TOP 10 COMPUTER VIRUSES

COMPUTER VIRUSES

­­Computer viruses can be a nightmare. Some can wipe out the information on a hard drive, tie up traffic on a computer network for hours, turn an innocent machine into a zombie and replicate and send themselves to other computers. If you've never had a machine fall victim to a computer virus, you may wonder what the fuss is about. But the concern is understandable -- according to Consumer Reports, computer viruses helped contribute to $8.5 billion in consumer losses in 2008 [source: MarketWatch]. Computer viruses are just one kind of online threat, but they're arguably the best known of the bunch.



Computer viruses have been around for many years. In fact, in 1949, a scientist named John von Neumann theorized that a self-replicated program was possible . The computer industry wasn't even a decade old, and already someone had figured out how to throw a monkey wrench into the figurative gears. But it took a few decades before programmers known as hackers began to build computer viruses.

While some pranksters created virus-like programs for large computer systems, it was really the introduction of the personal computer that brought computer viruses to the public's attention. A doctoral student named Fred Cohen was the first to describe self-replicating programs designed to modify computers as viruses. The name has stuck ever since.


Old-school Viruses

Some of the earliest viruses to infect personal computers included the Apple Viruses, which attacked Apple II computers
and the Brain virus, which could infect PCs.

­In the good­ old days (i.e., the early 1980s), viruses depended on humans to do the hard work of spreading the virus to other computers. A hacker would save the virus to disks and then distribute the disks to other people. It wasn't until modems became common that virus transmission became a real problem. Today when we think of a computer virus, we usually imagine something that transmits itself via the Internet. It might infect computers through e-mail messages or corrupted Web links. Programs like these can spread much faster than the earliest computer viruses.

We're going to take a look at 10 of the worst computer viruses to cripple a computer system. Let's start with the Melissa virus.

Worst Computer Virus 10: Melissa

In the spring of 1999, a man named David L. Smith created a computer virus based on a Microsoft Word macro. He built the virus so that it could spread through e-mail messages. Smith named the virus "Melissa," saying that he named it after an exotic dancer from Florida [source: CNN].



A courtroom photo of David L. Smith, the alleged creator of the Melissa virus.Rather than shaking its moneymaker, the Melissa computer virus tempts recipients into opening a document with an e-mail message like "Here is that document you asked for, don't show it to anybody else." Once activated, the virus replicates itself and sends itself out to the top 50 people in the recipient's e-mail address book.

The virus spread rapidly after Smith unleashed it on the world. The United States federal government became very interested in Smith's work -- according to statements made by FBI officials to Congress, the Melissa virus "wreaked havoc on government and private sector networks" [source: FBI]. The increase in e-mail traffic forced some companies to discontinue e-mail programs until the virus was contained.

After a lengthy trial process, Smith lost his case and received a 20-month jail sentence. The court also fined Smith $5,000 and forbade him from accessing computer networks without court authorization [source: BBC]. Ultimately, the Melissa virus didn't cripple the Internet, but it was one of the first computer viruses to get the public's attention.

Flavors of Viruses

The general term computer virus usually covers programs that modify how a computer works (including damaging the computer) and can self-replicate. A true computer virus requires a host program to run properly -- Melissa used a Word document.
A worm, on the other hand, doesn't require a host program. It's an application that can replicate itself and send itself through computer networks.
Trojan horses are programs that claim to do one thing but really do another. Some might damage a victim's hard drive. Others can create a backdoor, allowing a remote user to access the victim's computer system.

Worst Computer Virus 9: ILOVEYOU

A year after the Melissa virus hit the Internet, a digital menace emerged from the Philippines. Unlike the Melissa virus, this threat came in the form of a worm -- it was a standalone program capable of replicating itself. It bore the name ILOVEYOU.

The ILOVEYOU virus initially traveled the Internet by e-mail, just like the Melissa virus. The subject of the e-mail said that the message was a love letter from a secret admirer. An attachment in the e-mail was what caused all the trouble. The original worm had the file name of LOVE-LETTER-FOR-YOU.TXT.vbs. The vbs extension pointed to the language the hacker used to create the worm: Visual Basic Scripting.


According to anti-virus software producer McAfee, the ILOVEYOU virus had a wide range of attacks:

It copied itself several times and hid the copies in several folders on the victim's hard drive.
It added new files to the victim's registry keys.
It replaced several different kinds of files with copies of itself.
It sent itself through Internet Relay Chat clients as well as e-mail.
It downloaded a file called WIN-BUGSFIX.EXE from the Internet and executed it. Rather than fix bugs, this program was a password-stealing application that e-mailed secret information to the hacker's e-mail address.

Who created the ILOVEYOU virus? Some think it was Onel de Guzman of the Philippines. Filipino authorities investigated de Guzman on charges of theft -- at the time the Philippines had no computer espionage or sabotage laws. Citing a lack of evidence, the Filipino authorities dropped the charges against de Guzman, who would neither confirm nor deny his responsibility for the virus. According to some estimates, the ILOVEYOU virus caused $10 billion in damages .

Worst Computer Virus 8: The Klez Virus

The Klez virus marked a new direction for computer viruses, setting the bar high for those that would follow. It debuted in late 2001, and variations of the virus plagued the Internet for several months. The basic Klez worm infected a victim's computer through an e-mail message, replicated itself and then sent itself to people in the victim's address book. Some variations of the Klez virus carried other harmful programs that could render a victim's computer inoperable. Depending on the version, the Klez virus could act like a normal computer virus, a worm or a Trojan horse. It could even disable virus-scanning software and pose as a virus-removal tool.



Shortly after it appeared on the Internet, hackers modified the Klez virus in a way that made it far more effective. Like other viruses, it could comb through a victim's address book and send itself to contacts. But it could also take another name from the contact list and place that address in the "From" field in the e-mail client. It's called spoofing -- the e-mail appears to come from one source when it's really coming from somewhere else.


Spoofing an e-mail address accomplishes a couple of goals. For one thing, it doesn't do the recipient of the e-mail any good to block the person in the "From" field, since the e-mails are really coming from someone else. A Klez worm programmed to spam people with multiple e-mails could clog an inbox in short order, because the recipients would be unable to tell what the real source of the problem was. Also, the e-mail's recipient might recognize the name in the "From" field and therefore be more receptive to opening it.

Antivirus Software

It's important to have an antivirus program on your computer, and to keep it up to date. But you shouldn't use more than one suite, as multiple antivirus programs can interfere with one another. Here's a list of some antivirus software suites:

Avast Antivirus
AVG Anti-Virus
Kaspersky Anti-Virus
McAfee VirusScan
Norton AntiVirus

Worst Computer Virus 7: Code Red and Code Red II

­The Code Red and Code Red II worms popped up in the summer of 2001. Both worms exploited an operating system vulnerability that was found in machines running Windows 2000 and Windows NT. The vulnerability was a buffer overflow problem, which means when a machine running on these operating systems receives more information than its buffers can handle, it starts to overwrite adjacent memory.


The original Code Red worm initiated a distributed denial of service (DDoS) attack on the White House. That means all the computers infected with Code Red tried to contact the Web servers at the White House at the same time, overloading the machines.


A Windows 2000 machine infected by the Code Red II worm no longer obeys the owner. That's because the worm creates a backdoor into the computer's operating system, allowing a remote user to access and control the machine. In computing terms, this is a system-level compromise, and it's bad news for the computer's owner. The person behind the virus can access information from the victim's computer or even use the infected computer to commit crimes. That means the victim not only has to deal with an infected computer, but also may fall under suspicion for crimes he or she didn't commit.


While Windows NT machines were vulnerable to the Code Red worms, the viruses' effect on these machines wasn't as extreme. Web servers running Windows NT might crash more often than normal, but that was about as bad as it got. Compared to the woes experienced by Windows 2000 users, that's not so bad.


Microsoft released software patches that addressed the security vulnerability in Windows 2000 and Windows NT. Once patched, the original worms could no longer infect a Windows 2000 machine; however, the patch didn't remove viruses from infected computers -- victims had to do that themselves.

Worst Computer Virus 6: Nimda

SMobile Systems
The Symbian Skull Virus affects cell phones, causing them to display a series of skull images like this. Another virus to hit the Internet in 2001 was the Nimda (which is admin spelled backwards) worm. Nimda spread through the Internet rapidly, becoming the fastest propagating computer virus at that time. In fact, according to TruSecure CTO Peter Tippett, it only took 22 minutes from the moment Nimda hit the Internet to reach the top of the list of reported attacks [source: Anthes].


The Nimda worm's primary targets were Internet servers. While it could infect a home PC, its real purpose was to bring Internet traffic to a crawl. It could travel through the Internet using multiple methods, including e-mail. This helped spread the virus across multiple servers in record time.


The Nimda worm created a backdoor into the victim's operating system. It allowed the person behind the attack to access the same level of functions as whatever account was logged into the machine currently. In other words, if a user with limited privileges activated the worm on a computer, the attacker would also have limited access to the computer's functions. On the other hand, if the victim was the administrator for the machine, the attacker would have full control.



The spread of the Nimda virus caused some network systems to crash as more of the system's resources became fodder for the worm. In effect, the Nimda worm became a distributed denial of service (DDoS) attack.

Worst Computer Virus 5: SQL Slammer/Sapphire


The Slammer virus hit South Korea hard, cutting it off from the Internet and leaving Internet cafes like this one relatively empty.­In late January 2003, a new Web server virus spread across the Internet. Many computer networks were unprepared for the attack, and as a result the virus brought down several important systems. The Bank of America's ATM service crashed, the city of Seattle suffered outages in 911 service and Continental Airlines had to cancel several flights due to electronic ticketing and check-in errors.

The culprit was the SQL Slammer virus, also known as Sapphire. By some estimates, the virus caused more than $1 billion in damages before patches and antivirus software caught up to the problem [source: Lemos]. The progress of Slammer's attack is well documented. Only a few minutes after infecting its first Internet server, the Slammer virus was doubling its number of victims every few seconds. Fifteen minutes after its first attack, the Slammer virus infected nearly half of the servers that act as the pillars of the Internet [source: Boutin].


