7.Network_Data_Plane
COMP 3331/9331:
Computer Networks and
Applications
Week 7
Network Layer: Data Plane
Reading Guide: Chapter 4: Sections 4.1, 4.3
1
2
Our goals:
§ understand principles behind network layer
services, focusing on data plane:
• network layer service models
• forwarding versus routing
§ instantiation, implementation in the Internet
Network Layer: outline
4.1 Overview of Network layer
– data plane
– control plane
4.2 What’s inside a router
— Not Covered
4.3 IP: Internet Protocol
– datagram format
– fragmentation
– IPv4 addressing
– network address
translation
– IPv6
4.4 Generalized forwarding
and Software Defined
Networking (SDN)
– Not Covered
Network Layer, data plane: outline
3
• 1968: DARPAnet/ARPAnet (precursor to Internet)
– (Defense) Advanced Research Projects Agency Network
• Mid 1970’s: new networks emerge
– SATNet, Packet Radio, Ethernet
– All “islands” to themselves – didn’t work together
• Big question: How to connect these networks?
4
Some Background
• Cerf & Kahn in 1974,
– “A Protocol for Packet Network
Intercommunication”
– Foundation for the modern Internet
• Routers forward packets from source to
destination
– May cross many separate networks along the way
• All packets use a common Internet Protocol
– Any underlying data link protocol
– Any higher layer transport protocol
5
Internet Protocol Stack
• Application: Email, Web, …
• Transport: TCP, UDP, …
• Network: IP
• Link: Ethernet, WiFi, ATM, …
• Physical: copper, fiber, air, …
• “Hourglass” model, “thin waist”, “narrow waist”
IP
UDP
TCP
Ethernet
ATM
…
Email
Web
Internetworking
6
• transport segment from
sending to receiving host
• on sending side encapsulates
segments into datagrams
• on receiving side, delivers
segments to transport layer
• network layer protocols in
every host, router
• router examines header
fields in all IP datagrams
passing through it
application
transport
network
data link
physical
application
transport
network
data link
physical
network
data link
physical network
data link
physical
network
data link
physical
network
data link
physical
network
data link
physical
network
data link
physical
network
data link
physical
network
data link
physical
network
data link
physical
network
data link
physicalnetwork
data link
physical
Network Layer
7
• forwarding: move
packets from router’s
input to appropriate
router output
• routing: determine
route taken by packets
from source to dest.
– routing algorithms
analogy:
v routing: process of
planning trip from source
to dest
v forwarding: process of
getting through single
interchange
Two key nework-layer functions
8
1
23
0111
value in arriving
packet’s header
routing algorithm
local forwarding table
header value output link
0100
0101
0111
1001
3
2
2
1
Interplay between routing and forwarding
routing algorithm determines
end-end-path through network
forwarding table determines
local forwarding at this router
Data plane
§ local, per-router function
§ determines how datagram
arriving on router input
port is forwarded to
router output port
§ forwarding function
Control plane
§ network-wide logic
§ determines how datagram is
routed among routers along
end-end path from source host
to destination host
§ two control-plane approaches:
• traditional routing algorithms:
implemented in routers
• software-defined networking
(SDN): centralised (remote)
servers
1
2
3
0111
values in arriving
packet header
9
Network Layer: data vs control plane
Per-router control plane
Routing
Algorithm
Individual routing algorithm components in each and every
router interact in the control plane
data
plane
control
plane
4.1 • OVERVIEW OF NETWORK LAYER 309
tables. In this example, a routing algorithm runs in each and every router and both
forwarding and routing functions are contained within a router. As we’ll see in Sec-
tions 5.3 and 5.4, the routing algorithm function in one router communicates with
the routing algorithm function in other routers to compute the values for its forward-
ing table. How is this communication performed? By exchanging routing messages
containing routing information according to a routing protocol! We’ll cover routing
algorithms and protocols in Sections 5.2 through 5.4.
The distinct and different purposes of the forwarding and routing functions can
be further illustrated by considering the hypothetical (and unrealistic, but technically
feasible) case of a network in which all forwarding tables are configured directly by
human network operators physically present at the routers. In this case, no routing
protocols would be required! Of course, the human operators would need to interact
with each other to ensure that the forwarding tables were configured in such a way
that packets reached their intended destinations. It’s also likely that human configu-
ration would be more error-prone and much slower to respond to changes in the net-
work topology than a routing protocol. We’re thus fortunate that all networks have
both a forwarding and a routing function!
Values in arriving
packet’s header
1
2
3
Local forwarding
table
header
0100
0110
0111
1001
1101
3
2
2
1
output
Control plane
Data plane
Routing algorithm
Figure 4.2 ! Routing algorithms determine values in forward tables
M04_KURO4140_07_SE_C04.indd 309 11/02/16 3:14 PM
10
1
2
0111
values in arriving
packet header
3
data
plane
control
plane
Logically centralized control plane (SDN)
A distinct (typically remote) controller interacts with local
control agents (CAs)
Remote Controller
CA
CA CA CA CA
11
1
2
0111
3
values in arriving
packet header
Q: What service model for “channel” transporting
datagrams from sender to receiver?
