2023 question paper
Computer Networks
30 questions
Q1a. In an optical fiber, the inner core is ______ the cladding. (i) denser than (ii) less dense than (iii) the same density as (iv) another name for20232m
Module 1: Physical Layer & Data Communication
View this question on its own page →In an optical fiber, the inner core is ______ the cladding.
(i) denser than
(ii) less dense than
(iii) the same density as
(iv) another name forWorked SolutionAnswer: (i) denser than
In an optical fibre the core has a higher refractive index (denser) than the cladding. Light travelling in the core hits the core–cladding boundary at an angle greater than the critical angle and is reflected back by total internal reflection, so the signal stays inside the core.
Q1b. Sliding window protocol is used for (i) error control (ii) session control (iii) flow control (iv) concurrency control20232m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Sliding window protocol is used for
(i) error control
(ii) session control
(iii) flow control
(iv) concurrency controlWorked SolutionAnswer: (iii) flow control
A sliding window protocol lets the sender transmit several frames before an acknowledgement arrives, limited by the window size. The window slides forward as ACKs are received, so the sender never overwhelms the receiver. Its main role is flow control; it also supports error control when combined with ARQ (Go-Back-N, Selective Repeat).
Q1c. Connection-establishment involves a ______-way handshake in TCP. (i) one (ii) two (iii) three (iv) four20232m
Module 4: Transport Layer & Congestion Control
View this question on its own page →Connection-establishment involves a ______-way handshake in TCP.
(i) one
(ii) two
(iii) three
(iv) fourWorked SolutionAnswer: (iii) three
TCP connection establishment uses the three-way handshake:
- Client → Server:
SYN(seq = x) - Server → Client:
SYN + ACK(seq = y, ack = x+1) - Client → Server:
ACK(ack = y+1)
After step 3 the connection is established and data can flow.
- Client → Server:
Q1d. Which the following is an inter-domain routing protocol? (i) RIP (ii) OSPF (iii) BGP (iv) Both (a) & (b)20232m
Module 3: Network Layer & Routing
View this question on its own page →Which the following is an inter-domain routing protocol?
(i) RIP
(ii) OSPF
(iii) BGP
(iv) Both (a) & (b)Worked SolutionAnswer: (iii) BGP
BGP (Border Gateway Protocol) is the inter-domain (exterior) routing protocol that exchanges routes between autonomous systems on the Internet. RIP and OSPF are intra-domain (interior) protocols that work inside one AS, so option (iv) is wrong.
Q1e. Phase transition for each bit is used in (i) NRZ encoding (ii) Manchester encoding (iii) Carrier modulation (iv) Amplitude modulation20232m
Module 1: Physical Layer & Data Communication
View this question on its own page →Phase transition for each bit is used in
(i) NRZ encoding
(ii) Manchester encoding
(iii) Carrier modulation
(iv) Amplitude modulationWorked SolutionAnswer: (ii) Manchester encoding
In Manchester encoding every bit has a transition in the middle of the bit interval: one bit value is a low-to-high transition and the other is a high-to-low transition (which value maps to which depends on the convention used). This gives self-clocking and no DC component.
NRZ has no guaranteed transition per bit, and carrier/amplitude modulation are analog modulation techniques.
Q1f. Which one of the following is a valid host for network 192.168.4.32/68? (i) 192.168.4.39 (ii) 192.168.4.50 (iii) 192.168.4.47 (iv) 192.168.4.3120232m
Module 3: Network Layer & Routing
View this question on its own page →Which one of the following is a valid host for network 192.168.4.32/68?
(i) 192.168.4.39
(ii) 192.168.4.50
(iii) 192.168.4.47
(iv) 192.168.4.31Worked SolutionAnswer: (i) 192.168.4.39
The prefix
/68is not possible for IPv4 (the maximum is /32). The question most likely means 192.168.4.32/28, so that is what is solved here.For /28: block size = 2^(32−28) = 16 addresses.
- Network address: 192.168.4.32
- Broadcast address: 192.168.4.47
- Valid host range: 192.168.4.33 – 192.168.4.46
Option Address Status (i) 192.168.4.39 Valid host (ii) 192.168.4.50 Belongs to the next block (.48–.63) (iii) 192.168.4.47 Broadcast address, not usable (iv) 192.168.4.31 Belongs to the previous block (.16–.31) Q1g. UDP is (i) connection oriented (ii) connection less (iii) both (a) and (b) (iv) none of these.20232m
Module 4: Transport Layer & Congestion Control
View this question on its own page →UDP is
(i) connection oriented
(ii) connection less
(iii) both (a) and (b)
(iv) none of these.Worked SolutionAnswer: (ii) connection less
UDP (User Datagram Protocol) is connectionless: it sends independent datagrams with no handshake, no connection state, no acknowledgements, and no retransmission. It is unreliable but fast and has low overhead, so it suits DNS, streaming, VoIP, and gaming. TCP is the connection-oriented transport protocol.
Q1h. The protocol that maps a physical (MAC) address to the corresponding logical address is (i) ARP (ii) RARP (iii) ICMP (iv) IMAP420232m
Module 3: Network Layer & Routing
View this question on its own page →The protocol that maps a physical (MAC) address to the corresponding logical address is
(i) ARP
(ii) RARP
(iii) ICMP
(iv) IMAP4Worked SolutionAnswer: (ii) RARP
- RARP (Reverse Address Resolution Protocol) maps a physical (MAC) address to a logical (IP) address. A diskless host that knows only its MAC address uses it to ask a RARP server for its IP address.
- ARP does the opposite: it maps a logical (IP) address to a physical (MAC) address.
- ICMP reports errors and control messages, and IMAP4 is a mail access protocol.
(RARP has been superseded by BOOTP and DHCP.)
Q1i. Process to Process delivery is the function of ______ layer. (i) Transport (ii) Network (iii) Physical (iv) none of these20232m
Module 4: Transport Layer & Congestion Control
View this question on its own page →Process to Process delivery is the function of ______ layer.
(i) Transport
(ii) Network
(iii) Physical
(iv) none of theseWorked SolutionAnswer: (i) Transport
The transport layer provides process-to-process (end-to-end) delivery using port numbers to identify the sending and receiving applications (TCP and UDP). The network layer gives host-to-host delivery using IP addresses, and the data link layer gives node-to-node delivery using MAC addresses.
Q1j. Which channel access method is used in IEEE 802.5 networks? (i) CSMA/CD (ii) Token bus (iii) Token ring (iv) All of these20232m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Which channel access method is used in IEEE 802.5 networks?
(i) CSMA/CD
(ii) Token bus
(iii) Token ring
(iv) All of theseWorked SolutionAnswer: (iii) Token ring
IEEE 802.5 defines the Token Ring LAN. A special frame called a token circulates around the ring, and only the station holding the token may transmit. This gives collision-free, deterministic access.
CSMA/CD belongs to IEEE 802.3 (Ethernet) and token bus to IEEE 802.4.
- Install PocketlyBudget App•POCKETLY
Pocketly on Android
Log daily food, travel, and hostel expenses instantly. Set monthly spending limits and see where your money goes without complex spreadsheets.
Q2a. Differentiate between circuit switching and packet switching.20237m
Module 1: Physical Layer & Data Communication
View this question on its own page →Differentiate between circuit switching and packet switching.