The Slammer virus taught a valuable lesson: It's not enough to make sure you have the latest patches and antivirus software. Hackers will always look for a way to exploit any weakness, particularly if the vulnerability isn't widely known. While it's still important to try and head off viruses before they hit you, it's also important to have a worst-case-scenario plan to fall back on should disaster strike.

Worst Computer Virus 4: MyDoom

Alex Wong/Getty Images
The MyDoom virus inspired politicians like U.S. Senator Chuck Schumer to propose a National Virus Response Center. The MyDoom (or Novarg) virus is another worm that can create a backdoor in the victim computer's operating system. The original MyDoom virus -- there have been several variants -- had two triggers. One trigger caused the virus to begin a denial of service (DoS) attack starting Feb. 1, 2004. The second trigger commanded the virus to stop distributing itself on Feb. 12, 2004. Even after the virus stopped spreading, the backdoors created during the initial infections remained active.

Later that year, a second outbreak of the MyDoom virus gave several search engine companies grief. Like other viruses, MyDoom searched victim computers for e-mail addresses as part of its replication process. But it would also send a search request to a search engine and use e-mail addresses found in the search results. Eventually, search engines like Google began to receive millions of search requests from corrupted computers. These attacks slowed down search engine services and even caused some to crash.

MyDoom spread through e-mail and peer-to-peer networks. According to the security firm MessageLabs, one in every 12 e-mail messages carried the virus at one time . Like the Klez virus, MyDoom could spoof e-mails so that it became very difficult to track the source of the infection.

Worst Computer Virus 3: Sasser and Netsky


Sven Jaschan, creator of the Sasser and Netsky viruses, leaves the Verden Court.Sometimes computer virus programmers escape detection. But once in a while, authorities find a way to track a virus back to its origin. Such was the case with the Sasser and Netsky viruses. A 17-year-old German named Sven Jaschan created the two programs and unleashed them onto the Internet. While the two worms behaved in different ways, similarities in the code led security experts to believe they both were the work of the same person.


The Sasser worm attacked computers through a Microsoft Windows vulnerability. Unlike other worms, it didn't spread through e-mail. Instead, once the virus infected a computer, it looked for other vulnerable systems. It contacted those systems and instructed them to download the virus. The virus would scan random IP addresses to find potential victims. The virus also altered the victim's operating system in a way that made it difficult to shut down the computer without cutting off power to the system.


The Netsky virus moves through e-mails and Windows networks. It spoofs e-mail addresses and propagates through a 22,016-byte file attachment [source: CERT]. As it spreads, it can cause a denial of service (DoS) attack as systems collapse while trying to handle all the Internet traffic. At one time, security experts at Sophos believed Netsky and its variants accounted for 25 percent of all computer viruses on the Internet .


Sven Jaschan spent no time in jail; he received a sentence of one year and nine months of probation. Because he was under 18 at the time of his arrest, he avoided being tried as an adult in German courts.

Black Hats

Just as you'd find good and bad witches in Oz, you can find good and bad hackers in our world. One common term for a hacker who sets out to create computer viruses or compromise system security is a black hat. Some hackers attend conventions like the Black Hat conference or Defcon to discuss the impact of black hats and how they use vulnerabilities in computer security systems to commit crimes.

Worst Computer Virus 2: Leap-A/Oompa-A

We can thank "Weird Al" Yankovic for warning us of the dreaded "Stinky Cheese" virus.Maybe you've seen the ad in Apple's Mac computer marketing campaign where Justin "I'm a Mac" Long consoles John "I'm a PC" Hodgman. Hodgman comes down with a virus and points out that there are more than 100,000 viruses that can strike a computer. Long says that those viruses target PCs, not Mac computers.


For the most part, that's true. Mac computers are partially protected from virus attacks because of a concept called security through obscurity. Apple has a reputation for keeping its operating system (OS) and hardware a closed system -- Apple produces both the hardware and the software. This keeps the OS obscure. Traditionally, Macs have been a distant second to PCs in the home computer market. A hacker who creates a virus for the Mac won't hit as many victims as he or she would with a virus for PCs.


But that hasn't stopped at least one Mac hacker. In 2006, the Leap-A virus, also known as Oompa-A, debuted. It uses the iChat instant messaging program to propagate across vulnerable Mac computers. After the virus infects a Mac, it searches through the iChat contacts and sends a message to each person on the list. The message contains a corrupted file that appears to be an innocent JPEG image.



The Leap-A virus doesn't cause much harm to computers, but it does show that even a Mac computer can fall prey to malicious software. As Mac computers become more popular, we'll probably see more hackers create customized viruses that could damage files on the computer or snarl network traffic. Hodgman's character may yet have his revenge.

Breaking into Song

While computer viruses can pose a serious threat to computer systems and Internet traffic, sometimes the media overstates the impact of a particular virus. For example, the Michelangelo virus gained a great deal of media attention, but the actual damage caused by the virus was pretty small. That might have been the inspiration for the song "Virus Alert" by "Weird Al" Yankovic. The song warns listeners of a computer virus called Stinky Cheese that not only wipes out your computer's hard drive, but also forces you to listen to Jethro Tull songs and legally change your name to Reggie.

Worst Computer Virus 1: Storm Worm

The latest virus on our list is the dreaded Storm Worm. It was late 2006 when computer security experts first identified the worm. The public began to call the virus the Storm Worm because one of the e-mail messages carrying the virus had as its subject "230 dead as storm batters Europe." Antivirus companies call the worm other names. For example, Symantec calls it Peacomm while McAfee refers to it as Nuwar. This might sound confusing, but there's already a 2001 virus called the W32.Storm.Worm. The 2001 virus and the 2006 worm are completely different programs.

The Storm Worm is a Trojan horse program. Its payload is another program, though not always the same one. Some versions of the Storm Worm turn computers into zombies or bots. As computers become infected, they become vulnerable to remote control by the person behind the attack. Some hackers use the Storm Worm to create a botnet and use it to send spam mail across the Internet.


Many versions of the Storm Worm fool the victim into downloading the application through fake links to news stories or videos. The people behind the attacks will often change the subject of the e-mail to reflect current events. For example, just before the 2008 Olympics in Beijing, a new version of the worm appeared in e-mails with subjects like "a new deadly catastrophe in China" or "China's most deadly earthquake." The e-mail claimed to link to video and news stories related to the subject, but in reality clicking on the link activated a download of the worm to the victim's computer [source: McAfee].


Several news agencies and blogs named the Storm Worm one of the worst virus attacks in years. By July 2007, an official with the security company Postini claimed that the firm detected more than 200 million e-mails carrying links to the Storm Worm during an attack that spanned several days [source: Gaudin]. Fortunately, not every e-mail led to someone downloading the worm.


Although the Storm Worm is widespread, it's not the most difficult virus to detect or remove from a computer system. If you keep your antivirus software up to date and remember to use caution when you receive e-mails from unfamiliar people or see strange links, you'll save yourself some major headaches.

Malware

Computer viruses are just one kind of malware. Other types include spyware and some kinds of adware. Spyware spies on what a user does with his or her computer. That can include logging keystrokes as a way to discover login codes and passwords. Adware is a software app that displays ads to users while they use a larger application like a Web browser. Some adware contains code that gives advertisers extensive access to private information.

How Firewalls Works

If you have been using the Internet for any length of time, and especially if you work at a larger company and browse the Web while you are at work, you have probably heard the term firewall used. For example, you often hear people in companies say things like, "I can't use that site because they won't let it through the firewall."

If you have a fast Internet connection into your home (either a DSL connection or a cable modem), you may have found yourself hearing about firewalls for your home network as well. It turns out that a small home network has many of the same security issues that a large corporate network does. You can use a firewall to protect your home network and family from offensive Web sites and potential hackers.



Basically, a firewall is a barrier to keep destructive forces away from your property. In fact, that's why its called a firewall. Its job is similar to a physical firewall that keeps a fire from spreading from one area to the next. As you read through this article, you will learn more about firewalls, how they work and what kinds of threats they can protect you from.

What Firewall Software Does

A firewall is simply a program or hardware device that filters the information coming through the Internet connection into your private network or computer system. If an incoming packet of information is flagged by the filters, it is not allowed through.

If you have read the article How Web Servers Work, then you know a good bit about how data moves on the Internet, and you can easily see how a firewall helps protect computers inside a large company. Let's say that you work at a company with 500 employees. The company will therefore have hundreds of computers that all have network cards connecting them together. In addition, the company will have one or more connections to the Internet through something like T1 or T3 lines. Without a firewall in place, all of those hundreds of computers are directly accessible to anyone on the Internet. A person who knows what he or she is doing can probe those computers, try to make FTP connections to them, try to make telnet connections to them and so on. If one employee makes a mistake and leaves a security hole, hackers can get to the machine and exploit the hole.

With a firewall in place, the landscape is much different. A company will place a firewall at every connection to the Internet (for example, at every T1 line coming into the company). The firewall can implement security rules. For example, one of the security rules inside the company might be:

Out of the 500 computers inside this company, only one of them is permitted to receive public FTP traffic. Allow FTP connections only to that one computer and prevent them on all others.
A company can set up rules like this for FTP servers, Web servers, Telnet servers and so on. In addition, the company can control how employees connect to Web sites, whether files are allowed to leave the company over the network and so on. A firewall gives a company tremendous control over how people use the network.

Firewalls use one or more of three methods to control traffic flowing in and out of the network:

#Packet filtering - Packets (small chunks of data) are analyzed against a set of filters. Packets that make it through the filters are sent to the requesting system and all others are discarded.

#Proxy service - Information from the Internet is retrieved by the firewall and then sent to the requesting system and vice versa.

#Stateful inspection - A newer method that doesn't examine the contents of each packet but instead compares certain key parts of the packet to a database of trusted information. Information traveling from inside the firewall to the outside is monitored for specific defining characteristics, then incoming information is compared to these characteristics. If the comparison yields a reasonable match, the information is allowed through. Otherwise it is discarded.

Firewall Configuration

Firewalls are customizable. This means that you can add or remove filters based on several conditions. Some of these are:

#IP addresses - Each machine on the Internet is assigned a unique address called an IP address. IP addresses are 32-bit numbers, normally expressed as four "octets" in a "dotted decimal number." A typical IP address looks like this: 216.27.61.137. For example, if a certain IP address outside the company is reading too many files from a server, the firewall can block all traffic to or from that IP address.

