Ans: A computer network is a collection of autonomous computing devices (hosts) interconnected by a transmission medium so that they can exchange data under a common set of protocols. "Autonomous" means no node can forcibly start, stop or control another, which distinguishes a network from a multiprocessor system. Its purpose is resource sharing, reliability and communication, e.g. a college LAN sharing a printer and a file server.

Ans: The OSI (Open Systems Interconnection) Reference Model is a seven-layer conceptual framework standardised by ISO (ISO 7498, 1984) that partitions network communication into layers, each providing a defined service to the layer above and using the services of the layer below. It is a reference model only, not a protocol suite — real Internet traffic runs the TCP/IP protocols — but it remains the standard vocabulary for describing layer functions.

Ans: From bottom to top the seven OSI layers are: (1) Physical, (2) Data Link, (3) Network, (4) Transport, (5) Session, (6) Presentation, (7) Application. Layers 1–3 are the network-support (hardware) layers, layers 5–7 the user-support layers, and layer 4 (Transport) links the two. Mnemonic: "Please Do Not Throw Sausage Pizza Away".

Ans: The TCP/IP model is the four-layer protocol suite on which the Internet actually runs: Network Access (Host-to-Network), Internet (IP, ICMP, ARP), Transport (TCP, UDP) and Application (HTTP, FTP, DNS, SMTP). It collapses OSI layers 1–2 into one layer and OSI layers 5–7 into the Application layer; unlike OSI it was defined after its protocols existed, so the model fits the protocols rather than the reverse.

Ans: Physical topology is the geometric arrangement of the physical links and nodes of a network, i.e. how the cabling actually runs; the basic types are bus, star, ring, mesh and hybrid. It must be distinguished from logical topology, which describes how data actually flows: a 10BASE-T Ethernet is physically a star (all nodes wired to a hub) but logically a bus.

Ans: In a star topology every node has a dedicated point-to-point link to a central controller (hub or switch) and all traffic passes through that centre; no two nodes are directly linked. For \( n \) nodes it needs \( n \) links and \( n \) ports on the hub, is cheap to install and easy to fault-isolate, but the central device is a single point of failure. It is the topology of modern switched Ethernet LANs.

Ans: In a mesh topology every node has a dedicated point-to-point link to every other node, so a fully connected mesh of \( n \) nodes needs \( \frac{n(n-1)}{2} \) duplex links and \( n-1 \) I/O ports per node. It gives maximum reliability, privacy and no traffic contention, but the \( O(n^2) \) cabling and port cost restricts it to small or backbone networks.

Ans: Bandwidth is the capacity of a channel, used in two senses: bandwidth in hertz is the width of the band of frequencies the medium can pass, \( B = f_{max} - f_{min} \); bandwidth in bits per second is the maximum theoretical data rate the channel can carry. The two are linked by Nyquist, \( C = 2B\log_2 L \), and Shannon, \( C = B\log_2(1+\mathrm{SNR}) \). Bandwidth is a theoretical ceiling, not the rate actually achieved.

Ans: Throughput is the actual measured rate at which data is successfully delivered across a link or path, in bits per second. It differs from bandwidth: bandwidth is the theoretical maximum capacity of the medium, whereas throughput is what is really obtained after protocol overhead, collisions, retransmissions and congestion, so always \( \text{Throughput} \le \text{Bandwidth} \). A 100 Mbps link may deliver only 20 Mbps of throughput under load.

Ans: Propagation delay is the time a single bit takes to travel from sender to receiver across the physical medium: \( T_p = \frac{\text{Distance}}{\text{Propagation speed}} \), the speed being about \( 2 \times 10^8 \) m/s in copper or fibre. It depends only on distance and medium — never on packet size or data rate.

Ans: Transmission delay (store time) is the time the sender needs to push all the bits of a packet onto the link: \( T_t = \frac{L}{R} \), where \( L \) is the packet length in bits and \( R \) the bandwidth in bps. It depends on packet size and data rate but not on distance — the exact opposite of propagation delay.

Ans: The bandwidth–delay product is \( \text{BDP} = \text{Bandwidth} \times \text{Delay} \), and it gives the number of bits that can be "in flight" on the link at any instant, i.e. the volume of the pipe. Taken with the round-trip time it is the minimum sender window needed to keep the link fully utilised; a sliding window smaller than the BDP leaves the channel idle.

Ans: Simplex transmission is unidirectional only, one device sending and the other only receiving (keyboard to CPU). Half-duplex is bidirectional but only one direction at a time, the entire channel capacity going to whichever station is transmitting (walkie-talkie, Ethernet on a hub). Full-duplex is bidirectional simultaneously, the capacity being shared between the two directions or carried on two separate paths (telephone, switched Ethernet).

Ans: Guided (bounded) transmission media conduct the signal along a solid physical conductor that directs the wave from one device to another. The three types are twisted-pair cable (UTP/STP), coaxial cable and optical fibre. Because the signal is confined to the conductor, guided media give higher security, lower interference and higher data rates than wireless.

Ans: Unguided (unbounded) transmission media carry electromagnetic waves through free space with no physical conductor, so the signal is broadcast and available to anyone with a suitable antenna. The three bands are radio waves (3 kHz–1 GHz, omnidirectional, penetrate walls), microwaves (1–300 GHz, line-of-sight, unidirectional dish antennas) and infrared (300 GHz–400 THz, short range, blocked by walls).

Ans: Optical fibre communication transmits data as pulses of light through a glass or plastic core surrounded by cladding of lower refractive index, so that rays striking the boundary at more than the critical angle undergo total internal reflection and remain inside the core. It offers very high bandwidth, extremely low attenuation, and complete immunity to electromagnetic interference and crosstalk; propagation modes are single-mode and multimode (step-index or graded-index).

Ans: Bit rate is the number of bits transmitted per second, whereas baud rate (signal rate) is the number of signal elements or symbol changes per second. They are related by \( \text{Bit rate} = \text{Baud rate} \times \log_2 L \), where \( L \) is the number of distinct signal levels. Baud rate determines the bandwidth required while bit rate measures the data carried, so 16-QAM at 1000 baud yields 4000 bps.

Ans: Pulse Code Modulation (PCM) is the standard technique for converting an analog signal into a digital bit stream in three steps: sampling (PAM) at the Nyquist rate \( f_s \ge 2 f_{max} \), quantization of each sample into one of \( L \) levels, and encoding of each level into \( n = \log_2 L \) bits. Voice band sampled at 8000 Hz with 8-bit codes therefore gives the 64 kbps digital telephone channel.

Ans: Framing is the Data Link layer (OSI layer 2) function of dividing the continuous bit stream received from the Physical layer into distinguishable units called frames, each carrying a header with addresses and a trailer with a checksum, so the receiver knows exactly where a message begins and ends. Frame delimitation is achieved by character count, byte (character) stuffing with FLAG and ESC bytes, bit stuffing (insert a 0 after five consecutive 1s, as in HDLC), or physical-layer coding violations.

Ans: Error detection only determines whether the received bits differ from the transmitted bits — the receiver knows an error exists but not where, so it must ask for retransmission (ARQ); parity, checksum and CRC are detection codes. Error correction additionally locates and repairs the corrupted bits at the receiver with no retransmission (Forward Error Correction), as in Hamming code, and therefore needs far more redundant bits.

Ans: A parity check appends one redundant bit to the data unit so that the total number of 1s becomes even (even parity) or odd (odd parity). It is the simplest detection scheme, with minimum Hamming distance \( d_{min} = 2 \), so it detects all single-bit errors and any odd number of bit errors, but fails on every even number of errors and can never correct. Two-dimensional (LRC + VRC) parity improves this and can correct a single-bit error.

Ans: Cyclic Redundancy Check (CRC) is a polynomial-based error-detecting code used in data link networks. The sender appends a checksum \(R(x)\) derived from modulo-2 division of data polynomial \(M(x) \cdot 2^r\) by generator polynomial \(G(x)\).

Ans: Hamming code is a linear block error-correcting code that inserts \( r \) parity bits at the bit positions that are powers of two \( (1, 2, 4, 8, \dots) \) among \( m \) data bits, where \( r \) is the smallest integer satisfying \( 2^r \ge m + r + 1 \). Each parity bit checks a distinct set of positions, so the parity results read together form a syndrome whose binary value is the address of the erroneous bit. With \( d_{min} = 3 \) it corrects any single-bit error (and with one extra bit becomes SEC-DED).

Ans: The Hamming distance \( d(x,y) \) between two codewords of equal length is the number of bit positions in which they differ, obtained as the number of 1s in \( x \oplus y \). The minimum Hamming distance \( d_{min} \) of a code fixes its power: the code detects up to \( d_{min}-1 \) bit errors and corrects up to \( \left\lfloor \frac{d_{min}-1}{2} \right\rfloor \) bit errors.

Ans: Flow control is the set of procedures that prevents a fast sender from overwhelming a slow receiver, by limiting the amount of data that may be sent before an acknowledgement is received. It is a receiver-driven mechanism operating between two endpoints (stop-and-wait, sliding window, TCP's advertised receive window). It must not be confused with congestion control, which protects the routers inside the network rather than the end receiver's buffer.

Ans: In the Stop-and-Wait protocol the sender transmits one frame and then halts until the acknowledgement for that frame arrives, so the window size is 1 in each direction and a single sequence-number bit suffices. With \( a = \frac{T_p}{T_t} \) its link utilisation is \( \text{Efficiency} = \frac{1}{1+2a} \), which becomes very poor on long or high-speed links and motivates the sliding-window protocols.

Ans: A sliding window protocol lets the sender transmit several frames before any acknowledgement arrives, by maintaining a sender window of outstanding unacknowledged frames and a receiver window of frames it is prepared to accept; the windows "slide" forward as acknowledgements are received. With \( m \)-bit sequence numbers the numbering is modulo \( 2^m \), and a window of \( N \) raises efficiency to \( \frac{N}{1+2a} \), capped at 1. Go-Back-N and Selective Repeat are its two ARQ forms.