A. No guarantee whatsoever is provided by IP
layer in TCP/IP protocol stack. It’s “best effort
service”.
12
Network Layer: service model
4.1 Overview of Network layer
– data plane
– control plane
4.2 What’s inside a router
— Not Covered
4.3 IP: Internet Protocol
– datagram format
– fragmentation
– IPv4 addressing
– network address
translation
– IPv6
Network Layer, data plane: outline
13
4.4 Generalized forwarding
and Software Defined
Networking (SDN)
– Not Covered
14
The Internet network layer
forwarding
table
host, router network layer functions:
routing protocols
• path selection
• RIP, OSPF, BGP
IP protocol
• addressing conventions
• datagram format
• packet handling conventions
ICMP protocol
• error reporting
• router “signaling”
transport layer: TCP, UDP
link layer
physical layer
network
layer
IP Packet Structure
4-bit
Version
4-bit
Header
Length
8-bit
Type of Service
(TOS)
16-bit Total Length (Bytes)
16-bit Identification
3-bit
Flags 13-bit Fragment Offset
8-bit Time to
Live (TTL) 8-bit Protocol 16-bit Header Checksum
32-bit Source IP Address
32-bit Destination IP Address
Options (if any)
Payload
15
Fields for Reading Packet Correctly
4-bit
Version
4-bit
Header
Length
8-bit
Type of Service
(TOS)
16-bit Total Length (Bytes)
16-bit Identification
3-bit
Flags 13-bit Fragment Offset
8-bit Time to
Live (TTL) 8-bit Protocol 16-bit Header Checksum
32-bit Source IP Address
32-bit Destination IP Address
Options (if any)
Payload
16
Reading Packet Correctly
• Version number (4 bits)
– Indicates the version of the IP protocol
– Necessary to know what other fields to expect
– Typically, “4” (for IPv4)
• Header length (4 bits)
– Number of 32-bit words in the header
– Typically, “5” (for a 20-byte IPv4 header)
– Can be more when IP options are used
• Total length (16 bits)
– Number of bytes in the packet
– Maximum size is 65,535 bytes (216 -1)
– … though underlying links may impose smaller limits
17
Fields for Reaching Destination and Back
4-bit
Version
4-bit
Header
Length
8-bit
Type of Service
(TOS)
16-bit Total Length (Bytes)
16-bit Identification
3-bit
Flags 13-bit Fragment Offset
8-bit Time to
Live (TTL) 8-bit Protocol 16-bit Header Checksum
32-bit Source IP Address
32-bit Destination IP Address
Options (if any)
Payload
18
Telling End-Host How to Handle Packet
4-bit
Version
4-bit
Header
Length
8-bit
Type of Service
(TOS)
16-bit Total Length (Bytes)
16-bit Identification
3-bit
Flags 13-bit Fragment Offset
8-bit Time to
Live (TTL) 8-bit Protocol 16-bit Header Checksum
32-bit Source IP Address
32-bit Destination IP Address
Options (if any)
Payload
19
Telling End-Host How to Handle Packet
• Protocol (8 bits)
– Identifies the higher-level Transport protocol
– Important for demultiplexing at receiving host
Application
Transport
Network
Data link
PhysicalL1
L2
L3
L4
L7 SMTP HTTP DNS NTP
TCP UDP
IP
Ethernet FDDI PPP
optical copper radio PSTN
20
Checksum, TTL and Fragmentation Fields
4-bit
Version
4-bit
Header
Length
8-bit
Type of Service
(TOS)
16-bit Total Length (Bytes)
16-bit Identification
3-bit
Flags 13-bit Fragment Offset
8-bit Time to
Live (TTL) 8-bit Protocol 16-bit Header Checksum
32-bit Source IP Address
32-bit Destination IP Address
Options (if any)
Payload
21
Potential Problems
• Loop: TTL
• Header Corrupted: Checksum
• Packet too large: Fragmentation
22
Preventing Loops (TTL)
• Forwarding loops cause packets to cycle for a long time
– As these accumulate, eventually consume all capacity
• Time-to-Live (TTL) Field (8 bits)
– Decremented at each hop, packet discarded if reaches 0
– …and “time exceeded” message is sent to the source
– Recommended default value is 64
23
Header Corruption (Checksum)
• Checksum (16 bits)
– Particular form of checksum over packet header
• If not correct, router discards packets
– So, it doesn’t act on bogus information
• Checksum recalculated at every router
– Why?
– Why include TTL?
– Why only header?