#Domain names - Because it is hard to remember the string of numbers that make up an IP address, and because IP addresses sometimes need to change, all servers on the Internet also have human-readable names, called domain names. For example, it is easier for most of us to remember www.howstuffworks.com than it is to remember 216.27.61.137. A company might block all access to certain domain names, or allow access only to specific domain names.

#Protocols - The protocol is the pre-defined way that someone who wants to use a service talks with that service. The "someone" could be a person, but more often it is a computer program like a Web browser. Protocols are often text, and simply describe how the client and server will have their conversation. The http in the Web's protocol.

Some common protocols that you can set firewall filters for include:

1.IP (Internet Protocol) - the main delivery system for information over the Internet

2.TCP (Transmission Control Protocol) - used to break apart and rebuild information that travels over the Internet

3.HTTP (Hyper Text Transfer Protocol) - used for Web pages

4.FTP (File Transfer Protocol) - used to download and upload files

5.UDP (User Datagram Protocol) - used for information that requires no response, such as streaming audio and video

6.ICMP (Internet Control Message Protocol) - used by a router to exchange the information with other routers

7.SMTP (Simple Mail Transport Protocol) - used to send text-based information (e-mail)

8.SNMP (Simple Network Management Protocol) - used to collect system information from a remote computer

9.Telnet - used to perform commands on a remote computer
A company might set up only one or two machines to handle a specific protocol and ban that protocol on all other machines.


#Ports - Any server machine makes its services available to the Internet using numbered ports, one for each service that is available on the server (see How Web Servers Work for details). For example, if a server machine is running a Web (HTTP) server and an FTP server, the Web server would typically be available on port 80, and the FTP server would be available on port 21. A company might block port 21 access on all machines but one inside the company.

Specific words and phrases - This can be anything. The firewall will sniff (search through) each packet of information for an exact match of the text listed in the filter. For example, you could instruct the firewall to block any packet with the word "X-rated" in it. The key here is that it has to be an exact match. The "X-rated" filter would not catch "X rated" (no hyphen). But you can include as many words, phrases and variations of them as you need.
Some operating systems come with a firewall built in. Otherwise, a software firewall can be installed on the computer in your home that has an Internet connection. This computer is considered a gateway because it provides the only point of access between your home network and the Internet.

With a hardware firewall, the firewall unit itself is normally the gateway. A good example is the Linksys Cable/DSL router. It has a built-in Ethernet card and hub. Computers in your home network connect to the router, which in turn is connected to either a cable or DSL modem. You configure the router via a Web-based interface that you reach through the browser on your computer. You can then set any filters or additional information.

Hardware firewalls are incredibly secure and not very expensive. Home versions that include a router, firewall and Ethernet hub for broadband connections can be found for well under $100.

Why Firewall Security?

There are many creative ways that unscrupulous people use to access or abuse unprotected computers:

#Remote login - When someone is able to connect to your computer and control it in some form. This can range from being able to view or access your files to actually running programs on your computer.

#Application backdoors - Some programs have special features that allow for remote access. Others contain bugs that provide a backdoor, or hidden access, that provides some level of control of the program.

#SMTP session hijacking - SMTP is the most common method of sending e-mail over the Internet. By gaining access to a list of e-mail addresses, a person can send unsolicited junk e-mail (spam) to thousands of users. This is done quite often by redirecting the e-mail through the SMTP server of an unsuspecting host, making the actual sender of the spam difficult to trace.

#Operating system bugs - Like applications, some operating systems have backdoors. Others provide remote access with insufficient security controls or have bugs that an experienced hacker can take advantage of.

#Denial of service - You have probably heard this phrase used in news reports on the attacks on major Web sites. This type of attack is nearly impossible to counter. What happens is that the hacker sends a request to the server to connect to it. When the server responds with an acknowledgement and tries to establish a session, it cannot find the system that made the request. By inundating a server with these unanswerable session requests, a hacker causes the server to slow to a crawl or eventually crash.

#E-mail bombs - An e-mail bomb is usually a personal attack. Someone sends you the same e-mail hundreds or thousands of times until your e-mail system cannot accept any more messages.

#Macros - To simplify complicated procedures, many applications allow you to create a script of commands that the application can run. This script is known as a macro. Hackers have taken advantage of this to create their own macros that, depending on the application, can destroy your data or crash your computer.

#Viruses - Probably the most well-known threat is computer viruses. A virus is a small program that can copy itself to other computers. This way it can spread quickly from one system to the next. Viruses range from harmless messages to erasing all of your data.

#Spam - Typically harmless but always annoying, spam is the electronic equivalent of junk mail. Spam can be dangerous though. Quite often it contains links to Web sites. Be careful of clicking on these because you may accidentally accept a cookie that provides a backdoor to your computer.

#Redirect bombs - Hackers can use ICMP to change (redirect) the path information takes by sending it to a different router. This is one of the ways that a denial of service attack is set up.

#Source routing - In most cases, the path a packet travels over the Internet (or any other network) is determined by the routers along that path. But the source providing the packet can arbitrarily specify the route that the packet should travel. Hackers sometimes take advantage of this to make information appear to come from a trusted source or even from inside the network! Most firewall products disable source routing by default.
Some of the items in the list above are hard, if not impossible, to filter using a firewall. While some firewalls offer virus protection, it is worth the investment to install anti-virus software on each computer. And, even though it is annoying, some spam is going to get through your firewall as long as you accept e-mail.


The level of security you establish will determine how many of these threats can be stopped by your firewall. The highest level of security would be to simply block everything. Obviously that defeats the purpose of having an Internet connection. But a common rule of thumb is to block everything, then begin to select what types of traffic you will allow. You can also restrict traffic that travels through the firewall so that only certain types of information, such as e-mail, can get through. This is a good rule for businesses that have an experienced network administrator that understands what the needs are and knows exactly what traffic to allow through. For most of us, it is probably better to work with the defaults provided by the firewall developer unless there is a specific reason to change it.

One of the best things about a firewall from a security standpoint is that it stops anyone on the outside from logging onto a computer in your private network. While this is a big deal for businesses, most home networks will probably not be threatened in this manner. Still, putting a firewall in place provides some peace of mind.

Proxy Servers and DMZ

A function that is often combined with a firewall is a proxy server. The proxy server is used to access Web pages by the other computers. When another computer requests a Web page, it is retrieved by the proxy server and then sent to the requesting computer. The net effect of this action is that the remote computer hosting the Web page never comes into direct contact with anything on your home network, other than the proxy server.

Proxy servers can also make your Internet access work more efficiently. If you access a page on a Web site, it is cached (stored) on the proxy server. This means that the next time you go back to that page, it normally doesn't have to load again from the Web site. Instead it loads instantaneously from the proxy server.

There are times that you may want remote users to have access to items on your network. Some examples are:

#Web site

#Online business

#FTP download and upload area

­ In cases like this, you may want to create a DMZ (Demilitarized Zone). Although this sounds pretty serious, it really is just an area that is outside the firewall. Think of DMZ as the front yard of your house. It belongs to you and you may put some things there, but you would put anything valuable inside the house where it can be properly secured.

Setting up a DMZ is very easy. If you have multiple computers, you can choose to simply place one of the computers between the Internet connection and the firewall. Most of the software firewalls available will allow you to designate a directory on the gateway computer as a DMZ.

Firewall

A firewall is an integrated collection of security measures designed to prevent unauthorized electronic access to a networked computer system. It is also a device or set of devices configured to permit, deny, encrypt, decrypt, or proxy all computer traffic between different security domains based upon a set of rules and other criteria.

A system designed to prevent unauthorized access to or from a private network. Firewalls can be implemented in both hardware and software, or a combination of both. Firewalls are frequently used to prevent unauthorized Internet users from accessing private networks connected to the Internet, especially intranets. All messages entering or leaving the intranet pass through the firewall, which examines each message and blocks those that do not meet the specified security criteria.

There are several types of firewall techniques:

#Packet filter: Looks at each packet entering or leaving the network and accepts or rejects it based on user-defined rules. Packet filtering is fairly effective and transparent to users, but it is difficult to configure. In addition, it is susceptible to IP spoofing.

#Application gateway: Applies security mechanisms to specific applications, such as FTP and Telnet servers. This is very effective, but can impose a performance degradation.

#Circuit-level gateway: Applies security mechanisms when a TCP or UDP connection is established. Once the connection has been made, packets can flow between the hosts without further checking.

#Proxy server: Intercepts all messages entering and leaving the network. The proxy server effectively hides the true network addresses.

Functions

A firewall is a dedicated appliance, or software running on another computer, which inspects network traffic passing through it, and denies or permits passage based on a set of rules.

A firewall's basic task is to regulate some of the flow of traffic between computer networks of different trust levels. Typical examples are the Internet which is a zone with no trust and an internal network which is a zone of higher trust. A zone with an intermediate trust level, situated between the Internet and a trusted internal network, is often referred to as a "perimeter network" or Demilitarized zone (DMZ).

A firewall's function within a network is similar to physical firewalls with fire doors in building construction. In the former case, it is used to prevent network intrusion to the private network. In the latter case, it is intended to contain and delay structural fire from spreading to adjacent structures.

Without proper configuration, a firewall can often become worthless. Standard security practices dictate a "default-deny" firewall ruleset, in which the only network connections which are allowed are the ones that have been explicitly allowed. Unfortunately, such a configuration requires detailed understanding of the network applications and endpoints required for the organization's day-to-day operation. Many businesses lack such understanding, and therefore implement a "default-allow" ruleset, in which all traffic is allowed unless it has been specifically blocked. This configuration makes inadvertent network connections and system compromise much more likely.

History

The term "firewall" originally meant a wall to confine a fire or potential fire within a building, c.f. firewall (construction). Later uses refer to similar structures, such as the metal sheet separating the engine compartment of a vehicle or aircraft from the passenger compartment.

