IK2218 - Network Layer

Internetwork

Network of networks

Subnets

Link layer networks. Connected by routers via an interface, one per subnet. The network layer protocol(s) understood by every host and router.

Network Layer Purpose

End-to-end delivery of packets independent of the underlying link layer technologies

Network Layer Service Abstractions

Properties of end-to-end delivery. Ex. lossless transmission, bounded delay, guaranteed bandwidth, in-order delivery, connection-oriented vs connectionless.

Lossless Transmission

Packets sent will be recieved as they were sent

Bounded Delay

Packets sent will be recieved bounded by some time constant, ex. 15 ms.

Guaranteed Bandwidth

Ex. if A sends at most 2 MBit/s it will go through flawlessly

In-Order Delivery

Data arrives in the order it was sent.

Connection-oriented Service

Also called Virtual Circuit Switched. Source has to establish a connection to destination and send packets along the connection. Packets carry a VC identifier. Afterwards source has to tear-down connection. All packets follow the same path. Routers/Switches are statefu, will have to remember connection. Resources can easily be allocated to VC

Connectionless Service

Also called datagram service. No connection establishment. Packets are routed individually based on some info, ex. destination host address, this is what the internet uses. Route lookup for each packet, packets may not travel together. Routers are stateless but resource allocation can be challenging

End-to-End Delivery Types

Two types, direct and indirect delivery.

Direct Delivery

Direct delivery is when source and destination are connected to the same physical network, so destination address is in a network connected to a local interface.

Indirect Delivery

From host to router or router to router. Destination address is not within a network connected to a local interface.

Forwarding - Source Routing

Source makes routing decision & packet carries a path (ex. the hops). Downside is topology must be known, hard in huge internetworks and it needs space in the packet.

Forwarding - Next Hop Routing

One version is virtual circuit ID based, ex MPLS. Packet carries VC identifier which can change at each hop. There is a [VCID, nexthop] table so ex. if VCID says 3 send to router R2 and maybe update 3 to 4. Needs connection establishment to populate tables.

Forwarding - Address Based

Used in IPv4 & IPv6. Packet carries a destination address, ex. IPv4 address. Then look in a [addr, nexthop] table to find where to send packet. Can aggregate entries to save space, so instead of entry for each network can have one for combined. This does require an addressing scheme that allows aggregating subnets to a bigger subnet. Another possible thing is use a default entry.

ID/Name

Answers the question “what”. Doesnt change when moving, may not be unique but identifies what it is.

Address / Locator

Answers where? Can change while moving

Route

Answers how, how do we get to an address? Depends on the current location

Multi-homing

Entity with one ID but multiple addresses, ex. in multiple subnets

Mobility

Entity with one ID with changing addresses.

Unicast

One-to-one

Broadcast

One-to-All. Send to all destinations ex. in a subnet

Multicast

One to many. Send to all members of a group

Anycast

One-to-any. Deliver data to at least one member of a group

IPv4 Logical Address

32-bits assigned to an interface. Either binary notation but more commonly dotted decimal. Divide 32 bits into 4 1-byte blocks and separate by dots, ex. all 1’s is 255.255.255.255. They have a hierarchy - prefix is netID then suffix hostID

Classful IPv4 Addressing

Address space partitioned into 5 classes. A-C unicast, D multicast and E reserved. Class determined length of netID and hostID. Not used today. Class A was 0.0.0.0/1, Class B 128.0.0.0/2, Class C 192.0.0.0/3, Class D 224.0.0.0/4, Class E 240.0.0.0/4

Classless IPv4 Addressing (CIDR)

CIDR = Classless Inter Domain Routing. Notation is address followed by prefix length, or netmask. Ex. 0.0.0.0/4, where 4 is length of netID. Unicast addresses start with 0-223, multicast 224-239, 240-255 are experimental / reserved.

Network Mask

In IPv4 they are 32 bit long where prefix length determines how many 1’s there are. Ex /24 => first 24 are 1’s, rest 0. Used to compute net & hostID and broadcast address.

