Lecture 1

Web Essentials: Clients, Servers,

and Communication

The Internet
Technical origin: ARPANET (late 1960s)
One of earliest attempts to network
heterogeneous, geographically dispersed
computers
Email first available on ARPANET in 1972
(and quickly very popular!)

ARPANET access was limited to select

DoD-funded organizations
2

The Internet
Open-access networks
Regional university networks (e.g., SURAnet)
CSNET for CS departments not on ARPANET

NSFNET (1985-1995) (National Science Foundation Network)

Primary purpose: connect supercomputer
centers
Secondary purpose: provide backbone to
connect regional networks
3

The Internet

The Internet
Internet: the network of networks
connected via the public backbone and
communicating using TCP/IP
communication protocol
Backbone initially supplied by NSFNET,
privately funded (ISP fees) beginning in 1995

Internet Protocols
Communication protocol: how computers
talk
Cf. telephone protocol: how you answer and
end call, what language you speak, etc.

Internet protocols developed as part of

ARPANET research
ARPANET began using TCP/IP in 1982

Designed for use both within local area

networks (LANs) and between networks
6

Internet Protocol (IP)

IP is the fundamental protocol defining the
Internet (as the name implies!)
IP address:
32-bit number (in IPv4)
Associated with at most one device at a time
(although device may have more than one)
Written as four dot-separated bytes, e.g.
192.0.34.166
7

IP
IP function: transfer data from source device to
destination device
IP source software creates a packet
representing the data
Header: source and destination IP addresses, length
of data, etc.
Data itself

If destination is on another LAN, packet is sent

to a gateway that connects to more than one
network
8

IP
Source
Network 1

Gateway

Destination
Gateway

Network 2

Network 3

Transmission Control Protocol

(TCP)
Limitations of IP:
No guarantee of packet delivery (packets can
be dropped)
Communication is one-way (source to
destination)

TCP adds concept of a connection on top

of IP
Provides guarantee that packets delivered
Provide two-way (full duplex) communication
10

TCP
Establish
connection.

Can I talk to you?

{
{
{

Send packet
with
acknowledgment.

Resend packet if
no (or delayed)
acknowledgment.

OK. Can I talk to you?

OK.
Heres a packet.
Source

Destination
Got it.
Heres a packet.
Heres a resent packet.
Got it.
11

TCP
TCP also adds concept of a port
TCP header contains port number
representing an application program on the
destination computer
Some port numbers have standard meanings
Example: port 25 is normally used for email
transmitted using the Simple Mail Transfer
Protocol (SMTP)

Other port numbers are available first-comefirst served to any application

12

TCP

13

User Datagram Protocol (UDP)

Like TCP in that:
Builds on IP
Provides port concept

Unlike TCP in that:

No connection concept
No transmission guarantee

Advantage of UDP vs. TCP:

Lightweight, so faster for one-time messages
14

Domain Name Service (DNS)

DNS is the phone book for the Internet
Map between host names and IP addresses
DNS often uses UDP for communication

Host names
Labels separated by dots, e.g.,
www.example.org
Final label is top-level domain
Generic: .com, .org, etc.
Country-code: .us, .il, etc.
15

DNS
Domains are divided into second-level
domains, which can be further divided into
sub-domains, etc.
E.g., in www.example.com, example is a
second-level domain

A host name plus domain name

information is called the fully qualified
domain name of the computer
Above, www is the host name,
www.example.com is the FQDN
16

DNS
nslookup program provides commandline access to DNS (on most systems)
looking up a host name given an IP
address is known as a reverse lookup
Recall that single host may have multiple IP
addresses.
Address returned is the canonical IP address
specified in the DNS system.
17

Analogy to Telephone Network

IP ~ the telephone network
TCP ~ calling someone who answers,
having a conversation, and hanging up
UDP ~ calling someone and leaving a
message
DNS ~ directory assistance

18

Higher-level Protocols
Many protocols build on TCP
Telephone analogy: TCP specifies how we
initiate and terminate the phone call, but some
other protocol specifies how we carry on the
actual conversation

