Application protocols and end-to-end traces
Scope
Trace DNS, HTTP, SMTP/email and FTP from an application request to network exchanges. Distinguish application roles from transport choices. Port numbers below are conventional well-known service ports, not proof of the application in every packet. Timing examples explicitly omit DNS lookup, TLS setup, serialization and server processing unless included; real browser behavior is more complex.
1. DNS: names, records and caching
DNS is a distributed hierarchical naming database. A stub resolver usually asks a recursive resolver. On a cache miss, that resolver can follow referrals from root to a top-level-domain server to an authoritative server. Recursive service asks a server to obtain a final answer on the client's behalf; iterative resolution permits a server to return the best available answer or referral. The stub normally need not contact every hierarchy level itself. Authoritative servers serve zone data; recursive resolvers may answer from caches.
Important record types: A maps to an IPv4 address; AAAA to IPv6; NS identifies an authoritative name server; CNAME makes an alias to another domain name; MX identifies mail exchangers and preference values; PTR supports reverse lookup. A CNAME is not directly an address. An MX value names a host whose address may need a separate lookup, and a lower MX preference value is preferred. DNS names are hierarchical labels, not a physical path through routers.
Cache records for their remaining TTL, not forever. Example: a record with TTL300 s cached at time0 has180 s remaining at time120, assuming no refresh. An authoritative change need not be visible immediately to clients holding unexpired cached data. Negative answers can also be cached under specified rules. Caching reduces load and delay but complicates immediate updates.
Classic DNS uses UDP53 for many queries and TCP53 when required, including typical full zone transfers and fallback after truncated UDP responses. DNS is not UDP-only. Modern encrypted DNS transports exist, but protocol-version details beyond this syllabus are not needed to solve the core hierarchy/cache questions. A DNS answer supplies naming information, not an established application connection or an assurance that the returned server is responsive.
2. HTTP requests, responses and connection reuse
HTTP defines request/response semantics, methods, resource identifiers, headers and status codes. GET asks for a selected representation; HEAD asks for equivalent response metadata without response content; POST requests resource-specific processing.200 commonly signals success,301/302 redirection,304 a successful conditional validation without resending the representation,404 a missing target and500 a server error. Read the exact method/status context rather than labeling every non-200 as transport failure.
The protocol is stateless at the request semantics level, but applications can implement sessions using cookies or other tokens. A cookie is not the same thing as a TCP connection. Conditional GET with a validator such as ETag/If-None-Match can let a cache reuse a stored representation after a304 response. Cache policy and validators determine reuse; not every response is cacheable.
HTTP/1.0 commonly used separate connections per object; HTTP/1.1 normally supports persistent connections, and pipelining was specified but cannot be assumed in a numerical problem. HTTP/2 multiplexes streams on a connection; HTTP/3 maps HTTP to QUIC over UDP. Therefore “all HTTP uses TCP” is too broad. HTTPS protects HTTP with appropriate secure transport, commonly TLS, and does not mean that DNS, routing or application code cannot fail.
Worked timing model: HTTP/1.1 over TCP, one-way propagation RTT/2, negligible object transmission, no TLS or DNS delay, no existing connection. Fetching one object costs1 RTT for TCP setup plus1 RTT for request/response=2 RTT. A base page then reveals two objects from the same server. With sequential nonpersistent connections, total6 RTT. With one persistent connection and no pipelining, total4 RTT: handshake, base, object1, object2. If two embedded requests can be issued together on the existing connection under the stated pipelining model, total3 RTT. At RTT40 ms these are240,160 and120 ms. Parallel new connections would give a different schedule; never mix models silently.
3. Email: sending, relaying and reading
A mail user agent prepares a message and submits it to a mail service. SMTP transfers messages to a server and between mail servers. Server-to-server SMTP conventionally uses TCP25; submission commonly uses587, with secure variants/configurations as specified. The sender-side mail server looks up the recipient domain's MX records to find receiving mail exchangers. DNS chooses mail-routing targets, not the human's inbox password.
A simplified SMTP dialogue uses greeting, EHLO/HELO, MAIL FROM, one or more RCPT TO, DATA and message content terminated according to protocol framing. The envelope sender/recipients are separate from visible From/To message headers. SMTP acceptance by a relay does not prove that a human read the mail or that final delivery cannot later fail. Store-and-forward lets servers queue and retry; delivery is not one uninterrupted end-to-end TCP connection from sender's laptop to recipient's laptop.
