ipop part a (core)

Longest prefix for a subnet with H hosts and R routers

(IPv4) Count the addresses you need: hosts + routers + 2 (network and broadcast). Round up to a power of 2, written 2^k. The prefix is 32 − k. Example: 250 hosts + 3 routers + 2 = 255, round up to 256 = 2^8, so /24.

Split an address block into subnets

(IPv4) Give each subnet the smallest power of 2 that fits its hosts + 2. Hand out the blocks in the order the question says, starting at the lowest address. Each block must start at a multiple of its own size. Example: block 108.93.144.0/21, A 400 hosts gets 108.93.144.0/23, B 400 hosts gets 108.93.146.0/23, C 700 hosts gets 108.93.148.0/22.

Find the network and broadcast address

(IPv4) Find the block size in the number where the mask cuts. Network = the biggest multiple of the block size that is not above your number. Broadcast = network + block size − 1, and every number after it becomes 255. Example: 76.188.96.0/21 has block size 8 in the third number, so the broadcast is 76.188.103.255.

Mask and block size: /22 to /30

(IPv4) /22 = 255.255.252.0 (4 in the 3rd number). /23 = 255.255.254.0 (2 in the 3rd number). /24 = 256. /25 = 128. /26 = 64. /27 = 32. /28 = 16. /29 = 8. /30 = 4.

Which forwarding table row is used?

(Forwarding) Check every row the address fits in. The row with the longest prefix wins. If no row fits, the default route 0.0.0.0/0 is used. Watch out for small blocks: 134.84.0.10 does not fit in 134.84.0.0/29, which only covers .0 to .7.

Merge routes (aggregation)

(Forwarding) Two networks of the same length n can be merged into one /(n − 1) if their first n − 1 bits are equal. Never merge into a block that covers addresses you do not have. Example: 10.20.0.0 to 10.20.3.0 (/24) become 10.20.0.0/22.

Flag G in a forwarding table

(Forwarding) Gateway. The destination is not directly connected, so the packet is handed to the router in the next hop column. No G means the network is directly connected.

Proper use of an ARP request

(ARP) Sent as a broadcast: "Who has IP X?" X must be in the sender's own subnet.

Proper use of an ARP reply

(ARP) Sent as a unicast by the owner of the address, straight back to the host that asked: "IP X has MAC x."

What ends up in a host's ARP cache

(ARP) Only addresses in its own subnet: the hosts it reached directly, and its router for everything outside the subnet. A host in another subnet is never in the cache.

ARP snooping

(ARP) A host or router that hears an ARP request also saves the asker's IP and MAC address, even though the request was not for it.

What changes when a packet passes a router?

(Router) The MAC addresses. The router writes a new Ethernet header for the next link. The IP addresses stay the same.

ICMP types 8 and 0

(ICMP) Type 8 is Echo Request and type 0 is Echo Reply. Ping uses these two.

ICMP type 11

(ICMP) Time exceeded. A router sends it back to the sender when the TTL reaches 0. Traceroute uses this.

ICMP type 3

(ICMP) Destination unreachable. Sent back when there is no route to the destination, or when the packet is too big and DF = 1 (fragmentation needed).

Max UDP data without fragmentation

(UDP) MTU − 20 (IP header) − 8 (UDP header). Example: MTU 600 gives 572 bytes.

Size of the last IP fragment

(Fragmentation) 1. IP payload = data + 8 (UDP header). 2. Max per fragment = MTU − 20, rounded down to a multiple of 8. 3. Take away as many full fragments as fit; the rest is the last fragment. Example: MTU 800 and 3100 bytes over UDP: 3108 in total, 776 per fragment, 4 × 776 = 3104, so the last one carries 4 bytes.

Fragment rules to remember

(Fragmentation) Every fragment except the last carries a multiple of 8 bytes. Each fragment has its own 20 byte IP header. Only the destination host puts the fragments back together.

RIP

(RIP) A routing protocol used inside one network. Every 30 s, each router tells its neighbours how far it is to each network. The distance is counted in hops, meaning the number of routers on the way.

RIP infinity

(RIP) 16 means "this network cannot be reached", so a route can be at most 15 hops long. When a route stops working, the router sets it to 16 and tells its neighbours straight away, without waiting the usual 30 seconds. This is called a triggered update.

RIP update rule

(RIP) New cost = link cost to the neighbour + the neighbour's own cost. The router keeps the new route if it is cheaper. With split horizon, a router never sends a route back to the neighbour it learned it from.