Firewall technology emerged in the late 1980s when the Internet was a fairly new technology in terms of its global use and connectivity. The predecessors to firewalls for network security were the routers used in the late 1980s to separate networks from one another.[1] The view of the Internet as a relatively small community of compatible users who valued openness for sharing and collaboration was ended by a number of major internet security breaches, which occurred in the late 1980s.

Clifford Stoll's discovery of German spies tampering with his system[1]
Bill Cheswick's "Evening with Berferd" 1992 in which he set up a simple electronic jail to observe an attacker[1]
In 1988 an employee at the NASA Ames Research Center in California sent a memo by email to his colleagues[citation needed] that read,
“ We are currently under attack from an Internet VIRUS! It has hit Berkeley, UC San Diego, Lawrence Livermore, Stanford, and NASA Ames. ”

The Morris Worm spread itself through multiple vulnerabilities in the machines of the time. Although it was not malicious in intent, the Morris Worm was the first large scale attack on Internet security; the online community was neither expecting an attack nor prepared to deal with one.

First generation - packet filters

The first paper published on firewall technology was in 1988, when engineers from Digital Equipment Corporation (DEC) developed filter systems known as packet filter firewalls. This fairly basic system was the first generation of what would become a highly evolved and technical internet security feature. At AT&T Bell Labs, Bill Cheswick and Steve Bellovin were continuing their research in packet filtering and developed a working model for their own company based upon their original first generation architecture.

Packet filters act by inspecting the "packets" which represent the basic unit of data transfer between computers on the Internet. If a packet matches the packet filter's set of rules, the packet filter will drop (silently discard) the packet, or reject it (discard it, and send "error responses" to the source).

This type of packet filtering pays no attention to whether a packet is part of an existing stream of traffic (it stores no information on connection "state"). Instead, it filters each packet based only on information contained in the packet itself (most commonly using a combination of the packet's source and destination address, its protocol, and, for TCP and UDP traffic, the port number).

TCP and UDP protocols comprise most communication over the Internet, and because TCP and UDP traffic by convention uses well known ports for particular types of traffic, a "stateless" packet filter can distinguish between, and thus control, those types of traffic (such as web browsing, remote printing, email transmission, file transfer), unless the machines on each side of the packet filter are both using the same non-standard ports.


Second generation - "stateful" filters

From 1989-1990 three colleagues from AT&T Bell Laboratories, Dave Presetto, Janardan Sharma, and Kshitij Nigam developed the second generation of firewalls, calling them circuit level firewalls.

Second(2nd) Generation firewalls in addition regard placement of each individual packet within the packet series. This technology is generally referred to as a stateful packet inspection as it maintains records of all connections passing through the firewall and is able to determine whether a packet is either the start of a new connection, a part of an existing connection, or is an invalid packet. Though there is still a set of static rules in such a firewall, the state of a connection can in itself be one of the criteria which trigger specific rules.

This type of firewall can help prevent attacks which exploit existing connections, or certain Denial-of-service attacks.


Third generation - application layer

Publications by Gene Spafford of Purdue University, Bill Cheswick at AT&T Laboratories, and Marcus Ranum described a third generation firewall known as an application layer firewall, also known as a proxy-based firewall. Marcus Ranum's work on the technology spearheaded the creation of the first commercial product. The product was released by DEC who named it the DEC SEAL product. DEC’s first major sale was on June 13, 1991 to a chemical company based on the East Coast of the USA.

TIS, under a broader DARPA contract, developed the Firewall Toolkit (FWTK), and made it freely available under license on October 1, 1993. The purposes for releasing the freely-available, not for commercial use, FWTK were: to demonstrate, via the software, documentation, and methods used, how a company with (at the time) 11 years' experience in formal security methods, and individuals with firewall experience, developed firewall software; to create a common base of very good firewall software for others to build on (so people did not have to continue to "roll their own" from scratch); and to "raise the bar" of firewall software being used.

The key benefit of application layer filtering is that it can "understand" certain applications and protocols (such as File Transfer Protocol, DNS, or web browsing), and it can detect whether an unwanted protocol is being sneaked through on a non-standard port or whether a protocol is being abused in any harmful way.


Subsequent developments

In 1992, Bob Braden and Annette DeSchon at the University of Southern California (USC) were refining the concept of a firewall. The product known as "Visas" was the first system to have a visual integration interface with colours and icons, which could be easily implemented to and accessed on a computer operating system such as Microsoft's Windows or Apple's MacOS. In 1994 an Israeli company called Check Point Software Technologies built this into readily available software known as FireWall-1.

The existing deep packet inspection functionality of modern firewalls can be shared by Intrusion-prevention systems (IPS).

Currently, the Middlebox Communication Working Group of the Internet Engineering Task Force (IETF) is working on standardizing protocols for managing firewalls and other middleboxes.


Types

There are several classifications of firewalls depending on where the communication is taking place, where the communication is intercepted and the state that is being traced.


Network layer and packet filters

Network layer firewalls, also called packet filters, operate at a relatively low level of the TCP/IP protocol stack, not allowing packets to pass through the firewall unless they match the established rule set. The firewall administrator may define the rules; or default rules may apply. The term "packet filter" originated in the context of BSD operating systems.

Network layer firewalls generally fall into two sub-categories, stateful and stateless. Stateful firewalls maintain context about active sessions, and use that "state information" to speed packet processing. Any existing network connection can be described by several properties, including source and destination IP address, UDP or TCP ports, and the current stage of the connection's lifetime (including session initiation, handshaking, data transfer, or completion connection). If a packet does not match an existing connection, it will be evaluated according to the ruleset for new connections. If a packet matches an existing connection based on comparison with the firewall's state table, it will be allowed to pass without further processing.

Stateless firewalls require less memory, and can be faster for simple filters that require less time to filter than to look up a session. They may also be necessary for filtering stateless network protocols that have no concept of a session. However, they cannot make more complex decisions based on what stage communications between hosts have reached.

Modern firewalls can filter traffic based on many packet attributes like source IP address, source port, destination IP address or port, destination service like WWW or FTP. They can filter based on protocols, TTL values, netblock of originator, domain name of the source, and many other attributes.

Commonly used packet filters on various versions of Unix are ipf (various), ipfw (FreeBSD/Mac OS X), pf (OpenBSD, and all other BSDs), iptables/ipchains (Linux).

Application-layer

Application-layer firewalls work on the application level of the TCP/IP stack (i.e., all browser traffic, or all telnet or ftp traffic), and may intercept all packets traveling to or from an application. They block other packets (usually dropping them without acknowledgement to the sender). In principle, application firewalls can prevent all unwanted outside traffic from reaching protected machines.

On inspecting all packets for improper content, firewalls can restrict or prevent outright the spread of networked computer worms and trojans. In practice, however, this becomes so complex and so difficult to attempt (given the variety of applications and the diversity of content each may allow in its packet traffic) that comprehensive firewall design does not generally attempt this approach.

The XML firewall exemplifies a more recent kind of application-layer firewall.

Proxies

A proxy device (running either on dedicated hardware or as software on a general-purpose machine) may act as a firewall by responding to input packets (connection requests, for example) in the manner of an application, whilst blocking other packets.

Proxies make tampering with an internal system from the external network more difficult and misuse of one internal system would not necessarily cause a security breach exploitable from outside the firewall (as long as the application proxy remains intact and properly configured). Conversely, intruders may hijack a publicly-reachable system and use it as a proxy for their own purposes; the proxy then masquerades as that system to other internal machines. While use of internal address spaces enhances security, crackers may still employ methods such as IP spoofing to attempt to pass packets to a target network.


Network address translation

Firewalls often have network address translation (NAT) functionality, and the hosts protected behind a firewall commonly have addresses in the "private address range", as defined in RFC 1918. Firewalls often have such functionality to hide the true address of protected hosts. Originally, the NAT function was developed to address the limited number of IPv4 routable addresses that could be used or assigned to companies or individuals as well as reduce both the amount and therefore cost of obtaining enough public addresses for every computer in an organization. Hiding the addresses of protected devices has become an increasingly important defense against network reconnaissance.

LAPTOPS

Laptop

A laptop computer, also known as a notebook computer, is a small personal computer designed for mobile use. A laptop integrates all of the typical components of a desktop computer, including a display, a keyboard, a pointing device (a touchpad, also known as a trackpad, or a pointing stick) and a battery into a single portable unit. The rechargeable battery is charged from an AC/DC adapter and has enough capacity to power the laptop for several hours.



A laptop is usually shaped like a large notebook with thickness of 0.7–1.5 inches (18–38 mm) and dimensions ranging from 10x8 inches (27x22cm, 13" display) to 15x11 inches (39x28cm, 17" display) and up. Modern laptops weigh 3 to 12 pounds (1.4 to 5.4 kg), and some older laptops were even heavier. Most laptops are designed in the flip form factor to protect the screen and the keyboard when closed.

Originally considered "a small niche market"[1] and perceived as suitable for "specialized field applications" such as "the military, the Internal Revenue Service, accountants and sales representatives"[1][2], battery-powered portables had just 2% worldwide market share in 1986[3]. But today, there are already more laptops than desktops in the enterprise[4] and, according to a forecast by Intel, more laptops than desktops will be sold in the general PC market as soon as 2009.

History

As the personal computer became feasible in the early 1970s, the idea of a portable personal computer followed; in particular, a "personal, portable information manipulator" was envisioned by Alan Kay at Xerox PARC in 1968[6] and described in his 1972 paper as the "Dynabook".



The first commercially available portable computer appeared nine years later, in 1981. The Osborne 1 weighed 23.5 pounds (10.7 kg). It had no battery, a tiny 5" CRT screen and dual 5¼" single-density floppy drives. In the same year the first laptop-sized portable computer, the Epson HX-20, was announced[8]. The Epson had a LCD screen, a rechargeable battery and a calculator-size printer in a 1.6 kg (4 pounds) enclosure.

The first laptop using the clamshell design, utilized today by almost all laptops, appeared in 1982. The $8150 GRiD Compass 1100 was purchased by NASA and the military among others. The Gavilan SC, released in 1983, was the first notebook marketed using the term "laptop".

