CCNA Course Ep 5: Upper OSI Layers & Watching YouTube Traffic

this is episode five of my free ccna course and a huge shout out to bozon software the official sponsor of

this ccna course they are the reason this can be made available for free so i highly encourage

you to go check them out they have the absolute best ccna ccnp labs and practice exams when you watch a

youtube video like this one what happens what's happening in the network

in this video we're going to find out we're going to focus on the upper layers of the osi model the application

presentation session and transport layers and see what happens when we try to watch a youtube

video let's get started [Music]

in our last video johnny needed copy bad and we watched how his internet traffic his network traffic

would go across a network across the internet and get to network chuck coffee where he could place an order for

delicious coffee and it is good trust me we dive deep into the osi model a model that describes how

a network can work and we watched as johnny's computer took his application data and threw it down the layers of the

osi model going from segment to packet to frame a process we call encapsulation and then

it fired electrical signals it probably doesn't make that sound across the physical

wire going across the network the internet until it finally arrives at networkchuck.coffee a server that hosts

the website and here the process is actually reversed going from frame to packet to

segment a process we call de-encapsulation and this whole process is

amazing but up until now we focus hard on the network data link and physical layers we haven't

spent much time in the upper layers application presentation session and transport until now we're going to look

at all that right now if you've watched the previous videos you should have a basic understanding of

a switch and a router and what it does when your internet traffic hits it if you don't know what that is

then go back and watch those videos but now we're going up and johnny already has his coffee he's

already ready to go now he wants to watch some youtube videos so we're going to pop the hood a bit and see what

happens when johnny's web browser tries to access youtube and how the application

presentation session and transport layers are involved you might need some coffee for

this take johnny's advice let's take a look at the application layer first so johnny fires up his web

browser and he begins to type in youtube.com and this is where the osi model comes into play

the application layer and also keep in mind this does apply to the tcp ip model the model we

actually use which is the same as this except we don't use the presentation in session

in that model but the concept of these layers does not go away in the tcip model which is why we're going to talk

about them right now the application layer is kind of the portal an interface for a program on

your computer that needs a network like your web browser or a video game that you play online if that application

needs to interface with a network is going to engage the application layer of the osi model

it's sort of the gateway to the next two layers the presentation and session layer so johnny's web browser takes the

data it wants to send to youtube.com which in this case would be like hey i want to see your site so it'd be a get

request get me that stuff and it sends it down to the presentation layer where we get it prettied up time to get it

dolled up and ready to go what does that mean well the presentation layer is responsible for

making it presentable two of the main things you're going to be worried about is data format and

encryption now data format what does that mean one way to think about data formats is

to think about file types let's say i send you a document it's called mydocument.pdf

when you try to open that document at your computer what happens well it opens because you've got programs and

applications that know how to use pdf documents that's the data format adobe acrobat

even most browsers can open up pdf documents no problem it's a common format that we've all

agreed to use for things like this but if i were a weirdo when i put my data in a format that no

one even knew about like dot network chuck and i sent that to your computer your

computer would be like um i don't know how to view i don't know what this is

so that's why we have these file types these data formats things that we all pretty much agreed

we're going to put things into this format so we can all kind of play with and read and with web browsers what's a

file type we see all the time html the presentation layer would take our data

and put it in a format that we all pretty much understand put that to a html file and when youtube does send me

a html file and knows how to open that that's what the presentation layer does so html xml jpg you know a uh

image data type image data format that's what the presentation layer does we can also use encryption at the

presentation layer making sure our data that's being sent back and forth can't be seen by old hackers

a common one you might see is ssl secure socket layer that's done at the presentation layer so

what's the presentation layer is done with our data he's made it look pretty putting into the right format

he may have encrypted it so someone can't see it we then move on down to session

the jump of the session is to open up the communication to start the conversation between

the web browser johnny's application here and the youtube server and make sure things have been authenticated

make sure conversation is smooth now keeping in mind all this stuff is still going through all the other layers

and a bunch of things are happening here but logically the session keeps the communication open and what i mean by

that is that at the lower layers of the network layer going through routers the data link layer we're going through

switches all kinds of crazy stuff is happening down there but to the session layer it's

one conversation let's keep this thing going and when it's done he tears it down ending the conversation

and the session layer does this for any communication that the application has with anything

else maybe it's not just the web browser talking maybe you have spotify running talking to a spotify server it's

managing all those different sessions on your computer some popular protocols you might see at the

session layer are l2 tp or the layer 2 tunneling protocol you'll see this a lot with vpn

