Cracking the Code: An In-depth Exploration of OSI Layer 7

Hello and my name is Lowell Vanderpool and this channel is dedicated to IT professionals, IT students and anyone who's interested in technical subjects. We are at layer 7 of the OSI model. We've done layer 1, 2, 3, 4, 5, 6 and now we're in 7. Some of the layers are rich with protocols. Layer 1 and layer 2 are just, there's just this wealth of very diverse protocols that exist at layer 1 and layer 2. But when we get to layer 7, wow, it explodes. Over 400 protocols at layer 7. Now compared to the TCP model, which you see here on the slide, we see that layer 5, 6 and 7 are combined in the TCP model. That is one reason why we see a lot of protocols at what we consider the application layer. Let's break them down and take a look at them. We're also going to take a look at two architectures. One is client server and the other is peer-to-peer. When we look at the OSI model or the TCP model from a Microsoft perspective, remember the session, presentation and application layer, layer 5, 6 and 7 are all in user mode. They are not in kernel. When we look at these, we're going to see applications reaching down and talking. We're going to see processes that are running in user mode. That could be an application such as a browser, or it could be a service that's running in user mode. But we're going to see them pull up DLLs that are going to allow them to hook into the network stack. Just as an interesting fact, according to Cisco's forecast in 2020, we'll have over 194.4 exabytes of IP traffic every month in the year 2020. So what do we mean by the application layer at layer 7? Well, one, the word application really causes confusion. When the standard body of engineers decided to use the word application for the OSI layer 7, that was fine for them because they understood exactly what they were doing and what that meant to them. But unfortunately, students and a lot of users, when I say OSI layer 7 is the application layer, they get very confused because they think of application as something they install on their PC or download an app on their Android phone or something of that. And that's what they think is the application. Now, the two are connected, but keep in mind, when I say OSI layer 7 is the application layer, I'm talking about a network stack. When I talk about Microsoft Word, that's a software package that I can install and run as a user. I know the two are called both application, but keep them separate. So how does OSI layer has a protocol called HTTP? And yet we know our browsers leverage HTTP or HTTPS when they're running. How does that work? How does a application like Chrome use the layer 7 application layer? So how does a user mode process like Chrome use OSI layer 7? Well, both application processes like Chrome and the operating system use DLLs extensively in the Windows world. Now, there's a similar process in Linux, but in Windows, they're DLLs and it provides a developer APIs that give it direct access to the network stack. Take a look at the bottom graphic. You see the winhttp.dll. This is actually found in Chrome. So when Chrome launches, it pulls this DLL. And whenever you need to access HTTP services at layer 7, you take full advantage of that DLL. So how do applications that are running on your PC access the OSI layer 7, 6, 5 protocols that you see on this chart? Now I'm running Process Explorer, which allows me to see all my user mode processes. And I've got Chrome here. You can see I've got Chrome running and I'm going to go ahead and I'm going to show my lower pane. I'm going to click on this icon. And what it does is allows me to, it opens up two panes in Process Explorer and I can come up here to view and I can say in the lower plane, show me DLLs. So I want to see all the DLLs in the process that I select. So here I've got a process called chrome.exe and it's a child process of this one. This is the parent. You can see I've got a couple child processes, but notice this one talks to the network. You can see network receive, network send. So this particular child process is actually one that talks to the network. And I'm going to come down here and I can look in my DLL list and I can see there's my winhttp.dll. So that allows me to understand that this process can reach, use that DLL to reach right down into the network stack at the OSI layer 7 layer. So here's another example. I'm looking at OneDrive and I've highlighted OneDrive. And again, at the lower pane, I can see again, this particular application is talking to the layer 7, the application layer via a DLL. And if I scroll through all these DLLs that are used by this process, I can see almost over and over all of those common protocols that I expect applications to use in the network stack. And you'll see them in their DLL names. So here's an example of the Brave browser. And you can see I've highlighted in this graphic different DLLs that provide access to layer 7, layer 5, layer 6. Here's DHCP. Here's the HTTP services. Here's DNS. All of those protocols that you expect at the application layer. Another service is the web client service. Now this