From 1983 onwards:

Several new input methods were introduced: the touchpad (Gavilan SC, 1983), the pointing stick (IBM ThinkPad 700, 1992) and handwriting recognition (Linus Write-Top[9], 1987).
CPUs became designed specifically for laptops (Intel i386SL, 1990), targeting low power consumption, and were augmented with dynamic power management features (Intel SpeedStep and AMD PowerNow!).
Displays reached VGA resolution by 1988 (Compaq SLT 286) and 256-color screens by 1993 (PowerBook 165c), progressing quickly to millions of colors and high resolutions.
High-capacity hard drives and optical storage (CD-ROM followed by DVD) became available in laptops soon after their introduction to the desktops.
Early laptops often had proprietary and incompatible architectures, operating systems and bundled applications.

Subnotebook

A subnotebook, also called an ultraportable by some vendors, is a laptop designed and marketed with an emphasis on portability (small size, low weight and long battery life) that retains the performance of a standard notebook. Subnotebooks are usually smaller and lighter than standard laptops, weighing between 0.8 and 2 kg (2 to 5 pounds)[10]; the battery life can exceed 10 hours[15] when a large battery or an additional battery pack is installed.



To achieve the size and weight reductions, ultraportables use high resolution 13" and smaller screens (down to 6.4"), have relatively few ports, employ expensive components designed for minimal size and best power efficiency, and utilize advanced materials and construction methods. Some subnotebooks achieve a further portability improvement by omitting an optical/removable media drive; in this case they may be paired with a docking station that contains the drive and optionally more ports or an additional battery.

The term "subnotebook" is usually reserved to laptops that run general-purpose desktop operating systems such as Windows, Linux or Mac OS X, rather than specialized software such as Windows CE, Palm OS or Internet Tablet OS.

Netbook

A netbook is a small laptop designed for portability and low price, with a performance inferior to that of a standard notebook yet adequate for surfing on the Internet and basic word processing. Netbooks use 10" and smaller screens[citation needed], weigh 0.6 to 1.2 kg (1.5 to 3 pounds), and are generally powered by a CPU from one of the low-cost families with a high performance-to-power ratio such as Intel Atom, Celeron ULV, or VIA C7 processors.[16]

Netbooks use general-purpose operating systems such as Linux or Windows XP. Some models use small-capacity (4 to 40 Gb) SSD drives instead of the usual HDDs to save weight and battery power.

Components

The basic components of laptops are similar in function to their desktop counterparts, but are miniaturized, adapted to mobile use, and designed for low power consumption. Because of the additional requirements, laptop components have worse performance than desktop parts of comparable price. Furthermore, the design bounds on power, size, and cooling of laptops limit the maximum performance of laptop parts compared to that of desktop components. [19]




The following list summarizes the differences and distinguishing features of laptop components in comparison to desktop personal computer parts:

Motherboard - laptop motherboards are highly make- and model-specific, and do not conform to a desktop form factor. Unlike a desktop board that usually has several slots for expansion cards (3 to 7 are common), a board for a small, highly integrated laptop may have no expansion slots at all, with all the functionality implemented on the motherboard itself; the only expansion possible in this case is via an external port such as USB. Other boards may have one or more standard or proprietary expansion slots. Several other functions (storage controllers, networking, sound card and external ports) are implemented on the motherboard.[20]
Central processing unit (CPU) - Laptop CPUs have advanced power-saving features and produce less heat than desktop processors, but are not as powerful.[21] There is a wide range of CPUs designed for laptops available from Intel (Pentium M, Celeron M, Intel Core and Core 2 Duo), AMD (Athlon, Turion 64, and Sempron), VIA Technologies, Transmeta and others. On the non-x86 architectures, Motorola and IBM produced the chips for the former PowerPC-based Apple laptops (iBook and PowerBook). Some laptops have removable CPUs, although support by the motherboard may be restricted to the specific models.[22] In other laptops the CPU is soldered on the motherboard and is non-replaceable.

A SODIMM memory module.Memory (RAM) - SO-DIMM memory modules that are usually found in laptops are about half the size of desktop DIMMs.[20] They may be accessible from the bottom of the laptop for ease of upgrading, or placed in locations not intended for user replacement such as between the keyboard and the motherboard.
Expansion cards - A PC Card (formerly PCMCIA) or ExpressCard bay for expansion cards is often present on laptops to allow adding and removing functionality, even when the laptop is powered on. Some subsystems (such as Wi-Fi or a cellular modem) can be implemented as replaceable internal expansion cards, usually accessible under an access cover on the bottom of the laptop. Two popular standards for such cards are MiniPCI and its successor, the PCI Express Mini. [23]
Power supply - laptops are powered by an internal rechargeable battery that is charged using an external power supply. The power supply can charge the battery and power the laptop simultaneously; when the battery is fully charged, the laptop continues to run on AC power. The charger adds about 400 grams (1 lb) to the overall "transport weight" of the notebook.
Battery - Current laptops utilize lithium ion batteries, with more recent models using the new lithium polymer technology. These two technologies have largely replaced the older nickel metal-hydride batteries. Typical battery life for standard laptops is two to five hours of light-duty use, but may drop to as little as one hour when doing power-intensive tasks. Batteries' performance gradually decreases with time, leading to an eventual replacement in one to five years, depending on the charging and discharging pattern. This large-capacity main battery should not be confused with the much smaller battery nearly all computers use to run the real-time clock and to store the BIOS configuration in the CMOS memory when the computer is off.
Video display controller - on standard laptops video controller is usually integrated into the chipset. This tends to limit the use of laptops for gaming and entertainment, two fields which have constantly escalating hardware demands[24]. Higher-end laptops and desktop replacements in particular often come with dedicated graphics processors on the motherboard or as an internal expansion card. These mobile graphics processors are comparable in performance to mainstream desktop graphic accelerator boards.[25]
Display - Most modern laptops feature 12 inch (30 cm) or larger color active matrix displays with resolutions of 1024×768 pixels and above. Many current models use screens with higher resolution than typical for desktop PCs (for example, the 1440×900 resolution of a 15" Macbook Pro[26] can be found on 19" widescreen desktop monitors).

A size comparison of 3.5" and 2.5" hard disk drivesRemovable media drives - a DVD/CD reader/writer drive is standard. CD drives are becoming rare, while Blu-Ray is not yet common on notebooks[27]. Many ultraportables and netbooks either move the removable media drive into the docking station or exclude it altogether.
Internal storage - Hard disks are physically smaller—2.5 inch (60 mm) or 1.8 inch (46 mm) —compared to desktop 3.5 inch (90 mm) drives. Some new laptops (usually ultraportables) employ more expensive, but faster, lighter and power-efficient Flash memory-based SSDs instead. Currently, 250 to 320 Gb sizes are common for laptop hard disks (64 to 128 Gb for SSDs).
Input - A pointing stick, touchpad or both are used to control the position of the cursor on the screen, and an integrated keyboard is used for typing. External keyboard and mouse may be connected using USB or PS/2 (if present).
Ports - several USB ports, an external monitor port (VGA or DVI), audio in/out, and an Ethernet network port are found on most laptops. Less common are legacy ports such as a PS/2 keyboard/mouse port, serial port or a parallel port. S-video or composite video ports are more common on consumer-oriented notebooks.

Advantages

Portability is usually the first feature mentioned in any comparison of laptops versus desktop PCs[30]. Portability means that a laptop can be used in many places - not only at home and at the office, but also during commuting and flights, in coffee shops, in lecture halls and libraries, at clients' location or at a meeting room, etc. The portability feature offers several distinct advantages:

Getting more done - using a laptop in places where a desktop PC can't be used, and at times that would otherwise be wasted. For example, an office worker managing his e-mails during an hour-long commute by train, or a student doing her homework at the university coffee shop during a break between lectures.[31]
Immediacy - Carrying a laptop means having instant access to various information, personal and work files. Immediacy allows better collaboration between coworkers or students, as a laptop can be flipped open to present a problem or a solution anytime, anywhere.
Up-to-date information - If a person has more than one desktop PC, a problem of synchronization arises: changes made on one computer are not automatically propagated to the others. There are ways to resolve this problem, including physical transfer of updated files (using a USB stick or CDs) or using synchronization software over the Internet. However, using a single laptop at both locations avoids the problem entirely, as the files exist in a single location and are always up-to-date.
Connectivity - A proliferation of Wi-Fi wireless networks and cellular broadband data services (HSDPA, EVDO and others) combined with a near-ubiquitous support by laptops [32] means that a laptop can have easy Internet and local network connectivity while remaining mobile. Wi-Fi networks and laptop programs are especially widespread at university campuses.[33]
Other advantages of laptops include:

Size - laptops are smaller than standard PCs. This is beneficial when space is at a premium, for example in small apartments and student dorms. When not in use, a laptop can be closed and put away.
Low power consumption - laptops are several times more power-efficient than desktops. A typical laptop uses 20-90 W, compared to 100-800 W for desktops. This could be particularly beneficial for businesses (which run hundreds of personal computers, multiplying the potential savings) and homes where there is a computer running 24/7 (such as a home media server, print server, etc.)
Quiet - laptops are often quieter than desktops, due both to better components (quieter, slower 2.5-inch hard drives) and to less heat production leading to use of fewer and slower cooling fans.
Battery - a charged laptop can run several hours in case of a power outage and is not affected by short power interruptions and brownouts. A desktop PC needs a UPS to handle short interruptions, brownouts and spikes; achieving on-battery time of more than 20-30 minutes for a desktop PC requires a large and expensive UPS.

Disadvantages

Performance
While the performance of mainstream desktops and laptops is comparable, laptops are significantly more expensive than desktop PCs at the same performance level.[35] The upper limits of performance of laptops are a little bit lower, and "bleeding-edge" features usually appear first in desktops and only then, as the underlying technology matures, are adapted to laptops.

However, for Internet browsing and typical office applications, where the computer spends the majority of its time waiting for the next user input, even netbook-class laptops are generally fast enough.[36] Standard laptops are sufficiently powerful for high-resolution movie playback, 3D gaming and video editing and encoding. Number-crunching software (databases, math, engineering, financial, etc.) is the area where the laptops are at the biggest disadvantage.