Ans: Go-Back-N ARQ is a sliding-window protocol with a sender window of \( N \) but a receiver window of 1: the receiver accepts frames strictly in order, silently discards every frame arriving after a lost one, and returns cumulative acknowledgements. On timeout the sender retransmits the lost frame and all frames sent after it, so it needs no receiver buffering but wastes bandwidth. To keep sequence numbers unambiguous, \( N \le 2^m - 1 \).

Ans: Selective Repeat ARQ retransmits only the frame that was actually lost or damaged, because the receiver window is also \( N \): the receiver buffers out-of-order frames, acknowledges them individually and sends a NAK for the missing one. It is far more bandwidth-efficient than Go-Back-N but requires receiver buffering and resequencing logic, and the tighter window constraint \( N \le 2^{m-1} \).

Ans: Piggybacking is the technique of carrying the acknowledgement of received frames inside the header of an outgoing data frame travelling in the reverse direction, instead of sending a separate ACK frame. On a full-duplex link this saves bandwidth and reduces the number of frames, at the cost of a small added delay while the data link layer waits for a data frame to attach the ACK to.

Ans: A MAC (Media Access Control) address is the 48-bit (6-byte) physical hardware address burned into the NIC and used by the Data Link layer (OSI layer 2) to identify a station within one LAN. It is written as 12 hexadecimal digits (e.g. 00:1A:2B:3C:4D:5E), the first 24 bits being the OUI assigned to the manufacturer and the last 24 bits the card number. Unlike an IP address it is flat, permanent and globally unique, and it does not change when the host joins a different network.

Ans: CSMA/CD (Carrier Sense Multiple Access with Collision Detection) is the wired Ethernet (IEEE 802.3) MAC protocol in which a station senses the channel, transmits when it is idle, and keeps listening while transmitting; on detecting a collision it aborts at once, sends a 32-bit jam signal and retries after a binary exponential backoff of \( R \times \text{slot time} \) with \( R \) chosen randomly from \( [0,\, 2^k - 1] \). Detection requires \( T_t \ge 2T_p \), which fixes the 51.2 µs slot time and 64-byte minimum frame at 10 Mbps.

Ans: CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance) is the wireless (IEEE 802.11) MAC protocol, used because a radio NIC is half-duplex and suffers the hidden-terminal problem, so collisions cannot be detected and must instead be avoided. Avoidance uses interframe spacing (IFS), a random backoff drawn from a contention window before transmitting, a compulsory ACK for every frame, and optional RTS/CTS handshaking with a NAV timer that silences other stations.

Ans: Pure ALOHA is the original random-access protocol (Abramson, 1970) in which a station transmits a frame whenever it has data, with no carrier sensing at all, and retransmits after a random backoff time if no acknowledgement arrives. Since a frame is destroyed by any overlap beginning either one frame time before or after it, the vulnerable period is \( 2T_{fr} \), giving throughput \( S = G e^{-2G} \) with maximum \( S_{max} = \frac{1}{2e} \approx 0.184 \) (18.4%) at \( G = 0.5 \).

Ans: Slotted ALOHA divides time into slots of exactly one frame time and forces every station to begin transmitting only at the start of a slot. This halves the vulnerable period to \( T_{fr} \), so throughput becomes \( S = G e^{-G} \) with maximum \( S_{max} = \frac{1}{e} \approx 0.368 \) (36.8%) at \( G = 1 \) — exactly double Pure ALOHA, at the cost of requiring global clock synchronisation.

Ans: An IP address is the logical, hierarchical address assigned at the Network layer (OSI layer 3) that uniquely identifies the connection of a host or router interface to the Internet. It is universal, software-configured, and changes when the host moves to another network — unlike the flat, permanent 48-bit MAC address — and it is the address routers use to forward datagrams end-to-end across different networks.

Ans: An IPv4 address is 32 bits long, written in dotted-decimal notation as four 8-bit octets separated by dots (e.g. 192.168.1.10), giving an address space of \( 2^{32} \approx 4.3 \) billion addresses. It is hierarchically divided into a network ID (prefix) and a host ID (suffix); classful addressing defined class A (/8), B (/16), C (/24), D (multicast) and E (reserved), now superseded by CIDR.

Ans: An IPv6 address is 128 bits long, written in colon-hexadecimal notation as eight groups of four hexadecimal digits (e.g. 2001:0DB8:0000:0000:0000:0000:1428:57AB, abbreviable to 2001:DB8::1428:57AB), giving \( 2^{128} \approx 3.4 \times 10^{38} \) addresses. Beyond the enlarged space it uses a fixed 40-byte base header with optional extension headers, drops the header checksum and router fragmentation, and replaces broadcast with anycast.

Ans: Subnetting is the process of logically partitioning a single IP network into multiple smaller sub-networks (subnets) using a custom subnet mask, reducing broadcast domain size and optimizing IP allocation.

Ans: CIDR (Classless Inter-Domain Routing) abolishes the fixed class boundaries by writing an address as a.b.c.d/n, where the slash notation \( /n \) states how many leading bits form the network prefix; the mask is therefore \( n \) ones followed by \( 32-n \) zeros and the block contains \( 2^{32-n} \) addresses. Freed from the rigid /8, /16 and /24 boundaries it supports variable-length subnet masking and route aggregation (supernetting), which conserves IPv4 addresses and shrinks backbone routing tables.

Ans: Network Address Translation (NAT) is the technique by which a border router rewrites the private source IP addresses (RFC 1918 blocks 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) of outgoing datagrams into one or a few globally routable public addresses, and reverses the mapping on the replies using a translation table. PAT (NAT overload) also translates port numbers so that many internal hosts can share a single public IP; NAT conserves scarce IPv4 addresses and hides the internal topology.

Ans: ARP (Address Resolution Protocol) maps a known 32-bit IPv4 address to the unknown 48-bit MAC address of a host on the same physical network. The requesting host broadcasts an ARP request frame; only the owner of that IP answers with a unicast ARP reply carrying its MAC address, which is then stored in an ARP cache so repeat broadcasts are avoided. ARP is the glue between the Network and Data Link layers.

Ans: RARP (Reverse Address Resolution Protocol) is the inverse of ARP: a station that knows only its own 48-bit MAC address broadcasts a request so that a RARP server can tell it its 32-bit IP address. It was used by diskless workstations at boot time, but because it works only within one physical network and returns nothing but the IP address it has been replaced by BOOTP and DHCP.

Ans: ICMP (Internet Control Message Protocol) is the Network layer companion to IP that reports errors and carries diagnostic queries, since IP itself is an unreliable, connectionless best-effort protocol with no error-reporting mechanism of its own. ICMP messages (IP protocol number 1) are encapsulated inside IP datagrams and include error types such as Destination Unreachable, Time Exceeded, Source Quench, Parameter Problem and Redirect, plus query types Echo Request/Reply used by ping and traceroute. It only reports errors, never corrects them.

Ans: DHCP (Dynamic Host Configuration Protocol) is an Application layer client–server protocol running over UDP (server port 67, client port 68) that automatically leases a host its IP address, subnet mask, default gateway and DNS server addresses for a limited lease time. The client acquires them by the four-step DORA exchange — DISCOVER (broadcast), OFFER, REQUEST, ACK — and DHCP is a backward-compatible extension of BOOTP.

Ans: Distance vector routing is a decentralised algorithm based on Bellman–Ford in which every router keeps a vector of (destination, least cost, next hop) entries and periodically sends its entire routing table to its directly connected neighbours only, updating its own table whenever a neighbour advertises a cheaper path. No router ever learns the full topology; convergence is slow and the scheme suffers the count-to-infinity problem, mitigated by split horizon, poison reverse and an infinity of 16 hops. RIP is the classic example.

Ans: Link state routing is an algorithm in which each router measures the cost of its own directly attached links, floods this Link State Packet to every router in the area, and so builds an identical and complete topology map (the link state database); it then runs Dijkstra's shortest-path-first algorithm locally to compute its routing table. Compared with distance vector it converges much faster and is free of count-to-infinity, at the cost of higher memory and CPU use. OSPF is the classic example.

Ans: Congestion control is the set of mechanisms that keeps the total load offered to the network below its carrying capacity, so that router queues do not overflow and throughput does not collapse. It is global and network-oriented — open-loop (prevention: traffic shaping, admission control) or closed-loop (feedback: choke packets, ECN, TCP's congestion window with slow start and AIMD) — in contrast to flow control, which protects only an individual receiver's buffer.

Ans: The leaky bucket algorithm is a traffic-shaping mechanism that models the host as a bucket with a hole in it: however bursty the arriving traffic may be, the bucket drains onto the network at a fixed constant rate, and packets that arrive when the finite queue is full are discarded. It therefore converts a bursty flow into a perfectly smooth average-rate flow, but it permits no burstiness at all and can discard data from a well-behaved bursty source.

Ans: The token bucket algorithm adds tokens at a constant rate \( r \) to a bucket of capacity \( b \), and a packet may be sent only by consuming a token; while the host is idle tokens accumulate, so a later burst can be sent at full line speed. Over an interval \( t \) at most \( rt + b \) bytes may leave, so unlike the leaky bucket it preserves burstiness up to the bucket size and never discards data merely for arriving in a burst.

Ans: DNS (Domain Name System) is the Application layer distributed, hierarchical database that maps human-readable domain names to IP addresses and back, using port 53 over UDP for ordinary queries and TCP for zone transfers or replies longer than 512 bytes. Its name space is an inverted tree of root, top-level (.com, .in) and second-level domains, resolved recursively or iteratively through root, TLD and authoritative servers, with caching at every step.

Ans: HTTP (HyperText Transfer Protocol) is the stateless Application layer request–response protocol used to transfer Web pages over TCP port 80, with methods GET, POST, PUT, HEAD and DELETE. HTTPS is the same protocol tunnelled through TLS/SSL on TCP port 443, adding encryption, server authentication by digital certificate and message integrity — so HTTPS is secure HTTP, not a different application protocol.

Ans: FTP (File Transfer Protocol) is the Application layer TCP-based standard for copying files between hosts, and it is distinctive in using two parallel connections: a persistent control connection on port 21 that carries commands and replies for the whole session, and a separate data connection on port 20 opened and closed for each individual transfer. This out-of-band control lets it cope with differing file types and structures, and it operates in active or passive mode.