How RIP and OSPF react to a link failure

(Routing)
RIP sets the route to 16 and sends a triggered update to its neighbours.

OSPF floods link state advertisements (LSAs), and every router recomputes its paths with Dijkstra.

RIP is the small village where news travels by gossip, house by house. OSPF is the merchant city where everyone publishes their own price list (LSA), everyone combines them into one shared map, and each person plans their own best route on it (Dijkstra).

UDP: can one port talk to many processes?

(UDP) Yes. A process can send to and receive from many other processes through a single UDP port.

UDP pseudoheader

(UDP) The IP addresses, the protocol number and the UDP length, used only to compute the checksum. It is never sent. It lets the receiver notice a wrong destination IP or a wrong protocol.

Can the UDP checksum detect duplicated messages?

(UDP) No. A duplicate is an exact copy, so its checksum is correct. UDP does not detect duplicates.

Exponential backoff

(TCP) If no ACK comes within the RTO, TCP resends the segment and doubles the RTO. Example: RTO 1.2 s, then 2.4 s after the first resend, then 4.8 s after the second.

How to count retransmissions during an outage

(TCP)

Exponential backoff: Add up the doubling waits until you pass the time the link was down. Example: RTO 2 s, link down until 90 s: resends at 2, 6, 14, 30 and 62 s are lost, and the one at 126 s gets through. That is 6 retransmissions.

TCP Reno: 3 duplicate ACKs

(TCP) TCP resends the missing segment at once (fast retransmit). ssthresh = CWND ÷ 2 and CWND = ssthresh + 3 MSS. The RTO is not doubled and TCP does not go back to slow start. Example: CWND 7000, MSS 700 gives ssthresh 3500 and CWND 5600.

What happens at a TCP timeout?

(TCP) A timeout means no ACK arrived before the RTO ran out, so nothing seems to get through.
Two things happen:

Retransmission: the segment is resent and the RTO doubles.

Congestion control: ssthresh = CWND ÷ 2, CWND = 1 MSS, and slow start begins again.

Slow start and congestion avoidance

(TCP) Slow start: CWND doubles every RTT until it reaches ssthresh. Congestion avoidance: after that, CWND grows by only 1 MSS per RTT.

Nagle's algorithm

(TCP) Stops a slow application from sending many tiny segments. Only one small segment may be unacknowledged at a time. Meanwhile data is collected and sent when the ACK arrives or when a full MSS is ready.

Count segments with Nagle

(TCP) The first small piece is sent at once. After that, a segment is sent each time a full MSS has built up. A small leftover is sent once the earlier small segment is ACKed. Example: 2000 bytes in pieces of 250, MSS 500: 250, 500, 500, 500, 250 = 5 segments.

Persistence timer

(TCP) Used by the sender when the receiver has announced a window of 0. The sender sends window probes now and then, so the connection does not hang forever if the window update is lost.

Window limits and utilisation

(Reliable transfer) With m bits for sequence numbers: Go Back N window at most 2^m − 1, Selective Repeat at most 2^(m−1). Stop and Wait and Go Back N need no buffer at the receiver. A bigger window gives better utilisation.

True or false: a server needs a permanent IP address, so it cannot get it through DHCP

(Client/server) False.

True or false: the server needs the client's IP address and port number to answer

(Client/server) True.

True or false: a server uses different port numbers for different clients

(Client/server) False. It uses the same well known port for every client, with a new socket for each connection.

True or false: the client/server model only applies to TCP, not UDP

(Client/server) False. It applies to both.

True or false: it is always the client that starts the communication

(Client/server) True.

Sockets in use with n TCP clients

(Client/server) 2n + 1: one per client, one per connection on the server, plus the server's listening socket. Example: 4 clients gives 9 sockets.

Ports in use with n TCP clients

(Client/server) n + 1: one per client, plus the server's single port.

First line of an HTTP request for http://host/a/b?x=1

(HTTP) GET /a/b?x=1 HTTP/1.1. The host name is not part of this line.

True or false: HTTP usually uses UDP

(HTTP) False. HTTP uses TCP.

True or false: HTTP is a request/response protocol

(HTTP) True.

True or false: an HTTP proxy acts as client and server at the same time

(HTTP) True. It is a server to the browser and a client to the real web server.

True or false: an HTTP proxy can reduce the load on the organisation's access link

(HTTP) True.

