Application Layer Protocols: HTTP, FTP, SMTP, DNS, and Real-World Use Cases

TAKEAWAYS:

• HTTP/HTTPS enables web communication using request-response cycles (GET, POST, PUT, DELETE) over port 80/443, with HTTPS adding encryption via TLS.
• FTP transfers files between clients and servers (port 21) using separate control and data connections, while SFTP/FTPS add security.
• SMTP, POP3, and IMAP handle email delivery and retrieval: SMTP sends mail (port 25), POP3 downloads it (port 110), and IMAP syncs it (port 143).
• DNS translates domain names to IP addresses (port 53) using hierarchical name servers and caching to reduce lookup time.
• DHCP automates IP address assignment (ports 67/68) via lease offers and acknowledgments, while SNMP monitors network devices (port 161).
• Real-world ties: WhatsApp uses HTTP/HTTPS for API calls, eSewa relies on HTTPS for secure transactions, and Ncell’s billing portal uses SMTP for email alerts.

Application Layer Protocols: The User-Facing Interface of Networks

The application layer (Layer 7 of the OSI model) is where users interact directly with network services. Unlike lower layers that handle data transmission, this layer defines protocols for specific applications (e.g., web browsing, email, file transfer) and their message formats, ports, and rules. Protocols here are either reliable (guaranteed delivery, e.g., HTTP, SMTP) or unreliable (best-effort, e.g., DNS, UDP-based apps), depending on the use case.

1. HTTP/HTTPS: The Backbone of the Web

Definition: HTTP (HyperText Transfer Protocol) is a stateless, request-response protocol for fetching web resources (HTML, images, JSON). HTTPS (HTTP Secure) adds TLS/SSL encryption for secure transactions (e.g., online banking).

How It Works

1. Client-Server Model: A browser (client) sends a request (e.g., GET /index.html), and the server responds with data.
2. Methods: GET (retrieve), POST (submit data), PUT (update), DELETE (remove).
3. Status Codes:
   • 200 OK: Success.
   • 404 Not Found: Resource missing.
   • 500 Internal Server Error: Server failure.
4. Headers: Metadata like Content-Type, Cookie, or Authorization.
5. HTTPS Handshake:
   • Client → Server: "Hello, I support TLS 1.3."
   • Server → Client: "Here’s my certificate (signed by a CA)."
   • Client verifies certificate → Exchanges symmetric keys → Encrypted communication begins.

Message Format

GET /api/user HTTP/1.1
Host: esewa.com.np
User-Agent: Mozilla/5.0
Accept: application/json

HTTP/1.1 200 OK
Content-Type: application/json
Content-Length: 123

{"user_id": 12345, "balance": 5000}

Real-World Example: eSewa Transactions

When you pay a bill on eSewa:

1. Your browser sends a POST request to https://esewa.com.np/pay with your card details.
2. HTTPS encrypts the data using TLS 1.3.
3. eSewa’s server validates the request, deducts the amount, and sends a 200 OK response with a transaction ID.
4. Why HTTPS? Without encryption, attackers could intercept your card number (man-in-the-middle attack).

2. FTP: File Transfer Protocol

Definition: FTP (File Transfer Protocol) transfers files between a client and server over two separate connections:

• Control Connection (Port 21): Sends commands (e.g., USER, PASS, RETR).
• Data Connection (Port 20): Transfers the actual file.

Security Issues and Alternatives

Example: Downloading a File from Daraz

1. Client connects to ftp.daraz.com on port 21.
2. Sends USER/PASS credentials (in plaintext!).
3. Uses RETR filename.pdf to download the file over port 20. Problem: Passwords and data are sent unencrypted. Use SFTP (SSH-based) instead.

3. Email Protocols: SMTP, POP3, IMAP

Email relies on three protocols:

A. SMTP (Simple Mail Transfer Protocol)

• Port: 25 (or 587 for submission).
• Role: Sends emails from client to server or server to server.
• Process:
  1. Client → Server: HELO esewa.com
  2. Server → Client: 250 Hello
  3. Client sends MAIL FROM: <sender@example.com>
  4. Server replies 250 OK
  5. Client sends RCPT TO: <recipient@khalti.com>
  6. Server replies 250 OK
  7. Client sends email data → Server stores it.