24
25
IP fragmentation, reassembly
• network links have MTU
(max.transfer size) – largest
possible link-level frame
– different link types,
different MTUs
• large IP datagram divided
(“fragmented”) within net
– one datagram becomes
several datagrams
– “reassembled” only at
final destination
– IP header bits used to
identify, order related
fragments
fragmentation:
in: one large datagram
out: 3 smaller datagrams
reassembly
…
…
26
ID
=x
offset
=0
MF flag
=0
length
=4000
ID
=x
offset
=0
MF flag
=1
length
=1500
ID
=x
offset
=185
MF flag
=1
length
=1500
ID
=x
offset
=370
MF flag
=0
length
=1040
one large datagram becomes
several smaller datagrams
example:
v 4000-byte datagram
v MTU = 1500 bytes
1480 bytes in
data field
offset =
1480/8
IP fragmentation, reassembly
Applet:
http://media.pearsoncmg.com/aw/aw_kurose_network_2/applets/ip/ipfragmentation.html
Data = 4000 –
20 (IP header)
=3980
F1=1480
F2=1480
F3=1020
Note: Offset is expressed as multiple of 8 bytes
27
IPv4 fragmentation procedure
Ø Fragmentation
• Router breaks up datagram in size that output link can
support
• Copies IP header to pieces
• Adjust length on pieces
• Set offset to indicate position
• Set MF (More fragments) flag on pieces except the last
• Re-compute checksum
ØRe-assembly
• Receiving host uses identification field with MF and
offsets to complete the datagram.
Ø Fragmentation of fragments also supported
Tak
en f
rom
[TC
P/IP
Pro
toco
l Su
ite
by
Beh
roze
For
ouz
an]
MTU=1420
MTU=820
28
2.1
2.2
29
IP Fragmentation Attacks … IP Fragmentation Attacks…
https://en.wikipedia.org/wiki/IP_fragmentation_attack
Not on Exam
30
Path MTU Discovery procedure
Ø Host
• Sends a big packet to test whether all routers in path to the
destination can support or not
• Set DF (Do not fragment) flag
Ø Routers
• Drops the packet if it is too large (as DF is set)
• Provides feedback to Host with ICMP message telling the
maximum supported size
Fields for Special Handling
4-bit
Version
4-bit
Header
Length
8-bit
Type of Service
(TOS)
16-bit Total Length (Bytes)
16-bit Identification
3-bit
Flags 13-bit Fragment Offset
8-bit Time to
Live (TTL) 8-bit Protocol 16-bit Header Checksum
32-bit Source IP Address
32-bit Destination IP Address
Options (if any)
Payload
31
Special Handling
• “Type of Service”, or “Differentiated Services
Code Point (DSCP)” (8 bits)
– Allow packets to be treated differently based on needs
– E.g., low delay for audio, high bandwidth for bulk transfer
– Has been redefined several times
– Not widely used
• Options (not often used)
32
33
ver length
32 bits
data
(variable length,
typically a TCP
or UDP segment)
16-bit identifier
header
checksum
time to
live
32 bit source IP address
head.
len
type of
service
flgs fragment
offset
upper
layer
32 bit destination IP address
options (if any)
RECAP: IP datagram format
IP protocol version
number
header length
(bytes)
upper layer protocol
to deliver payload to
total datagram
length (bytes)
“type” of data
for
fragmentation/
reassemblymax number
remaining hops
(decremented at
each router)
e.g. timestamp,
record route
taken, specify
list of routers
to visit.
how much overhead?
v 20 bytes of TCP
v 20 bytes of IP
v = 40 bytes + app
layer overhead
4.1 Overview of Network layer
– data plane
– control plane
4.2 What’s inside a router
4.3 IP: Internet Protocol
– datagram format
– fragmentation
– IPv4 addressing
– network address
translation
– IPv6
Network Layer, data plane: outline
34
35
IP addressing: introduction
• IP address: 32-bit
identifier for host, router
interface
• interface: connection
between host/router and
physical link
– router’s typically have
multiple interfaces
– host typically has one or
two interfaces (e.g., wired
Ethernet, wireless 802.11)
• IP addresses associated
with each interface
223.1.1.1
223.1.1.2
223.1.1.3
223.1.1.4 223.1.2.9
223.1.2.2
223.1.2.1
223.1.3.2223.1.3.1
223.1.3.27
223.1.1.1 = 11011111 00000001 00000001 00000001
223 1 11
36
IP addressing: introduction
Q: how are interfaces
actually connected?
A: we’ll learn about that
in the link layer
223.1.1.1
223.1.1.2
223.1.1.3
223.1.1.4 223.1.2.9
223.1.2.2
223.1.2.1
223.1.3.2223.1.3.1
223.1.3.27
A: wired Ethernet interfaces
connected by Ethernet switches
A: wireless WiFi interfaces
connected by WiFi base station
37
Networks
• IP address:
–network part – high
order bits
–host part – low order
bits
• what’s a network ?
