Protocols, circuit switching and packet switching

Why a protocol is essential

A protocol is a set of rules that governs how two devices exchange data. It is not the data itself and it is not the cable: it is the agreement about how the data will be structured, addressed, transmitted and checked. Both the sender and the receiver must implement the same protocol, and both must follow it, or the message that arrives cannot be interpreted.

Without that agreement a receiving device is handed a stream of bits with no way of knowing where one message ends and the next begins, which part is the address of the sender, whether the payload is text or a compressed image, or whether the whole thing arrived intact. Multiply that by the number of different manufacturers, operating systems and network technologies on the internet and the problem becomes obvious: a browser on a phone can fetch a page from a server on another continent only because both ends use HTTP in exactly the same way.

Every protocol settles three things. The format (syntax) covers the structure of the data and of the addresses, including how the start and end of a message are marked. The meaning and order (semantics) covers what each field means and the sequence of requests and replies. Timing (synchronisation) covers how fast data may be sent, how long to wait for a reply, and what to do when a reply does not arrive.

Protocols also agree how a connection is opened and closed, how errors are detected and corrected, and how a fast sender is stopped from overwhelming a slow receiver (flow control). Two computers that agree on the format but not on error handling will still fail as soon as a packet is corrupted.

The agreement has to cover small details as well as large ones. A line break is represented differently on different systems, an image may be compressed with one of several algorithms, and a message may be split across several packets. Each of those choices has to be fixed by the protocol, because a receiver that guesses produces the wrong result silently - a garbled attachment or a page of strange characters - rather than an obvious failure that someone can diagnose.

• Agreed format: the layout of the message and of the addresses, so the receiver knows which bits mean what.
• Agreed order: which device sends first, what a valid reply looks like, and how the exchange is started and ended.
• Agreed addressing: how the sender and the recipient are identified, so the data reaches the right device and the right application.
• Agreed error handling: how corruption or loss is detected, and whether the data is acknowledged, retransmitted or discarded.
• Agreed speed and flow control: how much data may be in flight, so a slow receiver is not swamped by a fast sender.

Protocols as a stack

A protocol stack implements a set of protocols as a series of layers, each with its own defined function. Each layer provides a service to the layer above it and uses the service of the layer below it, and it does so without the layers above needing to know how the work is done. This is abstraction: the application layer sends its data without caring whether the link below it is copper, fibre or radio.

Each layer on the sending computer effectively communicates with the same layer on the receiving computer. The application layer on the sender and the application layer on the receiver speak the same protocol, the two transport layers speak their own protocol, and so on. Each layer adds only the control information that its own job requires.

As data passes down the stack on the sender, each layer adds its own header to the data it has been given and passes the whole thing to the layer below, so the data from the layer above becomes the payload of the layer below. This wrapping is called encapsulation. On the receiver the process runs in reverse: each layer reads and removes its own header before passing the rest up, which is decapsulation.

Layering is used because it makes an extremely complex task manageable. Each layer can be designed, tested and debugged on its own; a layer can be replaced without rewriting the others, so moving a network from copper cable to fibre changes the link layer and leaves the application layer untouched; and different manufacturers can build hardware and software that work together, provided each layer follows the agreed standard.

The stack is a model of what the software and hardware actually do, not a set of physical pipes. On a typical computer the application layer is the browser or the mail client, the transport and internet layers are provided by the operating system, and the link layer is the network interface card and its driver. A router implements only the internet layer and the layers below it, which is exactly why it can forward traffic for applications it knows nothing about.

• Each layer has one defined job, which makes the whole system easier to design and to explain.
• A layer can be changed or replaced without altering the others, provided its interface stays the same.
• Layers can be developed and tested separately, so a fault can be traced to one layer instead of the whole system.
• Standard layers let equipment and software from different manufacturers interoperate.
• Layering hides complexity: the application does not need to know how the data is routed or transmitted.

The TCP/IP suite: four layers

TCP/IP is the protocol suite used by the internet. It is a family of protocols arranged in four layers, listed from the top down as Application, Transport, Internet and Link. It is not a single protocol, so an answer that calls TCP/IP "the protocol" has already lost a mark.

The application layer provides the services that the user's software actually uses: web pages, email, file transfer and file sharing. It contains the protocols that name those services - HTTP, FTP, SMTP, POP3, IMAP and BitTorrent - and it deals with the format of requests and responses, not with how the data will cross the network.

The transport layer is responsible for delivery between the two applications. It takes data from the application layer and breaks it into packets, adds a sequence number so the packets can be put back in order, a port number so the receiving computer knows which application the data belongs to, and error-checking data so corruption can be detected. TCP sets up a connection, acknowledges packets that arrive, arranges for missing or corrupted ones to be sent again, and reassembles the data in the right order at the destination.

The internet layer is responsible for getting a packet from one network to another across the internet. It adds the source and destination IP addresses, and it is the layer at which routing decisions are made: each router reads the destination address and forwards the packet towards it. IP is a best-effort service, so on its own it does not guarantee delivery or order.