Worked SolutionCircuit switching vs packet switching
Circuit switching: a dedicated physical path (circuit) is set up between sender and receiver before data transfer, kept for the whole session, and released afterwards (e.g. the traditional telephone network).
Packet switching: the message is split into small packets, each carrying source and destination addresses. Packets travel independently, share links, and are reassembled at the destination (e.g. the Internet).
Basis Circuit switching Packet switching Path Dedicated path set up before transfer No dedicated path; each packet is routed separately Phases Setup → data transfer → teardown No setup needed (datagram) or a virtual circuit is set up Resource use Bandwidth reserved even when idle; poor utilisation Links shared through statistical multiplexing; efficient Delay Setup delay, then constant, low delay Variable delay due to queuing and routing Order of data Arrives in order on the same path May arrive out of order (datagram); reordered at destination Data unit Continuous stream Packets Congestion Blocked at setup time (busy signal) Occurs during transfer (delay or packet loss) Reliability A failure breaks the call Packets can be rerouted around failures Header overhead None per data unit Every packet carries a header Best for Real-time voice with constant rate Bursty data traffic (web, email, file transfer) Cost Higher Lower Example PSTN telephone network Internet (IP) Circuit: A ===== S1 ===== S2 ===== B (one reserved path) Packet: A -> S1 -> S2 -> B, A -> S1 -> S3 -> S2 -> B (paths may differ)Q2b. Given a 10 bit sequence 1010011110 and a divisor 1011. Find the CRC. Check your answer.20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Given a 10 bit sequence 1010011110 and a divisor 1011. Find the CRC. Check your answer.
Worked SolutionCRC for data 1010011110 with divisor 1011
Given: data =
1010011110(10 bits), divisor (generator) =1011(4 bits, i.e. x³ + x + 1).Step 1: append zeros
The divisor has 4 bits, so append 3 zeros (divisor length − 1):
Dividend =
1010011110+000=1010011110000(13 bits)Step 2: modulo-2 (XOR) division
Step Working bits Action XOR result Remainder (3 bits) 1 1010 1010 ⊕ 1011 0001 001 2 0010 (bring down 0) leading 0, ⊕ 0000 0010 010 3 0101 (bring down 1) leading 0, ⊕ 0000 0101 101 4 1011 (bring down 1) 1011 ⊕ 1011 0000 000 5 0001 (bring down 1) leading 0 0001 001 6 0011 (bring down 1) leading 0 0011 011 7 0110 (bring down 0) leading 0 0110 110 8 1100 (bring down 0) 1100 ⊕ 1011 0111 111 9 1110 (bring down 0) 1110 ⊕ 1011 0101 101 10 1010 (bring down 0) 1010 ⊕ 1011 0001 001 Remainder = 001, so the CRC =
001.Step 3: transmitted codeword
Data + CRC =
1010011110001=1010011110001Step 4: check at the receiver
Divide the received word
1010011110001by1011. The steps are identical up to step 9 (remainder101). In step 10 the last bit is now 1:- Step 10: bring down 1 →
1011⊕1011=0000→ remainder 000
The remainder is zero, so no error is detected and the answer is verified.
(Quotient = 1001000111. If a bit were flipped in transit the remainder would be non-zero.)
- Step 10: bring down 1 →
Q3a. Write down the similarities and differences between OSI and TCP/IP model.20237m
Module 1: Physical Layer & Data Communication
View this question on its own page →Write down the similarities and differences between OSI and TCP/IP model.
Worked SolutionOSI vs TCP/IP model
Both are layered reference models for network communication.
OSI (7 layers) TCP/IP (4 layers) Application ─┐ Presentation ├────────▶ Application Session ─┘ Transport ────────▶ Transport Network ────────▶ Internet Data Link ─┐ Physical ─┘──────▶ Network Access (Link)Similarities
- Both use a layered architecture, where each layer provides services to the layer above and uses the one below.
- Both have application, transport, and network layers with similar functions.
- Both use packet switching (not circuit switching).
- Both rely on encapsulation: each layer adds its own header as data moves down.
- Both are used to describe networking and to develop compatible, interoperable protocols.
- Layer functions are independent, so one layer can change without affecting the others.
Differences
Basis OSI model TCP/IP model Full form Open Systems Interconnection Transmission Control Protocol / Internet Protocol Developed by ISO (1984) US Department of Defense (ARPANET) Layers 7 4 (sometimes shown as 5) Nature Generic, protocol-independent reference model Protocol-specific model built around TCP/IP Approach Vertical: model first, protocols later Horizontal: protocols first, model later Session and presentation Separate layers Merged into the application layer Transport layer Connection-oriented service only, for reliability Both TCP (reliable) and UDP (unreliable) Network layer Supports both connection-oriented and connectionless Connectionless (IP) only Service, interface, protocol Clearly separated concepts Not clearly separated Reliability of design Well defined, but complex and rarely used in practice Simple, practical, and the standard of the Internet Protocols Fit in after the model was made Built first, e.g. HTTP, FTP, TCP, UDP, IP Usage Mainly for teaching and reference Actually used in networks Q3b. Explain leaky bucket and token bucket algorithm.20237m
Module 4: Transport Layer & Congestion Control
View this question on its own page →Explain leaky bucket and token bucket algorithm.
Worked SolutionBoth are traffic-shaping techniques used for congestion control. They regulate the rate at which packets enter the network.
1. Leaky bucket algorithm
Idea: a bucket with a small hole at the bottom. Water (packets) may arrive at any rate, but it leaks out at a constant rate. If the bucket is full, incoming water overflows and is discarded.
bursty input → [ bucket (buffer) ] → constant-rate output ↓ overflow discardedWorking:
- Incoming packets are placed in a finite queue (the bucket).
- Every clock tick, packets are sent out at a fixed rate (e.g. one packet or n bytes per tick).
- If the queue is full, arriving packets are dropped.
Properties:
- Converts bursty traffic into smooth, constant-rate traffic.
- Output rate never exceeds the leak rate, however large the burst.
- Simple to implement (a FIFO queue).
- Drawback: cannot exploit idle time, so a host that was quiet for a long time still cannot send a burst, and it may drop packets even when the network is free.
Byte-counting version (variable-size packets): each tick, send packets while the total bytes sent ≤ n.
2. Token bucket algorithm
Idea: the bucket holds tokens, generated at a constant rate (one every ΔT seconds) up to the bucket capacity C. To send a packet, the host must remove a token (or tokens equal to the packet size). Unused tokens accumulate, so after an idle period the host can send a burst.
tokens generated at rate r → [ bucket capacity C ] packet arrives → token available? yes: send, remove token / no: wait (or drop)Working:
- Tokens are added at rate r; extra tokens beyond capacity C are discarded.
- An arriving packet needs a token to be sent; if none is available it waits (or is dropped/marked).
- Idle hosts save tokens, allowing bursts of up to C packets at full link speed.
Maximum burst length: S = C / (M − r), where M is the maximum output rate and r the token rate.
Example: r = 1 token/ms, C = 5. After 5 ms of idleness the host may send 5 packets back-to-back, and afterwards only 1 packet per ms.
