CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 3-1
Chapter 3
TCP/IP
At a Glance
Instructor’s Manual Table of Contents
• Overview
• Objectives
• Teaching Tips
• Quick Quizzes
• Class Discussion Topics
• Additional Projects
• Additional Resources
• Key Terms
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 3-2
Lecture Notes
Overview
TCP/IP stands for Transmission Control Protocol/Internet Protocol. However, TCP/IP is
actually a protocol suite that contains a variable number of protocols, depending on the
specific type of network. This chapter covers the aspects of the protocols that make up the
TCP/IP protocol stack and are commonly used in data transmissions.
Chapter Objectives
• Discuss the origins of TCP/IP
• Identify and discuss the different layer functions of TCP/IP
• Describe the functions performed by protocols in the TCP/IP protocol suite, including
ICMP, UDP, TCP, ARP, and RARP
• Use Ping and Trace and describe their functions
• Explain how packets are transmitted
• Describe the Cisco three-layer hierarchical model
Teaching Tips
Origins of TCP/IP
1. Explain that the Transmission Control Protocol/Internet Protocol (TCP/IP) protocol
suite resulted from a coordinated effort by the U.S. Department of Defense (DOD).
2. Mention that the Advanced Research Projects Agency (ARPA) was charged with
creating a wide area network (WAN). The results were TCP/IP and ARPANET.
3. Mention that the DOD funded two projects:
a. The adaptation of TCP/IP to work with UNIX
b. The inclusion of the TCP/IP protocol with Berkeley UNIX (BSD UNIX)
Teaching
Tip
Because the ARPA project was funded by taxpayer money and was not
government-classified, it was considered to be in the public domain. This opened
the Internet to everyone, organizations and individuals alike.
Overview of the TCP/IP Protocol Suite
1. Explain that the TCP/IP model describes how the protocol suite works to provide
2. Mention that Requests for Comments (RFCs) define, describe, and standardize the
implementation and configuration of the TCP/IP protocol suite.
Teaching
Tip
Refer your students to
http://cisco.com/univercd/cc/td/doc/product/iaabu/centri4/user/scf4ap1.htm for
additional information about TCP/IP.
Application Layer
1. Describe some of the following protocols at the TCP/IP Application layer:
a. File Transfer Protocol (FTP)
b. Trivial File Transfer Protocol (TFTP)
c. Network File System (NFS)
Transport Layer
1. Explain that the Transport layer performs end-to-end packet delivery, reliability, and
flow control.
3. Mention that TCP and UDP use port numbers for communications between hosts. Use
Figure 3-2 to illustrate your explanation.
4. Port numbers are divided into three ranges:
6. Use Figure 3-3 to show the TCP packet header.
8. Use Figures 3-4 and 3-5 to show the TCP three-way handshake process.
9. Mention that a reset packet (RST) indicates that a TCP connection is to be terminated
10. Explain that TCP Sliding Windows control the flow and efficiency of communication.
11. Define sliding windows, also known as windowing, as a method of controlling packet
12. Mention that the size of the TCP window determines the number of acknowledgments
sent for a given data transfer. Networks that perform large data transfers should use
large window sizes.
Teaching
Tip
Read more about TCP at:
http://en.wikipedia.org/wiki/Transmission_Control_Protocol.
13. Describe other flow control methods, including the following:
a. Buffering
b. Collision avoidance
Quick Quiz 1
1. The invention and evolution of the Transmission Control Protocol/Internet Protocol
(TCP/IP) protocol suite resulted from a coordinated effort by the U.S. ____.
2. A series of documents called ____ define, describe, and standardize the implementation
and configuration of the TCP/IP protocol suite.
3. The ____ service provides TCP/IP host name to IP address resolution.
4. ____, also known as windowing, is a method of controlling packet flow between hosts.
Internetwork Layer
1. Describe the following four protocols at the Internetwork layer:
a. Internet Protocol (IP)
2. Define ARP as a routed protocol that maps IP addresses to MAC addresses. ARP tables
contain the MAC and IP addresses of other devices on the network.
3. Explain that when a computer transmits a frame to a destination on the local network, it
checks the ARP cache for an IP to MAC address mapping for the destination node. Use
Figure 3-6 to illustrate your explanation.
