Connectivity:Overview

Understanding TCP/IP
We conclude our four-part article looking in depth at the TCP/IP protocol.
Here, we examine the difference between the SMTP and POP3 email protocols.

By Julian Moss

I n this series of articles we have

looked at the TCP/IP suite of pro-
tocols, beginning with the link
layer and progressing by stages to the
serves a group of users such as all those-
int one domain. The server receives all
mail intended for its users and then
allows them to collect it using POP3
messages would make this impractical
- so this is about the only way ISPs can
prevent non-subscribers such as spam-
mers from using their mail servers to
application layer. We have seen how (Post Office Protocol version 3) or some send out messages.
each layer relies upon the layers below other mail protocol. Similarly, most Having received the correct ac-
it, so that network applications can be SMTP clients send messages to a single knowledgement the sender signs on to
written without needing to take ac- server, whose job it is to relay those mes- the server by sending the string
count of considerations such as how sages on to their eventual recipients. “HELO hostname”. HELO is the sign-
the network is constructed or what An SMTP transaction begins when on command and hostname is the
type of hardware or cabling is used. the sender client opens a TCP connec- name of the host. As we will see, the
A striking point about many of the tion with the receiver using the well- hostname is used in the Received:
application layer protocols is how sim- known port number 25. The server header which the server adds to the
ple they are. The protocols based on acknowledges the connection by send- message when it sends it on its way.
TCP mostly use commands and re- ing back a message of the form “220 This information allows the recipient
sponses in plain ASCII text, making SMTP Server Ready”. SMTP uses a to trace the path taken by the message.
them easier for a user to understand similar format of replies to ftp, which
and for a programmer to implement. we looked at previously. The three- Sending
For further illustration we shall look at digit code is all the client software
the two protocols that you may use needs to tell if everything is going OK. Once the sender gets a “250 OK”
every day to send and receive Internet The text is there to help the humans acknowledgement it can start sending
email: SMTP and POP3. who might be troubleshooting a prob- messages. The protocol is extremely
lem by analysing a log of the transac- simple. All the sender has to do is say
SMTP tion. The box “Application Protocol who the message is from, who it is to,
Reply Codes” provides more informa- and supply the contents of the mes-
Simple Mail Transfer Protocol tion about message reply codes. sage.
(SMTP) is one of the most venerable of An SMTP relay server might refuse Who a message is from is specified
the Internet protocols. Designed in the a connection by sending back a mes- with the command “MAIL FROM: <ad-
early 1980s, its function is purely and sage with a “421 Service not available” dress>”. This command also tells the re-
simply to transfer electronic mail reply code. For example, an Internet ceiver that it is about to receive a new
across and between networks and Service Provider’s SMTP server pro- message, so it knows to clear out its list
other transport systems. As such, its vided for use by its subscribers to relay of recipients. The address in the angle
use need not be restricted to systems outgoing mail might refuse a connec- brackets (which are required) is the
that use TCP/IP. Any communications tion from a host whose IP address in- return path for the message. The return
system capable of handling lines of up dicates that it is not a subscriber to that path is the address that any error re-
to 1,000 7-bit ASCII characters could be ISP. SMTP has no form of access con- port - such as would be generated if the
used to carry messages using SMTP. trol - the way it can be used to relay message is undeliverable - is sent to.
On a TCP/IP network, however, TCP
provides the transport mechanism.
In SMTP the sender is the client, but
a client may communicate with many
different servers. Mail can be sent di-
“SMTP uses a similar format of
rectly from the sending host to the re-
ceiving host, requiring a separate TCP
replies to ftp, which we looked at
connection to be made for each copy of
each message. However, few mail re-
previously. The three- digit code is
cipients run their own SMTP servers.
It is more usual for the destination
all the client software needs.”
of an SMTP message to be a server that