MIME describes content types, multipart structure and encodings so email can carry attachments and non-ASCII content. MIME is not a replacement transport for SMTP. IMAP generally supports server-side mailbox access and synchronization, while POP3 traditionally retrieves messages, with server retention depending on client/server settings. Deleting every server copy is not an unavoidable property of POP3. Conventional cleartext service ports are IMAP143 and POP3110; secure deployments use negotiated TLS or dedicated secure ports, so a port table alone is not a security guarantee. Webmail can expose the mailbox through HTTPS while backend mail transfer still uses mail protocols.
4. FTP control and data channels
FTP uses a persistent TCP control connection, conventionally to server port21, for commands and replies. File data and directory listings use separate data connections. In active mode the client supplies an address/port and the server initiates the data connection, traditionally from server port20. In passive mode the server supplies a listening endpoint and the client initiates the data connection. Passive data does not always use port20. NAT/firewalls often make unsolicited inbound active-mode connections harder, explaining the operational value of passive mode.
Control and data separation is the key exam distinction. Multiple transfers can use the same control session but separate data connections. Classic FTP does not encrypt credentials/data. FTPS secures FTP with TLS, while SFTP is a distinct SSH-based file-transfer protocol, not simply FTP's passive mode or the same protocol under a new port. Application transfer modes and modern extensions must be stated if a question depends on them.
5. Integrated trace and checking strategy
Suppose a configured host fetches an uncached HTTPS name. It consults its DNS resolver, resolving the resolver's local next hop with ARP if required. DNS supplies the server address. The host routes traffic to that address, resolving its gateway MAC as needed. Depending on the HTTP version, it establishes TCP plus TLS or a QUIC-based secure connection, then exchanges HTTP messages. Responses traverse transport demultiplexing and application parsing; caches may change which exchanges occur. DNS resolution and ARP can themselves already be cached, so do not add their packets when the question says the cache is warm.
For email substitute MX lookup and SMTP submission/relay plus a separate mailbox-access stage. For FTP count control and data connections separately. For timing draw a dependency timeline: a base document must arrive before newly discovered object URLs can be requested, unless the problem explicitly provides them earlier. Count a handshake once per new connection and state parallelism. Protocol names describe functions; they are not guarantees of successful delivery, encryption or identity by themselves.
Original practice: six single-correct MCQs
These original teaching questions are not previous-year questions. Choose exactly one answer.
P01. Which DNS record identifies a mail exchanger for a domain?
A. A B. CNAME C. MX D. PTR
Answer: C
A: A supplies an IPv4 address, not the mail-routing preference itself.
B: CNAME describes an alias.
C: MX names mail exchangers and their preference values.
D: PTR supports reverse lookup.
P02. A DNS record cached at time0 has TTL240 s. Without refresh, how much TTL remains at time90 s?
A. 90 s B. 150 s C. 240 s D. 330 s
Answer: B
A: 90 is elapsed time, not remaining lifetime.
B: 240−90=150 seconds.
C: The lifetime decreases while cached.
D: Elapsed time is subtracted, not added.
P03. Under the lesson’s no-TLS/no-DNS timing model, one new persistent TCP connection fetches a base page then three objects sequentially without pipelining. What is the total?
A. 3 RTT B. 4 RTT C. 5 RTT D. 8 RTT
Answer: C
A: This omits required exchanges.
B: Four request/response rounds omit setup.
C: One handshake plus four request/response rounds gives5 RTT.
D: 8 RTT would use four sequential nonpersistent connections.
P04. Which protocol is normally used for server-to-server email transfer?
A. SMTP B. ARP C. IMAP D. FTP
Answer: A
A: SMTP transfers mail between mail servers.
B: ARP resolves local IPv4 to MAC.
C: IMAP accesses and synchronizes mailboxes.
D: FTP transfers files with separate control/data channels.
P05. In passive FTP, who initiates the data connection?
A. The server to an arbitrary client port B. The client to a server-provided listening endpoint C. The DNS resolver D. Neither; data stays inside the control connection
Answer: B
A: Server-initiated data is the active-mode pattern.
B: Passive mode has the client open the data connection to the offered server endpoint.
C: DNS does not open the FTP data connection.
D: FTP uses a separate data connection.
P06. Which statement is accurate?
A. DNS is always UDP-only B. HTTP/3 uses QUIC over UDP C. MIME replaces SMTP as the mail transport D. SFTP is simply passive FTP
Answer: B
A: DNS can use TCP and other transports.
B: HTTP/3 maps HTTP onto QUIC, which uses UDP.
C: MIME describes message content representation.
D: SFTP is a distinct SSH-based protocol.
Sources and scope
Aligned to the 2026 course. This lesson covers the stated slice, not the entire Computer Networks syllabus. All numerical examples and questions are original. No claim of 2027 completeness.
Sign in to keep your progress. Sign in