I have to design a program that reads all the TCP segments incoming of the same connection. How can I distinguish which connection a packet belongs to, among many packets that I receive? Is it sufficient to discriminate on the basis of the DESTINATION PORT field in the header?
No. Using just the destination port isn't enough. A TCP connection is defined by a combination of the following 4 values:
Source port
Source ip address
Destination port
Destination ip address
Related
By searching on internet I got information that Address Resolution Protocol (ARP) is Link Layer (L2) protocol. As per ARP functionality it broadcasts to entire network to check to whom this specific IP belongs to get its MAC address.. but as ARP is L2 protocol, how does it knows destination IP address as IP's are encapsulated in L3 and L2 protocol can't read it
Layer 3 and above are located in the "Payload" part of an ethernet header.
As you can see here the ARP packet also contains IP addresses from its sender and receiver:
ARP packet contain source HW address and src IP address as well as destination HW address and destination IP also .
when ARP resolution happens, means when ARP send request and get response from same destination,ARP update the destination IP in arp_entry .
I would like to elaborate on the previous questions.
first, here it is the case where you can't really apply the model. ARP is sometimes layer 2 and sometimes layer 3 (the similar functionality in IPv6 is done with neighbor discovery protocol, which is carried in ICMP packets)
ARP packets do not carry IP payload. They only carry ARP packets. See other answers for the format
ARP is executed by two end-hosts, which both have to implement both layer 2 and layer 3
ARP is initiated by layer 3, when layer 3 tries to send packet to an IP address on the local network.
ARP is processed by a host, which implements both layer 2 and layer 3. A host without layer 3 cannot have an IP address.
Intermediate layer 2 systems generally cannot process ARP requests, past forwarding ethernet packets with broadcast destination MAC
Why the TCP segment only contains the port numbers but no IP addresses? How does the packet know which host it is going to?
Because the TCP segment is encapsulated into an Internet Protocol (IP) datagram, and the IP datagram contains the source and destination IP.
If suppose multiple TCP connections are there in a network , then how will I idnetfy a single TCP connecton uniquely ?
Thanks
This sounds like a homework question.... from networking 101.
In any case, TCP connections are uniquely identified by the following properties: source IP address, source port, destination address, and destination port.
Do an internet search for "TCP 4-tuple" or "TCP 5-tuple" for more details.
How should one map a sent packet and its response from server ? Is it safe to use port ?
e.g I captured a tcp packet , from X.X.X.X:45621 to Y.Y.Y.Y:993 , soon another tcp packet , which come from Y.Y.Y.Y:993 , and to X.X.X.X:45621.
Would it be safe to say , the second packet is the response of the first one ?
Is the following two situation causing problems ?
1) Port re-using
2) What if (is that possible ?) multiple request come from one port to the same remote machine ?
A TCP connection (or UDP pseudo-connection) is identified by 4 things: the local IP address, the local port number, the remote IP address, and the remote port number. If all 4 of those things are the same from one packet to the next then it's the same connection. If any of them are different, it's a different connection. Note that the "local" IP address and port appear as the source IP address and port of outgoing packets and as the destination IP address and port of incoming packets, and vice verse for "remote".
All of this is valid during the lifetime of the connection. After the connection is closed, the same 4-tuple might be reused for a new connection.
1) Q: Port re-using
A: many connections can use the same port. The connections will be differentiated by AT LEAST one of the other 3 members of the 4-tuple.
2) Q: What if multiple request come from one port to the same remote machine?
A: If multiple connections arrive destined to the same port of the same IP address and furthermore they have the same source port, that's OK as long as they come from different source hosts: source IP address will be different. This case won't happen for multiple connections coming from the same host destined to the same port on the same host because no two sockets on the same source host could have been bound to the same source port.
If a station simultaneously maintains three TCP connections,can use the same TCP port for the three connections? If yes how it could distinguish packets?
Each connection is made of the below parameters.
(source ip,source port destination ip, destination port, protocol).
Thus, the station can distinguish packets.
Yes, multiple connections to the same IP and port are possible. They're distinguished by the IP and port on the other end of each connection.