TCP/IP Illustrated, Volume 1: The Protocols

Citation

Fall, K. R., & Stevens, W. R. (2011). TCP/IP Illustrated, Volume 1: The Protocols (2nd ed.). Addison-Wesley Professional.

Chapter Summary

The second edition runs to about 1,050 pages in eighteen chapters, preceded by a foreword and two prefaces (one for this edition, one adapted from the first) and followed by a glossary of acronyms. Chapters 1–11 cover the layers below transport together with naming; Chapters 12–17 are devoted to TCP; Chapter 18 turns to security. Nearly every chapter ends with a section on attacks involving its protocol, then a summary and references.

Chapter 1: Introduction

Sets out the architectural principles of the Internet, the design and implementation of its protocols, and the structure of the TCP/IP suite. It also covers internets, intranets and extranets, how applications are designed, the standardization process, available implementations, and attacks that exploit the architecture itself.

Chapter 2: The Internet Address Architecture

Explains how IP addresses are written and structured for both IPv4 and IPv6, including CIDR and aggregation, special-use addresses, allocation, and unicast address assignment.

Chapter 3: Link Layer

Covers Ethernet and the IEEE 802 standards, full duplex, power save and autonegotiation, bridges and switches, wireless LANs (IEEE 802.11), the Point-to-Point Protocol, loopback, MTU and path MTU, and tunneling basics.

Chapter 4: ARP: Address Resolution Protocol

A short chapter on the ARP cache, frame format, timeouts, proxy ARP, gratuitous ARP and address conflict detection, the arp command, and attacks involving ARP.

Chapter 5: The Internet Protocol (IP)

Presents the IPv4 and IPv6 headers, IPv6 extension headers, IP forwarding, Mobile IP, and the way hosts process datagrams.

Chapter 6: System Configuration: DHCP and Autoconfiguration

Opens with a long section on DHCP, followed by IPv6 stateless address autoconfiguration (SLAAC), the interaction of DHCP and DNS, and PPP over Ethernet.

Chapter 7: Firewalls and Network Address Translation (NAT)

Treats firewalls and NAT, NAT traversal, configuration of packet-filtering firewalls and NATs, and NAT for IPv4/IPv6 coexistence and transition.

Chapter 8: ICMPv4 and ICMPv6: Internet Control Message Protocol

Describes ICMP messages, error messages and query or informational messages, then IPv6 Neighbor Discovery and the translation between ICMPv4 and ICMPv6.

Chapter 9: Broadcasting and Local Multicasting (IGMP and MLD)

Covers broadcasting, multicasting, and the group-management protocols IGMP and MLD.

Chapter 10: User Datagram Protocol (UDP) and IP Fragmentation

Covers the UDP header and checksum, UDP over IPv6, UDP-Lite, IP fragmentation, path MTU discovery with UDP, maximum datagram size, UDP server design, and translation between UDP/IPv4 and UDP/IPv6.

Chapter 11: Name Resolution and the Domain Name System (DNS)

A large chapter on the DNS name space, name servers and zones, caching, and the DNS protocol itself, followed by split DNS and round-robin, DynDNS, DNS64, LLMNR and mDNS, LDAP, and attacks on the DNS.

Chapters 12–13: TCP Preliminaries; TCP Connection Management

Chapter 12 (TCP: The Transmission Control Protocol, Preliminaries) introduces TCP, its header and encapsulation; the publisher offers it as a free sample. Chapter 13 covers connection establishment and termination, TCP options, path MTU discovery, state transitions, reset segments and server operation.

Chapters 14–15: TCP Timeout and Retransmission; TCP Data Flow and Window Management

Chapter 14 deals with setting the retransmission timeout, timer-based retransmission, fast retransmit, selective acknowledgments, spurious timeouts, reordering and duplication. Chapter 15 covers interactive communication, delayed acknowledgments, the Nagle algorithm, flow control and window management, and the urgent mechanism.

Chapters 16–17: TCP Congestion Control; TCP Keepalive

Chapter 16 presents the classic congestion-control algorithms and their evolution, an extended example, TCP friendliness, high-speed and delay-based variants, buffer bloat, and active queue management with ECN. Chapter 17 is a short chapter on keepalives.

Chapter 18: Security: EAP, IPsec, TLS, DNSSEC, and DKIM

Begins with basic principles of information security, threats and cryptography, then certificates and PKIs, network access control (802.1X, EAP), IPsec, TLS and DTLS, DNSSEC and DKIM.