service connected is a client server environment. It's at layer 7 and it's based on HTTP and HTTPS. And it allowed you to connect to a web dev server. Now, if you remember around 2004, that was real popular because it allowed you to remotely connect to a server, access files, edit them, author them, and control versions. All that has kind of declined because of cloud companies like Dropbox and Box and many, many other cloud providers. Google Drive have kind of taken over that space with their own proprietary protocols. So another service that we see in Windows is the WinHTTP web proxy auto discovery service. And this was to avoid having the user have to configure a proxy. If a proxy was involved with connecting to a service on the web, this would take care of that automatically. If you're a tech support, you know what it is to try to get a user to set up a proxy configuration. So just to add fun to OSI layers, with the advent of containers in the world of Docker containers, there's now discussion of layer 7.5. That's a whole other topic. According to Cisco's global forecast for 2020, global internet traffic in 2020 will be equivalent to 484 billion DVDs per year, 40 billion DVDs per month, or 55 million DVDs per hour. As we look at protocols at layer 7, we can kind of break them down into two broad categories, client-server architecture, and these are where the lion's share of layer 7 protocols exist, HTTP, HTTPS, SNMTP, and many, many more. Another broad category is peer-to-peer architecture, or P2P, Bitcoin, BitTorrent, BitTorrent Tracker. All of those fall into that category of peer-to-peer architecture. Remember, the client-server architecture is very popular. If you have an Android phone or an iOS phone, you're using client-server every day. Every app you load is a client and it's talking to some kind of cloud service, where in the idea of client-server concepts, the server listens and responds to the client software. The client talks to the server software. When we look at client-server, it is predominantly the model for especially the mobile devices. In the client-server architecture, the computing model is which the server hosts and delivers and manages most of the resources and servers to be consumed by the client. The majority of layer 7 is under this model. Now, the other architecture is peer-to-peer. This is decentralizing this computer model that we just talked about. So in the peer-to-peer, we partition tasks or workloads among peers. In other words, all the clients get a chance to do some of the work. Peers make a portion of their resources, such as processing power, disk space, network bandwidth, directly available to other participants in the network or in the peer-to-peer network. Even Microsoft is using peer-to-peer in their update delivery. So if you go into Microsoft updates, you can see you have a delivery optimization feature where you can actually get updates from other PCs on, say, a enterprise network, which reduces immensely your internet or your WAN connection delivery system. You can actually bring one version of the update down to a single PC distributed that via peer-to-peer among all the other computers on the local area network, drastically reducing your impact on your network connection, your internet connection. When we think of layer 7 protocols, the ones on this particular slide are some of the big ones. Most of you can look at these acronyms and right away recognize these protocols, but there are many, many more. What I've decided to do in this particular lecture is look at some of the ones that are probably you don't know as much about and are extremely interesting. The first protocol we'll look at is Universal Plug and Play, UPNP. It is supported by over 800 vendors participating in the Open Connectivity Foundation. It's a set of network protocols that allow network devices such as personal computers, printers, internet gateways, Wi-Fi, smart TVs, mobile devices, NAS devices to seemingly discover each other and to understand each other's presence on the network. It also allows them to functionally see the services for data sharing, communicating, and entertainment. This is typically used only on a residential environment, a home environment. Typically, we turn this off in an enterprise network. This is not desired in an enterprise network. Universal Plug and Play allows easier visibility of network devices on a home network. Here you can see the example of what I can see on my home network. You can see if I had my smart TVs up and on, you would actually see those also. Any device that is using Universal Plug and Play can be easily discovered and sometimes remotely configured. This is a nice feature at home. It does have some vulnerabilities, so some security experts do not like Universal Plug and Play, but for the home user, it really is nice. You can see a list of many, many protocols that exist at Layer 7. I'm going to pick and choose some of these. I do want you to take a look at them. There's quite a few available. It gives you an idea of the technology that exists at Layer 7. So most of us have heard of Bitcoin, but Bitcoin is based on a