OSI 7 Layer Architecture

The Open Systems Interconnection (OSI) model is a conceptual framework used to describe the functions of a networking system. It characterizes computing functions into a universal set of rules and requirements to support interoperability.

1. Physical Layer: Transmits raw bit streams (0s and 1s) over a physical medium (cables, radio). Deals with voltages, hubs, and repeaters.
2. Data Link Layer: Organizes bits into Frames. Provides node-to-node data transfer and handles MAC addressing and Error Detection (CSMA/CD, Switches).
3. Network Layer: Organizes frames into Packets. Handles logical IP addressing and Routing to determine the best path (Routers, IPv4/IPv6).
4. Transport Layer: Organizes packets into Segments. Ensures reliable, in-order, end-to-end delivery using Port numbers. Handles Error Correction and Flow Control (TCP, UDP).
5. Session Layer: Establishes, maintains, and terminates connections (sessions) between local and remote applications.
6. Presentation Layer: Formats, encrypts, and compresses data so it can be understood by the application layer (SSL/TLS, JPEG, ASCII).
7. Application Layer: Directly interacts with the software application. Provides network services to end-users (HTTP, FTP, SMTP, DNS).

OSI Model vs TCP/IP Model

Transmission Media (Guided)

Transmission media are the physical pathways that carry data from a transmitter to a receiver.

• Twisted Pair Cable: Consists of two insulated copper wires twisted around each other to cancel out Electromagnetic Interference (EMI) and crosstalk.
  • Unshielded (UTP): Cheap, flexible, used in standard Ethernet (Cat5e/Cat6).
  • Shielded (STP): Has metal foil casing for better noise protection.
• Coaxial Cable: Has a central copper conductor core, surrounded by an insulating layer, a braided metal shield, and an outer plastic jacket. Carries higher frequency signals than twisted pair. Used heavily for Cable TV and older broadband.
• Fiber Optics: Uses total internal reflection to transmit data as pulses of light through a glass or plastic core.
  • Pros: Extremely high bandwidth, completely immune to electromagnetic interference, spans massive distances.
  • Cons: Expensive, fragile, and difficult to splice.

Switching Techniques

Error Detection: Cyclic Redundancy Check (CRC)

CRC is a highly robust error-detecting code used in the Data Link Layer (like Ethernet). It uses polynomial binary division.

Mechanism:

1. Generator Polynomial: Both sender and receiver agree on a generator polynomial \(G(x)\) (represented as a binary divisor, e.g., 1101). Let the length of \(G\) be \(n\).
2. Appending Zeros: The sender appends \(n-1\) zero bits to the end of the original Data message \(M\).
3. Modulo-2 Division: The sender performs binary Modulo-2 division (which is just XORing) of the appended data by \(G\).
4. Remainder (CRC): The remainder of this division is the CRC checksum.
5. Transmission: The sender replaces the appended zeros with the CRC checksum and transmits the frame.
6. Verification: The receiver divides the received frame by \(G\). If the remainder is exactly zero, the frame is accepted as error-free. Otherwise, it is rejected.

Error Correction: Hamming Code

Hamming Code is a block code that is capable of detecting up to two simultaneous bit errors and correcting single-bit errors.

Mechanism:

1. Redundant Bits Calculation: Given \(m\) data bits, the number of redundant parity bits \(r\) must satisfy: \(2^r \ge m + r + 1\).
2. Positioning: Parity bits are placed at positions that are powers of 2 (1, 2, 4, 8...). Data bits fill the remaining positions.
3. Parity Calculation: Each parity bit calculates Even (or Odd) parity for a specific overlapping set of bit positions. For example, \(P_1\) checks positions 1, 3, 5, 7. \(P_2\) checks 2, 3, 6, 7.
4. Error Correction at Receiver: The receiver recalculates all parity bits. If there is an error, the parity bits that fail will form a binary number indicating the exact position of the flipped bit. The receiver simply flips that bit back to correct the error.

Stop-and-Wait ARQ Protocol

Stop-and-Wait ARQ is the simplest flow and error control protocol.

• Mechanism: The sender transmits exactly ONE frame and then stops. It waits for an Acknowledgement (ACK) from the receiver before sending the next frame.
• Error Handling: If the frame is lost or corrupted (failed CRC), the receiver stays silent (or sends a NAK). The sender's timer expires (Timeout), and it retransmits the same frame.
• Sequence Numbers: Frames and ACKs are numbered (0 or 1) to prevent duplicate frames.

Efficiency Formula

\[ \text{Efficiency } (\eta) = \frac{\text{Transmission Time (Tt)}}{\text{Total Cycle Time}} = \frac{T_t}{T_t + 2 \times T_p} = \frac{1}{1 + 2a} \]

Where \(a = \frac{T_p}{T_t}\) (Propagation Delay / Transmission Delay). It is highly inefficient for links with high propagation delay (like satellites) because the sender is idle most of the time.

Go-Back-N ARQ Protocol

Go-Back-N is a Sliding Window protocol that improves upon Stop-and-Wait by allowing the sender to transmit multiple frames before receiving an ACK.

• Window Sizes:
  • Sender Window Size \(W_s = N\) (can send up to N unacknowledged frames).
  • Receiver Window Size \(W_r = 1\) (can only accept frames strictly in order).
• Mechanism: If frame 3 is lost, but the sender continues to send frames 4, 5, and 6, the receiver will discard 4, 5, and 6 because it is strictly waiting for frame 3.
• Retransmission: When the sender times out waiting for the ACK for frame 3, it must "Go Back N" frames and retransmit frame 3 AND all subsequent frames (4, 5, 6).
• Efficiency: Much better than Stop-and-Wait, but wastes bandwidth on noisy channels due to retransmitting correctly received out-of-order frames.

Selective Repeat ARQ Protocol

Selective Repeat is the most efficient Sliding Window protocol, designed to overcome the wasted bandwidth of Go-Back-N on noisy channels.

• Window Sizes:
  • Sender Window Size \(W_s = 2^{m-1}\).
  • Receiver Window Size \(W_r = 2^{m-1}\) (where m is sequence number bits). Both windows must be equal and half the maximum sequence number.
• Mechanism: The receiver has a window larger than 1, meaning it can accept and buffer out-of-order frames. If frame 3 is lost, but 4, 5, and 6 arrive intact, the receiver buffers 4, 5, and 6 and sends a NAK specifically for frame 3.
• Retransmission: The sender only retransmits the specific frame that was lost (frame 3). Once the receiver gets frame 3, it delivers 3, 4, 5, and 6 to the Network layer in order.

ALOHA Protocols: Pure vs Slotted

ALOHA is a random-access MAC protocol used for satellite and wireless communications.

CSMA/CD (Carrier Sense Multiple Access with Collision Detection)

CSMA/CD is a MAC protocol used in traditional wired Ethernet LANs.

Mechanism:

1. Sense: A station listens to the cable. If idle, it transmits. If busy, it waits.
2. Detect: While transmitting, the station simultaneously listens. If it detects a signal amplitude higher than its own, a Collision has occurred.
3. Abort & Jam: It immediately stops transmitting the data frame and sends a short "Jam Signal" so all other stations know a collision happened.

Binary Exponential Backoff Algorithm

To prevent immediate re-collision, colliding stations wait a random amount of time before retrying. After the \(c\)-th collision (where \(c \le 10\)), a station chooses a random number \(K\) between \(0\) and \(2^c - 1\). It waits \(K \times 51.2 \mu s\) before sensing the line again. This exponentially increases the waiting time range, spreading out retries under heavy load.

CSMA/CA (Carrier Sense Multiple Access with Collision Avoidance)

CSMA/CA is used in Wireless LANs (Wi-Fi / 802.11) because wireless nodes cannot transmit and listen at the same time to detect collisions (the "Hidden Terminal Problem").

Mechanism (Collision Avoidance):

1. DIFS: A station with a frame to send listens to the channel. If idle for a period called DIFS, it proceeds.
2. RTS/CTS Handshake: To avoid hidden terminals, the sender transmits a short Request To Send (RTS) frame. The Access Point responds with a Clear To Send (CTS) frame broadcasted to everyone, reserving the channel.
3. Data & ACK: The sender transmits the Data frame. The receiver replies with an ACK. If no ACK is received, a collision is assumed, and the sender uses exponential backoff before retrying.

IPv4 Address Classes

An IPv4 address is 32 bits long. Classful addressing divided the IP space into 5 distinct classes based on the leading bits of the first octet.

(Note: 127.x.x.x is reserved for Loopback testing).

Subnetting and Subnet Masks

Subnetting is the process of logically dividing a single large IP network into multiple smaller, manageable sub-networks (subnets). This reduces broadcast traffic and conserves IP addresses.

Mechanism

It works by "borrowing" bits from the Host portion of the IP address and reassigning them to the Network portion to create Subnet IDs.

Subnet Mask

A 32-bit number used by routers to distinguish the Network/Subnet ID from the Host ID. It consists of a continuous stream of 1s (representing Network/Subnet bits) followed by a continuous stream of 0s (representing Host bits).

Example: A default Class C mask is 255.255.255.0. If we borrow 1 bit for subnetting, the mask becomes 255.255.255.128 (11111111.11111111.11111111.10000000), yielding 2 subnets of 126 hosts each.

CIDR (Classless Inter-Domain Routing)

CIDR was introduced to replace the rigid Classful (A, B, C) IP addressing system, which was rapidly depleting the IPv4 address space due to massive waste.

CIDR Notation (Slash Notation)

Instead of relying on fixed classes, CIDR uses a variable-length subnet mask (VLSM). An IP address is written with a slash followed by the prefix length: IP_Address / Prefix.

The Prefix (e.g., /26) explicitly states exactly how many bits from left to right represent the Network ID. The remaining bits (\(32 - \text{Prefix}\)) represent the Host ID.

Example: 192.168.1.0 /26. The network uses 26 bits. Hosts use \(32 - 26 = 6\) bits. Total hosts per subnet = \(2^6 - 2 = 62\) usable hosts.

Address Resolution Protocol (ARP)

ARP is a critical protocol used to map a known logical IP Address to an unknown physical MAC Address on a local network.