connections we've got rtcp the remote transport control protocol which this actually helps set up phone calls and

speaking of phone calls video calls the h.245 protocol which helps set up video calls and of

course proxies we have these socks proxies operating at this layer when you're trying to hide yourself as a

hacker or just as a person who values your privacy you will use a socks proxy which

operates at this layer to bounce between different hosts to kind of muddy up who you are this is

not an exhaustive list but this is one of the most popular protocols you'll see at that session layer

now at this point we've covered the application layer and what it does at a high level view application

presentation session keeping in mind that all of these are just one layer in the tcp model just the application layer

so we get the data ready we pretty it up put it in the right format encrypt it maybe and then we get the

communication started we start talking to somebody we get that session open but in order for that session

actually open up we have to send it down the other layers and now we're at the transport layer

we're getting somewhere literally the transport layer is where people who love networking start to pay attention

application layer nah that's for programmers wait did you say transport now you got my attention this is where

we operate the session layer sends our data down to the transport layer and now we're

worried about hey how can we get this data to the other end

to the other server this is kind of like sending a package to someone like let's say i want to send a package to you

and at the application layer i'm going okay i want to send this and this cable this pen

and this coffee mug full of coffee um then i'm gonna put it into a box i'm gonna make it all pretty

get tape it together okay done now how do i get it to you i gotta send us the next layer which

might be shipping do i use ups do i use usps do i use fedex dhl who's gonna take it for me what

method am i going to choose how am i going to transport it transport layer see that

and with the transport layer instead of choosing a shipping carrier we're going to choose a protocol there

are two main transport protocols we focus on there are others but these are two main ones we see

all the time we got tcp probably heard of that guy and udp probably heard of that guy and

at this point we have to ask ourselves a question and when i say us i mean like the web browser or the application

do we want our data to get there really really fast or do you want it to get there safely and

make sure it actually gets there if we want it fast that's going to be udp if we want to make sure it reliably

gets there it's going to be tcp let's take a look at tcp first let's say we do want to get

our stuff there reliably the reason it's so reliable is because tcp is kind of naggy

what i mean is that when tcp is communicating let's say youtube sends me a file like an html file

like maybe it's the home page so homepage.html before it sends me anything else

it waits to see if i got it it's like okay did he get it if i don't say anything back he's like

hey uh johnny here it is again did you get it and he waits for me to say yes youtube i

got it and then he'll continue to send me more data but it's a verification process

that reliability that makes tcp pretty cool it makes sure your data is received and if it doesn't

receive a confirmation that you got it it'll send that sucker again and another reason that tcp is reliable is that

before we even begin to send data to each other we have to get to know each other first so youtube will go

hey i want to send you something johnny but i have to make sure we're friends first

let's do a three-way handshake and that's what it's called the tcp three-way handshake which is all about

setting up that connection before we start exchanging data which works like this youtube will say hey

johnny how you doing my name is youtube which we'll call a synchronization message

johnny will respond and say oh look great to meet you youtube this will be our sin

ack message and then youtube responds with uh which sen means synchronization act

means acknowledgement and once this formality is out of the way then they can communicate with each

other but this has to happen and so this is a bit more involved oh and by the way tcp stands for transmission control

protocol with a strong emphasis on control because it wants to control every bit of that communication

whereas udp it's a little crazy do you want to know why udp is fast because it just doesn't care it doesn't

care if you get the message it doesn't care if you get the package it's just going to keep on sending stuff

it doesn't wait for verification it just goes blah here you go here you go here you go here

you go here you go here you go ah crap it just sends them sense so no how you doing nice to meet you no youtube just

sends and sends doesn't wait for verification and hopefully you get it all

so now when johnny's trying to watch youtube video which one is used tcp or udp both

it's actually using both check this out i'm gonna fire up wireshark which is a tool we can use to capture

our real network traffic so watch this it's awesome i'm gonna start capturing on one of my interfaces

here and look at all that it's it's just a ton of stuff so it's capturing everything now

i'm going to go off and watch a youtube video let's go boom all right let's pause that and

let's take a look at wireshark and see what happened let me stop this capture here now i captured all my internet

traffic and my computer is talking to a lot of things all at once so i need to filter that a bit now this

looks crazy i know a lot of stuff going on but we'll break down just a few things here

first of all this ip address right here 173 194 191 167 that is the ip address of youtube so

when i open up my web browser and i hit that url that's what i was going to notice the source is my ip address right

here destination is youtube and look at the protocol we're using tcp the transmission control protocol

