Suppose Alice, with a Web-based e-mail account (such as Hotmail or gmail),sends a

List five nonproprietary Internet applications and the application-layer protocols that they use.

What is the difference between network architecture and application architecture?

For a communication session between a pair of processes, which process is the client and which is the server?

For a P2P file-sharing application, do you agree with the statement, There is no notion of client and server sides of a communication session? Why or why not?

What information is used by a process running on one host to identify a process running on another host?

Suppose you wanted to do a transaction from a remote client to a server as fast as possible. Would you use UDP or TCP? Why?

Referring to Figure 2.4, we see that none of the applications listed in Figure 2.4 requires both no data loss and timing. Can you conceive of an application that requires no data loss and that is also highly time-sensitive?

List the four broad classes of services that a transport protocol can provide. For each of the service classes, indicate if either UDP or TCP (or both) provides such a service.

Recall that TCP can be enhanced with SSL to provide process-to-process security services, including encryption. Does SSL operate at the transport layer or the application layer? If the application developer wants TCP to be enhanced with SSL, what does the developer have to do?

What is meant by a handshaking protocol?

Why do HTTP, FTP, SMTP, and POP3 run on top of TCP rather than on UDP?

Consider an e-commerce site that wants to keep a purchase record for each of its customers. Describe how this can be done with cookies.

Describe how Web caching can reduce the delay in receiving a requested object. Will Web caching reduce the delay for all objects requested by a user or for only some of the objects? Why?

Telnet into a Web server and send a multiline request message. Include in the request message the If-modified-since: header line to force a response message with the 304 Not Modified status code.

Why is it said that FTP sends control information out-of-band?

Suppose Alice, with a Web-based e-mail account (such as Hotmail or gmail), sends a message to Bob, who accesses his mail from his mail server using POP3. Discuss how the message gets from Alices host to Bobs host. Be sure to list the series of application-layer protocols that are used to move the message between the two hosts

Print out the header of an e-mail message you have recently received. How many Received: header lines are there? Analyze each of the header lines in the message.

From a users perspective, what is the difference between the download-anddelete mode and the download-and-keep mode in POP3?

Is it possible for an organizations Web server and mail server to have exactly the same alias for a hostname (for example, foo.com)? What would be the type for the RR that contains the hostname of the mail server?

Look over your received emails, and examine the header of a message sent from a user with an .edu email address. Is it possible to determine from the header the IP address of the host from which the message was sent? Do the same for a message sent from a gmail account.

In BitTorrent, suppose Alice provides chunks to Bob throughout a 30-second interval. Will Bob necessarily return the favor and provide chunks to Alice in this same interval? Why or why not?

Consider a new peer Alice that joins BitTorrent without possessing any chunks. Without any chunks, she cannot become a top-four uploader for any of the other peers, since she has nothing to upload. How then will Alice get her first chunk?

What is an overlay network? Does it include routers? What are the edges in the overlay network?

Consider a DHT with a mesh overlay topology (that is, every peer tracks all peers in the system). What are the advantages and disadvantages of such a design? What are the advantages and disadvantages of a circular DHT (with no shortcuts)?

List at least four different applications that are naturally suitable for P2P architectures. (Hint: File distribution and instant messaging are two.)

In Section 2.7, the UDP server described needed only one socket, whereas the TCP server needed two sockets. Why? If the TCP server were to support n simultaneous connections, each from a different client host, how many sockets would the TCP server need?

For the client-server application over TCP described in Section 2.7, why must the server program be executed before the client program? For the clientserver application over UDP, why may the client program be executed before the server program?

True or false? a. A user requests a Web page that consists of some text and three images. For this page, the client will send one request message and receive four response messages. b. Two distinct Web pages (for example, www.mit.edu/research.html and www.mit.edu/students.html) can be sent over the same persistent connection. c. With nonpersistent connections between browser and origin server, it is possible for a single TCP segment to carry two distinct HTTP request messages. d. The Date: header in the HTTP response message indicates when the object in the response was last modified. e. HTTP response messages never have an empty message body.

Read RFC 959 for FTP. List all of the client commands that are supported by the RFC.

Consider an HTTP client that wants to retrieve a Web document at a given URL. The IP address of the HTTP server is initially unknown. What transport and application-layer protocols besides HTTP are needed in this scenario?

Consider the following string of ASCII characters that were captured by Wireshark when the browser sent an HTTP GET message (i.e., this is the actual content of an HTTP GET message). The characters <cr><lf> are carriage return and line-feed characters (that is, the italized character string <cr> in the text below represents the single carriage-return character that was contained at that point in the HTTP header). Answer the following questions, indicating where in the HTTP GET message below you find the answer.