Teaching
Tip
Most entries are dynamic, which means that the system performed IP to MAC
resolution as needed. Static entries, which are rarely used, provide semi-
permanent IP to MAC address mappings that an administrator entered manually.
4. Mention that if a source computer cannot locate an IP to MAC address mapping in its
5. Use Figure 3-7 to describe the ARP request frame.
Teaching
Tip
Devices on the network that receive and eventually discard an ARP request use
the source information to update their own ARP tables. Recipients enter the
source computer’s IP and MAC addresses from the ARP request packet into their
local ARP tables.
6. Explain that a source device checks its local ARP cache prior to sending packets on the
7. Explain that Reverse Address Resolution Protocol (RARP) is similar to ARP but it is
9. Use Figure 3-8 to describe the RARP request frame.
11. Although ARP and RARP share similarities, they have certain differences as well:
a. ARP is concerned with obtaining the MAC address of other clients by using an
IP address, but RARP obtains the IP address of the local host by using the local
12. Explain that ARP requests use broadcasts. Since routers filter broadcast traffic, a source
must forward the frame to the router.
14. Mention that routers have multiple network interfaces and therefore also include the
port numbers of their NICs in the ARP table.
3-1 to show how the ping command utility works.
Teaching
Tip
Cisco routers include two ping commands: standard ping and extended ping.
16. Explain that the Trace utility uses ICMP echo request/reply messages to verify
17. Mention that several different malicious network attacks have also been created using
Network Interface Layer
1. Explain that the Network Interface layer plays the same role as the Data Link and
Physical layers of the OSI model.
3. Mention that no specific IP functions exist at this layer because the layer’s focus is on
Understanding Frame Transmission
1. Explain that each host on a segment evaluates the frame to determine whether the listed
2. On the destination host, frames are sent up the TCP/IP stack. Each layer removes its
header information before passing the frames to the next layer.
3. Mention that for a packet to be routed on a TCP/IP internetwork, an IP address and
MAC address are required for both the source and destination hosts.
Routers on the Network
1. Explain that a router requires an IP address for every network segment to which it is
2. Mention that when computers need to send frames to destinations not on their segment,
they send them to the router (default gateway) instead. The router must determine which
subnet should receive the frame. The router references its routing table.
Network to Network
2. Explain that when a network uses TCP/IP, each port on a router requires an IP address;
3. Mention that on a TCP/IP network, the logical addresses on a certain segment must be
matched. If you move a computer from one segment to another, the IP address will have
to be changed.
Teaching
Tip
You only need to ensure that the logical address, such as the IP address, matches
the network because MAC addresses are a permanent part of the NIC and do not
change when the computer is moved to a new network.
Dynamic or Static Tables
1. Mention that routing tables match network addresses with the addresses of the routers
that handle those networks. The tables can be built statically or dynamically.
2. Explain that dynamic updates are provided through routing protocols. A router capable
3. Describe the following methods to determine the best path across a network:
a. The distance-vector algorithm
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 3-8
Transmitting Packets to Remote Segments
1. Explain that when TCP/IP hosts transmit packets to remote segments, they contact their
2. Mention that the router re-addresses the frame or sends the packet to the next router in
the path, also known as indirect routing.
Routing Packets
1. Use Figure 3-14 and Tables 3-2 through 3-5 to show an example of how to route a
packet from host A to host B.
The Cisco Three-Layer Hierarchical Model
1. Explain that the Cisco Three-Layer Hierarchical model does not describe how
2. Mention that each layer of the model is involved in specific functions and is typically
defined by a particular type of device. The three layers of the model from bottom up are
Access, Distribution, and Core. Use Figure 3-15 to illustrate your explanation.
Access Layer
1. Define the Access layer as the layer closest to the users, where they attach to the
network.
2. Explain that the Access layer device could be a router if the network is very small, but it
is typically a hub or layer 2 switch.
Distribution Layer
1. Mention that the Distribution layer separates the Access layer from the Core layer.
2. Explain that the Distribution layer implements network policies, and provides many
3. Mention that IP addressing hierarchy is managed at this layer. IP addressing is the
process of assigning unique IP addresses to devices on the network.
4. Mention that this layer typically involves routers and includes all of the router
functions. It provides almost all of the connectivity tasks.