Issue 93 (March 1998) Page 15

PC Network Advisor File: C04100.13
Connectivity:Overview

It is valid for the return path to be

null, as in “MAIL FROM: <>”. This is
typically used when sending an error “The return path is the address that any
report. A null return path means that
no delivery failure report is required. error report - such as would be generated
Its main purpose is to avoid getting
into the situation in which delivery fail- if the message is undeliverable - is sent to.”
ure messages continually shuttle back
and forth because both sender and re-
cipient addresses are unreachable.
The recipients of a message are de- will not appear in the headers at all. lookup on it. However, a mail server
fined using the command “RCPT TO: Each recipient is acknowledged intended to receive messages for local
<address>”. Each address is enclosed with a “250 OK” reply. A recipient may users only would reject recipients that
in angle brackets. A message may have also be rejected using a reply with a 550 aren’t at that domain.
many recipients, and an RCPT TO: reply code. This depends on how the Other replies may be received in
command is sent for each one. It is the server has been configured. Dial-up response to RCPT TO: messages as a
RCPT TO: command, not anything in ISP SMTP relay servers may accept result of the SMTP server being help-
the message headers, that results in a every RCPT TO: command, even if the ful. If an address is incorrect but the
message arriving at its destination. In address specified is invalid, because server knows the correct address it
the case of blind carbon copies or list the server doesn’t know that the ad- could respond with “251 User not lo-
server messages the recipient address dress is invalid until it does a DNS cal; will forward to <address>” or “551
User not local; please try <address>”.
Note the different reply codes signify-
Application Protocol Reply Codes ing whether the server has routed the
message or not. These replies aren’t
Many Internet application layer protocols which are based on ASCII text common, and a mail client may simply
commands use a system of replies in which an initial three-digit code treat the 551 response as an error,
provides the essential status information. Each digit has a particular mean- rather than try to parse the alternative
ing, as shown below. address out of the reply text.
For the sake of completeness it
First Digit should be pointed out that RCPT TO:
1xx: Positive Preliminary Reply. Command accepted but held awaiting a commands may specify routes, not
further confirmation command (continue or abort). merely addresses. A route would be
2xx: Positive Completion Reply. Command completed. Awaiting next com- expressed in the form “RCPT TO:
mand. <server1,server2:someone@server3>”.
Today this capability is rarely needed.
3xx: Positive Intermediate Reply. Command accepted but held awaiting
further information (such as a password). Message Text
4xx: Transient Negative Completion Reply. Command not accepted due to Once all the recipients have been
a temporary error condition (such as an HTTP server busy). The command specified, all that remains is for the
may be tried again later. sender to send the message itself. First
5xx: Permanent Negative Completion Reply. Command not accepted due to it sends the command “DATA”, and
a permanent error condition. The command is unlikely to be accepted if then waits for a reply like: “354 Start
repeated later. mail input; end with <CRLF>.-
<CRLF>”. The message is then sent as
Second Digit a succession of lines of text. No ac-
x0x: Syntax Error. For example, command unimplemented or valid but knowledgement is received for each
incorrect in the circumstances. line, though the sender needs to watch
for a reply that indicates an error con-
x1x: Information. The text following the code contains the answer to an dition.
information request. The end of the message is, as indi-
cated by the reply shown above, a pe-
x2x: Connections. Message reply relates to the communications channel. riod (full stop) on a line of its own.
x5x: Server. Message reply relates to the state of the server. Thus, one of the simplest but most es-
sential things that a mail client must do
Third Digit is ensure that a line containing a single
Used to distinguish individual messages. period does not appear in the actual
text.

File: C04100.14
PC Network Advisor Issue 93 (March 1998) Page 16
 Connectivity:Overview