Workflow:

1. ARP Request: A host wants to send data to IP 192.168.1.10 but doesn't know its MAC address. The host broadcasts an ARP Request frame to the entire local network: "Who has IP 192.168.1.10? Tell me your MAC address." (Destination MAC is FF:FF:FF:FF:FF:FF).
2. ARP Reply: All devices receive the request, but only the device with IP 192.168.1.10 processes it. It sends a Unicast ARP Reply back to the original sender containing its MAC address.
3. Caching: The sender saves this IP-to-MAC mapping in its local ARP Cache table for future use.

RARP, BOOTP, and DHCP

These protocols handle assigning IP addresses to devices.

• RARP (Reverse ARP): Used by diskless workstations to discover their own IP address when they boot up. The device broadcasts its MAC address asking, "What is my IP?". It was obsolete because it only provided an IP address, no subnet mask or gateway.
• BOOTP (Bootstrap Protocol): An improvement over RARP. It provided the IP address, subnet mask, and default gateway. However, mappings were static; an admin had to manually bind MACs to IPs in a server file.
• DHCP (Dynamic Host Configuration Protocol): The modern standard. It dynamically leases IP addresses from a pool to devices for a specific duration. It automates entire network configurations (IP, Mask, Gateway, DNS servers) with zero manual admin work. Uses the DORA process (Discover, Offer, Request, Acknowledge).

Distance Vector Routing

A dynamic routing algorithm (like RIP) where every router shares its entire routing table, but only with its immediate neighbors, at regular intervals.

Mechanism:

Routers calculate the best path using the Bellman-Ford equation. They don't know the full topology of the network; they only know "Route X is in that direction and is Y hops away".

Count-to-Infinity Problem:

A major flaw in DVR. If a network link goes down, Router A might think it can reach the broken network via Router B, while Router B thinks it can reach it via Router A. They continuously update each other, infinitely increasing the hop count (distance) until it hits infinity. Solutions include Split Horizon and Route Poisoning.

Link State Routing

A modern dynamic routing algorithm (like OSPF) that solves the Count-to-Infinity problem.

Mechanism:

1. Discovery: Every router says "hello" to its immediate neighbors to learn their identities and link costs.
2. Flooding (LSA): Each router creates a Link State Packet (LSP) containing the state/cost of its direct links. It floods this packet to every single router in the entire network.
3. Database Construction: Every router builds an identical, complete map (Topology Database) of the entire network.
4. Dijkstra's Algorithm: Every router independently runs Dijkstra's Shortest Path algorithm on this map to compute the optimal routing table to all destinations.

Internet Control Message Protocol (ICMP)

ICMP is a Network Layer protocol used by routers and hosts to send error messages and operational information. It does not carry user data.

Key Utility Tools:

• Ping: Sends an ICMP Echo Request message to a destination IP. If the destination is alive and reachable, it replies with an ICMP Echo Reply. Used to test basic connectivity and measure round-trip time.
• Traceroute: Used to map the exact path a packet takes through the internet. It works by sending packets with increasing TTL (Time To Live) values (1, 2, 3...). When a packet reaches a router and TTL hits 0, the router drops it and sends back an ICMP Time Exceeded error, revealing that router's IP address.

TCP 3-Way Handshake

TCP is a connection-oriented protocol. Before any data can be transferred, a reliable connection must be established between the client and server using a 3-way handshake.

1. SYN: The client sends a packet with the SYN flag set and a random initial Sequence Number (x) to the server.
2. SYN-ACK: The server receives the SYN. It replies with a packet that has both SYN and ACK flags set. It acknowledges the client's sequence number (ack = x+1) and provides its own random initial Sequence Number (y).
3. ACK: The client receives the SYN-ACK. It replies with an ACK acknowledging the server's sequence number (ack = y+1). The connection is now established.

TCP 4-Way Connection Termination

TCP connections are full-duplex, meaning both directions must be shut down independently. This takes 4 steps.

1. FIN (Client): The client has no more data to send, so it sends a FIN segment to the server.
2. ACK (Server): The server acknowledges the FIN with an ACK. The client-to-server connection is now closed. However, the server might still have data to send to the client.
3. FIN (Server): Once the server finishes sending all its data, it sends its own FIN segment to the client.
4. ACK (Client): The client acknowledges the server's FIN with a final ACK. The connection is completely closed.

TCP Flow Control (Sliding Window)

Flow control prevents a fast sender from overwhelming a slow receiver. TCP uses a dynamic Sliding Window protocol to achieve this.

• Receiver Window (rwnd): Every time the receiver sends an ACK to the sender, it includes a "Window Size" field in the TCP header. This number tells the sender exactly how many bytes of buffer space are currently available at the receiver.
• Dynamic Adjustment: If the receiver's application processes data slowly, its buffer fills up, and it advertises a smaller window to the sender. The sender must slow down.
• Zero Window: If the receiver's buffer is completely full, it advertises a window size of 0. The sender stops transmitting entirely until it receives a window update greater than 0.

TCP Congestion Control

While Flow Control protects the receiver, Congestion Control protects the entire network (routers and links) from being overwhelmed.

TCP maintains a Congestion Window (cwnd). The sender can only transmit up to the minimum of cwnd and rwnd.

1. Slow Start: The connection starts with a very small cwnd (e.g., 1 MSS). For every ACK received, cwnd doubles. The window grows exponentially until it reaches a threshold (ssthresh).
2. Congestion Avoidance: Once ssthresh is reached, the growth slows down. cwnd only increases by 1 MSS per RTT (Additive Increase).
3. Congestion Detection:
   • 3 Duplicate ACKs (Fast Retransmit): Implies mild congestion. ssthresh is halved, and cwnd is halved.
   • Timeout: Implies severe congestion (packet totally lost). ssthresh is halved, and cwnd drops all the way back to 1 MSS (Multiplicative Decrease).

Leaky Bucket Algorithm

The Leaky Bucket algorithm is a traffic shaping mechanism used to convert bursty, erratic traffic into a smooth, steady stream of packets.

Mechanism:

• Imagine a bucket with a hole at the bottom. Water (packets) pours into the top in bursts.
• No matter how fast water pours in, it leaks out of the bottom hole at a constant, fixed rate.
• If water pours in so fast that the bucket fills up entirely, any extra water spills over and is lost (packets are dropped).

Use Case: Ideal for applications that require a strict, constant bandwidth without fluctuations, like Voice over IP (VoIP) or Live Video Streaming.

Token Bucket Algorithm

The Token Bucket algorithm is another traffic shaping mechanism, but unlike the Leaky Bucket, it allows for temporary bursts of data.

Mechanism:

• A bucket holds "Tokens" instead of packets. Tokens are generated and added to the bucket at a constant rate.
• To transmit a packet, the sender must grab and destroy one token from the bucket.
• If the bucket is empty, the sender must wait for a new token to be generated.
• If the sender has been idle, tokens accumulate in the bucket (up to its maximum capacity). When the sender suddenly needs to transmit a massive burst of data, it can use all the accumulated tokens at once to send the burst at maximum line speed.

Use Case: Standard internet traffic (web browsing, file downloads) which is naturally bursty.

Domain Name System (DNS)

DNS is the "phonebook of the Internet". It translates human-readable domain names (like www.google.com) into machine-readable IP addresses (like 142.250.190.46).

Hierarchy

• Root Servers (.): The top of the tree. They know where all the TLD servers are.
• TLD Servers (.com, .org): Top-Level Domain servers know where the Authoritative servers for specific domains are located.
• Authoritative Servers (google.com): The final servers that actually hold the exact IP address records for a specific domain.

Resolution Process

When you type a URL, your browser asks a Recursive Resolver (usually provided by your ISP). If the IP isn't cached, the resolver asks the Root Server → then the TLD Server → then the Authoritative Server, finally returning the IP to your browser.

HTTP vs HTTPS

File Transfer Protocol (FTP)

FTP is an application layer protocol used to transfer files between a client and a server. Uniquely, FTP requires two separate TCP connections to function:

1. Control Connection (Port 21): This connection is established first and stays open for the entire session. It is used exclusively to send commands (like LIST, RETR, QUIT) and receive server replies. No files are sent over this connection.
2. Data Connection (Port 20): This connection is opened dynamically only when a file transfer or directory listing is requested. The actual file bytes are transferred here. Once the specific file finishes transferring, this data connection is immediately closed.

Email Protocols

Sending and receiving emails involves distinct protocols:

• SMTP (Simple Mail Transfer Protocol - Port 25/587): Used exclusively for sending (pushing) emails. It pushes the email from the sender's client to the sender's mail server, and then from the sender's mail server to the recipient's mail server.
• POP3 (Post Office Protocol v3 - Port 110): Used for receiving (pulling) emails. It connects to the mail server, downloads all the emails to the local device, and then usually deletes them from the server. Not ideal for multiple devices.
• IMAP (Internet Message Access Protocol - Port 143): A modern receiving protocol. It syncs the local client with the mail server. Emails remain stored on the server. If you read or delete an email on your phone, it syncs and shows as read/deleted on your laptop.

Network Devices

• Hub (Layer 1): A dumb device that connects multiple computers. When it receives a packet on one port, it blindly broadcasts it to all other ports. High collision rate.
• Bridge (Layer 2): Connects two LAN segments. It learns MAC addresses and filters traffic, only forwarding frames across the bridge if the destination MAC is on the other side.
• Switch (Layer 2): A multi-port bridge. It maintains a MAC address table. When a frame arrives, the switch intelligently forwards it only to the specific port where the destination MAC lives. Eliminates collisions.
• Router (Layer 3): Connects different logical networks (e.g., your home LAN to the ISP's network). Uses IP addresses to determine the best path to forward packets globally.
• Gateway (All Layers): A device that translates between entirely different network architectures and protocols (e.g., connecting a TCP/IP network to an old IPX/SPX network).

IPv6 Header and Benefits over IPv4

IPv6 was developed to solve the IPv4 address exhaustion problem by expanding the address space from 32 bits to 128 bits.