–device interfaces with
same network part of IP
address
–can physically reach
each other without
intervening router
inter-network consisting of 3 nets
223.1.1.1
223.1.1.3
223.1.1.4 223.1.2.9
223.1.3.2223.1.3.1
subnet
223.1.1.2
223.1.3.27
223.1.2.2
223.1.2.1
38
how many? 223.1.1.1
223.1.1.3
223.1.1.4
223.1.2.2223.1.2.1
223.1.2.6
223.1.3.2223.1.3.1
223.1.3.27
223.1.1.2
223.1.7.0
223.1.7.1
223.1.8.0223.1.8.1
223.1.9.1
223.1.9.2
Networks
Answer: 6 as shown
39
Masking
• Mask
– Used in conjunction with the
network address to indicate how
many higher order bits are used
for the network part of the
address
• Bit-wise AND
– 223.1.1.0 with mask
255.255.255.0
• Broadcast Address
– host part is all 111’s
– E.g., 223.1.1.255
• Network Address
– Host part is all 0000’s
– E.g., 223.1.1.0
• Both are typically not assigned
to any host
223.1.1.0
223.1.2.0
223.1.3.0
Host B Dot-decimal
address
Binary
IP address 223.1.1.2 11111101.00000001.00000001.00000010
Mask 255.255.255.0 11111111.11111111.11111111.00000000
Network Part 223.1.1.0 11111101.00000001.00000001.00000000
Host Part 0.0.0.2 00000000.00000000.00000000.00000010
B: 223.1.1.2
Original Internet Addresses
• First eight bits: network address (/8)
• Last 24 bits: host address, ~16.7 million
Assumed 256 networks were more than
enough!
40
Next design: Class-ful Addresses
0
10
110
1110
1111
Class A
Class B
Class C
Class D
Class E
8 16 24 310
netid hostid
netid hostid
netid hostid
multicast address
reserved for future use
1.0.0.0 to
127.255.255.255
128.0.0.0 to
191.255.255.255
192.0.0.0 to
223.255.255.255
224.0.0.0 to
239.255.255.255
240.0.0.0 to
255.255.255.255
Used till
the introd
uction of
CIDR 19
93
41
Problem: Networks only come in three sizes!
27 nets,
224hosts
214 nets,
216 hosts
221 nets,
28 hosts
Finding the address class
42
What are the issues?
ØAn organization requires 6 nets each of size 30.
Does it have to buy 6 class C address blocks?
ØAn organization requires 512 addresses? How
many IP addresses should it buy?
43
Subnetting
ØSubnetting is the process of dividing the class
A, B or C network into more manageable
chunks that are suited to your network’s size
and structure.
ØSubnetting allows 3 levels of hierarchy
• netid, subnetid, hostid
ØOriginal netid remains the same and
designates the site
ØSubnetting remains transparent outside the
site
44
Subnetting
ØThe process of subnetting simply extends the point
where the 1’s of Mask stop and 0’s start
ØYou are sacrificing some host ID bits to gain Network
ID bits
45
A company is granted the site address 201.70.64.0 (class
C). The company needs six subnets. Design the subnets.
The company needs six subnets. 6 is not a power of 2.
The next number that is a power of 2 is 8 (23). We need
3 more 1s in the subnet mask. The total number of 1s
in the subnet mask is 27 (24 + 3). The mask is
11111111 11111111 11111111 11100000
or 255.255.255.224
46
Number of addresses in each subnet = 25
= 32
Quiz?
The number of addresses in each subnet is 25 or 32.
47
Quiz: IP Addressing
• How many IP addresses belong to the subnet
128.119.254.0/25 ? What are the IP addresses
at the two end-points of this range ?
48
Answer: 27 = 128 addresses (126 are usable)
10000000 01110111 11111110 00000000
subnet
part
host
part
128.119.254.0/25
128.119.254.127
128.119.254.0
/25
49
Today’s addressing: CIDR
CIDR: Classless InterDomain Routing
§ network portion of address of arbitrary length
§ address format: a.b.c.d/x, where x is # bits in
network portion of address
11001000 00010111 00010000 00000000
Network (Prefix)
part
Host (Suffix)
part
200.23.16.0/23
200.23.17.255
200.23.16.0
/23
IP address
How many IP addresses belong to the subnet
134.45.22.0/23?
A) 32
B) 64A
C) 128
D) 256
E) 512
50
Quiz: IP Addressing
www.zeeting.com/salil
ANSWER: E (2^9 = 512)
Answer: E
A small organization is given a block with the beginning
address and the prefix length 205.16.37.24/29 (in slash
notation). What are the IP addresses at the two end
points?
The beginning address is 205.16.37.24. To find the
last address we keep the first 29 bits and change the
last 3 bits to 1s.
Beginning:11001101 00010000 00100101 00011000
Ending : 11001101 00010000 00100101 00011111
There are only 8 addresses in this block.