protocol at Layer 7. It's basically digital cash based on a distributive ledger, but at the heart of Bitcoin is the Bitcoin protocol. The Bitcoin transaction mechanism is the core part of that protocol. It has a unique transaction ID, a Bitcoin address for the person who has the Bitcoins, the number of Bitcoins as part of that transaction mechanism protocol, and then the receiver Bitcoin address. So all protocols are complex. The more I've studied protocols, the more I'm amazed at the complexity and the brilliance of the engineers who design them. Bitcoin is a peer-to-peer architecture. All transactions are broadcast to the network. Everybody that's participating in Bitcoin can see the transaction, and they're usually confirmed within 10 to 20 minutes. This is called mining. Strict cryptographic rules pack transgressions into a blockchain. Here's our continuing look at a list of technologies and protocols at Layer 7. I encourage you just to pause and look at how many protocols exist at this layer. So one of the protocols that exists at Layer 7 is called the Diameter Protocol. It's part of the next generation authentication, authorization, and accounting, AAA, for cellular networks. Remember there's a lot going on in cellular besides downloading something on your phone or having a phone call or texting. There's a lot in the cellular world that has to go in terms of authorization, accounting for what you're doing on their cellular networks, and authentication. So all of that is tied into the Diameter Protocol. It's really replacing Radius and LDAP. It's a peer-to-peer architecture. It has three types of nodes, client, server, and agent. It's not going away. It's part of 5G also. So any of the telecommunications networks that are all IP are using Diameter as their main protocol for AAA. So here's another list of protocols at Layer 7. I love this one, Hypertext Coffee Pot Control Protocol. Gotta love it. So in the web, we are moving away from HTTP Slash 2 or Version 2 to HTTP Version 3 or Slash 3. And you can just look at these charts with, on the left-hand side, you can see how many packets it takes to connect between a client and a web server to get a secure connection. This would give you, with using TLS, would give you HTTPS. You can see how many packets have to be exchanged to get an HTTPS connection. Over on the right-hand side, you see HTTP Version 3, where we're using the QUIC Protocol using UDP rather than the old TCP. And you can see we're making the same HTTPS connection much quicker with many fewer packet transfers. So here's another interesting protocol. It's called ICE, Internet Communication Engine Protocol. It's an object-oriented RPC, and it's client-server. So you can write your client in one language, your server in another, and run them on your favorite platforms. You can see it runs on just about anything. Your client and server are unaware of the language and platform the other is using. And here's a diagram of ICE. Here's a fascinating protocol at Layer 7, the National Transportation Communications for Intelligent Transportation System Protocol, or NTCIP. It's over 20 years old, and it provides command and control for traffic signals, dynamic message signs, sensor stations, vehicle count stations, ramp meters, and streetlights. It can be integrated with intelligent traffic systems and traffic controls and mobile apps. So here's another extensive list of protocols that exist at Layer 7. Another fascinating protocol at Layer 7 is Precision Time Protocol, the IEEE 1588. And there's a new standard that was done in 2019. It's a hierarchical master-slave architecture for precision clock distribution in the microsecond range. It allows synchronizing services. It can be carried by IPv4 or IPv6, unicast transport. It's critical for automotive video broadcasting networks, industrial Ethernet applications, avionics, and telecom. This precision protocol is used and is very important in high-speed robotics in the industrial manufacturing arena and video broadcasting. Here's another long list of additional protocols at Layer 7, things like SMB, server message block, shimmering cat, signal protocol, and many, many more. Another fascinating protocol at Layer 7 is called the Simple Protocol for Independent Computing Environment, or SPICE. It's an open-source solution for remote access to virtual machines. SPICE is a protocol, a client, a server, and a guest. It provides low CPU consumption, high-quality video streaming, and cross-platform x86, x64, and ARM. Here's an example of this protocol being used. I've got a Windows 7 box that has got remote access to two Red Hat virtual machines. Pretty cool. Many Layer 7 protocols are fading away. They're old, they're not being used anymore, and there's a lot of new ones taking their place. A fascinating protocol at Layer 7 is TOR, the Onion Service Protocol. TOR makes it possible for users to hide their location while offering various kinds of services, web publishing, or an instant message server. TOR is a six-step process allowing you to connect to hidden services. I've got a web link on the slide if you'd like more information about TOR.