Benefits of IPv6:

• Massive Address Space: \(2^{128}\) addresses, enough for every grain of sand on Earth to have an IP.
• Simpler Header: The IPv6 header has a fixed length of 40 bytes. Several optional IPv4 fields (like Fragmentation and Checksum) were removed or moved to Extension Headers, making routing much faster.
• No NAT Required: Because there are so many public IPs, every device can have a globally unique public IP, restoring true end-to-end connectivity without NAT.
• Built-in Security: IPSec (which is optional in IPv4) is fully integrated into the IPv6 protocol standard.

Wireless LAN (IEEE 802.11) Architecture

The IEEE 802.11 standard defines the architecture for Wi-Fi networks.

• BSS (Basic Service Set): The fundamental building block. It consists of a group of wireless stations and one central Access Point (AP). All communication goes through the AP.
• IBSS (Independent BSS / Ad-Hoc): A network with no AP. Stations communicate directly with each other (peer-to-peer).
• ESS (Extended Service Set): Created by connecting multiple BSSs together using a Distribution System (usually a wired Ethernet backbone). This allows users to roam from one AP's coverage area to another without dropping their connection (like Wi-Fi in a large university).

Bluetooth Architecture: Piconet & Scatternet

Bluetooth (IEEE 802.15.1) is a short-range wireless Personal Area Network (PAN) technology.

• Piconet: The basic Bluetooth network. It consists of exactly one Master node and up to 7 active Slave nodes. The Master controls the clock and frequency hopping sequence. Slaves can only communicate with the Master, not directly with each other.
• Scatternet: Formed when two or more Piconets overlap. A node can act as a Slave in one Piconet and a Master in another, effectively bridging the two Piconets together.

Network Address Translation (NAT) & PAT

NAT is used by routers to translate Private, non-routable IP addresses (like 192.168.1.5) into a single Public, routable IP address (like 8.8.8.8) before sending traffic out to the Internet.

Types:

• Static/Dynamic NAT: Translates 1 private IP to 1 public IP. Does not conserve addresses, mostly used to hide internal server IPs.
• PAT (Port Address Translation / NAT Overload): This is what home routers use. It maps multiple private IP addresses to a single public IP address. It distinguishes different internal devices by assigning them unique TCP/UDP Port Numbers in the router's NAT table.

Symmetric vs Asymmetric Cryptography

RSA Public Key Algorithm

RSA is the most widely used asymmetric encryption algorithm, based on the mathematical difficulty of factoring the product of two massive prime numbers.

Key Generation Steps:

1. Choose two large distinct prime numbers, \(p\) and \(q\).
2. Compute \(n = p \times q\). (\(n\) is the modulus for both keys).
3. Compute Euler's totient function: \(\phi(n) = (p-1) \times (q-1)\).
4. Choose an integer \(e\) such that \(1 < e < \phi(n)\), and \(e\) is coprime with \(\phi(n)\).
5. Compute \(d\) such that \((d \times e) \pmod{\phi(n)} = 1\). (\(d\) is the modular multiplicative inverse of \(e\)).

Keys: Public Key is \((e, n)\). Private Key is \((d, n)\).

Encryption: \(Cipher = Message^e \pmod{n}\)

Decryption: \(Message = Cipher^d \pmod{n}\)

Firewall Types

A firewall is a network security device that monitors and filters incoming and outgoing traffic based on security rules.

• Packet Filter (Stateless): Operates at Layer 3 (Network). It examines every individual packet in isolation and checks its IP address and Port number against a strict access control list (ACL). Fast, but easily bypassed.
• Stateful Inspection: Operates at Layer 4 (Transport). It remembers the "state" of active TCP connections. It knows if an incoming packet is a legitimate response to an outgoing request you just made, blocking unsolicited incoming traffic.
• Proxy (Application-Level Gateway): Operates at Layer 7 (Application). It acts as an intermediary. The client connects to the proxy, and the proxy connects to the outside world on behalf of the client. Highly secure, capable of deeply inspecting HTTP/FTP traffic for viruses, but very slow.

Quality of Service (QoS)

QoS refers to any technology that manages data traffic to reduce packet loss, latency, and jitter on a network. It prioritizes specific types of traffic (like VoIP) over less critical traffic (like file downloads).

Parameters:

• Bandwidth: The maximum rate of data transfer.
• Delay (Latency): The time it takes a packet to travel from source to destination.
• Jitter: The variation in packet delay. High jitter causes audio/video to stutter.
• Packet Loss: The percentage of packets that fail to reach their destination.

Techniques:

Traffic Shaping (Leaky Bucket), Scheduling (Priority Queuing where voice traffic goes first), and Resource Reservation.

Socket Programming Concepts

Socket programming allows two applications on different computers to communicate across a network.

• IP Address: Identifies the specific computer/server on the global network.
• Port Number: Identifies the specific application/process running on that computer (e.g., Port 80 for the web server, Port 22 for SSH).
• Socket: One endpoint of a two-way communication link. A socket is fundamentally defined by the combination of an IP Address and a Port Number (e.g., 192.168.1.5:80).
• Socket API (Berkeley Sockets): Provides functions for developers to use:
  • socket(): Creates a new socket.
  • bind(): Associates the socket with a specific local IP and port.
  • listen() & accept(): Server waits for incoming client connections.
  • connect(): Client initiates a connection to a server.
  • send() & recv(): Transmit data.

Master Answer: CRC & Sliding Window Protocols

Part (a) CRC Checksum Calculation

Given Data \(M = 1101011011\). Generator Polynomial \(G(x) = x^4 + x + 1\), which translates to binary divisor \(G = 10011\).

Length of G is \(n = 5\). Number of appended zeros = \(n - 1 = 4\).

Dividend = \(11010110110000\).

Perform Modulo-2 Division (XOR):

       1100001011
      ________________
10011 )11010110110000
       10011
       -----
        10011
        10011
        -----
         000010110
             10011
             -----
              010100
               10011
               -----
                01110

The Remainder (CRC Checksum) is 1110.

Transmitted Frame: Data + CRC = 11010110111110.

Part (b) Sliding Window Protocols Efficiency

Master Answer: Subnetting and CIDR

Part (a) Subnetting Calculation

Given IP Block: 192.168.1.0/24. We need 4 equal subnets.

To get 4 subnets, we need to borrow bits from the Host portion: \(2^n = 4 \implies n = 2\) bits borrowed.

New Prefix = \(24 + 2 = 26\).

1. Subnet Mask: /26 translates to 255.255.255.192 (binary: 11111111.11111111.11111111.11000000).

2. Subnet Details:

Host bits remaining = \(32 - 26 = 6\). Usable Hosts per subnet = \(2^6 - 2 = 62\). Block size = 64.

Part (b) CIDR Advantages

• Eliminates Class Rigidity: Addresses can be allocated in arbitrary block sizes, drastically reducing wasted IPs compared to Class A/B/C assignments.
• Route Aggregation (Supernetting): Multiple contiguous smaller networks can be summarized into a single routing table entry (e.g., combining four /24 blocks into one /22 block), reducing router memory load and speeding up lookups.

Master Answer: Routing Algorithms

Part (a) Dijkstra's Algorithm

Dijkstra's Algorithm is used in Link State Routing to find the shortest path from a source node to all other nodes.

1. Initialize distance to Source as 0, and all other nodes as Infinity.
2. Mark all nodes as unvisited. Set the Source node as the current node.
3. For the current node, consider all its unvisited neighbors. Calculate their tentative distances through the current node.
4. Compare the newly calculated tentative distance to the current assigned value and assign the smaller one.
5. When finished considering all neighbors of the current node, mark the current node as visited. It will never be checked again.
6. Select the unvisited node that is marked with the smallest tentative distance, set it as the new "current node", and go back to step 3.

Part (b) Distance Vector vs Link State Routing

Master Answer: TCP Congestion Control

Part (a) Congestion Control Algorithms

• Slow Start: The Congestion Window (cwnd) starts at 1 MSS. For every ACK received, cwnd increases by 1. Effectively, cwnd doubles every Round Trip Time (RTT). It grows exponentially until it reaches the ssthresh (Slow Start Threshold).
• Congestion Avoidance: Once ssthresh is reached, exponential growth is too risky. The algorithm switches to linear growth (Additive Increase). cwnd increases by exactly 1 MSS per entire RTT.
• Fast Retransmit: If a sender receives 3 duplicate ACKs for the same packet, it assumes the packet was dropped due to mild congestion. It immediately retransmits the missing packet without waiting for the timeout timer to expire.
• Fast Recovery: After Fast Retransmit, instead of dropping cwnd back to 1 (which Slow Start would do), it cuts cwnd and ssthresh in half (Multiplicative Decrease) and immediately resumes Congestion Avoidance linear growth.

Part (b) Congestion Window Graph

cwnd (MSS)
 32 |                       /\
    |                      /  \
 16 |          /^\        /    \    (Linear Growth - Congestion Avoidance)
    |         /   |      /      \
  8 |        /    |     /        \
    |       /     |____/          \__ (3 Dup ACKs: Fast Recovery, drops to half)
  1 |______/      (Timeout: Drops to 1, Slow Start)
    |__________________________________
           Transmission Rounds (RTT)

Master Answer: RSA and Security

Part (a) RSA Numerical Example

Given: \(p = 61, q = 53, e = 17\)

1. Calculate Modulus (n):
   \(n = p \times q = 61 \times 53 = 3233\).
2. Calculate Totient \(\phi(n)\):
   \(\phi(n) = (p-1)(q-1) = 60 \times 52 = 3120\).
3. Calculate Private Key (d):
   We need \(d\) such that \((17 \times d) \pmod{3120} = 1\).
   Using the Extended Euclidean Algorithm, we find \(d = 2753\).

Keys: Public Key is \((17, 3233)\). Private Key is \((2753, 3233)\).

To encrypt a message \(M=65\): \(Cipher = 65^{17} \pmod{3233} = 2790\).

Part (b) Digital Signatures and SSL/TLS

• Digital Signatures: Uses Asymmetric cryptography in reverse. The sender hashes the document and encrypts the hash using their Private Key. Anyone can decrypt it using the sender's Public Key. If it decrypts successfully and matches the document's hash, it proves Authenticity (only the sender has the private key) and Integrity (the document wasn't altered).
• SSL/TLS Handshake:
  1. Client Hello: Client sends supported cipher suites.
  2. Server Hello & Certificate: Server chooses a cipher and sends its Digital Certificate (containing its Public Key).
  3. Key Exchange: Client verifies the certificate. The client generates a symmetric "Session Key", encrypts it with the server's Public Key, and sends it to the server.
  4. Secure Communication: Both parties now use the fast symmetric Session Key to encrypt all HTTP data.