Comparison
Basis Leaky bucket Token bucket Output rate Constant (fixed) Variable; bursts allowed up to bucket size Idle periods Not exploited Saved as tokens for later bursts What is stored Packets Tokens Bucket full Packets are discarded Tokens are discarded, not packets Burst handling Smooths bursts completely Permits controlled bursts Best for Strictly uniform traffic Bursty traffic with an average-rate limit Simple JavaScript sketch of the token bucket
class TokenBucket { constructor(capacity, ratePerSec) { this.capacity = capacity; this.rate = ratePerSec; this.tokens = capacity; this.last = Date.now(); } allow(cost = 1) { const now = Date.now(); this.tokens = Math.min(this.capacity, this.tokens + (now - this.last) / 1000 * this.rate); this.last = now; if (this.tokens >= cost) { this.tokens -= cost; return true; } // send return false; // wait/drop } }Q4a. Find the expressions for average delay and throughput for both pure ALOHA and slotted ALOHA. Compare their performances as well.20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Find the expressions for average delay and throughput for both pure ALOHA and slotted ALOHA. Compare their performances as well.
Worked SolutionALOHA: throughput and delay
Notation: T = frame time, G = average number of frame transmissions per frame time (offered load, including retransmissions), S = throughput (successful frames per frame time). Frame arrivals are assumed to follow a Poisson process.
1. Pure ALOHA
Stations transmit whenever they have data. A frame sent at time t₀ is successful only if no other frame starts in the vulnerable period [t₀ − T, t₀ + T], which is 2T long.
- Probability of no other transmission in 2T: P₀ = e^(−2G)
- Throughput: S = G · e^(−2G)
- Maximum: dS/dG = 0 gives G = 0.5, so S_max = 1/(2e) ≈ 0.184 (18.4%)
Delay: the probability of a frame succeeding on one try is e^(−2G), so the average number of transmissions per frame is e^(2G), i.e. e^(2G) − 1 retransmissions. If each failed attempt costs one frame time plus propagation time Tₚ plus an average back-off time B:
D_pure ≈ T + Tₚ + (e^(2G) − 1)(T + Tₚ + B)
Delay grows exponentially with load G.
2. Slotted ALOHA
Time is divided into slots of length T. A station may start transmission only at the beginning of a slot. Two frames either collide completely or do not collide at all. The vulnerable period shrinks to T.
- Probability of no other transmission in one slot: P₀ = e^(−G)
- Throughput: S = G · e^(−G)
- Maximum: G = 1, so S_max = 1/e ≈ 0.368 (36.8%)
Delay: average transmissions per frame = e^G, so retransmissions = e^G − 1. A frame also waits on average T/2 for the next slot boundary:
D_slotted ≈ T/2 + T + Tₚ + (e^G − 1)(T + Tₚ + B)
Comparison
Basis Pure ALOHA Slotted ALOHA Time Continuous Discrete slots Synchronisation Not required Required (common clock) Vulnerable period 2T T Throughput S = G·e^(−2G) S = G·e^(−G) Maximum throughput 0.184 at G = 0.5 0.368 at G = 1 Collision probability Higher (partial overlaps possible) Lower (only full overlaps) Delay at high load Grows as e^(2G) Grows as e^G; lower Delay at very low load Lower (send immediately) Slightly higher (wait for slot start) Complexity Simple Needs slot synchronisation Conclusion: slotted ALOHA doubles the maximum throughput of pure ALOHA and has much better delay under load, at the cost of clock synchronisation.
Q4b. Why are medium access control techniques required? Discuss three popular medium access control techniques in brief.20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Why are medium access control techniques required? Discuss three popular medium access control techniques in brief.
Worked SolutionWhy Medium Access Control (MAC) Techniques Are Required
A LAN such as Ethernet or Wi-Fi is a broadcast channel: one shared medium carries the transmission of every station. If two stations transmit at the same time their signals collide and both frames are destroyed. Because there is no separate control channel to arbitrate use, the Medium Access Control (MAC) sublayer — the lower half of the data-link layer (OSI Layer 2) — must decide which station may transmit, and when.
The MAC sublayer is required to:
- Arbitrate access and handle collisions so that overlapping transmissions do not waste the shared bandwidth.
- Address frames on the shared medium — attach source and destination addresses so a frame is accepted only by the intended station.
- Make the use of the channel fair and orderly — every station gets a chance to transmit and none can monopolise the medium.
- Deal with the consequences of sharing — acknowledgements, retransmissions and inter-frame timing rules.
1. Static channel allocation — TDM and FDM
- The channel is divided in advance among the stations: in FDM each station gets a private frequency band; in TDM each station gets a private time slot (one slot carries one frame of that station).
- Advantage: simple, collision-free, constant delay.
- Disadvantage: an idle station still holds its slot/band, so bandwidth is wasted. LAN traffic is bursty (stations are idle most of the time), which makes static allocation inefficient; it suits constant-rate traffic such as telephony and FDM radio.
2. Token passing — controlled access
- A small frame called the token circulates logically; only the station currently holding the token may transmit. After sending, it passes the token to its neighbour (early or late release). Examples: IEEE 802.5 Token Ring, FDDI.
- Advantages: no collisions, deterministic worst-case delay (good for real-time traffic), fair access, and nearly 100 % efficiency under heavy load.
- Disadvantages: complex (token monitoring, insertion/removal, error recovery), slow under light load because the token must still travel, and costlier hardware.
3. CSMA/CD — contention (random access)
- A station with data first senses the channel (carrier sense); if it is idle the station transmits and keeps monitoring while transmitting. On detecting a collision it stops, sends a jam signal, waits a random backoff time (binary exponential backoff) and retries. This is the MAC protocol of classic Ethernet — IEEE 802.3.
- Advantages: very efficient for bursty traffic — no time is wasted when the channel is idle and there is no token overhead.
- Disadvantages: collisions still occur and efficiency falls as the load rises; the protocol also needs the minimum-frame/slot-time rule. It cannot be used in WLANs because a radio transmitter cannot listen while it is transmitting — hence 802.11 uses CSMA/CA.
Comparison
Technique Example Collisions Efficiency at low load Complexity Static (TDM/FDM) TDM telephony, FDM radio None Low — idle slots wasted Simple Token passing 802.5 Token Ring None Low — token circulation delay High Contention (CSMA/CD) 802.3 Ethernet Possible, resolved by random backoff Very high Moderate Q5a. An ISP is granted the block 80.70.56.0/21. The ISP needs to allocate addresses for two organizations each with 500 addresses, two organizations each with 250 addresses, and three organizations each with 50 addresses. (a) Find the number and range of addresses in the ISP block.20237m
Module 3: Network Layer & Routing
View this question on its own page →An ISP is granted the block 80.70.56.0/21. The ISP needs to allocate addresses for two organizations each with 500 addresses, two organizations each with 250 addresses, and three organizations each with 50 addresses.
(a) Find the number and range of addresses in the ISP block.Worked Solution(a) Number and Range of Addresses in the ISP Block 80.70.56.0/21
Given: network address , prefix length .
Step 1 — Number of addresses
Formula:
The block contains 2048 addresses.
Step 2 — Subnet mask
/21 means the first 21 bits are 1s: two full octets plus 5 bits of the third octet.