Some examples:
SMTP (email)
FTP (file transfer)
HTTP (transfer of Web documents)
19

World Wide Web

Originally, one of several systems for
organizing Internet-based information
Competitors: WAIS, Gopher, ARCHIE

Distinctive feature of Web: support for

hypertext (text containing links)
Communication via Hypertext Transport
Protocol (HTTP)
Document representation using Hypertext
Markup Language (HTML)
20

World Wide Web

The Web is the collection of machines
(Web servers) on the Internet that provide
information, particularly HTML documents,
via HTTP.
Machines that access information on the
Web are known as Web clients. A Web
browser is software used by an end user
to access the Web.
21

Hypertext Transport Protocol

(HTTP)
HTTP is based on the request-response
communication model:
Client sends a request
Server sends a response

HTTP is a stateless protocol:

The protocol does not require the server to
remember anything about the client between
requests.
22

HTTP
Normally implemented over a TCP connection
(80 is standard port number for HTTP)
Typical browser-server interaction:

User enters Web address in browser

Browser uses DNS to locate IP address
Browser opens TCP connection to server
Browser sends HTTP request over connection
Server sends HTTP response to browser over
connection
Browser displays body of response in the client area
of the browser window
23

HTTP
The information transmitted using HTTP is
often entirely text
Can use the Internets Telnet protocol to
simulate browser request and view server
response

24

HTTP
Connect

Send
Request

{
{

Receive
Response

$ telnet www.example.org 80
Trying 192.0.34.166...
Connected to www.example.com
(192.0.34.166).
Escape character is ^].
GET / HTTP/1.1
Host: www.example.org
HTTP/1.1 200 OK
Date: Thu, 09 Oct 2003 20:30:49 GMT

25

HTTP Request
Structure of the request:
start line
header field(s)
blank line
optional body

26

HTTP Request
Structure of the request:
start line
header field(s)
blank line
optional body

27

HTTP Request
Start line
Example: GET / HTTP/1.1

Three space-separated parts:

HTTP request method
Request-URI
HTTP version

28

HTTP Request
Start line
Example: GET / HTTP/1.1

Three space-separated parts:

HTTP request method
Request-URI
HTTP version
We will cover 1.1, in which version part of start line
must be exactly as shown

29

HTTP Request
Start line
Example: GET / HTTP/1.1

Three space-separated parts:

HTTP request method
Request-URI
HTTP version

30

HTTP Request
Uniform Resource Identifier (URI)
Syntax: scheme : scheme-depend-part
Ex: In http://www.example.com/
the scheme is http

Request-URI is the portion of the requested

URI that follows the host name (which is
supplied by the required Host header field)
Ex: / is Request-URI portion of
http://www.example.com/
31

URI
URIs are of two types:
Uniform Resource Name (URN)
Can be used to identify resources with unique
names, such as books (which have unique ISBNs)
Scheme is urn (urn:isbn:0451450523)

Uniform Resource Locator (URL)

Specifies location at which a resource can be
found
In addition to http, some other URL schemes are
https, ftp, mailto, and file
32

HTTP Request
Start line
Example: GET / HTTP/1.1

Three space-separated parts:

HTTP request method
Request-URI
HTTP version

33

HTTP Request
Common request methods:
GET
Used if link is clicked or address typed in browser
No body in request with GET method

POST
Used when submit button is clicked on a form
Form information contained in body of request

HEAD
Requests that only header fields (no body) be
returned in the response
34

HTTP Request
Structure of the request:
start line
header field(s)
blank line
optional body

35

HTTP Request
Header field structure:
field name : field value

Syntax
Field name is not case sensitive
Field value may continue on multiple lines by
starting continuation lines with white space
Field values may contain MIME types, quality
values, and wildcard characters (*s)
36

Multipurpose Internet Mail

Extensions (MIME)
Convention for specifying content type of a
message
In HTTP, typically used to specify content type
of the body of the response

