make
sense of them.
So here in Wireshark, if we open up a capture--
and I've got a capture of an HTTP session.
An HTTP is an example of a protocol that
would be used at the application layer when a user, for example,
visits a website.
And now that we have this opened up,
if we just grab one of these entries
here-- in fact in this example, I'm
just going to grab number four.
In this output of Wireshark, it's
showing us the upper layer of protocols.
We have the application layer, we have HTTP, the hypertext
transfer protocol, and then at layer 4,
we have the TCP protocol right here.
And then at layer 3, the network layer, we have IP version 4.
And then below that, because we're on an Ethernet network,
it's showing us the layer 2 framing
information for Ethernet regarding this data.
If we looked at another example, let's go ahead
and do that, too.
We'll go to File, Open, and let's go ahead
and grab a DNS request.
DNS is used a lot in the background
when we type in a name like www.cbtnuggets.com,
and it resolves that into an IP address for our computer.
And the key here-- if we grab one of these--
we have DNS as the application layer of service being used.
And then at layer 4, the transport layer, here
we have UDP, because that's what DNS uses for a DNS query.
This will go down to the network layer, layer 3.
We have IP once again.
In this case, it's IP version four.
And then below that, we have the layer two information
for the framing based on the type of network we're crossing.
So we've looked at an example of TCP
being used and UDP being used, let's also
take a look at ICMP being used.
Let's open up another capture for that.
So, in Wireshark, we'll go to File, click on Open,
and I've got one for ICMP right here that
includes some ICMP traffic.
So here in the Wireshark output, we
have three panes, or three areas.
Here we have the List view, here we have the Details view,
and down here we have the Bytes view.
And up here in the List view, if we take a look at entry number
one here, it's showing that the protocol being used is ICMP.
And in the info section, it's showing us a ping request,
and then it's followed by-- in entry number two--
it's followed by a ping reply.
So with the ping request selected,
here in the Detail view, we have the Internet Control Message
Protocol.
If we expand it, it will give us the details
of what's going on, including the fact that it's
a ping request.
And then, we have the layer 3 protocol of IPv4, and then
the layer 2 information regarding
the framing of that data before it's actually
sent out on the wire.
And also, while we have a few moments right here
in the protocol analyzer, let's take
a closer look at TCP and UDP to compare and contrast them.
Because we have UDP right here in this packet capture,
let's go ahead and start there.
This is an example of UDP.
It's pretty straightforward as far as the UDP at layer 4.
It has some port information, some length,
but you'll notice here for UDP, it
does not have a lot of details regarding
the connection oriented status.
And that's because UDP is connectionless,
it doesn't maintain connection state,
it's not verifying that segments of data
are making it to the other side, and that's
why it's very lean and light, not a lot of overhead.
However, if we take a look at a TCP segment--
and let's open up another capture.
In fact, let's go back to File, Open, and let's go back
to HTTP, because that uses TCP.
And we can click on any of these because they're all
TCP related, but we'll go in and click
on the HTTP protocol, that being the application layer protocol.
And let's expand TCP right here.
So if we expand TCP--
and I'll go ahead and scroll this down a little
big so we can see it--
take a look at this.
Just by sheer volume of all the stuff going on,
here in TCP, because of the reliable connection
oriented services that TCP delivers.
Including sequence numbers, and acknowledgment numbers,
and a lot of other details that UDP simply
doesn't have, or need because UDP,
unlike TCP, doesn't give a hoot about connection
oriented or reliable sessions from the transport layer
perspective.
And as a result, there's a lot less overhead,
which makes it more desirable for applications and functions
that don't need a connection oriented, reliable session.
In this Nugget, we've taken the opportunity
to leverage a protocol analyzer-- in our example,
it was Wireshark-- to take a closer look
at some common, core TCP/IP protocols,
including TCP and UDP at layer 4, IP at layer 3,
and IP management protocol, named ICMP.
We also reinforced the idea that TCP,
because it does offer connection oriented and reliable services,
does have more overhead at layer 4
to accomplish that work, compared to its sibling,
UDP, which couldn't care less about reliable delivery.
I hope this has been informative for you,
and I'd like to thank you for viewing.