File Transfer and Remote Login

Modern computer networks rely on application-layer protocols to facilitate file sharing, system configuration, remote control, and email communications across diverse operating system platforms. This guide details the architecture, design patterns, and operational mechanics of these core Internet protocols.

1. File Transfer Protocol (FTP) and TFTP

The exchange of files between heterogeneous computing platforms presents significant challenges, such as reconciling incompatible directory structures, file-naming conventions, and internal data representations (e.g., ASCII versus EBCDIC).

1.1 FTP Architecture and Dual-Connection Model

Unlike protocols that multiplex commands and data over a single stream, the File Transfer Protocol (FTP) utilizes an out-of-band control architecture. FTP establishes two separate Transmission Control Protocol (TCP) connections between the client and server:

Control Connection (Port 21): Established first, this connection remains open for the entire duration of the interactive session. It transmits user credentials, configuration commands, and file transfer requests.
Data Connection (Port 20): This is a transient connection. It is opened on-demand and closed automatically after completing a specific file transmission or directory listing.

text

       +---------------------------------------------+
       |                 FTP CLIENT                  |
       |  +-----------------+   +-----------------+  |
       |  |  User Interface  |   |   User-PI *     |  |
       |  +--------+--------+   +--------+--------+  |
       |           |                     |           |
       |  +--------v--------+   +--------v--------+  |
       |  |    Client-DTI*  |   |  Control Conn.  |  |
       |  +--------+--------+   +--------+--------+  |
       +-----------|---------------------|-----------+
                   |                     |
             Port 20 (Data)        Port 21 (Control)
                   |                     |
       +-----------|---------------------|-----------+
       |           |                     |           |
       |  +--------v--------+   +--------v--------+  |
       |  |    Server-DTI*  |   |   Server-PI*    |  |
       |  +--------+--------+   +--------+--------+  |
       |           |                     |           |
       |  +--------v--------+            |           |
       |  |    File System  |            |           |
       |  +-----------------+            |           |
       |                 FTP SERVER                  |
       +---------------------------------------------+
       * PI = Protocol Interpreter | DTI = Data Transfer Interface

This separation ensures that a massive file transfer does not block or delay the execution of urgent control commands, such as aborting an active transfer.

Active vs. Passive FTP Modes

The mechanics of data connection establishment depend on the operational mode:

Active Mode: The client issues a PORT command specifying its temporary IP address and port number. The server then initiates a TCP connection from its local Port 20 to the client's specified port. This mode often fails when the client is behind a firewall or network address translator (NAT), as incoming connection requests are typically blocked.
Passive Mode (PASV): The client sends a PASV command to the server. The server responds with a temporary port number. The client then initiates the data connection to this port, avoiding firewall blockage.

1.2 Trivial File Transfer Protocol (TFTP)

For lightweight file transfers—such as downloading boot images or configuration files to diskless workstations and routers—the overhead of FTP's TCP connections is inefficient. Trivial File Transfer Protocol (TFTP) operates directly over User Datagram Protocol (UDP) on port 69.

text

+------------------+------------------+------------------+
| Opcode (2 bytes) |  Filename (Var)  | Mode (Var) |  0  |  Read (RRQ) / Write (WRQ)
+------------------+------------------+------------------+
| Opcode (2 bytes) | Block # (2 bytes)|    Data (0-512 bytes)   |  DATA Packet
+------------------+------------------+------------------+
| Opcode (2 bytes) | Block # (2 bytes)|                     ACK Packet
+------------------+------------------+------------------+

To maintain reliability over UDP, TFTP uses a lock-step Stop-and-Wait flow control mechanism:

Each data packet contains exactly $512$ bytes of payload (except the final terminating packet, which has $< 512$ bytes).
The sender transmits a data block and waits for an explicit Acknowledgement (ACK) matching the block number before sending the next block.
If an ACK is not received within a preconfigured timeout period, the sender retransmits the block.