B. POP3 (Post Office Protocol v3)

• Port: 110 (or 995 for POP3S with TLS).
• Role: Downloads emails from server to client and deletes them (unless configured otherwise).
• Example: When you check your Ncell email on a desktop app.

C. IMAP (Internet Message Access Protocol)

• Port: 143 (or 993 for IMAPS with TLS).
• Role: Syncs emails between client and server (keeps a copy on the server).
• Example: Gmail or WhatsApp’s email notifications sync via IMAP.

Comparison Table

4. DNS: The Phonebook of the Internet

Definition: DNS (Domain Name System) translates human-readable domain names (e.g., google.com) to IP addresses (e.g., 142.250.190.46) using a hierarchical, distributed database.

How DNS Works

1. User enters esewa.com → Browser checks local cache.
2. If not found, queries the root DNS server (.).
3. Root refers to .com TLD server.
4. TLD refers to esewa.com authoritative server.
5. Authoritative server returns IP (e.g., 103.10.192.45).
6. Browser connects to the IP.

DNS Record Types

Real-World Example: WhatsApp’s DNS Lookup

When you open WhatsApp:

1. Your phone queries DNS for web.whatsapp.com.
2. DNS returns the IP of WhatsApp’s servers (e.g., 157.240.11.35).
3. Your phone connects to this IP to fetch app updates.

5. DHCP: Automating IP Addresses

Definition: DHCP (Dynamic Host Configuration Protocol) automatically assigns IP addresses to devices on a network, reducing manual configuration.

How DHCP Works (4-Way Handshake)

sequenceDiagram
    participant Client as Device (e.g., Laptop)
    participant Server as DHCP Server
    Client->>Server: DHCPDISCOVER (Broadcast)
    Server->>Client: DHCPOFFER (Unicast)
    Client->>Server: DHCPREQUEST (Accept offer)
    Server->>Client: DHCPACK (Confirm lease)

Example: NTC’s Wi-Fi Hotspot

1. Your phone broadcasts DHCPDISCOVER on the NTC network.
2. DHCP server replies with an IP (e.g., 192.168.1.100), subnet mask, and gateway.
3. Your phone configures itself and connects to the internet.

6. SNMP: Monitoring Networks

Definition: SNMP (Simple Network Management Protocol) monitors and manages network devices (routers, switches) by collecting statistics (e.g., bandwidth usage, errors).

How SNMP Works

1. Manager (e.g., Ncell’s network ops) sends a GET request to a router.
2. Agent (SNMP software on the router) responds with data (e.g., CPU usage = 85%).
3. Manager takes action (e.g., alerts IT staff).

Example: Ncell’s Network Monitoring

Ncell uses SNMP to:

• Track traffic on fiber optic cables (IMAGE: fiber optic cable diagram | Cross-section of a fiber optic cable).
• Detect link failures and reroute traffic automatically.

## In the Real World

1. eSewa (HTTPS + DNS)

   • When you pay a bill, eSewa uses HTTPS to encrypt your card details during the POST request.
   • DNS resolves esewa.com to its server IPs (e.g., 103.10.192.45) so your browser knows where to send the request.

2. WhatsApp (HTTP/HTTPS + DNS)

   • WhatsApp’s web version uses HTTP/2 (a faster version of HTTP) to load chats.
   • DNS translates web.whatsapp.com to its global server IPs (e.g., 157.240.11.35) for low-latency access.

3. Ncell Billing (SMTP + POP3)

   • Ncell sends your monthly bill via SMTP (port 25) to your email provider.
   • You check it using POP3/IMAP on your phone or computer.

4. Daraz Orders (FTP/SFTP)

   • Daraz’s internal systems use SFTP (secure FTP) to transfer product images from suppliers to their servers.
   • Customers download order confirmations via HTTP/HTTPS.