Upgradeability

Upgradeability of laptops is very limited compared to desktops, which are thoroughly standardized. In general, hard drives and memory can be upgraded easily. Optical drives and internal expansion cards may be upgraded if they follow an industry standard, but all other internal components, including the CPU and graphics, are not intended to be upgradeable.

The reasons for limited upgradeability are both technical and economic. There is no industry-wide standard form factor for laptops; each major laptop manufacturer pursues its own proprietary design and construction, with the result that laptops are difficult to upgrade and have high repair costs. With few exceptions, laptop components can rarely be swapped between laptops of competing manufacturers, or even between laptops from the different product-lines of the same manufacturer.

Some upgrades can be performed by adding external devices, either USB or in expansion card format such a PC Card: sound cards, network adapters, hard and optical drives, and numerous other peripherals are available. But those upgrades usually impair the laptop's portability, because they add cables and boxes to the setup and often have to be disconnected and reconnected when the laptop is moved.


Ergonomics and health

Laptop coaster preventing heating of lap and improving laptop airflow.Because of their small and flat keyboard and trackpad pointing devices, prolonged use of laptops can cause RSI.[37] Usage of ergonomic keyboards and pointing devices is recommended to prevent injury when working for long periods of time; they can be connected to a laptop easily by USB or via a docking station. Some health standards require ergonomic keyboards at workplaces.

The integrated screen often causes users to hunch over for a better view, which can cause neck or spinal injuries. A larger and higher-quality external screen can be connected to almost any laptop to alleviate that and to provide additional "screen estate" for more productive work.

A study by State University of New York researchers found that heat generated from laptops can raise the temperature of the scrotum, potentially putting sperm count at risk. The small study, which included little more than two dozen men aged 13 to 35, found that the sitting position required to balance a laptop can raise scrotum temperature by as much as 2.1 °C (3.8 °F). Heat from the laptop itself can raise the temperature by another 0.7 °C (1.4 °F), bringing the potential total increase to 2.8 °C (5.2 °F). However, further research is needed to determine whether this directly affects sterility in men.

A common practical solution to this problem is to place the laptop on a table or desk. Another solution is to obtain a cooling unit for the laptop, these units are usually USB powered consist of a hard thin plastic case housing 1, 2 or 3 cooling fans (the whole thing is designed to sit under a laptop) which results in the laptop remaining cool to the touch, and greatly reduces laptop heat generation. There are several companies which make these coolers.

Heat from using a laptop on the lap can also cause skin discoloration on the thighs.


Durability

A clogged heatsink on a 2.5 year old laptop.Due to their portability, laptops are subject to more wear and physical damage than desktops. Components such as screen hinges, latches, power jacks[40] and power cords deteriorate gradually due to ordinary use. A liquid spill onto the keyboard, a rather minor mishap with a desktop system, can damage the internals of a laptop and result in a costly repair. One study found that a laptop is 3 times more likely to break during the first year of use than a desktop.

Original external components are expensive (a replacement AC adapter, for example, could cost $75); other parts are inexpensive - a power jack can cost a few dollars - but their replacement may require extensive disassembly and reassembly of the laptop by a technician. Other inexpensive but fragile parts often cannot be purchased separate from larger more expensive components.The repair costs of a failed motherboard or LCD panel may exceed the value of a used laptop.

Laptops rely on extremely compact cooling systems involving a fan and heat sink that can fail due to eventual clogging by accumulated airborne dust and debris. Most laptops do not have any sort of removable dust collection filter over the air intake for these cooling systems, resulting in a system that gradually runs hotter and louder as the years pass. Eventually the laptop starts to overheat even at idle load levels. This dust is usually stuck inside where casual cleaning and vacuuming cannot remove it. Instead, a complete disassembly is needed to clean the laptop.

Battery life of laptops is limited; the capacity drops with time, necessitating an eventual replacement after a few years.

Security
Being expensive, common and portable, laptops are prized targets for theft. The cost of the stolen business or personal data and of the resulting problems (identity theft, credit card fraud, breach of privacy laws) can be many times the value of the stolen laptop itself. Therefore, both physical protection of laptops and the safeguarding of data contained on them are of the highest importance.

Most laptops have a Kensington security slot which is used to tether the computer to a desk or other immovable object with a security cable and lock. In addition to this, modern operating systems and third-party software offer disk encryption functionality that renders the data on the laptop's hard drive unreadable without a key or a passphrase.

Other portable computing devices

There are several categories of portable computing devices that can run on batteries but are not usually classified as laptops: portable computers, keyboardless tablet PCs, Internet tablets, PDAs, Ultra Mobile PCs (UMPCs) and smartphones.


The Compaq Portable
A keyboard-less tablet PC
A Palm TX PDA
A Nokia N800 Internet tablet
An OQO Ultra Mobile PC
An Apple iPhone smartphoneA Portable computer is a general-purpose computer that can be easily moved from place to place, but cannot be used while in transit, usually because it requires some "setting-up" and an AC power source. The most famous example is the Osborne 1. Also called a "transportable" or a "luggable" PC.

A Tablet PC that lacks a keyboard (also known as a non-convertible Tablet PC) is shaped like slate or a paper notebook, features a touchscreen with a stylus and handwriting recognition software. Tablets may not be best suited for applications requiring a physical keyboard for typing, but are otherwise capable of carrying out most tasks that an ordinary laptop would be able to perform.

An Internet tablet is an Internet appliance in tablet form. Unlike a Tablet PC, an Internet tablet does not have much computing power and its applications suite is limited - it can not replace a general purpose computer. Internet tablets typically feature an MP3 and video player, a web browser, a chat application and a picture viewer.

A Personal digital assistant (PDA) is a small, usually pocket-sized, computer with limited functionality. It is intended to supplement and to synchronize with a desktop computer, giving access to contacts, address book, notes, e-mail and other features.

An Ultra Mobile PC is a full-featured, PDA-sized computer running a general-purpose operating system.

A Smart phone is a PDA with an integrated cellphone functionality. Current smartphones have a wide range of features and installable applications.

Boundaries that separate these categories are blurry at times. For example, the OQO UMPC is also a PDA-sized tablet PC; the Apple eMate had the clamshell form factor of a laptop, but ran PDA software. The HP Omnibook line of laptops included some devices small enough to be called Ultra Mobile PCs. The hardware of the Nokia 770 internet tablet is essentially the same as that of a PDA such as the Zaurus 6000; the only reason it's not called a PDA is that it doesn't have PIM software. On the other hand, both the 770 and the Zaurus can run some desktop Linux software, usually with modifications.

Major brands and manufacturers

There is a multitude of laptop brands and manufacturers; several major brands, offering notebooks in various classes, are listed in the box to the right.

The major brands usually offer good service and support, including well-executed documentation and driver downloads that will remain available for many years after a particular laptop model is no longer produced. Capitalizing on service, support and brand image, laptops from major brands are more expensive than laptops by smaller brands and ODMs.

Some brands are specializing in a particular class of laptops, such as gaming laptops (Alienware), netbooks (EeePC) and laptops for children (OLPC).

Many brands, including the major ones, do not design and do not manufacture their laptops. Instead, a small number of Original Design Manufacturers (ODMs) design new models of laptops, and the brands choose the models to be included in their lineup. In 2006, 7 major ODMs manufactured 7 of every 10 laptops in the world, with the largest one (Quanta Computer) having 30% world market share.[43] Therefore, there often are identical models available both from a major label and from a low-profile ODM in-house brand.

Sales

For year 2008 it is estimated that 145.9 million notebooks were sold, and in 2009 the number will grow to 177.7 million.[45] The third quarter of 2008 was the first time when notebook PC shipments exceeded desktops, with 38.6 million units versus 38.5 million units.

INTERNET PROTOCOLS (IP)

Internet Protocols

Background

The Internet protocols are the world's most popular open-system (nonproprietary) protocol suite because they can be used to communicate across any set of interconnected networks and are equally well suited for LAN and WAN communications. The Internet protocols consist of a suite of communication protocols, of which the two best known are the Transmission Control Protocol (TCP) and the Internet Protocol (IP). The Internet protocol suite not only includes lower-layer protocols (such as TCP and IP), but it also specifies common applications such as electronic mail, terminal emulation, and file transfer. This chapter provides a broad introduction to specifications that comprise the Internet protocols. Discussions include IP addressing and key upper-layer protocols used in the Internet. Specific routing protocols are addressed individually later in this document.

Internet protocols were first developed in the mid-1970s, when the Defense Advanced Research Projects Agency (DARPA) became interested in establishing a packet-switched network that would facilitate communication between dissimilar computer systems at research institutions. With the goal of heterogeneous connectivity in mind, DARPA funded research by Stanford University and Bolt, Beranek, and Newman (BBN). The result of this development effort was the Internet protocol suite, completed in the late 1970s.

TCP/IP later was included with Berkeley Software Distribution (BSD) UNIX and has since become the foundation on which the Internet and the World Wide Web (WWW) are based.

Documentation of the Internet protocols (including new or revised protocols) and policies are specified in technical reports called Request For Comments (RFCs), which are published and then reviewed and analyzed by the Internet community. Protocol refinements are published in the new RFCs. To illustrate the scope of the Internet protocols, maps many of the protocols of the Internet protocol suite and their corresponding OSI layers. This chapter addresses the basic elements and operations of these and other key Internet protocols.

Internet Protocol (IP)

The Internet Protocol (IP) is a network-layer (Layer 3) protocol that contains addressing information and some control information that enables packets to be routed. IP is documented in RFC 791 and is the primary network-layer protocol in the Internet protocol suite. Along with the Transmission Control Protocol (TCP), IP represents the heart of the Internet protocols. IP has two primary responsibilities: providing connectionless, best-effort delivery of datagrams through an internetwork; and providing fragmentation and reassembly of datagrams to support data links with different maximum-transmission unit (MTU) sizes.

The following discussion describes the IP packet fields illustrated in :

•Version—Indicates the version of IP currently used.

•IP Header Length (IHL)—Indicates the datagram header length in 32-bit words.

•Type-of-Service—Specifies how an upper-layer protocol would like a current datagram to be handled, and assigns datagrams various levels of importance.

•Total Length—Specifies the length, in bytes, of the entire IP packet, including the data and header.