The text below shows the reply sent from the server in response to the HTTP GET message in the question above. Answer the following questions, indicating where in the message below you find the answer. 172 CHAPTER 2 APPLICATION LAYER HTTP/1.1 200 OK<cr><lf>Date: Tue, 07 Mar 2008 12:39:45GMT<cr><lf>Server: Apache/2.0.52 (Fedora) <cr><lf>Last-Modified: Sat, 10 Dec2005 18:27:46 GMT<cr><lf>ETag: 526c3-f22-a88a4c80<cr><lf>Accept- Ranges: bytes<cr><lf>Content-Length: 3874<cr><lf> Keep-Alive: timeout=max=100<cr><lf>Connection: Keep-Alive<cr><lf>Content-Type: text/html; charset= ISO-8859-1<cr><lf><cr><lf><!doctype html public - //w3c//dtd html 4.0 transitional//en><lf><html><lf> <head><lf> <meta http-equiv=Content-Type content=text/html; charset=iso-8859-1><lf> <meta name=GENERATOR content=Mozilla/4.79 [en] (Windows NT 5.0; U) Netscape]><lf> <title>CMPSCI 453 / 591 / NTU-ST550A Spring 2005 homepage</title><lf></head><lf> <much more document text following here (not shown)> a. Was the server able to successfully find the document or not? What time was the document reply provided? b. When was the document last modified? c. How many bytes are there in the document being returned? d. What are the first 5 bytes of the document being returned? Did the server agree to a persistent connection?

Obtain the HTTP/1.1 specification (RFC 2616). Answer the following questions: a. Explain the mechanism used for signaling between the client and server to indicate that a persistent connection is being closed. Can the client, the server, or both signal the close of a connection? b. What encryption services are provided by HTTP? c. Can a client open three or more simultaneous connections with a given server? d. Either a server or a client may close a transport connection between them if either one detects the connection has been idle for some time. Is it possible that one side starts closing a connection while the other side is transmitting data via this connection? Explain.

Suppose within your Web browser you click on a link to obtain a Web page. The IP address for the associated URL is not cached in your local host, so a DNS lookup is necessary to obtain the IP address. Suppose that n DNS servers are visited before your host receives the IP address from DNS; the successive visits incur an RTT of RTT1, . . ., RTTn. Further suppose that the Web page associated with the link contains exactly one object, consisting of a small amount of HTML text. Let RTT0 denote the RTT between the local host and the server containing the object. Assuming zero transmission time of the object, how much time elapses from when the client clicks on the link until the client receives the object?

Referring to Problem P7, suppose the HTML file references eight very small objects on the same server. Neglecting transmission times, how much time elapses with a. Non-persistent HTTP with no parallel TCP connections? b. Non-persistent HTTP with the browser configured for 5 parallel connections? c. Persistent HTTP?

Consider Figure 2.12, for which there is an institutional network connected to the Internet. Suppose that the average object size is 850,000 bits and that the average request rate from the institutions browsers to the origin servers is 16 requests per second. Also suppose that the amount of time it takes from when the router on the Internet side of the access link forwards an HTTP request until it receives the response is three seconds on average (see Section 2.2.5). Model the total average response time as the sum of the average access delay (that is, the delay from Internet router to institution router) and the average Internet delay. For the average access delay, use /(1 ), where is the average time required to send an object over the access link and  is the arrival rate of objects to the access link. a. Find the total average response time. b. Now suppose a cache is installed in the institutional LAN. Suppose the miss rate is 0.4. Find the total response time.

Consider a short, 10-meter link, over which a sender can transmit at a rate of 150 bits/sec in both directions. Suppose that packets containing data are 100,000 bits long, and packets containing only control (e.g., ACK or handshaking) are 200 bits long. Assume that N parallel connections each get 1/N of the link bandwidth. Now consider the HTTP protocol, and suppose that each downloaded object is 100 Kbits long, and that the initial downloaded object contains 10 referenced objects from the same sender. Would parallel downloads via parallel instances of non-persistent HTTP make sense in this case? Now consider persistent HTTP. Do you expect significant gains over the non-persistent case? Justify and explain your answer.

Consider the scenario introduced in the previous problem. Now suppose that the link is shared by Bob with four other users. Bob uses parallel instances of non-persistent HTTP, and the other four users use non-persistent HTTP without parallel downloads. a. Do Bobs parallel connections help him get Web pages more quickly? Why or why not? b. If all five users open five parallel instances of non-persistent HTTP, then would Bobs parallel connections still be beneficial? Why or why not?