Master Answer: Hamming Code

Part (a) Constructing 7-bit Hamming Code for 1011

Data bits \(m = 4\) (1011). Required parity bits \(r = 3\) (since \(2^3 \ge 4+3+1\)). Total length = 7 bits.

Positions (Powers of 2 are parity): \(P_1, P_2, D_3, P_4, D_5, D_6, D_7\)

Insert data (1011): \(P_1, P_2, 1, P_4, 0, 1, 1\)

Calculate Even Parity:

• \(P_1\) checks positions 1, 3, 5, 7 \(\rightarrow\) ?, 1, 0, 1 \(\rightarrow\) To make even, \(P_1 = 0\).
• \(P_2\) checks positions 2, 3, 6, 7 \(\rightarrow\) ?, 1, 1, 1 \(\rightarrow\) To make even, \(P_2 = 1\).
• \(P_4\) checks positions 4, 5, 6, 7 \(\rightarrow\) ?, 0, 1, 1 \(\rightarrow\) To make even, \(P_4 = 0\).

Transmitted Code: 0 1 1 0 0 1 1

Part (b) Error Detection and Correction

Suppose the 3rd bit flips during transmission. Received code: 0 1 0 0 0 1 1 (Data is now 0011).

Receiver calculates parity checks (C bits):

• \(C_1\) checks 1, 3, 5, 7 (0, 0, 0, 1) \(\rightarrow\) Parity is Odd (1), meaning ERROR. So, \(C_1 = 1\).
• \(C_2\) checks 2, 3, 6, 7 (1, 0, 1, 1) \(\rightarrow\) Parity is Odd (1), meaning ERROR. So, \(C_2 = 1\).
• \(C_4\) checks 4, 5, 6, 7 (0, 0, 1, 1) \(\rightarrow\) Parity is Even (0), meaning OK. So, \(C_4 = 0\).

Read the C bits in reverse (\(C_4 C_2 C_1\)): 011 (which is decimal 3). The receiver knows exactly that the 3rd bit is flipped and changes it from 0 back to 1, restoring the original data.

Master Answer: CSMA/CD Timing Constraint

Part (a) The Formula \(T_{frame} \ge 2 \times T_{prop}\)

In CSMA/CD, for a sender to detect a collision, it must still be transmitting its frame when the collision signal reaches back to it.

Worst-case scenario: Station A and Station B are at opposite ends of the cable. A transmits. Just before A's signal reaches B (taking \(T_{prop}\) time), B also transmits, causing a collision at B's end. The collision noise must travel all the way back to A (taking another \(T_{prop}\) time).

Therefore, A must keep transmitting for at least \(2 \times T_{prop}\) (the Round Trip Time) to guarantee it hears the collision. If A transmits a very short frame and stops before \(2 \times T_{prop}\), it will hear the collision but wrongly assume it was someone else's collision, thinking its own frame succeeded.

Thus: Transmission Time (\(T_{frame}\)) \(\ge\) Round Trip Time (\(2 \times T_{prop}\)).

Part (b) Minimum Frame Size Calculation

Given: Bandwidth = 1 Gbps (\(10^9\) bps). Distance = 1 km (\(1000\) m). Signal speed = \(2 \times 10^8\) m/s.

\(T_{prop} = \frac{\text{Distance}}{\text{Speed}} = \frac{1000}{2 \times 10^8} = 5 \times 10^{-6} \text{ seconds} (5 \mu s)\)

\(T_{frame} \ge 2 \times T_{prop} = 2 \times 5 \mu s = 10 \mu s\)

Since \(T_{frame} = \frac{\text{Frame Size (Bits)}}{\text{Bandwidth}}\):

\(\text{Frame Size} = T_{frame} \times \text{Bandwidth} = (10 \times 10^{-6}) \times 10^9 = 10,000 \text{ bits} = \mathbf{1250 \text{ bytes}}\).

Master Answer: Subnetting and Supernetting

Part (a) Concepts

• Subnetting: Borrowing bits from the Host portion to create more networks. (e.g., Splitting one /24 into four /26 networks). Used to reduce broadcast domains.
• Supernetting (Route Aggregation): Borrowing bits from the Network portion to combine multiple small networks into one large network. (e.g., Combining four /24 networks into one /22 network). Used to shrink the size of routing tables.

Part (b) Aggregating 4 Class C Networks

Given networks:

• 200.10.0.0 (Binary: 200.10.00000000.0)
• 200.10.1.0 (Binary: 200.10.00000001.0)
• 200.10.2.0 (Binary: 200.10.00000010.0)
• 200.10.3.0 (Binary: 200.10.00000011.0)

Looking at the 3rd octet, the first 22 bits (from the left) are identical across all 4 IP addresses (200.10.000000xx). We can summarize these 4 blocks by making the network mask 22 bits instead of 24.

Aggregated CIDR Block: 200.10.0.0 /22

Master Answer: Distance Vector Routing Issues

Part (a) Bellman-Ford Algorithm

In Distance Vector Routing, each router periodically sends its entire routing table (vectors of distances to all known destinations) to its immediate neighbors. When a router receives an update from a neighbor, it updates its own table using the Bellman-Ford equation:

Dx(y) = min { c(x,v) + Dv(y) } for each neighbor v

Essentially: The cost from me to destination Y is the minimum of (cost from me to my neighbor V) + (neighbor V's advertised cost to destination Y).

Part (b) Count-to-Infinity & Solutions

If the link between Router A and Network N goes down, A updates its distance to N to Infinity. However, if neighbor Router B recently advertised "I can reach N in 2 hops" (which was actually bouncing through A), Router A will wrongly think "Oh, B has an alternate route! I will route through B, cost = 3". A advertises this to B. B updates its cost to 4. They bounce updates back and forth, counting to infinity.

Solutions:

• Split Horizon: A router never advertises a route back out the same interface it learned it from. (If B learned the route to N from A, B will not advertise that route back to A).
• Poison Reverse: Instead of not advertising, B actively advertises the route back to A with a metric of Infinity. This immediately kills any chance of A trying to use B for that route.

Master Answer: BGP and Gateway Protocols

Part (a) BGP Path Vector Routing

Border Gateway Protocol (BGP) is the protocol that makes the internet work. Instead of Distance Vector or Link State, it uses Path Vector Routing.

Instead of just advertising a distance metric (like "cost 5"), BGP advertises the entire path of Autonomous Systems (AS) a packet must traverse (e.g., "Path to Network X: AS100 → AS300 → AS500").

Why Path Vector? It inherently prevents routing loops. If a router in AS100 receives a BGP advertisement and sees "AS100" already in the path string, it immediately rejects the route because accepting it would create a loop.

Part (b) IGP vs EGP

Master Answer: IPv4 Header and Fragmentation

Part (a) IPv4 Header Fields

The IPv4 header is typically 20 bytes long.

• Version (4 bits): Indicates IPv4.
• IHL (Internet Header Length, 4 bits): Length of the header in 32-bit words (usually 5, meaning 20 bytes).
• TOS (Type of Service, 8 bits): Used for QoS to prioritize packets.
• Total Length (16 bits): Total length of the packet (header + data) in bytes. Max is 65,535.
• Identification (16 bits): Unique ID assigned to a packet, used heavily in fragmentation.
• Flags (3 bits): Bit 0: Reserved. Bit 1 (DF): Don't Fragment. Bit 2 (MF): More Fragments coming.
• Fragment Offset (13 bits): Specifies where in the original original unfragmented packet this fragment belongs.
• TTL (Time to Live, 8 bits): Decremented by 1 at every router. If it hits 0, the packet is discarded (prevents infinite routing loops).
• Protocol (8 bits): Identifies the next-level protocol (e.g., 6 for TCP, 17 for UDP, 1 for ICMP).
• Header Checksum (16 bits): Error-checking for the header only.
• Source & Destination IP Addresses (32 bits each).

Part (b) Fragmentation and Reassembly

If a router receives a 4000-byte packet but the next link's MTU (Maximum Transmission Unit) is 1500 bytes, the router must fragment the packet.

Example: 4000-byte packet (20 bytes header + 3980 bytes data). MTU = 1500.

• Fragment 1: Data = 1480 bytes. ID = 777. MF = 1 (More Fragments). Offset = 0.
• Fragment 2: Data = 1480 bytes. ID = 777. MF = 1. Offset = 185 (1480 / 8 = 185).
• Fragment 3: Data = 1020 bytes. ID = 777. MF = 0 (Last Fragment). Offset = 370 (2960 / 8 = 370).

The destination host uses the matching Identification numbers to group them, checks the MF flag to know when it has the last piece, and uses the Offset to order them correctly during Reassembly.

Master Answer: TCP Header and Connections

Part (a) TCP Header Fields

The TCP header is typically 20 bytes long.

• Source & Destination Port (16 bits each): Identifies the sending and receiving applications.
• Sequence Number (32 bits): Identifies the byte in the stream of data from the sender to receiver.
• Acknowledgment Number (32 bits): The next Sequence Number the receiver is expecting.
• Data Offset / Header Length (4 bits): Size of the TCP header in 32-bit words.
• Control Flags (6 bits): URG (Urgent), ACK, PSH (Push), RST (Reset connection), SYN (Synchronize), FIN (Finish connection).
• Window Size (16 bits): Used for Flow Control. The number of bytes the receiver is currently willing to accept.
• Checksum (16 bits): Error-checking for the header AND the data.
• Urgent Pointer (16 bits): Points to urgent data if the URG flag is set.