TCP/IP

The end of the message is acknow-

ledged with “250 OK”.
It’s worth noting that SMTP isn’t in “As with the other text-based application
the least bit interested in the content of
the message. It could be absolutely protocols you can connect with a
anything, though strictly speaking it
should not contain any characters with POP3 server using a Telnet terminal
ASCII values in the range 128 to 255,
and lines of text may not exceed 1,000 emulator and interact with it using
characters. There is no requirement for
the headers to show the same sender POP3 commands.”
and recipient addresses that were used
in the SMTP commands, which makes
it easy to make a message appear to
have come from someone other than
the true sender. liver a message to the next (or final) tion of commands. This is simpler than
host in the chain, it will try at ever- the numeric codes used by SMTP and
Tracking lengthening intervals over a period of other protocols: software need only
a few days before giving up and send- check the first character for a plus or a
When a message is relayed by the ing a delivery failure notification to the minus. The text that may appear after
server it inserts a “Received:” header return path address. a “+OK” is a prompt for what to do
at the start of the message showing the SMTP offers no way for the recipi- next. After “-ERR” it is an error de-
identity of the host that sent the mes- ent to prompt a server into sending scription. The exact content of the text
sage, its own host name, and a time mail that it is trying to deliver. If a may vary between server implementa-
stamp. Each SMTP server that a mes- recipient connects to the Internet infre- tions.
sage passes through adds its own “Re- quently their server may never be ac-
ceived:” header. Thus it is possible to tive at the right time. In this case the To Access The Server
track the path taken by a message. Al- mail will eventually bounce.
though this won’t identify the sender SMTP is rather like a courier deliv- A POP3 server holds people’s per-
it may shed some light on whether or ery service. If you aren’t in when it calls sonal mail, so unsurprisingly you need
not the address the message is appar- then, after a couple of re-delivery at- to enter a user name and a matching
ently from is in fact the true one. tempts, the message is returned to the password before you can gain access to
After the “250 OK” that acknow- sender. Post Office Protocol version 3 it. To log in you must send “USER
ledges the end of the message, the (POP3) - as the name suggests - lets you username”. A “+OK” response shows
sender can start again with a new mes- have your mail held at the post office that the user name is valid. You must
sage by sending a new “MAIL FROM:” so you can collect it at a time of your then send “PASS password”. If the
command or it can sign off from the own choosing. password is correct you will receive
server using “QUIT”. A 221 reply will POP3 is another TCP application, another positive acknowledgement in
be received in response to the QUIT and uses the well-known port number a reply like “+OK username has two
command. 110. As with the other text-based appli- message(s) (914 octets)”. “-ERR” re-
SMTP servers should support two cation protocols you can connect with plies may be received if the user name
further commands for a minimum im- a POP3 server using a Telnet terminal is not known, the password is incorrect
plementation. NOOP does nothing, emulator and interact with it using or the server is for some reason unable
but should provoke a “250 OK” reply. POP3 commands. This can sometimes to open a user’s mailbox.
RSET aborts the current message trans- be useful, as for example to manually Once a client is successfully logged
action. There are other commands delete a corrupt message that crashes a in it can issue several different com-
such as HELP which are really only of mail client whenever it is downloaded. mands which allow it to find out how
interest to those trying to communicate (However, don’t try connecting to many messages are waiting and how
with SMTP servers interactively and your ISP’s port 110 and sending ran- big they are, and to download the mes-
are therefore not really relevant to un- dom commands without permission. sages and delete them from the server.
derstanding how the protocol works in Their automatic hacker detection sys- The “STAT” command returns the
day-to-day use. tems might spring into operation and number of messages waiting (mw) and
you may well be asked to explain what their total size in bytes (sb), as a re-
POP3 you’re doing.) sponse in the form “+OK mw sb”. Note
On connecting to the server, the that this is the same information given
SMTP is capable of delivering mail server should respond with the mes- in the login acknowledgement, but in
direct to the recipient’s desktop, but in sage “+OK POP3 server ready”. POP3 a form (two numbers separated by a
practice it isn’t the ideal protocol for uses “+OK” and “-ERR” at the start of single space) that is easier for the client
this. If an SMTP relay is unable to de- replies to indicate acceptance or rejec- software to process.

Issue 93 (March 1998) Page 17

PC Network Advisor File: C04100.15
Connectivity:Overview

net client, also makes it easy to write

client software using just about any
“SMTP is rather like a courier delivery programming language that can send
and receive text using TCP.
service. If you aren’t in when it calls then, This simplicity is in stark contrast to
many other network architectures
after a couple of re-delivery attempts, the which require the use of proprietary
APIs and languages that support com-
message is returned to the sender.” plex data structures.