Write a simple TCP program for a server that accepts lines of input from a client and prints the lines onto the servers standard output. (You can do this by modifying the TCPServer.py program in the text.) Compile and execute your program. On any other machine that contains a Web browser, set the proxy server in the browser to the host that is running your server program; also configure the port number appropriately. Your browser should now send its GET request messages to your server, and your server should display the messages on its standard output. Use this platform to determine whether your browser generates conditional GET messages for objects that are locally cached.

What is the difference between MAIL FROM: in SMTP and From: in the mail message itself?

How does SMTP mark the end of a message body? How about HTTP? Can HTTP use the same method as SMTP to mark the end of a message body? Explain.

Read RFC 5321 for SMTP. What does MTA stand for? Consider the following received spam email (modified from a real spam email). Assuming only the originator of this spam email is malacious and all other hosts are honest, identify the malacious host that has generated this spam email. From - Fri Nov 07 13:41:30 2008 Return-Path: <tennis5@pp33head.com> Received: from barmail.cs.umass.edu (barmail.cs.umass.edu [128.119.240.3]) by cs.umass.edu (8.13.1/8.12.6) for <hg@cs.umass.edu>; Fri, 7 Nov 2008 13:27:10 -0500 Received: from asusus-4b96 (localhost [127.0.0.1]) by barmail.cs.umass.edu (Spam Firewall) for <hg@cs.umass.edu>; Fri, 7 Nov 2008 13:27:07 -0500 (EST) Received: from asusus-4b96 ([58.88.21.177]) by barmail.cs.umass.edu for <hg@cs.umass.edu>; Fri, 07 Nov 2008 13:27:07 -0500 (EST) Received: from [58.88.21.177] by inbnd55.exchangeddd.com; Sat, 8 Nov 2008 01:27:07 +0700 From: "Jonny" <tennis5@pp33head.com> To: <hg@cs.umass.edu> Subject: How to secure your savings

Read the POP3 RFC, RFC 1939. What is the purpose of the UIDL POP3 command?

Consider accessing your e-mail with POP3. a. Suppose you have configured your POP mail client to operate in the download-and-delete mode. Complete the following transaction: C: list S: 1 498 S: 2 912 S: . C: retr 1 S: blah blah ... S: ..........blah S: . ? ? b. Suppose you have configured your POP mail client to operate in the download-and-keep mode. Complete the following transaction: C: list S: 1 498 S: 2 912 S: . C: retr 1 S: blah blah ... S: ..........blah S: . ? ? PROBLEMS 175 c. Suppose you have configured your POP mail client to operate in the download-and-keep mode. Using your transcript in part (b), suppose you retrieve messages 1 and 2, exit POP, and then five minutes later you again access POP to retrieve new e-mail. Suppose that in the five-minute interval no new messages have been sent to you. Provide a transcript of this second POP session. P18. a. What is a whois database

a. What is a whois database? b. Use various whois databases on the Internet to obtain the names of two DNS servers. Indicate which whois databases you used. c. Use nslookup on your local host to send DNS queries to three DNS servers: your local DNS server and the two DNS servers you found in part (b). Try querying for Type A, NS, and MX reports. Summarize your findings. d. Use nslookup to find a Web server that has multiple IP addresses. Does the Web server of your institution (school or company) have multiple IP addresses? e. Use the ARIN whois database to determine the IP address range used by your university. f. Describe how an attacker can use whois databases and the nslookup tool to perform reconnaissance on an institution before launching an attack. g. Discuss why whois databases should be publicly available.

In this problem, we use the useful dig tool available on Unix and Linux hosts to explore the hierarchy of DNS servers. Recall that in Figure 2.21, a DNS server higher in the DNS hierarchy delegates a DNS query to a DNS server lower in the hierarchy, by sending back to the DNS client the name of that lower-level DNS server. First read the man page for dig, and then answer the following questions. a. Starting with a root DNS server (from one of the root servers [a-m].rootservers. net), initiate a sequence of queries for the IP address for your departments Web server by using dig. Show the list of the names of DNS servers in the delegation chain in answering your query. b. Repeat part a) for several popular Web sites, such as google.com, yahoo.com, or amazon.com.

Suppose you can access the caches in the local DNS servers of your department. Can you propose a way to roughly determine the Web servers (outside your department) that are most popular among the users in your department? Explain.