205.16.37.24 to 205.16.37.31
51
Quiz: IP Addressing
www.zeeting.com/salil
An ISP is granted a block of addresses starting with
190.100.0.0/16. The ISP needs to distribute these
addresses to three groups of customers as follows:
1. The first group has 64 customers; each needs 256 addresses.
2. The second group has 128 customers; each needs 128 addresses.
3. The third group has 128 customers; each needs 64 addresses.
Design the sub-blocks and give the slash notation for
each sub-block. Find out how many addresses are still
available after these allocations.
52
Quiz: IP Addressing
Group 1
For this group, each customer needs 256 addresses.
This means the suffix length is 8 (28 = 256). The
prefix length is then 32 – 8 = 24.
01: 190.100.0.0/24 è190.100.0.255/24
02: 190.100.1.0/24 è190.100.1.255/24
…………………………………..
64: 190.100.63.0/24è190.100.63.255/24
Total = 64 ´ 256 = 16,384
53
Group 2
For this group, each customer needs 128 addresses.
This means the suffix length is 7 (27 = 128). The
prefix length is then 32 – 7 = 25. The addresses
are:
001: 190.100.64.0/25 è190.100.64.127/25
002: 190.100.64.128/25 è190.100.64.255/25
………………………………………………….
128: 190.100.127.128/25 è190.100.127.255/25
Total = 128 ´ 128 = 16,384
54
Group 3
For this group, each customer needs 64 addresses.
This means the suffix length is 6 (26 = 64). The
prefix length is then 32 – 6 = 26.
001:190.100.128.0/26 è190.100.128.63/26
002:190.100.128.64/26 è190.100.128.127/26
…………………………
128:190.100.159.192/26 è190.100.159.255/26
Total = 128 ´ 64 = 8,192
55
Number of granted addresses: 65,536
Number of allocated addresses: 40,960
Number of available addresses: 24,576
56
57
IP addresses: how to get one?
Q: How does a host get IP address?
• hard-coded by system admin in a file
– Windows: control-panel->network->configuration->tcp/ip-
>properties
– UNIX: /etc/rc.config
• DHCP: Dynamic Host Configuration Protocol: dynamically
get address from as server
– “plug-and-play”
58
DHCP
goal: allow host to dynamically obtain its IP address from
network server when it joins network
– can renew its lease on address in use
– allows reuse of addresses (only hold address while
connected/“on”)
– support for mobile users who want to join network
DHCP overview:
– host broadcasts “DHCP discover”msg
– DHCP server responds with “DHCP offer”msg
– host requests IP address: “DHCP request”msg
– DHCP server sends address: “DHCP ack”msg
59
DHCP client-server scenario
223.1.1.0/24
223.1.2.0/24
223.1.3.0/24
223.1.1.1
223.1.1.3
223.1.1.4 223.1.2.9
223.1.3.2223.1.3.1
223.1.1.2
223.1.3.27
223.1.2.2
223.1.2.1
DHCP
server
arriving DHCP
client needs
address in this
network
60
DHCP server: 223.1.2.5 arriving
client
DHCP discover
src : 0.0.0.0, 68
dest.: 255.255.255.255,67
yiaddr: 0.0.0.0
transaction ID: 654
DHCP offer
src: 223.1.2.5, 67
dest: 255.255.255.255, 68
yiaddrr: 223.1.2.4
transaction ID: 654
lifetime: 3600 secs
DHCP request
src: 0.0.0.0, 68
dest:: 255.255.255.255, 67
yiaddrr: 223.1.2.4
transaction ID: 655
lifetime: 3600 secs
DHCP ACK
src: 223.1.2.5, 67
dest: 255.255.255.255, 68
yiaddrr: 223.1.2.4
transaction ID: 655
lifetime: 3600 secs
DHCP client-server scenario
61
DHCP: more than IP addresses
DHCP can return more than just allocated IP
address on subnet:
§ address of first-hop router for client
§ name and IP address of DNS sever
§ network mask (indicating network versus host
portion of address)
62
v connecting laptop needs its
IP address, addr of first-hop
router, addr of DNS server:
use DHCP
router with DHCP
server built into
router
v DHCP request encapsulated in
UDP, encapsulated in IP,
encapsulated in 802.1 Ethernet
v Ethernet frame broadcast (dest:
FFFFFFFFFFFF) on LAN,
received at router running DHCP
server
v Ethernet demuxed to IP
demuxed, UDP demuxed to
DHCP
168.1.1.1
DHCP
UDP
IP
Eth
Phy
DHCP
DHCP
DHCP
DHCP
DHCP
DHCP
UDP
IP
Eth
Phy
DHCP
DHCP
DHCP
DHCPDHCP
DHCP: example
63
• DHCP server formulates
DHCP ACK containing
client ’ s IP address, IP
address of first-hop
router for client, name &
IP address of DNS server
• Encapsulation of DHCP
server, frame forwarded
to client, demuxing up to
DHCP at client
DHCP: example
router with DHCP
server built into
router
DHCP
DHCP
DHCP
DHCP
DHCP
UDP
IP
Eth
Phy
DHCP
DHCP
UDP
IP
Eth
Phy
DHCP
DHCP
DHCP
DHCP
• Client now knows its IP
address, name and IP
address of DSN server, IP
address of its first-hop
router
64
DHCP: Wireshark
output (home LAN)
Message type: Boot Reply (2)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x6b3a11b7
Seconds elapsed: 0
Bootp flags: 0x0000 (Unicast)
Client IP address: 192.168.1.101 (192.168.1.101)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server IP address: 192.168.1.1 (192.168.1.1)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client MAC address: Wistron_23:68:8a (00:16:d3:23:68:8a)
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option: (t=53,l=1) DHCP Message Type = DHCP ACK
Option: (t=54,l=4) Server Identifier = 192.168.1.1
Option: (t=1,l=4) Subnet Mask = 255.255.255.0
Option: (t=3,l=4) Router = 192.168.1.1
Option: (6) Domain Name Server
Length: 12; Value: 445747E2445749F244574092;
IP Address: 68.87.71.226;
IP Address: 68.87.73.242;
IP Address: 68.87.64.146
Option: (t=15,l=20) Domain Name = “hsd1.ma.comcast.net.”
