Chapter 1.
introduction
1.1 Architectural Principles
1.2 Design and Implementation
1.3 TCP/IP Architecture and Protocol Suite
1.4 Internet, Intranet, Extranet
1.5 Application Design
1.6 Standardization Procedure
1.7 Implementation and Software Distribution
1.8 Attacks Related to Internet Architecture
1.9 Summary
1.10 References


Chapter 2.
Internet address structure
2.1 Overview
2.2 Representation of IP addresses
2.3 Basic Structure of IP Addresses
2.4 Merge with CIDR
2.5 Special purpose addresses
2.6 Allocation
2.7 Unicast Address Assignment
2.8 IP address related attacks
2.9 Summary
2.10 References


Chapter 3.
Link layer
3.1 Overview
3.2 Ethernet and IEEE 802 LAN/MAN Standards
3.3 Full duplex, power saving, auto-negotiation, 802.1X flow control
3.4 Bridges and Switches
3.5 Wireless LAN: IEEE 802.11 (Wi-Fi)
3.6 PPP
3.7 Loopback
3.8 MTU and Path MTU
3.9 Tunneling Basics
3.10 Attacks on the Link Layer
3.11 Summary
3.12 References


Chapter 4. ARP: Address Resolution Protocol
4.1 Overview
4.2 Example
4.3 ARP Cache
4.4 ARP Frame Format
4.5 ARP Example
4.6 ARP Cache Timeout
4.7 Proxy ARP
4.8 Gratuitous ARP and Address Collision Detection (ACD)
4.9 arp command
4.10 Using ARP to Set IPv4 Addresses on Embedded Devices
4.11 ARP-related attacks
4.12 Summary
4.13 References


Chapter 5.
Internet Protocol
5.1 Overview
5.2 IPv4 Header and IPv6 Header
5.4 IP Forwarding
5.5 Mobile IP
5.6 Host Processing of IP Datagrams
5.7 IP-related attacks
5.8 Summary
5.9 References


Chapter 6.
System Configuration: DHCP and Autoconfiguration
6.1 Overview
6.2 Dynamic Host Configuration Protocol
6.3 Automatically setting stateless addresses
6.4 Interaction between DHCP and DNS
6.5 PPP over Ethernet (PPPoE)
6.6 Attacks related to system settings
6.7 Summary
6.8 References


Chapter 7.
Firewalls and Network Address Translation
7.1 Overview
7.2 Firewall
7.3 Network Address Translation (NAT)
7.4 NAT Traversal
7.5 Packet Filtering Firewall and NAT Settings
7.6 NAT for IPv4/IPv6 Coexistence and Transition
7.7 Attacks Related to Firewalls and NAT
7.8 Summary
7.9 References


Chapter 8. ICMPv4 and ICMPv6: Internet Control Message Protocol
8.1 Overview
8.2 ICMP Messages
8.3 ICMP Error Messages
8.4 ICMP Inquiry/Informational Messages
8.5 IPv6 Neighbor Discovery
8.6 Conversion between ICMPv4 and ICMPv6
8.7 Attacks Related to ICMP
8.8 Summary
8.9 References


Chapter 9.
Broadcasting and local multicasting
9.1 Overview
9.2 Broadcasting
9.3 Multicasting
9.4 IGMP and
9.5 Attacks Related to IGMP and MLD
9.6 Summary
9.7 References


Chapter 10.
User Datagram Protocol and IP Fragmentation
10.1 Overview
10.2 UDP Header
10.3 UDP Checksum
10.4 Example
10.5 UDP and IPv6
10.6 Lightweight UDP
10.7 IP Fragmentation
10.8 PMTUD using UDP
10.9 Interaction Between IP Fragmentation and ARP/ND
10.10 Maximum UDP Datagram Size
10.11 UDP Server Design
10.12 Converting UDP/IPv4 and UDP/IPv6 Datagrams
10.13 UDP on the Internet
10.14 Attacks Related to UDP and IP Fragmentation
10.15 Summary
10.16 References


Chapter 11.
Name Resolution and the Domain Name System
11.1 Overview
11.2 DNS Namespaces
11.3 Nameservers and Zones
11.4 Caching
11.5 DNS Protocol
11.6 Sorted Lists, Round Robin, and Split DNS
11.7 Open DNS Servers and DynDNS
11.8 Transparency and Scalability
11.9 DNS Conversion from IPv4 to IPv6 (DNS64)
11.10 LLMNR and mDNS
11.11 LDAP
11.12 Attacks on DNS
11.13 Summary
11.14 References