reliability and notice here's the three-way handshake right here got my sin

my hello how are you doing my stunt act from youtube i'm doing fine i'm youtube and then the act from me

and then of course a lot more stuff going on down here but i want to scroll down and show you

something else i said we're using both and i wasn't lying to you if you scroll down a bit i mean there's

a lot of things going on we'll keep scrolling scrolling scrolling scrolling until i finally made it here

okay cool notice it went from tcp and it changed everything to udp

still talking to youtube it's still me talking to youtube right here but the protocol switched over to udp

why well when johnny sent his request to watch a youtube video and obviously i'm

changing myself to johnny now youtube doesn't just send a video but it sends a web page

as well so like we look back at the web page here it's loading all kinds of stuff like we got the menu right here we

got suggested videos over here sign in stuff buttons graphics all kinds of stuff this is all just a regular

web page in fact if we look at the developer tools which you can do in any web browser we can see that it is indeed

an html document so youtube sends the html file and along with other stuff to build out this web page

but then it starts to play the video this is when it switches from tcp to udp to send data but why does

that video need udp why couldn't just use tcp i mean what's wrong with having reliable

transportation for a video well think about when you're watching a video like let's say this video right now with udp

you're just getting this data bam bam bam bam the video is coming at you you might miss a few of those packets so

let's do a clip for example let's say i go um that is delicious coffee but maybe your

internet connection is bad and you drop a few packets so it might look like this mmm just coffee now that's not great

because you missed something so you might think well we can prevent this from happening by

using tcp right it'll make sure you get stuff this sounds good in theory but here's

what would happen it's coffee that is delicious you see for real time applications like that watching a video

watching a live stream gaming online it doesn't make sense to resend the same thing because once that

thing's missed it does no good to get it later i mean this has happened to you before right like you're playing an

online game you're running maybe your internet connection drops for a second and you're

suddenly 15 feet ahead it would make zero sense to try and have that data sent back to you

and throw you back 15 steps so you can walk that hallway no you'd already be dead because someone

shot you up there so tcp is great and it's used for most things that don't require that real-time interaction but

when we need to have things quickly and fast and we're re-transmitting things which would not

make sense that's where udp comes in now there's one more thing i want to touch on with

the transport layer in tcp and udp and it's these numbers right here 443 and then 57095 they're crazy

important but what are they let me show you a problem we might have if we didn't have those numbers

which we call ports but we'll cover what those are in a minute when we want to watch a youtube video we have to access

their server which means we have to go over the internet and hit their ip address this will be using the http

protocol and in pretty much all cases now the https for secure

protocol but what if that youtube server wasn't just doing a website what if it also had ftp a file

transfer protocol server what if it had ssh and rdp both protocols that we can use to access

a server remotely so if i wanted to ssh and log into the command line of that youtube server

how do i tell it that how do i go to the ip address and say i want to ssh and not just i want to

watch a video that is what those port numbers are for if we look back at wireshark where we

captured our network traffic look at this first message which is from me to the youtube server

i'm using the tcp protocol and here's the from port we'll talk about that here in a moment but the 2 port

is 443 you may already know that port 443 is the port that's commonly used for https so in

your web browser when you type in https youtube.com you're saying you want to access this server ip address

on port 443 it could also look like this the ip address with a colon after that and the port so i want to access that

server the ip address on port 443 those ports allow us to run multiple services on one server

so one server can be a ton of things it could be rdp server ssh server ftp server

web server gaming server you can open up other ports other windows into your server and no

i'm not talking about windows server it could be linux i don't know another well-known port you might know about

is port 21. port 21 is commonly used as ftp ssh 22 rdp 3389

if you go to google and just type in common ports you'll get a ton of information i'll look at this wikipedia

article real quick and uh scroll down here notice we have our port numbers here in one column and

then we have tcp and udp some ports are only tcp or just udp or can use either or and notice

as i scroll down there are a ton just a ton in fact we have available

ports 0 through 65 535 but as far as these well-known ports which are listed below

ports 0 through 1023 are reserved for those now you don't have to memorize all of

them but it is important to learn the key ports ports that you'll see used a lot so 22

for ssh 23 for telnet 25 for snmtp port 80 for http 115 for smtp 123 for ntp so just a lot

of stuff out there so looking back at wireshark we got this destination port of 443

we know what that's for it's for https we're accessing the web server of youtube

awesome but then what's this big number over here 57 95 obviously not part of the well-known

port range what is this for well network communication is a two-way street so when i'm communicating with

youtube and i'm saying hey i want to access your web server i want to see some videos right now

right now that's going to send that video back to me that's going to send that video back to