The link layer is the layer that actually puts the data on the medium. It packages the data into a frame, adds the MAC addresses of the two devices at the ends of that particular link, and passes it to the network interface card to be transmitted over copper, fibre or radio. It also carries out error detection for each individual link.

Two consequences of this split are worth remembering. First, the internet layer is connectionless: it treats each packet as an independent unit carrying an address, and nothing in IP itself promises that the packet will arrive, that it will arrive once, or that packets will stay in order. Reliability is added by TCP at the transport layer, which is why the pair is written as TCP/IP. Second, each header is meaningful only to its peer layer, so a router can forward a packet without understanding the email inside it, and the same packet can cross an Ethernet, a fibre link and a mobile network on its way.

A message's journey down and up the stack

Follow one email from a laptop to a mail server and you can see each layer doing its own job in turn, and then the same job being undone at the other end.

On the way down, the application layer produces a message in the format its protocol defines. The transport layer treats that whole message as payload, splits it into packets and puts its own header in front of each one, containing the sequence number, the port numbers and the checksum. The internet layer treats each of those packets as payload in turn and adds an IP header with the two IP addresses. The link layer wraps the result in a frame with the MAC addresses of the next device and a trailer for error checking, and only then do bits reach the wire.

At the receiving end the process is mirrored. The link layer checks the frame, strips its header and trailer and passes the packet up; the internet layer reads the IP header, confirms the packet is for this host and removes it; the transport layer uses the sequence number to place the packet in order, acknowledges it, and when the whole message is present hands the data to the application named by the port number; the application layer finally interprets the message with SMTP, HTTP or whichever protocol the two ends agreed.

The important detail for exam answers is that a router only processes a packet up to the internet layer. It does not open the transport or application headers, because it does not need to know which application sent the data or what the message says - it needs only the destination IP address to decide where to send the packet next. That is also why the same packet can cross networks built from completely different link technologies.

• Application layer (sender): the email client creates the message using SMTP, which defines the commands, the format of the addresses and the replies it expects.
• Transport layer (sender): TCP divides the message into packets, numbers them, adds port numbers and a checksum, and opens a connection to the destination.
• Internet layer (sender): IP adds the source and destination IP addresses, producing a packet that can be routed across the internet.
• Link layer (sender): the packet is placed in a frame with the MAC addresses of the sending device and the next device on the path, and transmitted.
• At each router: the frame is removed, the destination IP address is read, the routing table is consulted, and the packet is placed in a new frame for the next hop.
• Link layer (receiver): the frame is checked and removed, and the packet is passed up.
• Internet layer (receiver): the IP header is read and removed, confirming the packet has reached the right host.
• Transport layer (receiver): the packets are put back in sequence, missing ones are requested again, and the data is passed to the correct application using the port number.
• Application layer (receiver): the mail server reads the SMTP commands and stores the message in the recipient's mailbox.

Application layer protocols: HTTP, FTP, SMTP, POP3 and IMAP

These are the protocols the syllabus names, and the exam expects the purpose of each and, for email, the direction in which each one works.

HTTP is the protocol a browser uses to request resources from a web server and the protocol the server uses to return them. It is a request-response protocol: the client sends a request naming the resource, and the server returns a status code and, if the request succeeded, the resource itself. Each request is independent of the last, which is why HTTP is described as stateless, and the protocol defines the methods such as GET and POST and the format of the headers.

FTP transfers files between a client and a server, in both directions: a user can download files from the server or upload files to it. It uses one connection for commands and a separate connection for the file data, requires a login (a username and password, or anonymous access where that is offered), and can resume an interrupted transfer instead of starting again, which makes it suitable for large files.

SMTP is a push protocol: it sends an email from the client to the outgoing mail server, and then from one mail server to another until the message reaches the server holding the recipient's mailbox. POP3 is a pull protocol used by a mail client to download messages from that mailbox to one device; in its usual configuration the messages are then deleted from the server, and it does not synchronise folders or read status between devices. IMAP also retrieves mail, but it leaves the messages on the server and keeps the client synchronised with it, so folders, read/unread state and deletions appear on every device that connects.

All five run above TCP, which is what makes them application layer protocols: they assume a reliable, ordered stream of bytes can be delivered to the other end and concentrate on what those bytes mean. HTTP does not care how a page is split into packets and SMTP does not care which route the message takes, which is exactly the separation of concerns the stack is designed to give. It is also why a fault that stops a page loading could sit in any layer, and why the layers are tested one at a time.

BitTorrent and peer-to-peer file sharing

BitTorrent is an application layer protocol for peer-to-peer (P2P) file sharing. In a client-server transfer such as FTP, every client downloads from one server, so the server's bandwidth limits the whole operation. In BitTorrent every computer that downloads also uploads, so the work is spread across the users themselves.

The file is divided into pieces, and a small metadata file (or magnet link) records the address of a tracker, the size of the pieces and a hash for each one. The tracker knows which peers hold which pieces. A peer asks several other peers for different pieces at the same time, checks each piece against its hash and re-requests any that are corrupt, and once it holds the whole file it becomes a seed that others can download from.