Chapter 12. TCP: Transmission Control Protocol
12.1 Overview
12.2 Introduction to TCP
12.3 TCP Header and Encapsulation
12.4 Summary
12.5 References


Chapter 13. TCP Connection Management
13.1 Overview
13.2 TCP Connection Establishment and Termination
13.3 TCP Options
13.4 TCP Path MTU Discovery
13.5 TCP State Transitions
13.6 Reset Segment
13.7 CP Server Operation
13.8 Attacks Related to TCP Connection Management
13.9 Summary
13.10 References


Chapter 14. TCP Timeouts and Retransmissions
14.1 Overview
14.2 Simple Timeout and Retransmission Example
14.3 Setting the retransmission timeout
14.4 Timer-based retransmission
14.6 Retransmission with Optional Acknowledgement
14.7 Pseudo-Timeouts and Retransmissions
14.8 Packet Reordering and Duplication
14.9 Destination Indicator
14.10 Repacketization
14.11 Attacks involving TCP packet retransmission
14.12 Summary
14.13 References


Chapter 15. TCP Data Flow and Window Management
15.1 Overview
15.2 Interactive Communication
15.3 Delayed Acknowledgment Response
15.4 Nagel's Algorithm
15.5 Flow Control and Window Management
15.6 Emergency Mechanism
15.7 Attacks Related to Windows Management
15.8 Summary
15.9 References


Chapter 16. TCP Congestion Control
16.1 Overview
16.2 Classical Algorithms
16.3 Development of standard algorithms
16.4 Quasi-RTO Processing - Eifel Response Algorithm
16.5 Extended Example
16.6 Congestion Sharing
16.7 TCP Affinity
16.8 TCP in High-Speed ​​Environments
16.9 Delay-based congestion control
16.10 Buffer Bloat
16.11 Active Queue Management and ECN
16.12 Attacks Related to TCP Congestion Control
16.13 Summary
16.14 References


Chapter 17. TCP Maintenance
17.1 Overview
17.2 Description
17.3 Attacks Related to TCP Maintainability
17.4 Summary
17.5 References


Chapter 18.
Security: EAP, IPSec, TLS, DNSSEC, DKIM
18.1 Overview
18.2 Basic Principles of Information Security
18.3 Threats in Network Communications
18.4 Basic Encryption and Security Mechanisms
18.5 Certificates, Certification Authorities (CAs), and PKI
18.6 TCP/IP Security Protocols and Layers
18.7 Network Access Control: 802.1X, 802.1AE, EAP, PANA
18.8 Layer 3 IP Security (IPSec)
18.9 Transport Layer Security (TLS and DTLS)
18.10 DNS Security (DNSSEC)
18.11 DomainKeys Identified Mail (DKIM)
18.12 Attacks on Security Protocols
18.13 Summary
18.14 References

Chapter 19.
Dictionary of Abbreviations

◈ Introduction ◈

“The knowledge presented in this book will be of great help to engineers working to enhance the security and sophistication of Internet operations, or to develop solutions to persistent problems.”
- Vint Cerf / Internet pioneer

TCP/IP Illustrated, Volume 1, Second Edition is a detailed and vivid guide to today's TCP/IP protocol suite.
It fully reflects the latest innovative modifications and shows how each protocol works through examples in the latest Linux, Windows, and Mac OS environments.
This is the best way to understand how TCP/IP works, what it does under normal conditions, and how it applies to various applications and networks.
Kevin R. Paul, author of the second edition
Fall) has significantly revised the book based on the first edition by the late Richard Stevens, adding his cutting-edge experience as a leader in TCP/IP protocol research, and reflecting the latest protocols and best practices.
Kevin begins by introducing the core goals and architectural concepts of TCP/IP, then shows how TCP/IP can reliably connect diverse networks and support multiple services simultaneously.
Then, we will explain in detail the Internet addressing system in IPv4 and IPv6 networks.
After that, the structure and functions of TCP/IP are explained from lower layers to upper layers, starting from link layer protocols such as Ethernet and Wi-Fi to network layer, transport layer, and application layer.
It covers numerous protocols in detail, including ARP, DHCP, NAT, firewalls, ICMPv4/ICMPv6, broadcasting, multicasting, UDP, DNS, and more.
It also covers TCP and its related reliable transport features such as connection management, timeouts, retransmissions, interactive data flow, and congestion control in detail.
Finally, we introduce the basic concepts of security and cryptography, and explain recent major protocols such as EAP, IPsec, TLS, DNSSEC, and DKIM for security and privacy protection.
Regardless of your level of TCP/IP knowledge, this book will give you an intuitive understanding of the entire TCP/IP protocol suite, enabling you to write better applications and operate more efficient and reliable networks.