Key Concepts

Chapters 1–5: Architecture, Addressing, Link Layer, ARP and IP

• Architectural principles: the design goals behind the TCP/IP suite and how its protocols fit together.
• CIDR and aggregation: classless addressing as the basis of IPv4 and IPv6 address structure.
• Path MTU: the largest datagram that can cross a path without fragmentation.
• IPv6 extension headers: optional headers that extend the basic IPv6 header.

Chapters 6–11: Configuration, NAT, ICMP, Multicast, UDP and DNS

• DHCP and SLAAC: stateful and stateless ways of configuring a host's address.
• NAT traversal: techniques for communication through address translators.
• Neighbor Discovery: the IPv6 mechanism that takes over the work of ARP.
• IGMP and MLD: group-management protocols for IPv4 and IPv6 multicast.
• DNS caching and zones: how the name space is divided and queries are answered.

Chapters 12–17: TCP

• Retransmission timeout and fast retransmit: how TCP decides when a segment is lost.
• Nagle algorithm and delayed acknowledgments: interactions that shape small-segment traffic.
• Congestion control: the algorithms that limit sending rate to network capacity.
• Buffer bloat and ECN: queueing problems and the signalling mechanisms that address them.

Chapter 18: Security

• IPsec, TLS and DTLS: protocol suites that protect traffic at the network and transport layers.
• DNSSEC and DKIM: authentication added to naming and e-mail.

Critical Analysis

Strengths

• Protocols shown in operation. The publisher describes the book as showing each protocol in action through realistic examples from Linux, Windows and Mac OS, and as explaining why the protocols work as they do.
• Complete layer-by-layer coverage with a consistent structure. The table of contents shows the same pattern in every protocol chapter: introduction, mechanism, a section on attacks, summary and references. That makes it easy to find what a protocol is vulnerable to without reading the rest.
• Depth on TCP. Six chapters (12–17), more than 220 pages, cover connection management, timeout and retransmission, window management, congestion control and keepalive, far more than a general networking text gives it.
• IPv6 integrated, not appended. Addressing, headers, extension headers, Neighbor Discovery, SLAAC, UDP over IPv6 and NAT for transition appear in the main chapters.

Limitations

• Size and pace. At roughly 1,050 pages the book is a reference more than a course text; individual chapters, such as the DHCP section (about 40 pages) or the DNS protocol section (about 45 pages), go well beyond what most courses need.
• Prerequisites. The book introduces TCP/IP's goals and architecture, but readers are expected to be comfortable with networking vocabulary; it is not a first introduction to networking.
• Dated at the edges. The book appeared in 2011, so the congestion-control chapter's treatment of high-speed, delay-based and ECN mechanisms reflects the field at that point, and later TCP developments are not in the table of contents.

Where It Fits in the Course

This book serves as the protocol-level reference in a computer-networks sequence. Kurose and Ross begin from applications and move down the stack, and Tanenbaum's text works through the layers from the physical level up; Forouzan's book is a gentler bottom-up introduction to the TCP/IP suite, and Comer's is a non-mathematical account of how the Internet works. Any of these is a sensible first course, after which Fall and Stevens supplies the detail on how each protocol behaves on the wire.

Varghese and Xu's Network Algorithmics is a graduate text about making network software and hardware fast, so it asks a different question: it assumes the protocols are understood and studies the implementation bottlenecks. Reading the TCP chapters here first gives the background for it.

How to Use This Book

The book is best for students who have finished an introductory networking course and want to see exactly what packets look like, for network engineers and administrators who troubleshoot real systems, and for security analysts who need precise protocol behaviour.

A practical plan:

• Core: Chapters 1, 2 and 5 for architecture, addressing and IP; Chapters 12–16 for TCP, read in order.
• Read when needed: Chapter 3 (link layer), Chapters 4 and 6 (ARP, DHCP), Chapter 8 (ICMP), Chapter 10 (UDP) and Chapter 11 (DNS), as the course or a debugging task requires.
• Specialist: Chapter 7 (NAT and firewalls), Chapter 9 (multicast), Chapter 17 (keepalive) and Chapter 18 (security), which is a short course on its own.

Capture traffic with a packet analyzer on a lab machine while reading, and compare it with the traces in the text. Use the attack sections as a checklist when studying network security.