5. NTC Traffic Routing (SNMP + DNS)

   • NTC’s routers use SNMP to monitor fiber optic links (IMAGE: router diagram | A Cisco router used in NTC’s backbone).
   • DNS ensures ntc.net.np resolves to the correct peering points for internet traffic.

## Exam Tip

1. Protocol Comparisons: Always compare HTTP vs. HTTPS, POP3 vs. IMAP, or FTP vs. SFTP in tables (as shown above). Examiners love structured answers.
2. Port Numbers: Memorize key ports:
   • HTTP: 80, HTTPS: 443
   • FTP: 21, SFTP: 22
   • SMTP: 25, POP3: 110, IMAP: 143
   • DNS: 53, DHCP: 67/68, SNMP: 161
3. Real-World Scenarios: Link protocols to apps/companies. For example:
   • "eSewa uses HTTPS for secure transactions because..."
   • "Ncell monitors its network using SNMP to..."
4. Message Formats: Draw a fields figure for HTTP requests/responses or DNS queries. Label each part (e.g., method, headers, body).
5. DNS Hierarchy: Explain DNS resolution step-by-step with a sequence diagram (as shown for DHCP). Use root → TLD → authoritative in your answer.
6. Security: Always mention encryption (TLS for HTTPS, SSH for SFTP) when asked about secure protocols.
7. Common Pitfalls:
   • Don’t confuse SMTP (sending) with POP3/IMAP (receiving).
   • FTP is not secure; always prefer SFTP/FTPS in exams.
   • DNS is not a protocol for email routing (that’s SMTP/MX records).

## Visual Summaries

1. OSI Model with Application Layer Highlighted

pie
    title OSI Model Layers
    "Application (HTTP, DNS, SMTP)" : 15
    "Presentation (SSL/TLS)" : 10
    "Session (NetBIOS)" : 5
    "Transport (TCP/UDP)" : 20
    "Network (IP, Routing)" : 20
    "Data Link (MAC, Switching)" : 15
    "Physical (Cables, Signals)" : 15

2. HTTP Request/Response Fields

+-------------------------------+
| GET /index.html HTTP/1.1      |
+-------------------------------+
| Host: esewa.com.np            |
| User-Agent: Mozilla/5.0       |
| Accept: text/html             |
+-------------------------------+
|                               |
| (Empty line)                  |
|                               |
+-------------------------------+
| HTTP/1.1 200 OK               |
+-------------------------------+
| Content-Type: text/html       |
| Content-Length: 1234          |
+-------------------------------+
| <html>...</html>              |
+-------------------------------+

Caption: HTTP/1.1 request and response structure.

3. DNS Resolution Flow

graph TD
    A["User enters google.com"] --> B["Check local cache"]
    B -->|"Not found"| C["Query Root DNS"]
    C --> D["Root refers to .com TLD"]
    D --> E["TLD refers to google.com"]
    E --> F["Authoritative server returns IP"]
    F --> G["Browser connects to 142.250.190.46"]

4. Email Flow (SMTP + POP3)

sequenceDiagram
    participant A as Alice (Sender)
    participant B as SMTP_Server
    participant C as IMAP_Server
    participant D as Bob (Receiver)
    A->>B: Compose email (SMTP Port 25)
    B->>C: Deliver email (SMTP)
    D->>C: Check mail (IMAP Port 143)
    C->>D: Sync email to device

## Practice Questions (Exam-Style)

1. Differentiate between HTTP and HTTPS. How does eSewa use HTTPS to secure transactions?
2. Explain the 4-way DHCP handshake with a sequence diagram. How does NTC’s Wi-Fi use DHCP?
3. Draw a table comparing POP3 and IMAP. Which would you use for Ncell’s email service and why?
4. Trace the DNS lookup process for khalti.com. Include root, TLD, and authoritative servers.
5. Why is FTP insecure? Describe how SFTP solves this problem with a diagram of its connection setup.