Suppose that your department has a local DNS server for all computers in the department. You are an ordinary user (i.e., not a network/system administrator). Can you determine if an external Web site was likely accessed from a computer in your department a couple of seconds ago? Explain.

Consider distributing a file of F = 15 Gbits to N peers. The server has an upload rate of us = 30 Mbps, and each peer has a download rate of di = 2 Mbps and an upload rate of u. For N = 10, 100, and 1,000 and u = 300 Kbps, 700 Kbps, and 2 Mbps, prepare a chart giving the minimum distribution time for each of the combinations of N and u for both client-server distribution and P2P distribution.

Consider distributing a file of F bits to N peers using a client-server architecture. Assume a fluid model where the server can simultaneously transmit to multiple peers, transmitting to each peer at different rates, as long as the combined rate does not exceed us. a. Suppose that us/N dmin. Specify a distribution scheme that has a distribution time of NF/us. b. Suppose that us/N dmin. Specify a distribution scheme that has a distribution time of F/ dmin. c. Conclude that the minimum distribution time is in general given by max{NF/us, F/ dmin}.

Consider distributing a file of F bits to N peers using a P2P architecture. Assume a fluid model. For simplicity assume that dmin is very large, so that peer download bandwidth is never a bottleneck. a. Suppose that us (us + u1 + ... + uN)/N. Specify a distribution scheme that has a distribution time of F/us. b. Suppose that us (us + u1 + ... + uN)/N. Specify a distribution scheme that has a distribution time of NF/(us + u1 + ... + uN). c. Conclude that the minimum distribution time is in general given by max{F/us, NF/(us + u1 + ... + uN)}.

Consider an overlay network with N active peers, with each pair of peers having an active TCP connection. Additionally, suppose that the TCP connections pass through a total of M routers. How many nodes and edges are there in the corresponding overlay network?

Suppose Bob joins a BitTorrent torrent, but he does not want to upload any data to any other peers (so called free-riding). a. Bob claims that he can receive a complete copy of the file that is shared by the swarm. Is Bobs claim possible? Why or why not? b. Bob further claims that he can further make his free-riding more efficient by using a collection of multiple computers (with distinct IP addresses) in the computer lab in his department. How can he do that?

In the circular DHT example in Section 2.6.2, suppose that peer 3 learns that peer 5 has left. How does peer 3 update its successor state information? Which peer is now its first successor? Its second successor?

In the circular DHT example in Section 2.6.2, suppose that a new peer 6 wants to join the DHT and peer 6 initially only knows peer 15s IP address. What steps are taken?

Because an integer in [0, 2n 1] can be expressed as an n-bit binary number in a DHT, each key can be expressed as k = (k0, k1, . . . , kn1), and each peer identifier can be expressed p = (p0, p1, . . . , pn1). Lets now define the XOR distance between a key k and peer p as Describe how this metric can be used to assign (key, value) pairs to peers. (To learn about how to build an efficient DHT using this natural metric, see [Maymounkov 2002] in which the Kademlia DHT is described.)

As DHTs are overlay networks, they may not necessarily match the underlay physical network well in the sense that two neighboring peers might be physically very far away; for example, one peer could be in Asia and its neighbor could be in North America. If we randomly and uniformly assign identifiers to newly joined peers, would this assignment scheme cause such a mismatch? Explain. And how would such a mismatch affect the DHTs performance?

Install and compile the Python programs TCPClient and UDPClient on one host and TCPServer and UDPServer on another host. a. Suppose you run TCPClient before you run TCPServer. What happens? Why? b. Suppose you run UDPClient before you run UDPServer. What happens? Why? c. What happens if you use different port numbers for the client and server sides?

Suppose that in UDPClient.py, after we create the socket, we add the line: clientSocket.bind(('', 5432)) Will it become necessary to change UDPServer.py? What are the port numbers for the sockets in UDPClient and UDPServer? What were they before making this change?

Can you configure your browser to open multiple simultaneous connections to a Web site? What are the advantages and disadvantages of having a large number of simultaneous TCP connections?

We have seen that Internet TCP sockets treat the data being sent as a byte stream but UDP sockets recognize message boundaries. What are one advantage and one disadvantage of byte-oriented API versus having the API explicitly recognize and preserve application-defined message boundaries?

What is the Apache Web server? How much does it cost? What functionality does it currently have? You may want to look at Wikipedia to answer this question.

Many BitTorrent clients use DHTs to create a distributed tracker. For these DHTs, what is the key and what is the value?