•Identification—Contains an integer that identifies the current datagram. This field is used to help piece together datagram fragments.

•Flags—Consists of a 3-bit field of which the two low-order (least-significant) bits control fragmentation. The low-order bit specifies whether the packet can be fragmented. The middle bit specifies whether the packet is the last fragment in a series of fragmented packets. The third or high-order bit is not used.

•Fragment Offset—Indicates the position of the fragment's data relative to the beginning of the data in the original datagram, which allows the destination IP process to properly reconstruct the original datagram.

•Time-to-Live—Maintains a counter that gradually decrements down to zero, at which point the datagram is discarded. This keeps packets from looping endlessly.

•Protocol—Indicates which upper-layer protocol receives incoming packets after IP processing is complete.

•Header Checksum—Helps ensure IP header integrity.

•Source Address—Specifies the sending node.

•Destination Address—Specifies the receiving node.

•Options—Allows IP to support various options, such as security.

•Data—Contains upper-layer information.

IP Addressing

As with any other network-layer protocol, the IP addressing scheme is integral to the process of routing IP datagrams through an internetwork. Each IP address has specific components and follows a basic format. These IP addresses can be subdivided and used to create addresses for subnetworks.

Each host on a TCP/IP network is assigned a unique 32-bit logical address that is divided into two main parts: the network number and the host number. The network number identifies a network and must be assigned by the Internet Network Information Center (InterNIC) if the network is to be part of the Internet. An Internet Service Provider (ISP) can obtain blocks of network addresses from the InterNIC and can itself assign address space as necessary. The host number identifies a host on a network and is assigned by the local network administrator.

IP Address Format

The 32-bit IP address is grouped eight bits at a time, separated by dots, and represented in decimal format (known as dotted decimal notation). Each bit in the octet has a binary weight (128, 64, 32, 16, 8, 4, 2, 1). The minimum value for an octet is 0, and the maximum value for an octet is 255. illustrates the basic format of an IP address.

IP Address Classes

IP addressing supports five different address classes: A, B,C, D, and E. Only classes A, B, and C are available for commercial use. The left-most (high-order) bits indicate the network class. provides reference information about the five IP address classes.

Table 30-1 Reference Information About the Five IP Address Classes

IP Address Class Format Purpose High-Order Bit(s) Address Range No. Bits Network/Host Max. Hosts
A
N.H.H.H1
Few large organizations
0
1.0.0.0 to 126.0.0.0
7/24
167772142 (224 - 2)

B
N.N.H.H
Medium-size organizations
1, 0
128.1.0.0 to 191.254.0.0
14/16
65534 (216 - 2)

C
N.N.N.H
Relatively small organizations
1, 1, 0
192.0.1.0 to 223.255.254.0
21/8
254 (28 - 2)

D
N/A
Multicast groups (RFC 1112)
1, 1, 1, 0
224.0.0.0 to 239.255.255.255
N/A (not for commercial use)
N/A

E
N/A
Experimental
1, 1, 1, 1
240.0.0.0 to 254.255.255.255
N/A
N/A

IP Subnet Addressing
IP networks can be divided into smaller networks called subnetworks (or subnets). Subnetting provides the network administrator with several benefits, including extra flexibility, more efficient use of network addresses, and the capability to contain broadcast traffic (a broadcast will not cross a router).

Subnets are under local administration. As such, the outside world sees an organization as a single network and has no detailed knowledge of the organization's internal structure.

A given network address can be broken up into many subnetworks. For example, 172.16.1.0, 172.16.2.0, 172.16.3.0, and 172.16.4.0 are all subnets within network 171.16.0.0. (All 0s in the host portion of an address specifies the entire network.)

IP Subnet Mask

A subnet address is created by "borrowing" bits from the host field and designating them as the subnet field. The number of borrowed bits varies and is specified by the subnet mask. shows how bits are borrowed from the host address field to create the subnet address field.

Subnet masks use the same format and representation technique as IP addresses. The subnet mask, however, has binary 1s in all bits specifying the network and subnetwork fields, and binary 0s in all bits specifying the host field. illustrates a sample subnet mask.


Subnet mask bits should come from the high-order (left-most) bits of the host field, as illustrates. Details of Class B and C subnet mask types follow. Class A addresses are not discussed in this chapter because they generally are subnetted on an 8-bit boundary.

Various types of subnet masks exist for Class B and C subnets.

The default subnet mask for a Class B address that has no subnetting is 255.255.0.0, while the subnet mask for a Class B address 171.16.0.0 that specifies eight bits of subnetting is 255.255.255.0. The reason for this is that eight bits of subnetting or 28 - 2 (1 for the network address and 1 for the broadcast address) = 254 subnets possible, with 28 - 2 = 254 hosts per subnet.

The subnet mask for a Class C address 192.168.2.0 that specifies five bits of subnetting is 255.255.255.248.With five bits available for subnetting, 25 - 2 = 30 subnets possible, with
23 - 2 = 6 hosts per subnet.

The reference charts shown in table 30-2 and table 30-3 can be used when planning Class B and C networks to determine the required number of subnets and hosts, and the appropriate subnet mask.

Table 30-2 Class B Subnetting Reference Chart


Number of Bits Subnet Mask Number of Subnets Number of Hosts
2
255.255.192.0
2
16382

3
255.255.224.0
6
8190

4
255.255.240.0
14
4094

5
255.255.248.0
30
2046

6
255.255.252.0
62
1022

7
255.255.254.0
126
510

8
255.255.255.0
254
254

9
255.255.255.128
510
126

10
255.255.255.192
1022
62

11
255.255.255.224
2046
30

12
255.255.255.240
4094
14

13
255.255.255.248
8190
6

14
255.255.255.252
16382
2





Table 30-3 Class C Subnetting Reference Chart

-----------------------------------------------------------------------------------
Number of Bits Subnet Mask Number of Subnets Number of Hosts
----------------------------------------------------------------------------------
2 255.255.255.192 2 62
3 255.255.255.224 6 30
4 255.255.255.240 14 14
5 255.255.255.248 30 06
6 255.255.255.252 62 02
-----------------------------------------------------------------------------------


How Subnet Masks are Used to Determine the Network Number
The router performs a set process to determine the network (or more specifically, the subnetwork) address. First, the router extracts the IP destination address from the incoming packet and retrieves the internal subnet mask. It then performs a logical AND operation to obtain the network number. This causes the host portion of the IP destination address to be removed, while the destination network number remains. The router then looks up the destination network number and matches it with an outgoing interface. Finally, it forwards the frame to the destination IP address. Specifics regarding the logical AND operation are discussed in the following section.

Logical AND Operation

Three basic rules govern logically "ANDing" two binary numbers. First, 1 "ANDed" with 1 yields 1. Second, 1 "ANDed" with 0 yields 0. Finally, 0 "ANDed" with 0 yields 0. The truth table provided in table 30-4 illustrates the rules for logical AND operations.

Table 30-4 Rules for Logical AND Operations


Input Input Output
1 1 1
1 0 0
0 1 0
0 0 0


Two simple guidelines exist for remembering logical AND operations: Logically "ANDing" a 1 with a 1 yields the original value, and logically "ANDing" a 0 with any number yields 0.

illustrates that when a logical AND of the destination IP address and the subnet mask is performed, the subnetwork number remains, which the router uses to forward the packet.

Figure 30-9 Applying a logical AND the destination IP address and the subnet mask produces the subnetwork number.







Address Resolution Protocol (ARP) Overview

For two machines on a given network to communicate, they must know the other machine's physical (or MAC) addresses. By broadcasting Address Resolution Protocols (ARPs), a host can dynamically discover the MAC-layer address corresponding to a particular IP network-layer address.

After receiving a MAC-layer address, IP devices create an ARP cache to store the recently acquired IP-to-MAC address mapping, thus avoiding having to broadcast ARPS when they want to recontact a device. If the device does not respond within a specified time frame, the cache entry is flushed.

In addition to the Reverse Address Resolution Protocol (RARP) is used to map MAC-layer addresses to IP addresses. RARP, which is the logical inverse of ARP, might be used by diskless workstations that do not know their IP addresses when they boot. RARP relies on the presence of a RARP server with table entries of MAC-layer-to-IP address mappings.

Internet Routing .

Internet routing devices traditionally have been called gateways. In today's terminology, however, the term gateway refers specifically to a device that performs application-layer protocol translation between devices. Interior gateways refer to devices that perform these protocol functions between machines or networks under the same administrative control or authority, such as a corporation's internal network. These are known as autonomous systems. Exterior gateways perform protocol functions between independent networks.

Routers within the Internet are organized hierarchically. Routers used for information exchange within autonomous systems are called interior routers, which use a variety of Interior Gateway Protocols (IGPs) to accomplish this purpose. The Routing Information Protocol (RIP) is an example of an IGP.

Routers that move information between autonomous systems are called exterior routers. These routers use an exterior gateway protocol to exchange information between autonomous systems. The Border Gateway Protocol (BGP) is an example of an exterior gateway protocol.

IP Routing

IP routing protocols are dynamic. Dynamic routing calls for routes to be calculated automatically at regular intervals by software in routing devices. This contrasts with static routing, where routers are established by the network administrator and do not change until the network administrator changes them.

An IP routing table, which consists of destination address/next hop pairs, is used to enable dynamic routing. An entry in this table, for example, would be interpreted as follows: to get to network 172.31.0.0, send the packet out Ethernet interface 0 (E0).

IP routing specifies that IP datagrams travel through internetworks one hop at a time. The entire route is not known at the onset of the journey, however. Instead, at each stop, the next destination is calculated by matching the destination address within the datagram with an entry in the current node's routing table.

Each node's involvement in the routing process is limited to forwarding packets based on internal information. The nodes do not monitor whether the packets get to their final destination, nor does IP provide for error reporting back to the source when routing anomalies occur. This task is left to another Internet protocol, the Internet Control-Message Protocol (ICMP), which is discussed in the following section.

Internet Control Message Protocol (ICMP)
The Internet Control Message Protocol (ICMP) is a network-layer Internet protocol that provides message packets to report errors and other information regarding IP packet processing back to the source. ICMP is documented in RFC 792.