Part (b) Connection State Transition Diagram

Key states during connection setup and teardown:

Master Answer: Traffic Shaping

Part (a) Leaky Bucket vs Token Bucket

Part (b) Token Bucket Burst Duration Calculation

Given:

• Bucket Capacity \(C = 1 \text{ MB}\)
• Token Arrival Rate \(R = 2 \text{ MB/s}\)
• Max Transmission Rate \(M = 10 \text{ MB/s}\)

Let \(S\) be the maximum burst duration in seconds. During this time \(S\), the total data transmitted at max rate \(M\) must equal the data initially in the bucket \(C\) plus the new tokens generated during that time \((R \times S)\).

\[ M \times S = C + (R \times S) \]

\[ (M - R) \times S = C \]

\[ S = \frac{C}{M - R} = \frac{1}{10 - 2} = \frac{1}{8} = \mathbf{0.125 \text{ seconds}} \]

The system can transmit at the maximum 10 MB/s speed for 0.125 seconds before it runs out of tokens and is forced to slow down to the 2 MB/s token arrival rate.

Master Answer: Domain Name System (DNS)

Part (a) Iterative vs Recursive Resolution

• Recursive: The client asks the Local DNS Server. The Local server takes full responsibility. It asks the Root, gets referred to the TLD, asks the TLD, gets referred to the Authoritative, asks the Authoritative, gets the IP, and finally hands the fully resolved IP back to the client. The client does no work.
• Iterative: The Local DNS Server asks the Root. The Root replies, "I don't know, but here is the IP of the TLD." The Local Server then asks the TLD. The TLD replies, "I don't know, but here is the IP of the Authoritative." The Local server does all the back-and-forth legwork.

Part (b) DNS Resource Records (RR)

A Resource Record has the format (Name, Value, Type, TTL).

• Type A (Address): Maps a hostname (www.google.com) to an IPv4 address.
• Type AAAA (Quad-A): Maps a hostname to an IPv6 address.
• Type CNAME (Canonical Name): Maps an alias hostname (www.ibm.com) to its true, canonical name (server-east.ibm.com).
• Type MX (Mail Exchange): Identifies the mail server responsible for accepting email messages on behalf of a domain.
• Type NS (Name Server): Identifies the Authoritative DNS server for a domain.
• Type PTR (Pointer): Used for Reverse DNS lookup. Maps an IP address back to a hostname.

Master Answer: Evolution of HTTP

Part (a) HTTP 1.0 vs 1.1 vs 2.0 vs 3.0

Part (b) Advanced Concepts

• Persistent Connections (Keep-Alive): Keeps the underlying TCP socket open after a request is completed, saving the massive overhead of performing a 3-way handshake for every asset on a web page.
• Pipelining: Sending multiple HTTP requests on a persistent connection without waiting for the corresponding responses. (Mostly abandoned in favor of Multiplexing).
• Multiplexing: HTTP/2 breaks requests and responses into small interleaved frames. If a massive image is downloading, a tiny CSS file can be downloaded simultaneously over the exact same TCP connection without waiting.
• QUIC Protocol: Developed by Google. It provides the reliability of TCP but runs on top of UDP. It combines the cryptographic handshake (TLS) with the transport handshake, resulting in 0-RTT connection setups.

Master Answer: Cryptography, Hashing, and PKI

Part (a) Hash Functions and Certificates

• Cryptographic Hash Functions (MD5, SHA-256): A mathematical algorithm that takes input data of any size and produces a fixed-size string of characters (a hash).
  Properties: It is a one-way function (cannot be reversed). Changing even one comma in a 500-page document completely changes the resulting hash (Avalanche Effect). Used to verify Data Integrity.
• Digital Certificates: An electronic document used to prove the ownership of a Public Key. It acts like a digital passport. It contains the owner's identity (website name), their Public Key, and the Digital Signature of the Certificate Authority that issued it.

Part (b) Public Key Infrastructure (PKI) & CA Verification

PKI is the entire ecosystem of roles, policies, and hardware needed to manage digital certificates.

How your browser verifies a CA:

1. You visit https://bank.com. The server sends its Digital Certificate.
2. Your browser checks who issued the certificate (e.g., DigiCert CA).
3. The browser looks in its internal, pre-installed "Trusted Root Store" to find DigiCert's Public Key.
4. The browser uses DigiCert's Public Key to decrypt the Digital Signature on the bank's certificate.
5. If the decrypted signature matches the certificate's hash, the browser knows the certificate is genuine and hasn't been tampered with. It now trusts the bank's Public Key.

Master Answer: IPsec Architecture

Part (a) IPsec Protocol Suite

IPsec (Internet Protocol Security) secures IP communications by authenticating and encrypting each IP packet of a communication session. It operates at Layer 3 (Network).

• AH (Authentication Header): Provides data origin authentication, data integrity, and anti-replay protection. It signs the entire packet, including the IP header. It does not provide encryption (data is still in plain text).
• ESP (Encapsulating Security Payload): Provides confidentiality (encryption) in addition to authentication and integrity. It encrypts the payload so sniffers cannot read the data.
• IKE (Internet Key Exchange): The protocol used to set up the Security Associations (SA). It securely exchanges the cryptographic keys (using Diffie-Hellman) before AH or ESP can start transmitting data.

Part (b) Transport Mode vs Tunnel Mode

Master Answer: Wireless LAN MAC (802.11)

Part (a) CSMA/CA Overview

Carrier Sense Multiple Access with Collision Avoidance (CSMA/CA) is required in Wi-Fi because wireless radios cannot transmit and receive simultaneously to detect collisions like Ethernet can.

Part (b) Hidden/Exposed Terminal Problems & RTS/CTS

• The Hidden Terminal Problem: Station A and Station C can both see Access Point B, but A and C cannot see each other (they are hidden by distance/walls). If A and C both transmit to B simultaneously, they won't detect each other's carrier, causing a massive collision at B.
• The Exposed Terminal Problem: Station B wants to transmit to A. Station C wants to transmit to D. B transmits to A. C hears B transmitting and wrongly assumes the channel is busy, so C waits. But C's transmission to D would NOT have interfered with B's transmission to A. C is unnecessarily blocked.

Solution: RTS/CTS Handshake:

Before sending data, A sends a short Request-To-Send (RTS) to B. B replies with a Clear-To-Send (CTS) broadcast. Station C hears B's CTS and knows to stay quiet. The Hidden Terminal is solved because C heard the receiver (B) grant permission, even if C couldn't hear the sender (A).

Master Answer: Software Defined Networking (SDN)

Part (a) SDN Architecture

Traditional routers combine both decision-making (Routing protocols like OSPF) and data-forwarding (moving packets from input port to output port) in the exact same hardware box. SDN completely separates these two functions.

Part (b) Planes and Protocols

• Data Plane (Forwarding Plane): Dumb, fast hardware switches. Their only job is to look at an incoming packet, check a local Flow Table, and forward the packet out the correct port at lightning speed. They make no routing decisions.
• Control Plane: The "Brains" of the network. This is moved out of the routers and into a centralized software application called the SDN Controller. The controller computes the optimal routing paths for the entire network globally.
• OpenFlow Protocol: The standard communication protocol used between the centralized SDN Controller and the dumb Data Plane switches. The Controller uses OpenFlow to push down the computed Flow Tables to the switches.

Benefit: A network admin can program and change the behavior of the entire network globally from a single software dashboard, rather than logging into 500 individual routers to change OSPF configurations.

Master Answer: Case Study - Web Browsing Lifecycle

Part (a) & (b) Tracing a packet to google.com

When a user types https://www.google.com, a massive chain of protocols executes in milliseconds:

1. DNS Query: The browser doesn't know Google's IP. It checks its cache. If missing, it sends a UDP DNS request (Port 53) to the local DNS resolver to get the IP address (e.g., 142.250.190.46).
2. ARP Resolution: The PC needs to send the packet to its Default Gateway (Home Router). It broadcasts an ARP Request: "Who has the router's IP?". The router replies with its MAC address.
3. Ethernet Framing: The PC encapsulates the packet in an Ethernet Frame with the Router's MAC as the destination.
4. TCP 3-Way Handshake: The browser initiates a TCP connection to Google's IP on Port 443 (HTTPS). It sends a SYN, Google sends SYN-ACK, PC sends ACK.
5. TLS Handshake: Because it's HTTPS, the client and server negotiate encryption algorithms. Google sends its Digital Certificate. They establish a secure symmetric session key.
6. HTTP GET Request: The browser finally encrypts an HTTP GET / request using the TLS key and sends it.
7. IP Routing: The packet travels through dozens of ISP routers using OSPF and BGP to find the optimal path to Google's data center.
8. Response: Google's server processes the request, sends back a 200 OK with the encrypted HTML payload. The browser decrypts and renders the page.

Master Answer: ALOHA Throughput Analysis

Part (a) Mathematical Calculation

Let \(G\) be the offered load (total number of frames generated by all stations in one frame transmission time \(T_f\)). Let \(S\) be the throughput (successful transmissions).

Pure ALOHA:

Vulnerable time is \(2 \times T_f\). A frame is successful only if no other frame is generated during this \(2T_f\) window. Using Poisson distribution, the probability of 0 frames generated in \(2T_f\) is \(e^{-2G}\).

\[ S_{pure} = G \times e^{-2G} \]

To find the maximum, set the derivative \(dS/dG = 0\). This occurs at \(G = 0.5\).

\[ S_{max} = 0.5 \times e^{-1} \approx 0.184 \text{ (18.4% efficiency)} \]

Slotted ALOHA:

Vulnerable time is reduced to exactly \(1 \times T_f\) because transmissions can only start at slot boundaries. The probability of 0 frames generated in \(T_f\) is \(e^{-G}\).

\[ S_{slotted} = G \times e^{-G} \]

Maximum occurs at \(G = 1\).

\[ S_{max} = 1 \times e^{-1} \approx 0.368 \text{ (36.8% efficiency)} \]

Part (b) Throughput vs Load Graph

   Throughput (S)
      |
 0.368|             *  (Slotted ALOHA Max)
      |           *   *
 0.184|     *   *       * (Pure ALOHA Max)
      |   *   *           *
      | *   *               *
      |*__*___________________*_______
      0  0.5       1.0              Offered Load (G)

Master Answer: Optical Fiber Communication

Part (a) Principles of Optical Fiber

• Total Internal Reflection (TIR): The core principle. Light traveling through a denser medium (glass core) hits the boundary of a less dense medium (cladding) at an angle greater than the "critical angle". Instead of passing through, the light perfectly reflects back into the core, bouncing down the cable with zero loss through the walls.
• Multi-mode Fiber: Has a thick core. Light rays bounce at multiple different angles (modes). This causes Modal Dispersion (pulses spread out and blur together over long distances). Used for short-distance LANs.
• Single-mode Fiber: Has a microscopic core. Light can only travel straight down the middle in one single mode. Eliminates modal dispersion. Used for long-haul transoceanic cables.