Compute net, host, broadcast ID

& = bit-wise AND, | = bit-wise OR

• Address & Mask = netID

• Address & Inverted Mask = hostID

• Address | Inverse Mask = broadcast addr

IPv6 Logical Address

128-bits assigned to an interface, can be more than 1 per interface. Uses colon hexadecimal notation. Ex. 2000:1000:…. Common ways to shorten is omit leading 0’s or zero compression, one of the series of zeros replaced by ::. Typically first 64-bits is global routing prefix and last 64 is interface ID.

IPv6 Global Unicast Address

Prefix is 001 in binary. Then 64 bits network ID and 64 bits interface ID. Either interface ID uses 48-bit MAC but for security reasons mostly random numbers.

Private / Unique Local Addresses

Not globally unique. Two uses, either on isolated networks or behind a NAT. In IPv4 there are three blocks.

10.0.0.0/8, 172.16/12, 192.168/16. In IPv6 its FC00::/7.

Link-local Addresses

Used for link local unicast when you dont have an address yet. Routers do not forward packets with such a destination. Reserved prefixes in IPv4 is 169.254.0.0/16, in IPv6 FE80::/64. Can either be random with duplication detection or MAC derived (IPv6 only)

Multicast Addresses

Reserved addresses registered by IANA. 224.0.0.0/24. All hosts on subnet = 224.0.0.1, all routers on subnet = 224.0.0.2, OSPF all routers = 224.0.0.5…

Global IP address allocation

IANA manages public IP addresses & ASN:s. IANA allocates blocks to Regional Internet Registreies (RIR), one on each continent. RIR allocates blocks to National / Local Internet Registreies (LIR), which are mostly ISP like telia. Finally LIR assigns blocks to end users.

IPv4 Address Exhaustion

Last IPv4 block assigned by IANA 2011. Solution more efficient use of IPv4 addresses. Example 80% assignment rule - if can’t use 80% of allocated has to return to layer above. Also address block trading and NAT’s with local networks and transition to IPv6

How to allocate blocks

2^(32-n) addresses in a block, where n is /n. 2 are always reserved for NW address and DBA (except /31). Therefore always +2 number of interfaces and think about grouping up similar size blocks for aggregation.

Sequential Allocation

Allocate blocks sequentially. Doesn’t allow for easy expansion at previous allocated blocks.

Spread-Out Allocation

Leave space after to allow expansion.

Longest Prefix Matching

If multiple entries match while forwarding, choose the one with longest prefix matching.

Forwarding Table Fields

• Mask: Netmask applied for entry

• Network Address: Destination network

• Next Hop Address: address for next router interface

• Interface: Outgoing interface [ex. eth0]

• Flags: Status / info. U(p) = Next hop router running, G(ateway): shows indirect delivery, H(ost-specific) = entry specific for a host, /32

• Reference Count: # of users using this route

• Use: # of packets transmitted for this destination. Used for ECMP

Fast Lookup Trie

Use binary trie for fast lookup. Store [nexthop, interface] in each node and travel as far down as possible.

IP Service

IP is a best effort service - Connectionless & unreliable. App/Trans layer handles reliability. Implements only the absolutely necessary functionality.

Network Layer functionality

• Addressing (globally unique addresses, aggregation)

• Forwarding

• Fragmentation

• Multiplexing/Demultiplexing

• Routing Protocols

• Error handling and diagnosis

Header length (IPv4)

4 bit field. Size of IPv4 header including options (20-60 bytes). Granularity is 4 bytes, 5<=HLEN<=15.

Total Length (IPv4)

16 bit field. Total length of the datagram, including header. 1 byte granularity. If datagram fragmented, its the length of the fragment

Payload Length (IPv6)

16 bits. Total length of the payload, excluding header which is fixedsize of 40 bytes. Length of fragment if fragmented with 1 byte granularity. Extension header allows for Jumbo payload up to 4 GB.

Protocol Type Field (IPv4) / Next Header (IPv6)

8 bit. Specifies what type of protocol from which the data was recieved from which is what the destination has to send. Assigned by IANA. Ex 1 = ICMP, 4 = IPv4, 6 = TCP, 7 = UDP, 41 = IPv6

Maximum Transfer Unit (MTU)

The maximum payload size of a link, ex. 1500 bytes in ethernet. Specifies the largest IP datagram size that can be carried, ex. 1500 MTU = 20 bytes IPv4 header, 1480 IPv4 payload.