Remote login protocols allow a user to access a command-line interface on a remote server as if their terminal were physically connected to that system.

text

+---------------+                 NVT Stream                 +---------------+
| Local Terminal| <----------------------------------------> | Remote Server |
+-------+-------+                                            +-------+-------+
        |                                                            |
        v                                                            v
+---------------+             TCP Connection                 +---------------+
| TELNET Client | <========================================> | TELNET Server |
+---------------+                 Port 23                    +---------------+

2.1 TELNET and the Network Virtual Terminal (NVT)

TELNET (Terminal Network) provides terminal emulation across diverse environments using a software abstraction called the Network Virtual Terminal (NVT).

The Translation Model: The TELNET client converts terminal-specific keyboard inputs (e.g., carriage return behaviors, special keys) into NVT format before sending them. The remote server's daemon converts NVT codes into the host system's native terminal format.
NVT Coding Scheme: Character codes from $0$ to $127$ represent standard US-ASCII text. Codes from $128$ to $255$ are reserved for control functions. Control signals are marked by the Interpret As Command (IAC) byte, which has a hexadecimal value of 0xFF ( $255$ ).

Option Negotiation

TELNET uses four command codes to dynamically negotiate features like terminal echo, window size, and character set:

$\text{Commands: } \{\text{DO}, \text{DONT}, \text{WILL}, \text{WONT}\}$

An example exchange requesting the remote server to handle echo functions is shown below:

text

Client                                                   Server
  |                                                        |
  | -------- [IAC] [DO] [ECHO] (0xFF 0xFD 0x01) ---------> | (Client requests Server to echo)
  |                                                        |
  | <------- [IAC] [WILL] [ECHO] (0xFF 0xFB 0x01) -------- | (Server accepts and starts echoing)

2.2 Secure Shell (SSH)

TELNET transmits data—including usernames, passwords, and commands—in plaintext, making it vulnerable to eavesdropping and session hijacking. Secure Shell (SSH) provides a secure alternative by establishing an encrypted channel over TCP port 22.

text

+-----------------------------------------------------------+
|                     SSH PACKET FORMAT                     |
|  +-----------------------------------------------------+  |
|  |             Packet Length (4 bytes)                 |  |
|  +-----------------------------------------------------+  |
|  |             Padding Length (1 byte)                 |  |
|  +-----------------------------------------------------+  |
|  |                      Payload                        |  |
|  |    (Authenticated and Encrypted Application Data)   |  |
|  +-----------------------------------------------------+  |
|  |                  Random Padding                     |  |
|  +-----------------------------------------------------+  |
|  |            Message Authentication Code (MAC)        |  |
|  +-----------------------------------------------------+  |
+-----------------------------------------------------------+

Layered Architecture

SSH consists of three main sub-protocols:

SSH Transport Layer Protocol: Handles server authentication, confidentiality, and integrity using cryptographic algorithms (e.g., Diffie-Hellman, AES). It also handles data compression.
SSH User Authentication Protocol: Authenticates the client to the server using mechanisms such as public-key cryptography, passwords, or host-based credentials.
SSH Connection Protocol: Multiplexes the secure tunnel into multiple logical channels, enabling interactive shell sessions, remote command execution, and port forwarding.

3. World Wide Web and HTTP

The World Wide Web (WWW) is a distributed client-server application that retrieves linked hypermedia resources.

text

         Static Document Retrieval                           CGI Dynamic Document Generation
    Client                      Server                   Client                      Server
      |                           |                        |                           |
      | --- HTTP GET Request ---> |                        | --- HTTP GET Request ---> |
      |                           |                        |                           | +------------------+
      |                           | [Reads from Disk]      |                           | | Execute Program  |
      |                           |                        |                           | | & Return Output  |
      |                           |                        |                           | +--------+---------+
      | <--- HTTP 200 OK File --- |                        | <--- HTTP 200 OK Output - | <--------+

3.1 Categorization of Web Documents

Static Documents: Fixed-content files (e.g., HTML, CSS, images) stored on the server's disk. The server retrieves and transmits them without modification.
Dynamic Documents: Created on-the-fly by the web server in response to a client request. The server executes an external helper program, such as a Common Gateway Interface (CGI) script or a server-side runtime (e.g., PHP, Node.js), and returns its output to the client.
Active Documents: Program code sent from the server but executed directly on the client browser (e.g., JavaScript). This offloads computational tasks to the client and enables interactive user interfaces.