Step 3 — Range of addresses
The third octet advances in steps of . The block starts at the third octet value 56 and therefore ends at .
- First (network) address = 80.70.56.0
- Last (broadcast) address = 80.70.63.255
Check: 8 values of the third octet (56 to 63) addresses
Answer: the ISP block has 2048 addresses, ranging from 80.70.56.0 to 80.70.63.255 (first address 80.70.56.0, broadcast address 80.70.63.255).
Q5b. An ISP is granted the block 80.70.56.0/21. The ISP needs to allocate addresses for two organizations each with 500 addresses, two organizations each with 250 addresses, and three organizations each with 50 addresses. (b) Find the range of addresses for each organization and the range of unallocated addresses.20237m
Module 3: Network Layer & Routing
View this question on its own page →An ISP is granted the block 80.70.56.0/21. The ISP needs to allocate addresses for two organizations each with 500 addresses, two organizations each with 250 addresses, and three organizations each with 50 addresses.
(b) Find the range of addresses for each organization and the range of unallocated addresses.Worked Solution(b) Range of Addresses for Each Organisation and the Unallocated Range
Rule: allocate to each organisation the smallest block whose size is a power of 2 and is its requirement, so that the block stays CIDR-aligned (a block of addresses has prefix and must start on a multiple of its own size).
# Needs Smallest power of 2 Block size CIDR Allocated range Org 1 500 512 /23 80.70.56.0 – 80.70.57.255 Org 2 500 512 /23 80.70.58.0 – 80.70.59.255 Org 3 250 256 /24 80.70.60.0 – 80.70.60.255 Org 4 250 256 /24 80.70.61.0 – 80.70.61.255 Org 5 50 64 /26 80.70.62.0 – 80.70.62.63 Org 6 50 64 /26 80.70.62.64 – 80.70.62.127 Org 7 50 64 /26 80.70.62.128 – 80.70.62.191 Allocation proceeds from the start of the ISP block, each block being placed at an address aligned to its own size (e.g. a /23 always begins at an even value of the third octet, a /26 always at a multiple of 64 in the fourth octet).
Verification of the total
Unallocated addresses
Unallocated range = 80.70.62.192 to 80.70.63.255, which can itself be split into two aligned blocks:
- 80.70.62.192/26 — 64 addresses (80.70.62.192 – 80.70.62.255)
- 80.70.63.0/24 — 256 addresses (80.70.63.0 – 80.70.63.255)
Note: each allocated block also contains its own network address and broadcast address, so for example Org 1 gets 512 total addresses of which are usable host addresses — still more than the 500 it requires.
Q6a. How do guided media differ from unguided media? Name the advantages of optical fiber over twisted-pair and coaxial cable.20237m
Module 1: Physical Layer & Data Communication
View this question on its own page →How do guided media differ from unguided media? Name the advantages of optical fiber over twisted-pair and coaxial cable.
Worked SolutionGuided Media vs Unguided Media, and Advantages of Optical Fiber
Guided vs unguided media
Guided media (wired / bounded media) are physical conductors that confine the electromagnetic signal to a fixed path: twisted-pair wire (UTP/STP), coaxial cable and optical fibre. The signal travels only along the medium, so it can be measured, tapped only physically, and it does not radiate.
Unguided media (wireless / unbounded media) have no physical conductor; the signal is radiated through air or vacuum as electromagnetic waves and reaches any receiver within range by broadcasting: radio waves (AM/FM, Bluetooth, Wi-Fi), terrestrial microwave, satellite, infrared and laser.
Property Guided media Unguided media Physical path Fixed cable required Open air / free space Attenuation Higher but predictable Governed by distance, fading, obstacles Interference EMI on copper; none on fibre Heavy — fading, multipath, weather, adjacent channels Security Hard to tap (fibre hardest) Easily intercepted by anyone in range Installation & cost Cabling, ducts, connectors No cable, but antennas and licences Mobility None — host is tied to the wire High — roaming supported Broadcast capability Point-to-point (needs a bus/switch) Naturally point-to-multipoint Advantages of optical fibre over twisted-pair and coaxial cable
- Very high bandwidth — a light carrier in the hundreds of THz range gives data rates of Gbps (10/40/100 Gbps per wavelength) over a single fibre; copper is limited to a few hundred MHz and much lower rates over distance.
- Very low attenuation — typically about 0.2 dB/km at 1550 nm, against roughly 0.2 dB per 100 m for UTP. Repeaters/amplifiers are needed tens to hundreds of km apart instead of every kilometre or so.
- Complete immunity to electromagnetic interference (EMI) and no electrical crosstalk — glass is a dielectric and carries no current, so it works safely beside motors, power lines and lift shafts where copper picks up noise.
- Higher security and privacy — a fibre cannot be tapped by induction; attempting to bend it out causes a measurable power loss, so intrusion is detectable. Copper radiates signals that can be picked up remotely.
- Much lower bit-error rate (of the order of or better) and no ground-loop / lightning-induced currents.
- Light weight and small diameter — far more channels per duct, important where conduit space is scarce.
- Electrical isolation and safety — non-conducting, no sparking hazard in explosive atmospheres, and no risk of short circuits between networks.
Disadvantages (for completeness in the exam): higher cost of cable, transmitters (laser/LED) and detectors, and the fibre is fragile and difficult to splice or connect — it needs skilled installation.
Q6b. Explain how sliding window protocol works at data link layer.20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Explain how sliding window protocol works at data link layer.
Worked SolutionSliding Window Protocol at the Data Link Layer
Definition. In a sliding-window protocol both the sender and the receiver keep a window of sequence numbers. The sender may transmit several frames back-to-back without waiting for each individual acknowledgement, but never more than its window size ; the receiver is prepared to accept up to frames and acknowledges them cumulatively. As ACKs arrive, the window slides over the cyclic sequence-number space, so new frames may be sent while older ones are still being acknowledged. This single mechanism provides both error control and flow control.
With sequence bits the numbers run and then wrap around.
Working at the sender
- Keep three counters:
base(oldest unacknowledged frame),nextseqnum(next frame to send) and a timer for the oldest frame. - If
nextseqnumlies inside the window[base, base + W_s - 1], transmit the frame, buffer it, advancenextseqnum; start the timer if it is the first unacknowledged frame. - On receiving ACK(n) (cumulative — all frames below n received correctly), advance
basepast n; slide the window, restart the timer for the newbaseif the window is not empty, otherwise stop it. - On timeout: Go-Back-N retransmits all unacknowledged frames; Selective Repeat retransmits only the missing ones.
Working at the receiver
- A frame is accepted only if its sequence number equals the number expected; it is then delivered to the network layer and a cumulative ACK is returned.
- Go-Back-N: out-of-order frames are simply discarded and the last correct ACK is re-sent, so the receiver needs no buffer.
- Selective Repeat: out-of-order frames are buffered; frames are delivered as soon as the gap is filled, and each frame is ACKed individually.
Flow control
The receiver advertises its window; the sender keeps , so at most unprocessed frames are outstanding at a slow receiver — it is never overrun.
Bounds and efficiency
- Stop-and-wait is the special case — only one frame outstanding, so the line idles for bit-times per frame.
- for Go-Back-N, and for Selective Repeat (see the proof of the Go-Back-N bound).