◈ Target audience of this book ◈

No prior knowledge of networking concepts is required to understand this book, but advanced readers with prior knowledge will benefit from the details and references.
For readers who wish to explore further, a wealth of reference material is provided at the end of each chapter.



◈ Content changes in the 2nd edition ◈

Instead of covering virtually every protocol used at every layer of the Internet, the second edition details non-secure protocols that are widely used today or expected to be widely used in the near future, including Ethernet (802.3), Wi-Fi (802.11), PPP, ARP, IPv4, IPv6, UDP, TCP, DHCP, and DNS.
Both system administrators and regular users will likely encounter these protocols.
In the second edition, security is addressed in two ways.
First, we dedicate a section to each chapter where relevant information is available, describing attacks and countermeasures related to the protocols covered in that chapter.
Although these techniques do not specifically provide methods for constructing attacks, they do provide practical insights into the types of problems that can arise when protocol implementations (and sometimes the specifications themselves) are not sufficiently robust.
In today's Internet, even relatively simple attacks can compromise critical business systems due to incomplete specifications or lax implementations.
A second important discussion of security occurs in Chapter 18, which delves into security and cryptography, introducing protocols such as IPsec, TLS, DNSSEC, and DKIM.
It is widely known today that the above protocols are important in the implementation of any service or application that requires ensuring integrity or secure operation.
As the commercial importance of the Internet increases, the need for security also increases proportionally.
The second consideration in the structure of the second edition was to reduce the content on less commonly used protocols and to reflect the revisions to protocols that have undergone significant revisions since the first edition was published. Chapters covering RARP, BOOTP, NFS, SMTP, and SNMP were eliminated, and the description of the SLIP protocol was replaced with expanded coverage of DHCP and PPP (including PPPoE). IP forwarding functionality is covered in Chapter 5, which covers the general IPv4 and IPv6 protocols.
We've omitted descriptions of dynamic routing protocols (such as RIP, OSPF, and BGP), as OSPF and BGP alone could easily fill a book. We've covered significant differences between IPv4 and IPv6 behavior, from ICMP to IP, TCP, and UDP. Rather than a separate chapter on IPv6, we've described the impact of IPv6 on each core protocol, where applicable.

Several chapters covering new material have been added.
Chapter 1 begins with a general overview of networking issues and architectures, and then introduces Internet-related content.
The Internet addressing system architecture is covered in Chapter 2.
Chapter 6 is a new addition that covers host configuration and how to connect the system to the network.
Chapter 7 covers firewalls and Network Address Translation (NAT), including how NAT is used to partition address space between routable and non-routable areas.
In addition to the tools used in the first edition, Wireshark (a free network traffic monitoring application with a graphical user interface) was added.


◈ Praise poured in for the first edition ◈

“This book is practically a bible for TCP/IP developers and users.
Within minutes of opening this book, I found scenarios that I and my colleagues had been struggling with.
In this book, Stevens clearly reveals many secrets that have been obscured by the so-called network system gurus.
“This book is by far the best book I've read in my many years of working on TCP/IP implementations.”
- Robert A. Ciampa
Ciampa), network engineer for 3COM's Synernetics division

“All of Stevens’ books are technically excellent and accessible, but this one is by far the best.
While many books have described the TCP/IP protocols, Stevens provides a depth and real-world detail unmatched by competing books.
This book provides readers with a peek inside TCP/IP and shows how the protocol works.”
- Steven Baker, networking columnist for UNIX Review

"This is an excellent reference book for developers, network administrators, or anyone needing an understanding of TCP/IP technology. It comprehensively covers TCP/IP-related topics, providing sufficient background and explanation for beginners while also providing enough detail to satisfy experts."
- Bob Williams, Vice President of Marketing, NetManage

“What makes this book different is that Stevens not only explains the protocols, but also demonstrates them.
Stevens teaches the protocols using a variety of tools, including clear explanations, exercises at the end of each chapter, detailed diagrams of protocol headers and data, and real-world network traffic examples.”
- Walter Zintz, UnixWorld

“It cannot be compared to books that only introduce theory.
Stevens uses diagrams to illustrate TCP/IP examples, taking a multi-host based configuration.
This book is based on real-world examples that complement the theory.
This is a distinguishing feature from existing books on TCP/IP, and the explanations using examples help to understand the contents of this book and provide a lot of information.”
- Peter M. Havelock
Haverlock), IBM TCP/IP Development Consultant