3.2 Hypertext Transfer Protocol (HTTP)

HTTP is a stateless protocol used to retrieve resources on the web, operating over TCP port 80.

HTTP Transaction Formats

An HTTP transaction consists of a request and a response.

text

HTTP Request Message:
+-------------------------------------------------------------+
| Method (e.g., GET) | Space | URL | Space | Version | CR LF  | <- Request Line
+-------------------------------------------------------------+
| Header Field Name | : | Value                      | CR LF  | <- Headers
+-------------------------------------------------------------+
| CR LF (Blank Line)                                          |
+-------------------------------------------------------------+
| Entity Body (Optional, e.g., POST payload)                 |
+-------------------------------------------------------------+
 
HTTP Response Message:
+-------------------------------------------------------------+
| Version | Space | Status Code (e.g., 200) | Phrase | CR LF  | <- Status Line
+-------------------------------------------------------------+
| Header Field Name | : | Value                      | CR LF  | <- Headers
+-------------------------------------------------------------+
| CR LF (Blank Line)                                          |
+-------------------------------------------------------------+
| Entity Body (Optional, e.g., HTML File)                     |
+-------------------------------------------------------------+

Message Traces

The following is an example HTTP request and response trace:

http

# Client Request
GET /usr/bin/image1.gif HTTP/1.1
Host: www.example.com
Accept: image/gif, image/jpeg
Connection: close
 
# Server Response
HTTP/1.1 200 OK
Date: Mon, 15 Jul 2026 12:00:00 GMT
Server: Apache/2.4.41 (Unix)
Content-Type: image/gif
Content-Length: 2048
 
[Raw Binary Image Data]

Connection Persistence Model

The persistence model of the underlying TCP connection significantly impacts performance:

Non-Persistent Connections (HTTP/1.0): The server opens a new TCP connection for each requested object and closes it immediately after delivery. If an HTML document contains references to ten images, retrieving the page requires eleven separate TCP handshakes:

$\text{Total Connections} = 1 \text{ (HTML)} + 10 \text{ (Images)} = 11$
Persistent Connections (HTTP/1.1): The server keeps the TCP connection open after sending a response. The client can request subsequent objects over the same connection, reducing handshake overhead and latency.

Cookies and State Management

HTTP is stateless; it does not retain information about previous requests. To maintain state (such as user sessions or shopping carts), servers use Cookies:

The server includes a Set-Cookie header in an HTTP response (e.g., Set-Cookie: ID=12343).
The client browser stores this value and includes it in the Cookie header of all subsequent requests to that domain (e.g., Cookie: ID=12343).
The server uses this identifier to retrieve the user's session data from its backend database.

4. Electronic Mail (SMTP, POP3, IMAP, and MIME)

Internet email architecture divides the message delivery process into creation, transfer, and retrieval.

text

  Sender Client                     Mail Servers                      Receiver Client
+---------------+   SMTP (Push)   +-------------+   SMTP (Push)   +-------------+
|  User Agent   | --------------> | Message     | --------------> | Message     |
|     (UA)      |                 | Transfer    |                 | Access      |
+---------------+                 | Agent (MTA) |                 | Agent (MAA) |
                                  +-------------+                 +------+------+
                                                                         |
                                                                         | POP3 / IMAP4
                                                                         | (Pull)
                                                                         v
                                                                  +-------------+
                                                                  |  User Agent |
                                                                  |     (UA)    |
                                                                  +-------------+

4.1 Architecture and Delivery Agent Roles

User Agent (UA): The client software interface (e.g., Outlook, webmail) used to compose, read, and organize email messages.
Message Transfer Agent (MTA): The server software (e.g., Postfix, Sendmail) that routes emails across the Internet. MTAs communicate using the Simple Mail Transfer Protocol (SMTP). Because SMTP is a push protocol, it is used to send messages from a client to a server, and between servers.
Message Access Agent (MAA): The server software that allows recipients to retrieve emails from their mail server. Because mail retrieval requires a pull protocol, MAAs utilize POP3 or IMAP4 instead of SMTP.