my ip address which if i'm only accessing youtube that's fine but i'm not only watching

youtube right now often i'm uh listening to spotify so spotify's sending me stuff too

i'm browsing a few other websites the same time i mean we all have like a million tabs open right so they're

sending me data at the same time i'm receiving a lot of data from a lot of different network applications

so that port number 5790 that's kind of like my from address when i say hey youtube send me back a video i

say hey send it back to me on this port so my application can get it

because i'm doing a lot of other stuff right now you're not the only application i'm talking to you

sorry youtube uh so essentially my web browser pulled this number out of the air it's

temporary often referred to as an ephemeral port i love saying that word ephemeral

ephemeral say it say it ephemeral say it out loud right now ephemeral it's temporary and when youtube sends me

that video it responds back to that port my ip address with that port if i look back at wireshark

and i stop filtering just by youtube traffic and i look at everything i'm talking to right now

you can see that my computer is using a bunch of different source ports 52015 for this particular server i'm talking

to 51 931 talking to this server and here's an example of the server talking back to

me on my port so 443 talking back to my ethernet port here so let's walk back through what just happened with youtube

let me erase some stuff here my communication with youtube used both tcp and udp so after the application

layer got it all pretty and ready for me boxed up with the bow on it my web browser decided to use tcp on

port 443 and we take that information that segment and give it to the network layer and what does he do well he

handles the ip addresses so now it kind of looks like this at this point we have our data from the application

layer we have our layer 4 header from the transport layer which basically is saying we're using tcp port

443 and the network layer is going to slap on a layer 3 header turning this into a

packet and it's got a destination ip address of 173.194.191.167.

blah blah kind of hard to see there you know what it is and then it goes on down you know the process

if you go back and watch our previous videos you know what happens oh and of course this

layer four header also has the source port duh 57095 and when it goes through the

internet and finally arrives at the youtube server and it gets to the transport layer

transport will go oh hey this is coming in on port 443 this is our web server

let me hit this up to the web server application all right quiz time hope you're ready hope you have your coffee

ready because this is going to going to make you think these questions are brought to you by boson xm the best

practice exam software out there for any kind of cisco ccna prep ccnp prep so if you're getting ready for your exam

you might want to get bows on and see if you're ready but let's see how you're doing right now this will be a simulator

question very similar to what you might see on the exam so i'll go and launch this right

now oh look at this so select the application layer protocols on the left and drag them to the corresponding

transport layer protocols all application layer protocols will be used

so i know you can't drag this with me but write it out on a piece of paper and see what you got

oh and i realized that we did not talk about every single protocol here go research it go figure it out if you

already know it that's fantastic this is your chance to learn it right now so we'll see what i know right now

dns that's going to be tcp and udp it uses both dhcp will be udp what's that port number

let me know in the comments below ftp that's going to be tcp what was that again port number 21 http

it's going to be tcp smtp it's going to be tcp snmp udp tftp udp i would love to see

you put all the port numbers to these protocols in the comments below let's see if i got it right let's show

the answer here yeah we got it right all right second and final question which of the following ports is used by

tftp select the best answer and you would already know the protocol from the

previous question but you don't know the port number just yet let's see what you got all right time to

see if i know this i know it's going to be udp that's what the trivial file transfer protocol uses and i know

it's going to be udp port 69. let's see if i got my answer right and correct i got it

if you got both of those questions right congrats that's amazing like this is from boson xm the ccna

practice exam it's the gold standard if you can pass their stuff you're pretty you're in a pretty good spot many people

say this is harder than the actual ccna exam today we covered a lot we saw how johnny when he wants to watch a

youtube video what that looks like from the osi model or the tcp model perspective

we had already covered the first three layers of the osi model the physical data link and network all involving

things like cables switches and routers but then the upper layers we hadn't really talked about and we got to see

that happen in this video transport session presentation and application now i know

i say this a lot in pretty much every video but we just scratch the surface there's a lot

more to know with the tcp model with the osi model and as we move forward in studying

networking as we go deeper into the ccna topics we will explore each of these more but for now i want you to know that

this is just the beginning i hope you're excited i hope you're having fun and let me know what you

think about this video comment below you have any questions or need any help

don't be afraid to ask we got a community here that's amazing and if you want to jump into my discord server

below i've got a link join the community and if you want to help me do

more of what i do here making a free ccna making other free courses along with david bomble consider joining

the mission this is it.io that's the website go to it

it's a membership that we offer that has some pretty cool benefits along with helping us do

more of this anyways that was episode five i'll catch you guys on episode six

[Music]