Conclusion
The command “LIST” can be used The command must include a message In this article it has only been possi-
to determine the size of each message. number (mn). After an “+OK” ac- ble to give an overview of the most
After the “+OK” the server sends, on knowledgement the server sends the important protocols used on the In-
separate lines, the message numbers whole message. Again, the end of the ternet. The full specifications of these
(mn) and the message sizes (ms) sepa- message is indicated by a line contain- and other Internet protocols can be
rated by a space. Waiting messages are ing just a period. found in Requests For Comments
numbered sequentially, starting from (RFCs) published by the Network
1. The command “LIST mn” can be Wiping Working Group. RFCs are freely avail-
used to find out the size of a specific able for download from the Internet.
message. The LIST command is typi- The command “DELE mn” is used Anyone interested in finding out more
cally used by mail clients that imple- to delete a message. In fact, the DELE about TCP/IP, and particularly in im-
ment a user-defined restriction on the command only marks messages for de- plementing their own TCP/IP applica-
size of messages that will be down- letion. Any messages marked for dele- tions, should obtain and study the
loaded, or those that want to display a tion during a session may be undeleted RFCs for the protocols concerned.
progress indicator that shows how by issuing an “RSET” command. The However, even if you never have to
much of each message has been down- messages are only deleted once the cli- write your own Internet software it is
loaded. ent has closed the POP3 session by hoped that this article has piqued your
POP3 provides no commands that issuing a “QUIT” command. If a client interest, and contributed to a better un-
enable a client to find out the subject of never gets to close a session properly derstanding of how TCP/IP and the
a message or who it is from. However, because the connection is lost or timed Internet really work.
the TOP command lets the client out then you may find some messages
download a message’s headers and a being downloaded again the next time
specified number of lines from the you connect to the server.
message body, from which this infor- In order to avoid downloading mes-
mation may be obtained. TOP is an sages twice, a POP3 client can use the
optional POP3 command but its imple- command “UIDL” or “UIDL mn” to
mentation is strongly recommended. obtain unique, server-generated IDs
The format of the command is “TOP for each message. By storing the UIDLs
mn nl” where mn is the message of downloaded messages in a file, a
number and nl the number of lines client can easily determine whether a
PCNA
required. The response is “+OK” (if mn message on the server has been pre-
is valid) followed by a partial down- viously retrieved or not.
load of the message. The end of the Implementation of the UIDL com-
download is indicated by a line con- mand is optional, but most POP3 serv-
taining a single period (full stop). ers seem to support it and most mail
Some spam filtering software - clients use it.
which kills unwanted messages with-
out downloading them - uses the TOP Benefits
command to determine whether a
message meets the criteria for being SMTP and POP3 are two of the most
killed or not. However, the time taken commonly-used Internet protocols, The Author
to get this information for every mes- which is why we have devoted this Julian Moss is a freelance writer
sage may exceed the time it would article to looking at them in some de- and software developer with ex-
have taken simply to download the tail. Their text-based nature, which perience of developing TCP/IP
spam and delete it later. makes it possible to send and receive client software. He can be con-
The command “RETR mn” is used messages by communicating with a tacted as [email protected].
to retrieve messages from the server. server interactively using a simple Tel-

File: C04100.16
PC Network Advisor Issue 93 (March 1998) Page 18
Additional Resources

• IPv6 Explained
• The OSI 7 Layer Model Explained
• Understanding Frame Relay
• Understanding DHCP
• Virtual Private Networking Explained

All these articles are available free online now at

www.pcnetworkadvisor.com

PCNA

Copyright ITP, 2002

PC Network Advisor
www.pcnetworkadvisor.com
 Recent Reviews from Tech Support Alert

Reviews of the Best Windows Backup Software

In this detailed comparative review, we checked out eighteen backup software
utilities designed for home or SOHO use. Many of the products reviewed
were disappointing. However 6 products passed our tests with flying colors
and 2 of these were so impressive, they were awarded our “Editor’s Choice.”

Suppliers of Cheap Inkjet Printer Cartridges Reviewed and Rated

With hundreds of companies all claiming to have the “cheapest and best inkjet
printer cartridges,” our editors decided to put their claims to the test. Not
unexpectedly, many suppliers flunked but we did manage to come up with a
number of web sites that sell good quality inkjet printer cartridges at heavily
discounted prices.

The Best Anti Trojan Software

Our editors took a close look at the 6 leading anti-trojan/trojan remover
software utilities. Unfortunately, they found only 2 products that were effective
in their ability to detect and remove dangerous modern polymorphic and
process injecting trojans.

The 46 Best Ever Freeware Utilities

This is our Editor, Ian “Gizmo” Richards, personal selection of the best
freeware utilities. He’s hunted down some real gems, many of which perform
better than expensive commercial products.

Tech Support Alert

http://www.techsupportalert.com