4.2 SMTP Protocol Mechanics

SMTP operates over TCP port 25 and uses standard ASCII text commands:

text

Server Response: 220 mail.destination.com ESMTP
Client Command : HELO mail.sender.com
Server Response: 250 OK
Client Command : MAIL FROM:<alice@sender.com>
Server Response: 250 OK
Client Command : RCPT TO:<bob@destination.com>
Server Response: 250 OK
Client Command : DATA
Server Response: 354 Start mail input; end with <CR><LF>.<CR><LF>
Client Command : Subject: Academic Overview
Client Command :
Client Command : This is a test email message.
Client Command : .
Server Response: 250 OK Message accepted for delivery
Client Command : QUIT
Server Response: 221 Service closing transmission channel

4.3 Mail Access Protocols: POP3 vs. IMAP4

Post Office Protocol Version 3 (POP3): A simple, pull-based retrieval protocol operating over TCP port 110. POP3 typically downloads all messages from the server to the client's local storage and deletes them from the server. This model makes it difficult to sync email state across multiple devices.
Internet Message Access Protocol Version 4 (IMAP4): A more advanced protocol operating over TCP port 143. IMAP4 syncs message state directly on the mail server. It supports server-side search, custom folders, and partial downloads (such as downloading headers without attachments).

4.4 Multipurpose Internet Mail Extensions (MIME)

SMTP was originally designed to transmit only 7-bit US-ASCII text characters. Multipurpose Internet Mail Extensions (MIME) is an expansion framework that allows non-ASCII data, such as images, audio, and attachments, to be sent through standard email.

text

+--------------------------------------------------------+
|                      MIME HEADER                       |
|  +--------------------------------------------------+  |
|  | MIME-Version: 1.0                                |  |
|  +--------------------------------------------------+  |
|  | Content-Type: image/jpeg                         |  |
|  +--------------------------------------------------+  |
|  | Content-Transfer-Encoding: base64                |  |
|  +--------------------------------------------------+  |
+--------------------------------------------------------+

MIME introduces specialized headers to describe the format of a message payload:

MIME-Version: Declares the version of the MIME standard being used.
Content-Type: Defines the media type and subtype of the data (e.g., text/html, image/png, application/pdf).
Content-Transfer-Encoding: Specifies the algorithm used to encode binary data into a 7-bit ASCII representation. Common encoding schemes include:
- Base64: Divides every $3$ bytes of binary data ( $24$ bits) into $4$ chunks of $6$ bits each. Each 6-bit chunk maps to a specific character in a 64-character ASCII table, resulting in a constant size increase of approximately :

5. Domain Name System (DNS) and DHCP

IP routing protocols require numeric IP addresses, while users rely on human-readable domain names. The Domain Name System and Dynamic Host Configuration Protocol bridge this gap.

text

                            DNS Tree Hierarchy
                                  [Root]
                                    |
                    +---------------+---------------+
                    |                               |
                  [com]                           [org]
                    |                               |
             +------+------+                  +-----+-----+
             |             |                  |           |
        [example]       [google]           [kophub]     [ieee]
             |
          [www]

5.1 The Domain Name System (DNS)

DNS is a distributed database structured as an inverted hierarchical tree with up to $128$ levels (Level $0$ representing the Root).