- Throughput: for , where ; for the channel is saturated and .
Timeline (window , Go-Back-N)
time ---> Sender Receiver ------------------------------------------------------------- W = [0,1,2,3] | --- Frame 0 ---------------------------------> | expects 0 -> deliver | --- Frame 1 ---------------------------------> | expects 1 -> deliver | --- Frame 2 ---------------------------------> | expects 2 -> deliver | --- Frame 3 ---------------------------------> | expects 3 -> deliver | | (window now full: | channel keeps busy — no waiting!) | sender must stop) |<------------- cumulative ACK 4 --------------- | | W slides to [4,5,6,7] | expects 4 | --- Frame 4 ---------------------------------> | | --- Frame 5 ----------X (lost) | expects 6, got 5 -> discard | --- Frame 6 ---------------------------------> | (out of order: discard) | --- Frame 7 ---------------------------------> | discard, resend ACK 6 | | timeout for base = 4 expires | | Go-Back-N: retransmit 4, 5, 6, 7 ----------> | 4,5,6,7 accepted -> ACK 8- Keep three counters:
- Install PocketlyBudget App•POCKETLY
Pocketly on Android
Log daily food, travel, and hostel expenses instantly. Set monthly spending limits and see where your money goes without complex spreadsheets.
Q7a. In Go-Back-N ARQ show the window size should be < 2^n.20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →In Go-Back-N ARQ show the window size should be < 2^n.
Worked SolutionGo-Back-N ARQ: the Window Size must be Less than
Setup
With sequence-number bits the frame numbers are and then wrap around modulo . In Go-Back-N the receiver keeps track only of the next expected frame number and sends a cumulative ACK with that number; any frame that is not the expected one is discarded (no buffering).
Claim
i.e. the sender window must be strictly less than .
Proof by counter-example (contradiction)
Assume . Take , so frames are numbered and :
- The sender fills its whole window and transmits frames 0, 1, 2, 3, 4, 5, 6, 7.
- All eight frames arrive correctly; the receiver delivers all of them. Its next expected number is 0, so it is now waiting for a new frame numbered 0.
- All ACKs are lost. The sender's timer for frame 0 expires and it retransmits frame 0, believing it was never received.
- The receiver is waiting for exactly number 0, so it accepts the retransmission as a brand-new frame and delivers a duplicate copy of the data to the network layer.
The protocol has failed: the receiver cannot distinguish a retransmission of the old frame 0 from a new frame 0, because the window has consumed every number in the sequence space, leaving no free number to signal that a wrap-around occurred.
n = 3, W = 8 (illegal) Sender Receiver (expects next = 0) | -- frame 0 -->| expects 0 | -- frame 1 -->| expects 1 | ... | ... | -- frame 7 -->| expects 8 mod 8 = 0 | | ACKs lost, timeout on frame 0 | -- frame 0 -->| (retransmission) ACCEPTED AS NEW frame 0 <-- DUPLICATE n = 3, W = 7 (legal) Sender Receiver (expects next = 7) | -- frame 0..6 -->| expects 7 | ACKs lost, timeout on frame 0 | -- frame 0 -->| (retransmission) 0 != 7 --> discarded, re-ACK 7 <-- CORRECTWhy repairs the problem
If , at least one sequence number is always unused at any instant. When the sender retransmits a frame numbered , the receiver's expected number has not yet wrapped all the way around to (in the example above it expects 7, not 0), so the incoming frame is recognised as old, discarded, and the ACK is simply re-sent. Duplicates can never be delivered.
General statement
The extra, unused sequence number acts as the marker that separates the current window from the previous one. The same reasoning applied to Selective Repeat — where the sender and receiver windows slide independently — gives the tighter bound , so that the two windows can never overlap ambiguously.
Q7b. We know that there are 2 types of address scheme (i.e. IP address and MAC address) in computer networks. Explain what is the need of having two types of addresses. What will happen if we use only IP address in computer networks?20237m
Module 3: Network Layer & Routing
View this question on its own page →We know that there are 2 types of address scheme (i.e. IP address and MAC address) in computer networks. Explain what is the need of having two types of addresses. What will happen if we use only IP address in computer networks?
Worked SolutionNeed for Two Types of Addresses: IP Address and MAC Address
Definitions
- MAC (physical / link) address — a 48-bit (6-byte) flat address burned into the NIC by the manufacturer: 3 bytes of OUI (vendor) + 3 bytes of device ID, e.g.
00:1A:2B:3C:4D:5E. It is used by the data-link layer for hop-to-hop delivery on one local network. - IP (logical) address — a 32-bit (IPv4) hierarchical address assigned by the administrator or DHCP: a network part that identifies the network and a host part that identifies the host. It is used by the network layer for end-to-end routing through the internetwork.
Why both are needed
- Different scopes need different structures. IP must be hierarchical so that routers can aggregate: a core router forwards on the network part alone instead of storing millions of individual hosts. MAC addresses are flat and carry no routing information — a routing table built from them would have to list every NIC in the world.
- Different layers do different jobs. The IP address gets the packet to the destination network; the MAC address gets the frame to the next hop and finally to the destination host on that link. Each hop rewrites the frame header (new source MAC of the sender, new destination MAC of the receiver) while the IP header stays unchanged end-to-end.
- Technology independence. Ethernet, 802.11, Bluetooth and PPP each have their own frame format but can all carry the same IP packet. MAC is what makes local delivery possible on the specific medium of that hop.
- Fixed vs changeable. The MAC is tied to the hardware and is permanent; the IP changes when the host moves to another network. Applications can therefore keep using one IP identity while the host roams.
- ARP relies on the pair. A sender knows the destination IP but not the MAC of the next hop; ARP broadcasts a query that is framed with the link-layer broadcast address FF:FF:FF:FF:FF:FF and answered with the target's MAC — a procedure that is impossible without both address types.
What would happen if only IP addresses were used
- No local delivery mechanism. A switch forwards using MAC addresses in the frame. Without them it would have to decapsulate every frame and consult an IP table — every device would behave like a router, adding huge processing cost and latency even inside one LAN.
- Routing tables would explode. IP would have to serve both local identification and global routing. Keeping it flat (like MAC) means every router stores every host; keeping it hierarchical means hosts on the same LAN could not be addressed directly without a router in the path.
- Address resolution breaks. There would be no physical broadcast address, so no way to ask who owns an IP; ARP and DHCP discovery could not be framed.
- Multi-technology networks break. One address format cannot be written into every kind of frame (Ethernet, Wi-Fi, token ring); two devices on the same wireless LAN could never talk directly.
- Every NIC would need globally routable configuration, even for a closed LAN, and changing networks would mean re-addressing the hardware.
Conclusion: IP = where the host is in the internetwork (logical, hierarchical, routable); MAC = who the host is on the local wire (physical, flat, hop-to-hop). The two answer complementary questions, so both are required.
- MAC (physical / link) address — a 48-bit (6-byte) flat address burned into the NIC by the manufacturer: 3 bytes of OUI (vendor) + 3 bytes of device ID, e.g.
Q8a. Discuss CSMA/CA with the help of a flowchart.20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Discuss CSMA/CA with the help of a flowchart.