Part (b) Limitations

• Attenuation (Signal Loss): Measured in Decibels per kilometer (dB/km). Caused by impurities in the glass scattering or absorbing the light. Formula: \(\text{Loss} = 10 \log_{10}(\frac{P_{in}}{P_{out}})\). If a 100km link has 0.2 dB/km attenuation, total loss is 20 dB, meaning 99% of the signal power is lost and requires an optical amplifier.
• Dispersion (Signal Smearing): As light pulses travel, they spread out in time. If they spread too much, adjacent pulses overlap (Inter-Symbol Interference), and the receiver cannot distinguish a 1 from a 0. Limits the maximum bandwidth and distance.

Master Answer: Data Link Layer Framing

Part (a) Framing Methods

Framing breaks a continuous bit stream into manageable blocks (frames) so the receiver knows where data starts and ends.

• Byte Count: The frame header specifies the exact number of bytes in the frame. (Flaw: If the count gets corrupted, the receiver loses sync entirely).
• Byte Stuffing (Character Stuffing): Special FLAG bytes denote the start/end of a frame. If the FLAG byte accidentally appears inside the data, an ESC (Escape) byte is stuffed before it to tell the receiver "this is data, not the end of the frame".
• Bit Stuffing: The FLAG is a specific 8-bit pattern: 01111110 (Six 1s). To ensure this pattern never appears in the data, the sender artificially stuffs a 0 after every five consecutive 1s in the payload.

Part (b) Bit Stuffing Example

Original Payload: 011111101111110

Rule: After exactly five 1s, stuff a 0.

• First block: 011111 → Stuff a 0 → 011111(0)
• Next bit is 1 → 011111(0)1
• Next bit is 0 → 011111(0)10
• Next block: 11111 → Stuff a 0 → 011111(0)1011111(0)
• Next bit is 1 → 011111(0)1011111(0)1
• Next bit is 0 → 011111(0)1011111(0)10

Stuffed Payload: 01111101011111010

Final Transmitted Frame: [FLAG] 01111101011111010 [FLAG]

Master Answer: SNMP Architecture

Part (a) SNMP v1, v2, v3

Simple Network Management Protocol (SNMP) is used to monitor and configure network devices (routers, servers, printers).

• SNMPv1: Original standard. Unencrypted (plaintext community strings).
• SNMPv2c: Added Bulk GET requests for efficiency, but security was still weak plaintext.
• SNMPv3: Introduced massive security upgrades: Authentication (passwords), Privacy (Data Encryption via AES), and Access Control (who can view what).

Part (b) MIB and SMI

• SMI (Structure of Management Information): The rules defining how management data is structured, named, and formatted. It ensures all devices speak the same structural language.
• MIB (Management Information Base): A hierarchical, tree-structured database of all the variables (objects) that can be monitored or changed on a device.
  Example: An Object Identifier (OID) like 1.3.6.1.2.1.2.2.1.10.1 specifically points to the "bytes received on interface 1". The SNMP manager queries this OID to draw a traffic graph.

Master Answer: Mobile IP Architecture

Part (a) Overview

Standard IP assumes a device's IP address dictates its physical location. If a laptop moves to a new Wi-Fi network, its IP must change, breaking all active TCP connections. Mobile IP solves this, allowing a device to roam across different networks while keeping the exact same IP address.

Part (b) Core Components

• Home Agent (HA): A router on the Mobile Node's permanent home network. It intercepts packets destined for the node when it is away.
• Foreign Agent (FA): A router on the new, visited network that the Mobile Node has roamed into.
• Care-of Address (CoA): A temporary IP address assigned to the Mobile Node by the Foreign network. It reflects the node's actual current physical location.
• Tunneling Mechanism:
  1. The Mobile Node moves and registers its new CoA with its Home Agent.
  2. A sender sends a packet to the node's permanent Home IP.
  3. The Home Agent intercepts the packet, encapsulates it inside a new IP packet destined for the Care-of Address (IP-in-IP Tunneling), and sends it.
  4. The Foreign Agent receives the tunneled packet, strips the outer header, and delivers the original packet to the Mobile Node.

Master Answer: Network Security Threats

Part (a) Common Threats

• DoS (Denial of Service): Flooding a server with fake requests so legitimate users cannot access it.
• DDoS (Distributed DoS): Using a massive botnet of thousands of compromised IoT devices to launch a DoS attack. Extremely hard to block because the traffic comes from everywhere.
• Man-in-the-Middle (MitM): An attacker secretly intercepts and relays communications between two parties who believe they are talking directly (e.g., using a fake open Wi-Fi hotspot).
• SQL Injection: Inserting malicious SQL commands into a website's input form to manipulate the backend database (e.g., stealing passwords or deleting tables).

Part (b) SYN Flood Attack & SYN Cookies

SYN Flood (DoS): An attacker sends millions of TCP SYN requests with spoofed IPs but never completes the 3-way handshake (never sends the final ACK). The server allocates memory for all these "half-open" connections until its RAM fills up, causing it to crash.

SYN Cookies Defense: The server stops allocating memory for half-open connections. Instead, when it receives a SYN, it cryptographically hashes the client's IP, Port, and a secret key to generate a unique "Cookie". It sends this Cookie as the SYN-ACK Sequence Number and forgets about the client. If the client is legitimate, it replies with an ACK containing (Cookie + 1). The server recalculates the hash to verify it, and only then allocates memory to establish the connection.

Master Answer: P2P and BitTorrent

Part (a) P2P vs Client-Server

In Client-Server, all clients download files from a single, centralized server. As more users join, the server becomes a bottleneck and crashes. In Peer-to-Peer (P2P), every node is both a client and a server. As more users join, the total upload capacity of the network actually increases.

Part (b) BitTorrent Protocol Details

• BitTorrent: A file is broken into hundreds of small chunks. A user downloads chunk A from Peer 1, chunk B from Peer 2, and simultaneously uploads chunk A to Peer 3.
• DHT (Distributed Hash Table): A decentralized way for peers to find each other without needing a central "Tracker" server. Every peer acts as a mini-directory, maintaining a small routing table mapping file hashes to peer IPs.
• Choking Algorithm (Tit-for-Tat): A defense against "Leechers" (people who download but refuse to upload). A peer monitors who is uploading to it the fastest. It "unchokes" (allows uploads to) the top 4 fastest peers, and "chokes" (blocks) the rest. If you want fast downloads, you are mathematically forced to upload fast in return.

Master Answer: VLAN Architecture

Part (a) VLAN and 802.1Q Tagging

A VLAN (Virtual LAN) logically divides a single physical network switch into multiple isolated broadcast domains. For example, Ports 1-10 are the "HR VLAN", and Ports 11-20 are the "Engineering VLAN". A broadcast sent by HR will never reach Engineering, even though they are plugged into the same switch.

IEEE 802.1Q Tagging: When a frame needs to travel between two different switches via a "Trunk Link", the switches need to know which VLAN the frame belongs to. 802.1Q inserts a 4-byte Tag into the Ethernet header containing the 12-bit VLAN ID (allowing up to 4094 VLANs).

Part (b) Configuration and Routing

VLANs provide strict Layer 2 isolation. Computers in VLAN 10 literally cannot ping computers in VLAN 20, even on the same subnet.

Inter-VLAN Routing: To allow controlled communication between VLANs, a Layer 3 Router (or Layer 3 Switch) is required.
Router-on-a-Stick: A single physical cable connects the switch to the router. The router interface is divided into multiple virtual "sub-interfaces", one for each VLAN. The router acts as the default gateway for each VLAN, routing packets securely between them based on ACLs.

Master Answer: Overlay Networks & CDN

Part (a) Overlay Networks & CDNs

• Overlay Network: A virtual, logical network built on top of an existing physical network. (e.g., A VPN is an overlay network built on top of the physical internet. P2P is an overlay network).
• CDN (Content Delivery Network): A globally distributed network of proxy servers (like Cloudflare or Akamai). Its goal is to serve content (images, videos, HTML) to end-users with high availability and high performance by caching the content geographically closer to the user.

Part (b) Edge Caching and Anycast

• Edge Caching: Instead of a user in India downloading a video from a server in New York (high latency), the CDN caches a copy of the video on an "Edge Server" located in Mumbai. The Indian user downloads from Mumbai, dropping latency from 250ms to 20ms.
• Anycast Routing: A network routing methodology where multiple servers in different geographic locations all share the exact same IP address. When a user queries that IP, the BGP routing protocol automatically routes the request to the topologically closest server.

Master Answer: Real-time Streaming

Part (a) Streaming Protocols

• RTP (Real-time Transport Protocol): Runs over UDP. Provides sequence numbers and timestamps to the raw audio/video packets so the receiver can play them back in order and in sync.
• RTCP (RTP Control Protocol): Operates alongside RTP. It sends periodic statistics (packet loss, delay) back to the sender so the sender can dynamically adjust the video quality.
• RTSP (Real-Time Streaming Protocol): The "Remote Control" protocol. Used to establish the session and send Play, Pause, and Fast-Forward commands to the media server.
• HLS (HTTP Live Streaming): Apple's protocol. It breaks a video into 10-second chunks and streams them over standard HTTP/TCP. It seamlessly adjusts video resolution based on current internet speed (Adaptive Bitrate Streaming).

Part (b) Overcoming Network Flaws

• Jitter Buffering: Packets arrive over the internet with varying delays (Jitter). The receiver intentionally delays playing the video by a few seconds, storing incoming packets in a buffer. It then reads out of the buffer at a perfectly smooth, constant rate to prevent stuttering.
• Packet Loss Concealment (PLC): If a UDP audio packet is completely lost, retransmitting it is too slow for a live call. The receiver uses PLC algorithms to "guess" and synthesize the missing 20 milliseconds of audio by interpolating the sound before and after the lost packet, masking the drop from the human ear.