MIME content type syntax:

top-level type / subtype

Examples: text/html, image/jpeg

37

HTTP Quality Values and

Wildcards
Example header field with quality values:
accept:
text/xml,text/html;q=0.9,
text/plain;q=0.8, image/jpeg,
image/gif;q=0.2,*/*;q=0.1
Quality value applies to all preceding items
Higher the value, higher the preference
Note use of wildcards to specify quality 0.1
for any MIME type not specified earlier
38

HTTP Request
Common header fields:

Host: host name from URL (required)

User-Agent: type of browser sending request
Accept: MIME types of acceptable documents
Connection: value close tells server to close
connection after single request/response
Content-Type: MIME type of (POST) body, normally
application/x-www-form-urlencoded
Content-Length: bytes in body
Referer: URL of document containing link that
supplied URI for this HTTP request
39

HTTP Response
Structure of the response:
status line
header field(s)
blank line
optional body

40

HTTP Response
Structure of the response:
status line
header field(s)
blank line
optional body

41

HTTP Response
Status line
Example: HTTP/1.1 200 OK

Three space-separated parts:

HTTP version
status code
reason phrase (intended for human use)

42

HTTP Response
Status code
Three-digit number
First digit is class of the status code:

1=Informational
2=Success
3=Redirection (alternate URL is supplied)
4=Client Error
5=Server Error

Other two digits provide additional information

43

HTTP Response
Structure of the response:
status line
header field(s)
blank line
optional body

44

HTTP Response
Common header fields:
Connection, Content-Type, Content-Length
Date: date and time at which response was generated
(required)
Location: alternate URI if status is redirection
Last-Modified: date and time the requested resource
was last modified on the server
Expires: date and time after which the clients copy of
the resource will be out-of-date
ETag: a unique identifier for this version of the
requested resource (changes if resource changes)
45

Client Caching
A cache is a local copy of information
obtained from some other source
Most web browsers use cache to store
requested resources so that subsequent
requests to the same resource will not
necessarily require an HTTP
request/response
Ex: icon appearing multiple times in a Web
page
46

Client Caching
Server

Client

1. HTTP request for image

2. HTTP response containing image
Browser

Web
Server

3. Store image

Cache
47

Client Caching
Client

Browser
I need that
image
again

Server

Web
Server

Cache
48

Client Caching
Server

Client

This
HTTP request for image
Browser
I need that
image
again

HTTP response containing image

Web
Server

Cache
49

Client Caching
Server

Client

Web
Server

Browser
I need that
image
again
Get
image

or this

Cache
50

Client Caching
Cache advantages
(Much) faster than HTTP request/response
Less network traffic
Less load on server

Cache disadvantage
Cached copy of resource may be invalid
(inconsistent with remote version)

51

Conditional GET
Goal: dont send object if
cache
cache has up-to-date
HTTP request msg
cached version
If-modified-since:
cache: specify date of
<date>
cached copy in HTTP
HTTP response
request
HTTP/1.0
304 Not Modified
If-modified-since:
<date>
HTTP request msg
server: response contains
If-modified-since:
no object if cached copy
<date>
is up-to-date:
HTTP response
HTTP/1.0 304 Not
HTTP/1.0 200 OK
<data>
Modified

server
object
not
modified

object
modified

52

Character Sets
Every document is represented by a string of
integer values (code points)
The mapping from code points to characters is
defined by a character set
Some header fields have character set values:
Accept-Charset: request header listing character sets
that the client can recognize
Ex: accept-charset: ISO-8859-1,utf-8;q=0.7,*;q=0.7

Content-Type: can include character set used to

represent the body of the HTTP message
Ex: Content-Type: text/html; charset=UTF-8
53

Character Sets
Technically, many character sets are
actually character encodings
An encoding represents code points using
variable-length byte strings
Most common examples are Unicode-based
encodings UTF-8 and UTF-16

IANA maintains complete list of Internetrecognized character sets/encodings

54

Character Sets
Typical US PC produces ASCII documents
US-ASCII character set can be used for such
documents, but is not recommended
UTF-8 and ISO-8859-1 are supersets of USASCII and provide international compatibility
UTF-8 can represent all ASCII characters using a
single byte each and arbitrary Unicode characters
using up to 4 bytes each
ISO-8859-1 is 1-byte code that has many characters
common in Western European languages, such as
55

Web Clients
Many possible web clients:
Text-only browser (lynx)
Mobile phones
Robots (software-only clients, e.g., search
engine crawlers)
etc.