Worked SolutionCSMA/CA with the Help of a Flowchart
Definition. Carrier Sense Multiple Access with Collision Avoidance is the MAC protocol of WLANs (IEEE 802.11 DCF). In wireless a station cannot detect a collision while transmitting, so instead of detecting collisions it avoids them: the station senses the channel, waits an inter-frame space, and — if others may also be waiting — picks a random backoff interval so that waiting stations do not start together. Every unicast frame is ACKed, because losses from fading/interference are as likely as collisions.
Flowchart
+----------------------------+ | Station has a frame to | | transmit | +-------------+--------------+ | v +----------------------------+ | Sense the medium | | (physical carrier sense + | | virtual sense via NAV) | +-------------+--------------+ | medium idle for DIFS ? | | YES NO | | v v +----------------------+ +---------------------------+ | Transmit the frame | | Wait until medium is idle | +----------+-----------+ | choose random backoff k | | | in [0, CW]; start timer | | +-------------+-------------+ | | | v | +--------------------------+ | | medium busy ? --YES--> freeze timer, | | | resume later | | NO | | +----+---------------------+ | | | timer = 0 ? --NO--> back to sensing | YES | v | +--------------------------+ | | Transmit the frame | | +------------+-------------+ | | | wait SIFS | v | +--------------------------+ YES | | ACK received within |----------> DONE | | ACK timeout ? | (success, | +------------+-------------+ clear CW) | NO | v | +--------------------------+ | | CW = min(2*CW+1, CWmax); | | | retry = retry + 1 | +--------+--------------------------+ | | retry <= retryLimit | retry > retryLimit | v | +------------------+ | | DROP the frame | | | report failure | | +------------------+ v go back to SENSE THE MEDIUMExplanation of the steps
- Carrier sense (physical + virtual). Before sending, the station checks the channel. 802.11 adds virtual carrier sense: the duration field of a received RTS/CTS/data frame lets every other station set its NAV (Network Allocation Vector) — a timer for how long the medium will stay busy. Transmission is allowed only when both the NAV and the physical sensing are idle.
- DIFS. If the medium has been idle for a DCF Inter-Frame Space (DIFS) the station may transmit immediately.
- Random backoff. If the medium is busy, or after a failed transmission, the station draws a random number of slot times from the contention window and decrements it only while the medium is idle; if the medium becomes busy the timer freezes. When it reaches zero the frame is transmitted. This randomisation is precisely what avoids the collision that would occur if all waiting stations started at the same instant.
- SIFS + ACK. After transmitting, the receiver waits a Short Inter-Frame Space (SIFS) — shorter than DIFS, so the ACK always wins the medium — and returns an ACK. If no ACK arrives within the ACK timeout, the frame is presumed lost: the contention window doubles (), a new random backoff is drawn and the frame retransmitted, until the retry limit is exceeded and the frame is dropped.
- Optional RTS/CTS. For large frames the sender first sends a short RTS; the receiver replies CTS after SIFS. Both are heard by neighbouring stations, which set their NAV and stay silent for the whole exchange (RTS → CTS → DATA → ACK). This reserves the medium and solves the hidden-terminal problem.
Summary of the timing order
Q8b. Why CSMA/CD is not implemented in WLAN?20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Why CSMA/CD is not implemented in WLAN?
Worked SolutionWhy CSMA/CD is Not Implemented in WLAN (IEEE 802.11)
Short answer: CSMA/CD requires a station to detect a collision while it is transmitting. In a wireless (radio) environment that is physically impossible and also unreliable, so 802.11 uses CSMA/CA + acknowledgements instead.
1. A transmitting station cannot listen at the same time
In wired Ethernet the transmitting NIC continuously monitors the coaxial cable/bus; a collision raises the voltage level above the transmitted signal and is detected immediately — this is the collision detection in CSMA/CD. A WLAN station uses a single half-duplex antenna and its own transmitted signal is many orders of magnitude stronger than any incoming one, so while it is radiating it simply cannot hear anyone else. True collision detection would need an expensive full-duplex transceiver with self-interference cancellation.
2. The hidden-terminal problem defeats collision detection
Two stations A and C may both be in range of the access point B but out of range of each other. A senses an idle medium (it cannot hear C) and transmits; C does the same at the same time. The frames collide at B, but neither sender hears the other, so neither detects the collision — the very event CSMA/CD exists to catch happens where it cannot be observed.
3. Sensing range and interference range differ (fading)
Radio signals degrade with distance, multipath and shadowing. A station may fail to decode a distant transmission (so it believes the medium is idle) while that transmission still raises the noise floor enough to corrupt its own frame. There is no single reliable collision-detect threshold like the voltage step on a wire, making the CSMA/CD rule meaningless.
4. Collisions are not the only cause of loss
WLAN frames are also lost to fading, interference from non-802.11 devices and obstacle blockage. Since an ACK is needed anyway to recover from propagation losses, CSMA/CA + ACK handles both losses with one mechanism; adding collision detection would buy nothing extra.
5. The medium is never truly quiet
Every radio receiver always hears some background noise, unlike the clean idle level of a wired bus, so the simple carrier idle ⇒ safe to transmit + voltage rise ⇒ collision logic does not transfer to radio.
Consequence: 802.11 defines CSMA/CA (collision avoidance) — DIFS waiting, a random backoff drawn from the contention window, SIFS-protected ACKs, and the optional RTS/CTS handshake — so that collisions are prevented rather than detected. (Note: 802.11 does allow an optional virtual collision handling inside the AP, but it is still not physical CSMA/CD.)
Q8c. Why acknowledgement is numbered in stop & wait protocol? Discuss the situation when unnumbered acknowledgements can create confusion in the sender receiver end.20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Why acknowledgement is numbered in stop & wait protocol? Discuss the situation when unnumbered acknowledgements can create confusion in the sender receiver end.
Worked SolutionWhy Acknowledgements are Numbered in Stop-and-Wait
Definition. In stop-and-wait ARQ the sender transmits exactly one frame and then waits for its acknowledgement before sending the next. Frames carry a sequence number that alternates 0, 1, 0, 1 ... and the ACKs carry a number too — normally the number of the next data frame the receiver expects. One bit is enough, because only one frame can be outstanding: states suffice for sender and receiver to stay in step.
Why the acknowledgement must be numbered
- The sender must know which frame was acknowledged. A timeout fires whenever the ACK is late, even if the data frame arrived safely and only the ACK was lost. A bare, unnumbered ACK signal cannot tell the sender what it confirms, so the sender cannot decide correctly between retransmitting a frame the receiver already has (duplicate) and moving on to the next frame (which the receiver may never have got).
- Duplicate suppression. The receiver compares the incoming frame number with the number it expects; a retransmission of a frame already delivered is recognised as old, discarded, and simply re-ACKed.
- Rejection of stale ACKs. A delayed ACK from an earlier exchange may still be circulating. Only its number reveals that it refers to an old frame, so it cannot be matched to the current one.
Situation where unnumbered ACKs cause confusion
Sender Receiver | --- data frame D0 (unnumbered) -------------> | delivered D0 to network layer | | --- ACK (no number) --- lost | timeout: no ACK arrives | | --- D0 retransmitted (unnumbered) -----------> | ???- The sender transmits frame D0; the receiver accepts it and delivers the data to the network layer.