Fragmentation (IPv4)

Hosts and routers can fragment, unless DF bit set. Fragments are routed independently, destination host reassembles. If fragment is lost - discard the entire datagram. Minimum link MTU is 68 bytes. Fragmentation data is stored in IPv4 header.

Fragmentation (IPv6)

Only hosts fragment. Router discards packet if they can’t send and notifies the sender (also includes MTU of part that failed). Fragments routed independently and destination host reassembles and discard all if a fragment is lost. Minimum MTU is 1280 bytes and information stored in Fragmentation extension header.

Fragmentation Field (IPv4)

Contains identification, Flags, Fragmentation Offset

• Identification: 16 bits. Datagram uniquely identified by src and dst IP, ID and protocol. ID is copied to all frags of a datagram.

• Flags: 3 bits for 3 flags. 1 is Reserved Field (RF) - for future use. 1 Dont Fragment (DF) - datagram should not be fragmented. Send error to sender if can’t forward. 1 More Fragments (MF) - 1 for all frags except last

• Fragmentation Offset: 13 bits. Shows relative position of a fragment with respect to whole datagram. 8-byte granularity. So if value is 3, offset is 24 bytes.

Infinite Loop Avoidance

Limit lifetime of every datagram. Maintain down counter in packet header, initially 64 by default. Router drops packet if counter <= 1. Decrements the counter and forwards packet otherwise. Notifies sender if package expires, called Time To Live (TTL) in IPv4, every router should decrement the TTL by the number of seconds holding the datagram. Called Hop Limit in IPv6, both are 8 bits.

Error Checking (IPv4)

Detect bit errors in IPv4 header only. Calculate on each hop using the Internet Checksum Algorithm

Internet Checksum Algorithm

Take IP header, convert to sequence of 16-bit words and add together using one’s complement. The one’s complement of the result is stored in the checksum field. Drop the packet if the sum is not 0. IPv6 has no checksum.

Quality of Service

Network is used by apps with different requirements. Therefore, create preferential tratment for more sensitive data. Specified in Service type field (TOS byte)

TOS Byte (Old version)

Specify QOS on a per-packet basis. Bits 0-2 are used for Precedence which defines priority, ex. when packets must be dropped. Bits 3-6 are TOS bits. Bit 3 = Normal / Low delay, Bit 4 = Normal / High Throughput, Bit 5 = Normal / High Reliability, Bit 6 = Normal / Minimize cost.

DSField

Bits 0-5 are Differentiated Servides CodePoint(DSCP). A way to define treatment of packets. Ex. default forwarding is all 0’s, normal best effort service.

Explicit Congestion Notification (ECN)+

2 bits in Service field. Allows to signal congestion. Four values, 00 = packet does not support ECN, 01 or 10 = packet supports ECN. If experience congestion, then set to 11 and reciever can send to sender that there is congestion and sender can slow the rate of sending.

IPv4 Header

VER 4 bits, HLEN 4 bits, Service 8 bits, Total Length 16 bits, ID 16 bits, flags 3 bits, frag offset 13 bits, TTL 8 bits, protocol 8 bits, header checksum 16 bits, Source IP, Destination IP, Options.

Network Interface Card (NIC)

Has MAC address, IP address and configured name.

Finding MAC address

Either static hardcoded mapping between MAC & IP, or dyanmic with either Address Resolution Protocol (ARP) or Neighbor Discovery for IPv6.

ARP Operation

1. Send ARP request on broadcast to all stations “who has x.x.x.x”, tell “y.y.y.y”

2. Destination recognizes their IP and sends unicast ARP reply to sender “I have y.y.y.y and my mac is …”

If there is ARP cache can check that before the request, also check forwarding table before checking the ARP cache.

ARP Packet

HW type, Protocol type, Hardware length, Protocol Length, Operation (req, reply), Sender MAC, sender IP, dst MAC, dest IP.