Name Resolution Mechanics

When a client resolver queries a domain name, it uses one of two methods:

Recursive Resolution: The client queries a local DNS server. If the server does not have the record, it queries other servers on the client's behalf until it finds the answer or returns an error. This shifts the work of name resolution from the client to the local server.
Iterative Resolution: The local DNS server queries other servers in sequence. If a queried server cannot resolve the name, it returns the address of the next authoritative server down the hierarchy (e.g., Root $\to$ TLD $\to$ Authoritative Name Server). The local server then queries that next server directly.

text

Iterative Resolution Path:
Client      Local DNS Server        Root Server       TLD Server (.com)     Auth Server
  |                |                     |                     |                  |
  | -- Query ----> |                     |                     |                  |
  |                | -- Query ---------> |                     |                  |
  |                | <-- Refer to .com - |                     |                  |
  |                |                                           |                  |
  |                | -- Query -------------------------------> |                  |
  |                | <-- Refer to example.com ----------------- |                  |
  |                |                                                              |
  |                | -- Query --------------------------------------------------> |
  |                | <-- IP Address --------------------------------------------- |
  |<-- Response -- |                                                              |

DNS Transport & Encapsulation

DNS queries and responses are encapsulated in UDP datagrams on port 53.

If a response message exceeds $512$ bytes, the server sets the truncation flag (TC) in the header.
The client then retries the query over a reliable TCP port 53 connection to handle the larger payload.
Zone transfers—which copy database records from a primary name server to a secondary name server—always use TCP port 53 to guarantee reliability.

5.2 Dynamic Host Configuration Protocol (DHCP)

To communicate on a TCP/IP network, a host must be configured with four key pieces of information:

Unique IP Address
Subnet Mask
Default Gateway (Router IP)
Local DNS Server IP Address

DHCP automates this configuration process, operating over UDP with port 67 for servers and port 68 for clients.

text

Client (0.0.0.0:68)                                   DHCP Server (Port 67)
       |                                                       |
       | ------ DHCPDISCOVER (UDP Broadcast) ----------------> |
       |                                                       |
       | <----- DHCPOFFER (UDP Broadcast/Unicast) ------------ |
       |                                                       |
       | ------ DHCPREQUEST (UDP Broadcast) -----------------> |
       |                                                       |
       | <----- DHCPACK (UDP Broadcast/Unicast) -------------- |

DHCP State Machine

A DHCP client transitions through several states to acquire and renew its IP lease:

text

 [INIT] 
   |
   | Send DHCPDISCOVER
   v
 [SELECTING] <---+ (If lease expires or NAK received)
   |             |
   | Receive DHCPOFFER, Send DHCPREQUEST
   v             |
 [REQUESTING] ---+
   |
   | Receive DHCPACK
   v
 [BOUND] (Active lease)
   |
   | T1 Timer Expires (50% of lease time) -> Send DHCPREQUEST (Unicast)
   v
 [RENEWING] 
   |
   +--- Receive DHCPACK ---> [BOUND]
   |
   | T2 Timer Expires (87.5% of lease time) -> Send DHCPREQUEST (Broadcast)
   v
 [REBINDING]
   |
   +--- Receive DHCPACK ---> [BOUND]
   |
   | Lease Expires / NAK
   v
 [INIT]

6. Simple Network Management Protocol (SNMP)

Network administrators monitor and configure network devices, such as routers, switches, and servers, using network management systems.

text

+-----------------------+                    SNMP Protocol Commands                  +-----------------------+
|  Manager Station      | <========================================================> |     Managed Agent     |
|                       |            GetRequest / SetRequest / Response              |  +-----------------+  |
|  +-----------------+  |                                                            |  |      MIB-2      |  |
|  |  SMI Data Rules |  | <------------------ SNMP Trap (Port 162) ----------------- |  | (Data Variables)|  |
|  +-----------------+  |                                                            |  +-----------------+  |
+-----------------------+                                                            +-----------------------+

6.1 The SNMP Management Triad

Network management relies on three coordinated components:

Structure of Management Information (SMI): Defines the data types, naming rules, and encoding guidelines for managed objects.
Management Information Base (MIB): A structured database of managed variables on a device (e.g., packet counts, interface states). It organizes these variables hierarchically under the mib-2 subtree.
Simple Network Management Protocol (SNMP): The communication protocol that defines the format of packets exchanged between managers and agents.