reply
Message type: Boot Request (1)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x6b3a11b7
Seconds elapsed: 0
Bootp flags: 0x0000 (Unicast)
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server IP address: 0.0.0.0 (0.0.0.0)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client MAC address: Wistron_23:68:8a (00:16:d3:23:68:8a)
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option: (t=53,l=1) DHCP Message Type = DHCP Request
Option: (61) Client identifier
Length: 7; Value: 010016D323688A;
Hardware type: Ethernet
Client MAC address: Wistron_23:68:8a (00:16:d3:23:68:8a)
Option: (t=50,l=4) Requested IP Address = 192.168.1.101
Option: (t=12,l=5) Host Name = “nomad”
Option: (55) Parameter Request List
Length: 11; Value: 010F03062C2E2F1F21F92B
1 = Subnet Mask; 15 = Domain Name
3 = Router; 6 = Domain Name Server
44 = NetBIOS over TCP/IP Name Server
……
request
65
DHCP: further details
• DHCP uses UDP and port numbers 67 (server side) and 68
(client side)
• Usually the MAC address is used to identify clients
– DHCP server can be configured with a “registered list” of acceptable
MAC addresses
• DHCP offer message includes ip address, length of lease,
subnet mask, DNS servers, default gateway
• DHCP security holes
– DoS attack by exhausting pool of IP addresses
– Masquerading as a DHCP server
– Authentication for DHCP – RFC 3118
66
IP addresses: how to get one?
Q: how does network get subnet part of IP addr?
A: gets allocated portion of its provider ISP’s
address space
ISP’s block 11001000 00010111 00010000 00000000 200.23.16.0/20
Organization 0 11001000 00010111 00010000 00000000 200.23.16.0/23
Organization 1 11001000 00010111 00010010 00000000 200.23.18.0/23
Organization 2 11001000 00010111 00010100 00000000 200.23.20.0/23
… ….. …. ….
Organization 7 11001000 00010111 00011110 00000000 200.23.30.0/23
CIDR: Addresses allocated in contiguous
prefix chunks
Recursively break down chunks as get closer to host
12.0.0.0/8
12.0.0.0/15
12.253.0.0/16
12.2.0.0/16
12.3.0.0/16
:
:
12.3.0.0/22
12.3.4.0/24
:
:
12.3.254.0/23
12.253.0.0/19
12.253.32.0/19
12.253.64.0/19
12.253.64.108/30
12.253.96.0/18
12.253.128.0/17
:
:
:
:
67
68
Hierarchical addressing: route aggregation
“Send me anything
with addresses
beginning
200.23.16.0/20”
200.23.16.0/23
200.23.18.0/23
200.23.30.0/23
Fly-By-Night-ISP
Organization 0
Organization 7
Internet
Organization 1
ISPs-R-Us “Send me anything
with addresses
beginning
199.31.0.0/16”
200.23.20.0/23
Organization 2
…
…
hierarchical addressing allows efficient advertisement of routing
information:
69
Quiz: What should we do if organization 1 decides
to switch to ISPs-R-Us
A: Move 200.23.18.0/23 to ISPs-R-Us (and break up Fly-By-Night’s/20 block).