True or false: a web cache can slow things down, for example on a cache miss

(HTTP) True. On a miss, the request makes an extra stop at the cache before going to the real server.

True or false: an HTTP proxy helps clients process complex content / has a faster link / is not needed if hosts are fast

(HTTP) All three are false. A proxy only stores and reuses web objects.

True or false: a cookie is created by the server and stored by the client

(HTTP) True.

True or false: cookies help web servers keep information about users

(HTTP) True.

True or false: a client can have more than one cookie for the same server

(HTTP) True.

True or false: a cookie is a small program / a set of web objects / only given if the client asks

(HTTP) All three are false. A cookie is just a small ID that the server sends without being asked.

Who is the real recipient in an SMTP transcript?

(Email) The address in RCPT TO. The To: line inside the message is just text and can be different.

How does Alice's mail program (MUA) know where to send her email?

(Email) It is set up with the name of her outgoing mail server. That server later finds Bob's server with a DNS MX lookup.

Order of mail protocols from Alice sending to Bob reading

(Email) SMTP, SMTP, IMAP. Alice's program to her server, her server to Bob's server, then Bob reads it with IMAP.

Which questions can DNS answer? (valid DNS queries)

(DNS)
Ask yourself: is there a record type for it? If yes, DNS can answer.

Yes: the IP address of a name (A, AAAA), the incoming mail server (MX), the authoritative name server (NS), the admin’s contact info (SOA), and the name for an IPv4 or IPv6 address (PTR).
No: the outgoing mail server and the legal owner of the domain. There’s no record type for those.

TLD name server

(DNS) An authoritative name server for a top level domain, such as se or com.

Authoritative name server

(DNS) Answers questions about the names in its own zone. It does not do recursion for clients.

Reading a zone file

(DNS) $ORIGIN is the domain, as a full name ending with a dot. A name without a dot at the end gets $ORIGIN added. A line starting with blank space belongs to the name above it. NS lines name the name servers, and their A or AAAA lines give the addresses. CNAME means the name is an alias for another name.

What does NAT change in an outgoing packet?

(NAT) The source IP becomes your public IP address, and the source port gets a new number.

How to make a server behind NAT reachable

(NAT) Set up static port forwarding in your NAT router. No proxy at the provider is needed.

What NAT lets you do

(NAT) One public IP address is enough for many computers. You can renumber inside without telling the operator. You can change operator without renumbering inside.

Can a packet filter block SSH or SMTP?

(Firewall) Yes, by their port numbers: 22 for SSH and 25 for SMTP. Saying it cannot is the false statement.

What can a packet filter look at?

(Firewall) The IP header and the transport header (ports, TCP flags), which sits inside the IP payload. It cannot see user names.

What a stateful packet filter can do

(Firewall) It can block or allow by address and port, for example all hosts at KTH. It remembers connections, so it can block traffic that is not part of an open connection and let FTP data connections back in. It cannot filter by user name, because packets do not contain user names.

Default discard and default forward

(Firewall) Default discard: everything is blocked unless a rule allows it, so each new service needs a rule. Default forward: everything is allowed unless a rule blocks it, so new services need no changes.

What DHCP gives a host

(DHCP) An IP address for a limited time (a lease), the subnet mask, the default router and the DNS server. It does not pick a WiFi access point and does not hand out MAC addresses.

How DHCP messages are sent

(DHCP) Over UDP. The client has no address yet, so it uses 0.0.0.0 as its source address and sends to the broadcast address. The server can have any address on the subnet.

What does SLAAC give the host?

(SLAAC) The network prefixes and the router address, from Router Advertisements. It does not give a DNS server; that still needs DHCP.

IPv6 link local address

(SLAAC) An address that only works on the host's own link, not across other subnets. It can be made from the MAC address or from a random number.

OpenFlow protocol runs between

(OpenFlow) The SDN controller and the switches. It does not carry user traffic between switches.

OpenFlow forwarding compared with normal IP forwarding

(OpenFlow) Normal IP forwarding looks only at the destination IP. OpenFlow can look at many header fields, so its lookup is more complex. That lets one switch act as a router, a firewall or a NAT.

OpenFlow match

(OpenFlow) What the switch looks for in an arriving packet. For example: the port it came in on, the MAC addresses, the IP addresses and the TCP ports.

OpenFlow action

(OpenFlow) What the switch does with a packet that matches. It can send it out on a port, drop it, change a field, or send it to the controller.