Core Layer
1. Explain that the Core layer is responsible for switching large amounts of data quickly
and efficiently.
2. Mention that to prevent slowing down the switching process, this layer should not be
3. Explain that the primary device at this layer is a high-end layer 3 switch. This device is
essentially the backbone of the network.
Quick Quiz 2
1. The ____ resolves IP addresses to MAC addresses for source hosts that know the IP
address of the destination host but not the MAC address.
2. A(n) ____ is caused by a malicious user or program that sends a large quantity of ICMP
echo requests (pings) to a target device in an attempt to crash or greatly reduce the
performance of the target device.
3. The TCP/IP ____layer plays the same role as the Data Link and Physical layers of the
OSI model.
4. ____ is the process of assigning unique IP addresses to devices on the network.
Class Discussion Topics
1. Why does TCP require a flow control method such as sliding windows?
2. What are the functions of ARP in a TCP/IP network?
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 3-10
Additional Projects
1. Ask your students to read more about ICMP flood and write a report explaining the
Additional Resources
2. Three-way handshake example
3. User Datagram Protocol
4. TCP Sliding Window Acknowledgment System For Data Transport, Reliability and
Flow Control
5. Address Resolution Protocol
6. Build Your Skills: The three-layer hierarchical model
Key Terms
➢ Address Resolution Protocol (ARP) A protocol that works at the Internetwork layer of
the TCP/IP networking model; resolves a known IP address to an unknown MAC
address, which is the final leg of communication between the source and destination.
CCNA Guide to Cisco Networking Fundamentals, Fourth Edition 3-11
➢ ARP request A process used to obtain the correct mapping when a source computer
cannot locate a destination MAC address for a known IP address in its ARP table.
➢ ARP table A table used by a network device that contains MAC to IP address
mappings.
at which packets are being transmitted.
➢ default gateway The address to which a host or IP device sends a packet when the
destination host is not on its subnet. The default gateway is usually an interface on a
router.
➢ destination unreachable An ICMP message sent back to the source host when a
network path (intermediate gateways), and to verify the installation of the TCP/IP
protocol on the local source host.
➢ expectational acknowledgment A TCP acknowledgment process in which the
acknowledgment number refers to the next expected sequence number. If the expected
sequence is not received within a specific time interval, a retransmission is requested.
number of the network on which it resides.
➢ initial sequence number (ISN) Sequence numbers that allow communicating hosts to
synchronize their communications in a TCP three-way handshake. When the
communication is initiated, two hosts communicating over TCP will synchronize their
initial sequence numbers.
or DHCP.
➢ link-state A routing protocol that uses cost when calculating the best path between two
points. It considers items such as network traffic, router congestion, bandwidth,
reliability, and other factors that could affect network performance.
➢ Network File System (NFS) A file system associated with the UNIX operating system
➢ redirect An ICMP message sent to source hosts requesting that they change routes
because the one they chose was not optimal. This packet is used to update a source
host’s internal routing table.
➢ remote login application (rlogin) A utility that allows remote computers to connect to
other computers or devices.
its packets can be routed from a source to a remote destination on an internetwork.
➢ routing protocols Used to dynamically create routing tables so that routed protocols
can route the data.
➢ routing table A table used by a router to determine which of its interfaces is connected
to the destination network.
packets arrive too fast (the receiving host runs out of buffer space for the message), or if
the system is near capacity (network is congested).
➢ TCP/IP See Transmission Control Protocol (TCP) and Internet Protocol (IP).
➢ terminal emulation protocol (telnet) A connection-oriented, Application layer utility
that allows TCP/IP clients to log in to a remote system and operate on that system as if
➢ timestamp request/reply ICMP messages that are used to synchronize clocks by
requesting the destination machine’s current time of day value, which is given in
milliseconds from midnight Universal Time.
➢ Trace A utility that uses ICMP messages to determine the path between a source and
destination host. Trace can discover all of the hops (routers) along the path between two
➢ UDP (User Datagram Protocol) The protocol that operates at the Transport layer and
transports data unreliably over IP. This is sometimes known as connectionless
communication because the messages are sent without expectation of acknowledgment.
Unlike TCP, UDP has no connection negotiation process. The packets that are sent by
UDP are also known as datagrams. Because UDP does not negotiate a connection, it is