B: Give new addresses to Organization 1 (and force them to change all their addresses)
C: Some other solution
“Send me anything
with addresses
beginning
200.23.16.0/20”
200.23.16.0/23
200.23.18.0/23
200.23.30.0/23
Fly-By-Night-ISP
Organization 0
Organization 7
Internet
Organization 1
ISPs-R-Us “Send me anythingwith addresses
beginning
199.31.0.0/16”
200.23.20.0/23
Organization 2
…
…
Both A and B are valid. A is explained on the next 2 slides
70
ISPs-R-Us has a more specific route to Organization 1
“Send me anything
with addresses
beginning
200.23.16.0/20”
200.23.16.0/23
200.23.18.0/23
200.23.30.0/23
Fly-By-Night-ISP
Organization 0
Organization 7
Internet
Organization 1
ISPs-R-Us “Send me anything
with addresses
beginning 199.31.0.0/16
or 200.23.18.0/23”
200.23.20.0/23
Organization 2
…
…
Hierarchical addressing: more specific routes
Longest prefix matching
71
Example: continued
• But how will this work?
• Routers in the Internet will have two entries in
their tables
– 200.23.16.0/20 (Fly-by-Night-ISP)
– 200.23.18.0/23 (ISPs-R-Us)
• Longest prefix match
IP address
200.23.31.255
200.23.16.0
/20
200.23.19.255
200.23.18.0
/23
Longest prefix matching
Destination Address Range
11001000 00010111 00010*** *********
11001000 00010111 00011000 *********
11001000 00010111 00011*** *********
otherwise
DA: 11001000 00010111 00011000 10101010
examples:
DA: 11001000 00010111 00010110 10100001 which interface?
which interface?
when looking for forwarding table entry for given
destination address, use longest address prefix that
matches destination address.
longest prefix matching
Link interface
0
1
2
3
72
Quiz: Longest prefix matching
• On which outgoing interface will a packet
destined to 11011001 be forwarded?
73
Prefix Interface
1* A
11* B
111* C
Default D
www.zeetings.com/salil Answer: B
74
More on IP addresses
• IP addresses are allocated as
blocks and have geographical
significance
• It is possible to determine the
geographical location of an IP
address
http://www.geobytes.com/IpLocator.htm
Source: www.xkcd.com
4-75
IP Addressing: the last word…
Q: How does an ISP get block of addresses?
A: ICANN: Internet Corporation for Assigned
Names and Numbers http://www.icann.org/
IANA is a department within ICANN
http://www.icann.org/
76
Made-up Example in More Detail
• ICANN gives APNIC several /8s
• APNIC gives Telstra one /8, 129/8
– Network Prefix: 10000001
• Telstra gives UNSW a /16, 129.94/16
– Network Prefix: 1000000101011110
• UNSW gives CSE a /24, 129.94.242/24
– Network Prefix: 100000010101111011110010
• CSE gives me a specific address 129.94.242.51
– Address: 10000001010111101111001000110011
77
4.1 Overview of Network layer
– data plane
– control plane
4.2 What’s inside a router
4.3 IP: Internet Protocol
– datagram format
– fragmentation
– IPv4 addressing
– network address
translation
– IPv6
Network Layer, data plane: outline
78
Private Addresses
• Defined in RFC 1918:
– 10.0.0.0/8 (16,777,216 hosts)
-172.16.0.0/12 (1,048,576 hosts)
-192.168.0.0/16 (65536 hosts)
• These addresses cannot be routed
– Anyone can use them
-Typically used for NAT
79
NAT: network address translation
10.0.0.1
10.0.0.2
10.0.0.3
10.0.0.4
138.76.29.7
local network
(e.g., home network)
10.0.0/24
rest of
Internet
datagrams with source or
destination in this network
have 10.0.0/24 address for
source, destination (as usual)
all datagrams leaving local
network have same single
source NAT IP address:
138.76.29.7,different source
port numbers
80
implementation: NAT router must:
– outgoing datagrams: replace (source IP address, port #) of
every outgoing datagram to (NAT IP address, new port #)
. . . remote clients/servers will respond using (NAT IP address, new port
#) as destination addr
– remember (in NAT translation table) every (source IP address,
port #) to (NAT IP address, new port #) translation pair
– incoming datagrams: replace (NAT IP address, new port #) in
dest fields of every incoming datagram with corresponding
(source IP address, port #) stored in NAT table
NAT: network address translation
81
10.0.0.1
10.0.0.2
10.0.0.3
S: 10.0.0.1, 3345
D: 128.119.40.186, 80
1
10.0.0.4
138.76.29.7
1: host 10.0.0.1
sends datagram to
128.119.40.186, 80
NAT translation table
WAN side addr LAN side addr
138.76.29.7, 5001 10.0.0.1, 3345
…… ……
S: 128.119.40.186, 80
D: 10.0.0.1, 3345 4
S: 138.76.29.7, 5001
D: 128.119.40.186, 802
2: NAT router
changes datagram
source addr from
10.0.0.1, 3345 to
138.76.29.7, 5001,
updates table
S: 128.119.40.186, 80
D: 138.76.29.7, 5001 3
3: reply arrives
dest. address:
138.76.29.7, 5001
4: NAT router
changes datagram
dest addr from
138.76.29.7, 5001 to 10.0.0.1, 3345
NAT: network address translation
82
Local network uses just one IP address as far as
outside world is concerned:
– range of addresses not needed from ISP: just one IP
address for all devices
• 16-bit port-number field: ~65,000 simultaneous connections with
one WAN-side address!