ARP Cache

Used to optimize ARP. Save resolved addresess in cache, should time out after some time.

ARP Snooping

Learn mappings from broadcast ARP traffic. Recievers can update their cache with sender mapping before processing the request.

ARP Timeout

One use is when there is no reply to ARP request. Retry a number number of times. Then there are also cache timeouts to remove entries after some time, ex. 10-15 minutes.

ARP Proxy

Respond to ARP requests on someone elses behalf. Allows sub-networks to be hidden.

Gratuitos ARP

Hosts can send an ARP request of their own address. This informs others of its mapping so they can update their cache without ARP request/reply. Used for failsafe servers, if primary goes down backup can send gratuitous ARP with primary IP & backup MAC. Abusing this is ARP Poisoning

IP Diagnosis & Control

Purpose is control, testing and debugging of network functionality. Implemented as variable size options, extensions after fixed header. In IPv4, max 40 bytes. They start immediately after header. All IP implementations must recognize these, unknown options ignored.

IPv4 Options Encoding

Two types, single and multi-byte. First the code byte has 1 bit if options should be copied to fragments. Then 2 bits for what class of option it is and then 5 bits for actual option number. Then the length byte is total length of this option & data field option specific.

Source Route - Options

Strict Source Routing (SSRR). This option specifies exact path datagram will go through via IP addresses. Loose Source Routing (LSRR), this path goes through all addresses but there can be additional ones not listed. Sender prefills routers ot be visited, routers put their address in option. Used to troubleshoot, map network, performance and hacking.

IPv6 Extension Headers

Chain of extension headers after IPv6 header. Order specified, occurs at most once. Extension header length is multiple of 8 octets.

IPv6 Hop-by-hop options header

Information to be passed to all routers on the path, must immediately follow IPv6 header. Can carry a number of options of different times. Ex. Jumbo Payload or Router alert option - datagram needs special attention from router.

Internet Control Message Protocol (ICMP)

Signaling protocol for IP to report problems back to sender and used for control & management. Considered a part of IP, but uses IP for delivery.

ICMP Fields

Type 8 bits - what type of message, ex. dst unreachable

Code 8 bits - Reason why, ex. host unreachable

Checksum 16 bits. Covers header and data.

ICMP Message Types

Error Reporting & Query/Informational messages

ICMP Error Reporting Messages

Reports errors but doesnt correct them. Error message is always send back to original sender based on source IP. Error message carries part of datagram header/data to allow sender to know which datagram generated error. Not sent under certain conditions, ex. error message or error message, broadcast / multicast message, IP fragment other than the first, source not specified.

ICMP Time Exceeded

Sent if TTL = 0, send code 0 or if all fragments dont arrive within a time limit at destination started when the first one arrived, code 1.

Traceroute

Tool using ICMP. Traces path to destination by exploring each IP hop on the way. Set small TTL fields and recieve time exceeded incrementally. When final host reached, use unlikely UDP port and get ICMP port unreachable back.

ICMPv6 Packet Too Big

Router recieves datagram larger than MTU. Discards datagram and sends message to source including MTU. Can be used to find a paths MTU, like ICMPv4 Destination Unreachable (Fragmentation Needed)

ICMP Error Reporting Header

Carries part of original IP datagram. For ICMPv4, its the original header + options and 8 bytes of payload. ICMPv6 its header + payload such that the size is <= min IPv6 MTU.

ICMP Echo Request & Reply

Purpose is checking host reachability. Send a request and then destination answers with reply to show its reachable

Ping

Tool to test host reachability. Does this by sending ICMP echo request to node, then server replies with ICMP echo reply. With IPv4 recourd route option, the route of ping can be traced (up to IHL limit).

IPv6 Neighbor Discovery Protocol

Purpose is to assist forwarding of datagrams. Does this by doing address resolutions (ARP in IPv4), Forwarding table updates (Redirect in ICMPv4) and router address. Like ARP with different names. Query = Neighbor Solicitation,Reply = Neighbor Advertisement, Redirect = Forward table update necessary and there is also Router solicitation / advertisement for SLAAC.