“This book has wonderful illustrations and is written in a clean, easy-to-read style.
In short, this book makes complex topics easy to understand.
“I recommend this book as a must-read for everyone.”
- Elizabeth Zinkann, System Administrator

“Stevens has written an excellent textbook and reference book.
“This book is well organized and well written, and details the logic and operation of IP, TCP, and other supported protocols and applications, along with numerous excellent illustrations.”
- Scott Bradner, OIT/NSD consultant, Harvard University


◈ Recommended Articles ◈

Understanding the scope and limitations of the TCP/IP architecture and protocols will provide a solid foundation for thinking about future innovations.
As you read this book, you'll be amazed at how complex it has become from relatively simple concepts applied to a small number of networks and application environments.
Each chapter in this book will demonstrate how TCP/IP has become more complex to accommodate the growing demands of new operating conditions, challenges, and the rapid growth of system size.
What makes this book unique is its serious and detailed account of the history of TCP/IP.
This narrative provides background and developments on how solutions to networking problems have evolved.
This book also spares no effort in illuminating unresolved areas of concern and in improving the accuracy of its descriptions.
Engineers who are passionate about improving the precision and security of Internet operations and exploring solutions to chronic problems will find the knowledge gained in this book invaluable.
The authors of this book deserve praise for their thorough description of the latest Internet technologies.

- Vint Cerf, Woodhurst, June 2011


◈ Author's Note ◈

Welcome to TCP/IP Illustrated, Volume 1, Second Edition.
This book aims to provide a detailed and up-to-date description of the TCP/IP protocols.
This book goes beyond simply describing how TCP/IP protocols work; it also uses various analysis tools to examine how TCP/IP protocols work.
This will not only allow you to understand the background behind TCP/IP protocol design decisions and the interactions between protocols, but also provide access to implementation details without having to read the source code of the protocol implementation software or set up experimental equipment.
Of course, reading the source code or setting up experimental equipment will help deepen your understanding.
This book is for anyone who wants to deepen their understanding of how the current TCP/IP protocols work. This includes network operators and administrators, network software developers, students, and users who work with TCP/IP protocols.
I hope that even readers encountering this book for the first time will find it interesting, and that the existing content and the newly added material will be interesting and useful to readers.
The first edition of this book covered a wide range of protocols and their operation, from the link layer to the application layer and network management.
If we were to include such a wide range of content in one book today, it would be too thick.
For this reason, the second edition focuses on core protocols, including relatively low-level protocols that are primarily used to provide basic services on the Internet, such as configuration, naming, data transfer, and security.
Applications, routing, web services, and other important topics are covered in subsequent volumes.

◈ Translator's Note ◈

This book demonstrates how each protocol operates through a variety of examples in environments such as Linux, Windows, and Mac OS. It's the ultimate resource for understanding the fundamental principles of TCP/IP, its operation under typical conditions, and how it applies to various applications and networks.
Regardless of their level of TCP/IP knowledge, readers of this book will gain an intuitive understanding of the entire TCP/IP protocol, enabling them to write better applications and operate more efficient and reliable networks.
Therefore, I hope that this book will be of some help to many people working in the domestic Internet industry.

◈ Reviewer's Note ◈

This book is the second edition of 『TCP/IP Illustrated』, known as the bible of the TCP/IP protocol suite.
The first edition was so famous that it was considered a must-read for understanding the TCP/IP protocol, but with the advancement of Internet and software technology, an upgrade was necessary.
Unfortunately, the author of the first edition, Richard Stevens (W.
Richard Stevens passed away, and Kevin R.
The second edition, written by Fall, has been published.
Like the first edition, the second edition also covers a wide range of topics, yet is deeply thought-provoking, demonstrating the author's depth of knowledge.
However, because the authors are different, the presentation of the subject matter differs from the first edition, and the newly added material contains more challenging sections than in the first edition, making it somewhat challenging for beginners. If you're new to TCP/IP, consider reading another introductory book (or the first edition) before reading this book, or alternatively, focusing solely on the IPv4 section in this book and reading through it.
Most of the content covers both IPv4 and IPv6, but IPv6 is more challenging. Even without considering the slower-than-expected adoption rate of IPv6, studying IPv6 based on an understanding of IPv4 offers the advantage of gaining a comprehensive picture of the TCP/IP protocol suite without being overwhelmed by the sheer volume of material.
With over 1,000 pages to go through, you might feel overwhelmed by the sheer number of protocols in the TCP/IP protocol suite.
However, for a comprehensive understanding of the TCP/IP protocol suite and a deeper dive into specific details, there are few better books.