- The ACK is delayed or lost. The sender times out and retransmits D0. Since neither frames nor ACKs are numbered, the receiver cannot recognise the copy and delivers the same data a second time — a fatal error in, say, a banking application where the same ₹1000 withdrawal would be recorded twice.
- Now suppose the original, delayed ACK finally arrives after the sender has already re-sent D0 and received a second ACK. Unable to read any number, the sender may match this stale ACK with the next frame it is about to send and advance prematurely, while the receiver is still waiting for the current frame.
- From that point the two ends are permanently out of step: the sender believes every frame is acknowledged, the receiver believes frames are being lost. Every later frame is either wrongly accepted out of order or wrongly rejected — exactly the confusion numbering prevents.
How numbering removes the confusion
After D0 the receiver expects number 1: a retransmitted D0 is identified as old, discarded, and ACKed again; an ACK numbered 1 is recognised as referring to frame D0 (or as requesting frame 1) and can never be mistaken for the ACK of some other frame. Sender and receiver therefore always agree on which frame is outstanding, and no data is ever delivered twice or lost silently.
Q8d. Describe 802.3 header formats. Why padding is required?20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Describe 802.3 header formats. Why padding is required?
Worked SolutionIEEE 802.3 (Ethernet) Header Formats and the Need for Padding
Before the header, the physical layer sends a 7-byte preamble (alternating 1010...) followed by a 1-byte SFD (Start Frame Delimiter,
10101011) to synchronise the receiver's clock. Two header formats then exist.1. Ethernet II (DIX) frame — the format in use today
+-----------+------+--------+--------+--------+----------------+------+------+ | Preamble | SFD | Dest. | Source | Type | DATA | | FCS | | (7 B) | (1 B)| MAC | MAC | (2 B) | (46 - 1500 B) | | (4 B)| | | | (6 B) | (6 B) | | | | | +-----------+------+--------+--------+--------+----------------+------+------+ | 0x0800 = IPv4 | | 0x0806 = ARP | | 0x86DD = IPv6 |- Destination MAC (6 B) — receiving NIC, or
FF:FF:FF:FF:FF:FFfor broadcast. - Source MAC (6 B) — sender's NIC address.
- Type / EtherType (2 B) — identifies the encapsulated network-layer protocol. A value (1536) is interpreted as a type.
- Data (46-1500 B) — the network-layer packet (padded to at least 46 B).
- FCS (4 B) — CRC-32 over destination address through data, used for error detection.
2. IEEE 802.3 frame
+---------+-----+--------+--------+--------+----------------+------+------+ |Preamble | SFD | DA | SA | Length | LLC / SNAP | DATA | FCS | | (7 B) |(1 B)| (6 B) | (6 B) | (2 B) | (3 or 8 B hdr) | | (4 B)| +---------+-----+--------+--------+--------+----------------+------+------+ Length = 46 ... 1500 (bytes of payload) LLC = DSAP (1 B) + SSAP (1 B) + Control (1 or 2 B) SNAP = Org code (3 B) + EtherType (2 B)The 2-byte field after the source address is a Length (a value ) giving the number of bytes in the payload, instead of a protocol type. The IEEE 802.2 LLC header (DSAP/SSAP/Control) identifies the upper-layer user; when no DSAP value exists for a protocol a SNAP header is added which carries the original EtherType — this is how 802.3 and Ethernet II stay compatible.
3. Why padding is required
The minimum frame must be 64 bytes (measured from the destination address through the FCS):
So the payload field must be at least 46 bytes. If the network-layer packet is shorter (e.g. a 28-byte ARP packet), the sender zero-pads the data field to 46 bytes; the FCS covers the padding, and the receiver strips the padding using the Length field after checking the FCS.Reason 1 — collision detection (slot time). Under CSMA/CD a station must still be transmitting when a collision from the farthest station can reach it, i.e. the frame transmission time must cover the round-trip propagation time:
A shorter frame would finish before a collision signal arrived, producing an undetected late collision — the sender would think the frame was delivered while it was actually corrupted.Reason 2 — receiver detection. The minimum length guarantees enough signal energy/pulses for the receiver's squelch circuit to distinguish a real frame from line noise.
Maximum size: 1518 bytes (6 + 6 + 2 + 1500 + 4), or 1522 bytes when a 4-byte 802.1Q VLAN tag is inserted.
- Destination MAC (6 B) — receiving NIC, or
Q9a. Write short notes on FTP.20237m
Module 5: Application Layer & Security
View this question on its own page →Write short notes on FTP.
Worked SolutionShort Notes on FTP (File Transfer Protocol)
Definition. FTP is an application-layer protocol of the TCP/IP model (Layer 5 of the TCP/IP stack, Layer 7 of the OSI model), standardised in RFC 959, for copying files between a client and a server over an IP network. It supports login/authentication, directory listing, upload, download, rename and delete, and can transfer files in ASCII (text) mode or image/binary mode (also EBCDIC), with file structures of file, record or page.
Two connections. FTP is unusual in using two separate TCP connections:
- Control connection — port 21 (well-known). Carries commands and replies as 7-bit ASCII lines (
USER,PASS,RETR,STOR,LIST,CWD,DELE,TYPE,PORT,PASV,QUIT) and remains open for the whole session. - Data connection — carries the actual file bytes; opened only for each transfer and closed afterwards.
Active vs passive mode.
- Active mode: the server opens the data connection from its port 20 to an ephemeral port chosen by the client.
- Passive mode (PASV): the client opens the data connection to an ephemeral port announced by the server. Passive mode is what works through NAT/firewalls, which normally refuse inbound connection attempts.
Features. User authentication with
USER/PASS(anonymous FTP uses the usernameanonymousand any e-mail address as password), ASCII/binary translation so that text files are converted between operating-system line endings, remote directory navigation, and resumption of interrupted transfers. Reliability comes from TCP, so FTP needs no error correction of its own.Security — the main limitation. Classic FTP transmits the password and file data in clear text; anyone sniffing the path can capture them. Secure alternatives are:
- SFTP — SSH File Transfer Protocol, running over SSH on port 22; a completely different protocol, not FTP with security added.
- FTPS — FTP secured with TLS/SSL: implicit TLS on port 990, or explicit
AUTH TLSnegotiated on port 21.
Other issue. The
PORTcommand embeds the client's private IP address inside the payload, which breaks behind NAT; RFC 2428 added theEPRT/EPSVextensions and IPv6 support to solve this. Because FTP keeps control and data on different ports, it is also awkward for packet-filtering firewalls, which must be told to open both.- Control connection — port 21 (well-known). Carries commands and replies as 7-bit ASCII lines (
Q9b. Write short notes on Firewall.20237m
Module 5: Application Layer & Security
View this question on its own page →Write short notes on Firewall.
Worked SolutionShort Notes on Firewall
Definition. A firewall is a combination of hardware and software placed between a trusted internal network and an untrusted network (usually the Internet) that enforces an access-control policy: it examines every entering and leaving packet against a rule set and permits, drops or rejects it accordingly. Its goals are to keep intruders out, limit which services are reachable from outside, and stop internal hosts from contacting dangerous destinations. It does not replace authentication, antivirus or user awareness.