Because the pieces come from many peers in parallel, a popular file can arrive faster than from a single server, and the original publisher does not pay for all the bandwidth or act as a single point of failure. Peers that upload more are usually given priority by other peers, which encourages sharing. The costs are that the transfer depends on enough peers being online, that uploads consume the users' own bandwidth, and that the same mechanism is widely used to distribute copyrighted material without permission.

The design also changes the economics of distribution. With FTP, every extra downloader competes for the same server bandwidth, so a popular file gets slower as demand rises. With BitTorrent the total upload capacity grows as peers join, so a popular release can get faster, and the publisher only has to supply the first copy. The trade-off is that the swarm depends on those peers staying connected and on their upload speeds, and that an unpopular file with one seed may never finish.

• Peer-to-peer: each computer is both a client and a server for the pieces it holds.
• Tracker: keeps a list of the peers and the pieces each one has.
• Piece and hash: the file is split up, and each piece is verified so corrupt data is discarded.
• Seed: a peer that holds the complete file and only uploads.
• Benefit: fast distribution of large popular files with no central server cost.
• Drawback: slow when few peers are online, and a common route for illegal sharing.

Circuit switching

A circuit-switched network sets up a dedicated path between the sender and the receiver before any data is sent, and reserves that path for the whole duration of the communication. The capacity of every link on the path belongs to that connection, even during the silences when nothing is being transmitted.

Setting up the connection is a distinct phase. In the traditional telephone network, dialling asks the exchanges along the route to allocate a channel to the call; once the whole path is reserved the phone rings, and only then can speech pass. When one side hangs up, the circuit is released and its capacity becomes available to someone else.

The benefits follow from the reservation. The connection has a guaranteed bandwidth and a constant, predictable delay, because no other traffic can compete for the reserved capacity, so there is no congestion once the circuit exists. Data arrives in the order it was sent, and the network does no per-packet addressing or routing while the call is in progress, which keeps the transfer simple.

The drawbacks follow from the same reservation. Capacity is wasted whenever nothing is being sent, which is most of the time in a conversation with pauses, so circuit switching is an expensive way to carry bursty computer data. A connection must be set up before any data can flow, the number of simultaneous connections is limited by the number of circuits available, and if one link on the path fails the connection is lost and has to be established again.

The reservation is also full duplex: a telephone circuit carries both directions at once, so the two parties can speak over one another, which is part of why the service feels immediate. Nothing is queued, because nothing is competing for the capacity, and nothing has to be reassembled, because everything arrives in the order it was sent. Engineers call this a constant bit rate service: the circuit delivers a steady stream whether or not there is anything useful in it.

It is the right choice where a continuous, steady stream matters more than efficiency: ordinary voice telephony, live audio and video that must not stutter, and leased lines that give an organisation a fixed amount of bandwidth between two sites.

Packet switching, routers and the comparison

A packet-switched network has no reserved path. The message is broken into packets, and each packet is sent independently, sharing every link with packets from other users. Packets from the same message may travel by different routes depending on traffic and on the decisions of the routers they meet.

Every packet carries a header containing at least the source and destination IP addresses, a sequence number so the receiver can restore the order, and error-checking data so corruption can be detected. Some of the header is added by the transport layer and some by the internet layer, which is why the two-layer split matters.

A router is the device that decides where each packet goes next. It receives the packet, reads the destination IP address from the header, looks that address up in its routing table to find the best next hop, and forwards the packet to the next router on that route. The next router repeats the process, so the packet moves across the internet one hop at a time rather than being sent to the destination in a single step. If a link or router is congested or has failed, the router can choose a different next hop, which is why the network survives failures.

At the destination the packets may have arrived out of order and with different delays. The transport layer uses the sequence numbers to reassemble them in the right order, discards any that fail the error check, and asks for missing or corrupt packets to be sent again. A short delay while packets are buffered and reordered is called jitter, and it is the main reason real-time audio and video need priority treatment on a packet-switched network.

Congestion is handled by buffering. When a router receives packets faster than it can forward them it holds them in a queue in memory, and if the queue fills it discards the excess, so a busy network shows both longer delays and more lost packets. This is why real-time traffic such as voice is marked as high priority while a large download is left at low priority: without that priority, a file transfer can add enough delay to make a call unusable. Networks that can give different traffic different treatment are described as providing quality of service.

Packet switching is efficient because a link is only occupied while a packet is actually being sent, so many users share it, and it is resilient because traffic can be rerouted. It is used for almost all data: web pages, email, file transfer, file sharing and, with priority handling, voice and video over IP. The costs are variable delay, out-of-order arrival, packet loss under heavy congestion, and the processing and header overhead at every router.

• Break up: the message is split into packets, each small enough to cross the network.
• Label: each packet gets a header with source and destination IP addresses, a sequence number and error-checking data.
• Route independently: each router reads the destination address, consults its routing table and forwards to the best next hop.
• Reroute: if a link fails or is congested, later packets can take a different path.
• Reassemble: the receiver orders the packets by sequence number and requests any that are missing.