ICMP Messages

ICMPs generate several kinds of useful messages, including Destination Unreachable, Echo Request and Reply, Redirect, Time Exceeded, and Router Advertisement and Router Solicitation. If an ICMP message cannot be delivered, no second one is generated. This is to avoid an endless flood of ICMP messages.

When an ICMP destination-unreachable message is sent by a router, it means that the router is unable to send the package to its final destination. The router then discards the original packet. Two reasons exist for why a destination might be unreachable. Most commonly, the source host has specified a nonexistent address. Less frequently, the router does not have a route to the destination.

Destination-unreachable messages include four basic types: network unreachable, host unreachable, protocol unreachable, and port unreachable. Network-unreachable messages usually mean that a failure has occurred in the routing or addressing of a packet. Host-unreachable messages usually indicates delivery failure, such as a wrong subnet mask. Protocol-unreachable messages generally mean that the destination does not support the upper-layer protocol specified in the packet. Port-unreachable messages imply that the TCP socket or port is not available.

An ICMP echo-request message, which is generated by the ping command, is sent by any host to test node reachability across an internetwork. The ICMP echo-reply message indicates that the node can be successfully reached.

An ICMP Redirect message is sent by the router to the source host to stimulate more efficient routing. The router still forwards the original packet to the destination. ICMP redirects allow host routing tables to remain small because it is necessary to know the address of only one router, even if that router does not provide the best path. Even after receiving an ICMP Redirect message, some devices might continue using the less-efficient route.

An ICMP Time-exceeded message is sent by the router if an IP packet's Time-to-Live field (expressed in hops or seconds) reaches zero. The Time-to-Live field prevents packets from continuously circulating the internetwork if the internetwork contains a routing loop. The router then discards the original packet.

ICMP Router-Discovery Protocol (IDRP)

IDRP uses Router-Advertisement and Router-Solicitation messages to discover the addresses of routers on directly attached subnets. Each router periodically multicasts Router-Advertisement messages from each of its interfaces. Hosts then discover addresses of routers on directly attached subnets by listening for these messages. Hosts can use Router-Solicitation messages to request immediate advertisements rather than waiting for unsolicited messages.

IRDP offers several advantages over other methods of discovering addresses of neighboring routers. Primarily, it does not require hosts to recognize routing protocols, nor does it require manual configuration by an administrator.

Router-Advertisement messages enable hosts to discover the existence of neighboring routers, but not which router is best to reach a particular destination. If a host uses a poor first-hop router to reach a particular destination, it receives a Redirect message identifying a better choice.

Transmission Control Protocol (TCP)

The TCP provides reliable transmission of data in an IP environment. TCP corresponds to the transport layer (Layer 4) of the OSI reference model. Among the services TCP provides are stream data transfer, reliability, efficient flow control, full-duplex operation, and multiplexing.

With stream data transfer, TCP delivers an unstructured stream of bytes identified by sequence numbers. This service benefits applications because they do not have to chop data into blocks before handing it off to TCP. Instead, TCP groups bytes into segments and passes them to IP for delivery.

TCP offers reliability by providing connection-oriented, end-to-end reliable packet delivery through an internetwork. It does this by sequencing bytes with a forwarding acknowledgment number that indicates to the destination the next byte the source expects to receive. Bytes not acknowledged within a specified time period are retransmitted. The reliability mechanism of TCP allows devices to deal with lost, delayed, duplicate, or misread packets. A time-out mechanism allows devices to detect lost packets and request retransmission.

TCP offers efficient flow control, which means that, when sending acknowledgments back to the source, the receiving TCP process indicates the highest sequence number it can receive without overflowing its internal buffers.

Full-duplex operation means that TCP processes can both send and receive at the same time.

Finally, TCP's multiplexing means that numerous simultaneous upper-layer conversations can be multiplexed over a single connection.

TCP Connection Establishment
To use reliable transport services, TCP hosts must establish a connection-oriented session with one another. Connection establishment is performed by using a "three-way handshake" mechanism.

A three-way handshake synchronizes both ends of a connection by allowing both sides to agree upon initial sequence numbers. This mechanism also guarantees that both sides are ready to transmit data and know that the other side is ready to transmit as well. This is necessary so that packets are not transmitted or retransmitted during session establishment or after session termination.

Each host randomly chooses a sequence number used to track bytes within the stream it is sending and receiving. Then, the three-way handshake proceeds in the following manner:

The first host (Host A) initiates a connection by sending a packet with the initial sequence number (X) and SYN bit set to indicate a connection request. The second host (Host B) receives the SYN, records the sequence number X, and replies by acknowledging the SYN (with an ACK = X + 1). Host B includes its own initial sequence number (SEQ = Y). An ACK = 20 means the host has received bytes 0 through 19 and expects byte 20 next. This technique is called forward acknowledgment. Host A then acknowledges all bytes Host B sent with a forward acknowledgment indicating the next byte Host A expects to receive (ACK = Y + 1). Data transfer then can begin.

Positive Acknowledgment and Retransmission (PAR)
A simple transport protocol might implement a reliability-and-flow-control technique where the source sends one packet, starts a timer, and waits for an acknowledgment before sending a new packet. If the acknowledgment is not received before the timer expires, the source retransmits the packet. Such a technique is called positive acknowledgment and retransmission (PAR).

By assigning each packet a sequence number, PAR enables hosts to track lost or duplicate packets caused by network delays that result in premature retransmission. The sequence numbers are sent back in the acknowledgments so that the acknowledgments can be tracked.

PAR is an inefficient use of bandwidth, however, because a host must wait for an acknowledgment before sending a new packet, and only one packet can be sent at a time.

TCP Sliding Window
A TCP sliding window provides more efficient use of network bandwidth than PAR because it enables hosts to send multiple bytes or packets before waiting for an acknowledgment.

In TCP, the receiver specifies the current window size in every packet. Because TCP provides a byte-stream connection, window sizes are expressed in bytes. This means that a window is the number of data bytes that the sender is allowed to send before waiting for an acknowledgment. Initial window sizes are indicated at connection setup, but might vary throughout the data transfer to provide flow control. A window size of zero, for instance, means "Send no data."

In a TCP sliding-window operation, for example, the sender might have a sequence of bytes to send (numbered 1 to 10) to a receiver who has a window size of five. The sender then would place a window around the first five bytes and transmit them together. It would then wait for an acknowledgment.

The receiver would respond with an ACK = 6, indicating that it has received bytes 1 to 5 and is expecting byte 6 next. In the same packet, the receiver would indicate that its window size is 5. The sender then would move the sliding window five bytes to the right and transmit bytes 6 to 10. The receiver would respond with an ACK = 11, indicating that it is expecting sequenced byte 11 next. In this packet, the receiver might indicate that its window size is 0 (because, for example, its internal buffers are full). At this point, the sender cannot send any more bytes until the receiver sends another packet with a window size greater than 0.

TCP Packet Format
illustrates the fields and overall format of a TCP packet.

Figure 30-10 Twelve fields comprise a TCP packet.




TCP Packet Field Descriptions

The following descriptions summarize the TCP packet fields illustrated in :

•Source Port and Destination Port—Identifies points at which upper-layer source and destination processes receive TCP services.

•Sequence Number—Usually specifies the number assigned to the first byte of data in the current message. In the connection-establishment phase, this field also can be used to identify an initial sequence number to be used in an upcoming transmission.

•Acknowledgment Number—Contains the sequence number of the next byte of data the sender of the packet expects to receive.

•Data Offset—Indicates the number of 32-bit words in the TCP header.

•Reserved—Remains reserved for future use.

•Flags—Carries a variety of control information, including the SYN and ACK bits used for connection establishment, and the FIN bit used for connection termination.

•Window—Specifies the size of the sender's receive window (that is, the buffer space available for incoming data).

•Checksum—Indicates whether the header was damaged in transit.

•Urgent Pointer—Points to the first urgent data byte in the packet.

•Options—Specifies various TCP options.

•Data—Contains upper-layer information.

User Datagram Protocol (UDP)
The User Datagram Protocol (UDP) is a connectionless transport-layer protocol (Layer 4) that belongs to the Internet protocol family. UDP is basically an interface between IP and upper-layer processes. UDP protocol ports distinguish multiple applications running on a single device from one another.

Unlike the TCP, UDP adds no reliability, flow-control, or error-recovery functions to IP. Because of UDP's simplicity, UDP headers contain fewer bytes and consume less network overhead than TCP.

UDP is useful in situations where the reliability mechanisms of TCP are not necessary, such as in cases where a higher-layer protocol might provide error and flow control.

UDP is the transport protocol for several well-known application-layer protocols, including Network File System (NFS), Simple Network Management Protocol (SNMP), Domain Name System (DNS), and Trivial File Transfer Protocol (TFTP).

The UDP packet format contains four fields, as shown in . These include source and destination ports, length, and checksum fields.

Figure 30-11 A UDP packet consists of four fields.





Source and destination ports contain the 16-bit UDP protocol port numbers used to demultiplex datagrams for receiving application-layer processes. A length field specifies the length of the UDP header and data. Checksum provides an (optional) integrity check on the UDP header and data.

Internet Protocols Application-Layer Protocols
The Internet protocol suite includes many application-layer protocols that represent a wide variety of applications, including the following:

•File Transfer Protocol (FTP)—Moves files between devices

•Simple Network-Management Protocol (SNMP)—Primarily reports anomalous network conditions and sets network threshold values

•Telnet—Serves as a terminal emulation protocol

•X Windows—Serves as a distributed windowing and graphics system used for communication between X terminals and UNIX workstations

•Network File System (NFS), External Data Representation (XDR), and Remote Procedure Call (RPC)—Work together to enable transparent access to remote network resources

•Simple Mail Transfer Protocol (SMTP)—Provides electronic mail services

•Domain Name System (DNS)—Translates the names of network nodes into network addresses

lists these higher-layer protocols and the applications that they support.

Table 30-5 Higher-Layer Protocols and Their Applications


Application Protocols
File transfer
FTP

Terminal emulation
Telnet

Electronic mail
SMTP

Network management
SNMP

Distributed file services
NFS, XDR, RPC, X Windows