Types (classified by the layer at which they filter)
- Packet-filtering firewall (Layers 3/4). Filters each packet individually using a rule list (ACL) built on the 5-tuple: source IP, destination IP, protocol (TCP/UDP/ICMP), source port and destination port. It is cheap, fast, transparent to applications and needs no host configuration. But it is stateless — it cannot tell whether an inbound ACK belongs to a connection this host actually started — it cannot inspect payloads, and a large rule set quickly becomes inconsistent and error-prone.
- Stateful-inspection firewall (Layers 3-5). Maintains a state table of live connections, e.g.
192.168.1.10:49152 -> 142.250.x.x:443 ESTABLISHED. Inbound packets are accepted only if they belong to an existing session or are genuine new connection requests. This blocks spoofed, random inbound packets that a loose stateless rule would let through. - Circuit-level gateway / proxy (Layer 5). Validates the session (TCP handshake, SOCKS) between internal and external hosts without examining each packet; simple but gives no content control.
- Application-layer firewall / proxy (Layer 7). Understands specific protocols (HTTP, FTP, SMTP, DNS), so it can filter URLs and keywords, block file types, log individual user actions and reject malformed requests. It is the most thorough but adds latency and needs a proxy for every service. Next-generation firewalls (NGFW) add intrusion-prevention, application identification and user/packet deep inspection.
Other important ideas
- DMZ (demilitarised zone): a screened subnet between two firewall interfaces holding the public servers (web, mail, FTP). Even if a DMZ server is compromised, the internal network stays isolated.
- Default-deny policy: inbound traffic is denied unless explicitly allowed (only ports such as 80/443/25 open) — the safe default; default-allow is the opposite and is dangerous.
- Bastion host: the most exposed, heavily hardened system in the DMZ.
- Egress filtering restricts outbound traffic too, which limits data exfiltration and blocked-malware callbacks.
Limitations
A firewall cannot stop attacks arriving over an allowed channel (malware inside HTTPS, phishing), cannot see content of encrypted traffic unless it terminates TLS, does nothing against insider users or guests on the Wi-Fi, and cannot protect links (modem/remote access) that bypass it.
Q9c. Write short notes on VLAN.20237m
Module 2: Data Link Layer & MAC Sublayer
View this question on its own page →Write short notes on VLAN.
Worked SolutionShort Notes on VLAN (Virtual LAN)
Definition. A VLAN is a logical group of stations that communicate as if they were on the same broadcast domain, regardless of their physical location or the switch they are plugged into. VLANs are standardised by IEEE 802.1Q: one physical LAN is divided into several logical LANs by software configuration instead of by cabling.
Key points
- Broadcast containment. Each VLAN is a separate broadcast domain, so a broadcast in VLAN 10 reaches only VLAN 10 hosts. Broadcast storms and needless traffic are reduced and overall performance improves.
- Logical grouping and easy administration. Hosts are grouped by function (Accounts, Faculty, Hostel, Lab) rather than by wiring. Moving or adding a host is a switch-port configuration change, not re-cabling — administration becomes fast, cheap and error-free.
- Security / isolation. Stations in different VLANs cannot exchange frames at Layer 2. Traffic between VLANs must pass through a router or Layer-3 switch (inter-VLAN routing, e.g. router-on-a-stick with 802.1Q sub-interfaces), so guest traffic can be kept away from server traffic and access control can be applied at that point.
The 802.1Q tag
For a frame crossing a trunk link a 4-byte tag is inserted after the source MAC address:
+--------+--------+--------------+--------------+---------+-----+ | DA(6B) | SA(6B) | TPID (2 B) | TCI (2 B) | Payload | FCS | | | | = 0x8100 | | | | +--------+--------+--------------+--------------+---------+-----+ TCI = PCP (3 bits, priority) | DEI (1 bit) | VID (12 bits)- VID = 12 bits values; VLAN IDs 1 to 4094 are usable (0 and 4095 are reserved); VLAN 1 is the default VLAN.
- The tag adds 4 bytes, so a tagged frame may reach 1522 bytes (1518 + 4).
Port types
- Access port: belongs to exactly one VLAN; frames to/from end devices are sent untagged. PCs, printers and IP phones attach here.
- Trunk port: carries the frames of many VLANs between switches and routers, tagging each with 802.1Q. The native VLAN is carried untagged. Pruning (802.1Q-2005) removes VLANs from a trunk that does not need them, saving bandwidth.
Types of VLAN and summary
VLANs may be port-based (static, most common), MAC-based, protocol-based or dynamic/role-based. Advantages: flexibility, broadcast reduction, security, easy reconfiguration and mobility. Limitations: only 4094 VLANs are available, inter-VLAN traffic needs a router/L3 switch (extra cost), and a misconfigured trunk can leak traffic between VLANs.
Q9d. Write short notes on NAT.20237m
Module 3: Network Layer & Routing
View this question on its own page →Write short notes on NAT.
Worked SolutionShort Notes on NAT (Network Address Translation)
Definition. NAT is a method of remapping IP addresses as packets pass through a router/firewall: the source address (and port) of an outgoing packet is replaced by an address of the NAT device, and returning packets are translated back using a translation table. It operates at Layer 3 of the network layer and is specified in RFC 1631 (original NAT) and RFC 3022 (Traditional NAT).
Why NAT is needed
- Address conservation. The private addresses of RFC 1918 —
10.0.0.0/8,172.16.0.0/12,192.168.0.0/16— are not routable on the public Internet. NAT lets hundreds of hosts in a home or office share one public IPv4 address. - Security / abstraction — internal addresses and topology are hidden from outsiders, and the internal numbering need not change when the ISP changes the public address.
Types
Type Mapping Typical use Static NAT one private one public, permanent servers that must be reached from outside Dynamic NAT one private one public, taken from a pool for the session and released after a timeout small pools where each active host needs a public IP PAT / NAT overload many private 1 public, distinguished by unique port numbers home routers and most offices — the default today Double NAT / CGNAT carrier-grade NAT using the shared space 100.64.0.0/10 (RFC 6598) ISPs short of public IPv4 addresses How PAT works
The NAT device keeps a table such as
(192.168.1.10, 5001) <-> (203.0.113.5, 40001) TCP (192.168.1.11, 5002) <-> (203.0.113.5, 40002) TCP (192.168.1.10, 5003) <-> (203.0.113.5, 40003) UDPThe unique source port lets the NAT box demultiplex the returning segments to the correct internal host, so one public address serves many private ones. Entries are created on outbound traffic and deleted after a timeout.
Limitations
- It breaks the end-to-end principle: an internal host cannot be addressed from outside, so servers need static mappings / port forwarding.
- Protocols that carry addresses in the payload (FTP
PORT, SIP, IPsec AH) need an ALG (application-layer gateway) to rewrite them; transport-mode IPsec ESP fails under NAT, which is why NAT-Traversal (UDP encapsulation on port 4500) exists. - It complicates peer-to-peer applications, end-to-end diagnostics and tracing, since the public port identifies only the NAT box, not the internal host.
- The pool of public addresses can be exhausted by concurrent sessions — PAT is used precisely to avoid this.
- Address conservation. The private addresses of RFC 1918 —
PYQDeck for Android
Solve BEU previous-year exam papers anywhere, anytime. Fast search, offline paper viewing, and step-by-step solutions designed specifically for your phone.