– can change addresses of devices in local network
without notifying outside world
– can change ISP without changing addresses of devices
in local network
NAT Advantages
83
ØNAT violates the architectural model of IP
• Every IP address uniquely identifies a single node
on Internet
• routers should only process up to layer 3
ØNAT changes the Internet from connection less
to a kind of connection-oriented network
ØNAT possibility must be taken into account by
app designers, e.g., P2P applications
NAT Disadvantages
84
85
NAT: Practical Issues
• NAT modifies port # and IP address
– Requires recalculation of TCP and IP checksum
• Some applications embed IP address or port numbers in their
message payloads
– DNS, FTP (PORT command), SIP, H.323
– For legacy protocols, NAT must look into these packets and translate the
embedded IP addresses/port numbers
– Duh, What if these fields are encrypted ?? (SSL/TLS, IPSEC, etc.)
– Q: In some cases, why may NAT need to change TCP sequence
number?? (Discussion Question on Website)
• If applications change port numbers periodically, the NAT must be aware of
this
• NAT Traversal Problems
– How to setup a server behind a NAT router?
– How to talk to a Skype user behind a NAT router?
NAT traversal problem
• client wants to connect to
server with address 10.0.0.1
– server address 10.0.0.1 local to
LAN (client can’t use it as
destination addr)
– only one externally visible NATed
address: 138.76.29.7
• Solution1: Inbound-NAT
Statically configure NAT to
forward incoming connection
requests at given port to server
– e.g., (138.76.29.7, port 2500)
always forwarded to 10.0.0.1 port
25000
10.0.0.1
10.0.0.4
NAT
router
138.76.29.7
client
?
86
NAT traversal problem
• solution 2: Universal Plug and Play
(UPnP) Internet Gateway Device
(IGD) Protocol. Allows NATed host
to:
v learn public IP address
(138.76.29.7)
v add/remove port mappings
(with lease times)
i.e., automate static NAT port
map configuration
10.0.0.1
NAT
router
IGD
87
NAT traversal problem
• solution 3: relaying (used in Skype)
– NATed client establishes connection to relay
– external client connects to relay
– relay bridges packets between to connections
138.76.29.7
client
1. connection to
relay initiated
by NATed host
2. connection to
relay initiated
by client
3. relaying
established
NAT
router
10.0.0.1
88
89
NAT: Devil in the details
• Despite the problems, NAT has been widely deployed
• Most protocols can be successfully passed through a NAT,
including VPN
• Modern hardware can easily perform NAT functions at > 100
Mbps
• IPv6 is still not widely deployed commercially, so the need for
NAT is real
• After years of refusing to work on NAT, the IETF has been
developing “NAT control protocols” for hosts
• Lot of practical variations
– Full-cone NAT, Restricted Cone NAT, Port Restricted
Cone NAT, Symmetric NAT, …..
• The devil is in the detail (NOT COVERED IN THE COURSE)
Discussion
• The picture below shows you the IP address of my machine connected to
the uniwide wireless network.
• However when I ask Google it says my IP address is as noted below. Can
you explain the discrepancy?
90
Answer: My address belongs to the 10.0.0./8 address block with is a private
address block which means I am behind a NAT Router. The address reported by
Google is the public WAN side IP address of the NAT router.
Quiz: NAT
• A host with a private IP address 192.168.0.2 opens a TCP
socket on its local port 4567 and connects to a web server at
34.5.6.7. The NAT’s public IP address is 22.33.44.55. Which of
the following mapping entries could the NAT create as a
result?
A. [22.33.44.55, 4567]à[192.168.0.2, 80]
B. [34.5.6.7, 80] à [22.33.44.55, 4567]
C. [192.168.0.2, 80]à[34.5.6.7, 4567]
D. [22.33.44.55, 3967]à[192.168.0.2, 4567]
91
192.168.0.2
NAT
router
22.33.44.55
34.5.6.7ANSWER: D
Quiz: NAT
• A host with a private IP address 192.168.0.2 opens a TCP socket
on its local port 4567 and connects to a web server at 34.5.6.7.
The NAT’s public IP address is 22.33.44.55. Suppose the NAT
created the mapping [22.33.44.55, 3967]à[192.168.0.2, 4567]
as a result. What are the source and destination port numbers
in the SYN-ACK response from the server?
A. 80, 3967
B. 4567, 80
C. 3967, 80
D. 3967, 4567
E. 80, 4567
92
192.168.0.2
NAT
router
22.33.44.55
34.5.6.7
ANSWER: A