We will focus on traditional web browsers

56

Web Browsers
First graphical browser running on
general-purpose platforms: Mosaic (1993)

57

Web Browsers

58

Web Browsers
Primary tasks:
Convert web addresses (URLs) to HTTP
requests
Communicate with web servers via HTTP
Render (appropriately display) documents
returned by a server

59

HTTP URLs
http://www.example.org:56789/a/b/c.txt?t=win&s=chess#para5
host (FQDN)
authority

port

path

query

fragment

Request-URI

Browser uses authority to connect via TCP

Request-URI included in start line (/ used
for path if none supplied)
Fragment identifier not sent to server
(used to scroll browser client area)
60

Web Browsers
Standard features

Save web page to disk

Find string in page
Fill forms automatically (passwords, CC numbers, )
Set preferences (language, character set, cache and
HTTP parameters)
Modify display style (e.g., increase font sizes)
Display raw HTML and HTTP header info (e.g., LastModified)
Choose browser themes (skins)
View history of web addresses visited
Bookmark favorite pages for easy return
61

Web Browsers
Additional functionality:
Execution of scripts (e.g., drop-down menus)
Event handling (e.g., mouse clicks)
GUI for controls (e.g., buttons)
Secure communication with servers
Display of non-HTML documents (e.g., PDF)
via plug-ins

62

Web Servers
Basic functionality:
Receive HTTP request via TCP
Map Host header to specific virtual host (one of many
host names sharing an IP address)
Map Request-URI to specific resource associated
with the virtual host
File: Return file in HTTP response
Program: Run program and return output in HTTP response

Map type of resource to appropriate MIME type and

use to set Content-Type header in HTTP response
Log information about the request and response
63

Web Servers
httpd: UIUC, primary Web server c. 1995
Apache: A patchy version of httpd, now the
most popular server (esp. on Linux platforms)
IIS: Microsoft Internet Information Server
Tomcat:
Java-based
Provides container (Catalina) for running Java
servlets (HTML-generating programs) as back-end to
Apache or IIS
Can run stand-alone using Coyote HTTP front-end
64

Web Servers
Some Coyote communication parameters:
Allowed/blocked IP addresses
Max. simultaneous active TCP connections
Max. queued TCP connection requests
Keep-alive time for inactive TCP
connections

Modify parameters to tune server

performance
65

Web Servers
Some Catalina container parameters:
Virtual host names and associated ports
Logging preferences
Mapping from Request-URIs to server
resources
Password protection of resources
Use of server-side caching

66

Secure Servers
Since HTTP messages typically travel
over a public network, private information
(such as credit card numbers) should be
encrypted to prevent eavesdropping
https URL scheme tells browser to use
encryption
Common encryption standards:
Secure Socket Layer (SSL)
Transport Layer Security (TLS)
67

Secure Servers
Id like to talk securely to you (over port 443)
HTTP
Requests

Heres my certificate and encryption data

HTTP
Requests

Heres an encrypted HTTP request

Browser

TLS/
SSL

Heres an encrypted HTTP response

TLS/
SSL

Web
Server

Heres an encrypted HTTP request

HTTP
Responses

Heres an encrypted HTTP response

HTTP
Responses

68

Secure Servers
Man-in-the-Middle Attack
Fake
DNS
Server
Whats IP
address for
100.1.1.1
www.example.org?

Browser

Fake
www.example.org
100.1.1.1

My credit card number is

Real
www.example.org

69

Secure Servers
Preventing Man-in-the-Middle
Fake
DNS
Server
Whats IP
address for
100.1.1.1
www.example.org?

Browser

Fake
www.example.org
100.1.1.1

Send me a certificate of identity

Real
www.example.org

70

End of Lecture 1

71