6.2 SMI Naming and NVT Encoding Rules

SMI assigns a unique Object Identifier (OID) to every managed variable. All OIDs monitored by SNMP fall under a standardized global tree hierarchy:

$\text{Root Prefix: } 1.3.6.1.2.1 \quad (\text{iso.org.dod.internet.mgmt.mib-2})$

For example, the variable that tracks incoming UDP datagrams (udpInDatagrams) is identified by:

$\text{OID: } 1.3.6.1.2.1.7.1.0$

SMI uses Abstract Syntax Notation One (ASN.1) and Basic Encoding Rules (BER) to encode data for transmission across the network. BER encodes data using a three-field format:

text

+-------------------+---------------------+-------------------------+
|    Tag (1 byte)   |   Length (1 byte)   |      Value (Variable)   |
+-------------------+---------------------+-------------------------+

Tag: Identifies the data type (e.g., 0x02 for INTEGER, 0x04 for OCTET STRING).
Length: Specifies the size of the value field in bytes.
Value: Contains the actual payload being transmitted.

text

Example: Encoding the integer value 14
+-------------------+---------------------+-------------------------+
|     Tag: 0x02     |    Length: 0x01     |       Value: 0x0E       |
+-------------------+---------------------+-------------------------+

6.3 SNMP Operational Mechanics

SNMP uses UDP port 161 for standard manager-initiated queries and port 162 for agent-initiated event notifications (Traps).

text

+---------------------------------------------------------------------------------------------------------+
|                                           SNMP PDU FORMAT                                               |
|  +------------------+-------------------+-------------------------+----------------------------------+  |
|  | PDU Type (1 byte)| Request ID (4 B)  | Error Status (1 byte)   | Error Index (1 byte)             |  |
|  +------------------+-------------------+-------------------------+----------------------------------+  |
|  | VarBind List (Sequence of Object Identifiers and their associated values)                           |  |
|  +---------------------------------------------------------------------------------------------------+  |
+---------------------------------------------------------------------------------------------------------+

GetRequest: Sent by the manager to retrieve the value of a specific MIB variable.
SetRequest: Sent by the manager to modify the value of a MIB variable, changing the configuration of the remote device.
Response: Sent by the agent to return the requested data or confirm a modification.
Trap: An unsolicited message sent by an agent to notify the manager of an event or failure (e.g., a link status change).

Summary

Out-of-Band Control: FTP isolates commands from active file transfers by using separate connections for control (Port 21) and data (Port 20). TFTP simplifies this process by transferring files over a single, lock-step UDP connection on port 69.
Remote Emulation & Security: TELNET uses the Network Virtual Terminal (NVT) to handle communications between incompatible devices, but lacks encryption. SSH secures these interactive sessions using cryptographic mechanisms over TCP port 22.
Web Architecture & State: HTTP retrieves static, dynamic, and active documents over TCP port 80. It uses cookies to manage state across otherwise stateless connections.
Email Systems: Email relies on push-based MTAs running SMTP to route messages, and pull-based MAAs running POP3 or IMAP4 to retrieve them. MIME extends this system to support non-ASCII media.
Host Configuration & Naming: DNS resolves domain names to IP addresses over UDP port 53, switching to TCP for large payloads or zone transfers. DHCP automates host IP configuration on startup using a UDP-based state machine.
Network Management: SNMP monitors and configures network devices. It uses SMI to define data types and OIDs, and MIBs to organize managed variables.

Assessed progress

File Transfer and Remote Login

Key Concepts

Out-of-Band vs. In-Band Control

Network Virtual Terminal (NVT)

Active vs. Dynamic Web Documents

Push vs. Pull Protocol Architecture

SMI, MIB, and SNMP Triad

Quick Check

Computer Networks

Computer Networks