Introduction to Network Diagnostic Tools and Routing Protocols

Administrative Announcements and Project Guidelines

Project one includes specific word count limits for each question to encourage concise communication and the prioritization of significant points. The focus of the assessment is on quality rather than quantity. By editing a long response to select the most important information, students engage in synthesis and learning. These limits also ensure fairness to students who follow the rules and assist tutors, who are also students, in completing their marking tasks on time. While strict enforcement details were not finalized, tutors may stop reading beyond the stated limit.

There is a scheduled change in course delivery. A guest lecturer, Chris, will cover weeks five and six. The original instructor will return for weeks eleven and twelve. This adjustment represents a simple swap of the planned teaching schedule.

Network Diagnostic Tools: Ping

Ping is a primary diagnostic tool used to determine if a connection exists from one host to another. It utilizes the Internet Control Message Protocol (ICMP). The host initiating the command sends an ICMP echo request to a destination, which then responds with an ICMP echo reply. This exchange facilitates the measurement of delay.

When running a ping command, the user provides the IP address or host name. The output typically displays the number of bytes sent (defaulting to $64\,bytes$), the sequence number, the Time to Live ($TTL$) value (e.g., $238$), and the Round Trip Time ($RTT$). The $RTT$ represents the total duration from the moment the echo request is sent until the echo reply is received. After a series of requests, ping provides a tabulated summary including the number of packets transmitted and received, the percentage of packet loss, and statistics for round trip times including minimum, average, maximum, and standard deviation.

Network Diagnostic Tools: TraceRoute

TraceRoute is used to identify the specific path from a source computer to a destination. It operates by sending ICMP requests with an incrementing $TTL$ value, starting at $TTL = 1$. Because a $TTL$ of $1$ only allows the packet to reach the first hop, the router at that hop will return an ICMP message indicating that the $TTL$ has been exceeded, allowing the source to record the identity of that router and the transit time. TraceRoute sends three packets for each $TTL$ value before incrementing to the next ($TTL = 2$, then $TTL = 3$, etc.) until the destination is reached.

In a TraceRoute output, three asterisks ($***$) on a line indicate that a router administrator has configured the device for security to not return ICMP messages. Significant jumps in delay measurements can indicate specific network conditions. For example, a jump from $18\,ms$ or $19\,ms$ to $280\,ms$ between hops suggests the link may be traversing an intercontinental connection, such as a link from Europe to Australia managed by an ISP with a global presence like telstraglobal.net.

Internet Protocol (IP) Hierarchy and Configuration

For any node (host, server, or router) to participate in the Internet, it must have a unique IP address. This can be manually configured or obtained via the Dynamic Host Configuration Protocol (DHCP). DHCP provides a host with its IP configuration, which consists of the IP address, the default gateway (the first hop router), and the DNS server address. These three elements are essential for Internet communication.

IPv4 addresses are $32\,bits$ long and are commonly expressed in dotted quad notation (e.g., $192.168.1.75$), which can be converted into binary segments. A subnet mask or net mask is used to convey prefix information. For example, a net mask of $255.255.255.0$ corresponds to a binary string where the first $24\,bits$ are ones. In Classless Inter-Domain Routing (CIDR) notation, this is represented as $/24$. Performing a bitwise AND operation between the IP address and the net mask yields the network address.

Packet Forwarding and Path Traversal

The delivery of a packet (e.g., from host $H5$ to host $H8$) involves a multi-step encapsulation and lookup process. The IP layer at the source host encapsulates a TCP segment into a datagram and sets the destination IP (e.g., $4.1.1.2$). The host consults its forwarding table; if the destination is not local, the IP layer routes the datagram to the default gateway router (e.g., $R1$ at IP address $1.2.2.1$).

To construct the physical layer frame (such as $802.11$), the source needs the MAC address of the next hop. It uses the Address Resolution Protocol (ARP) to resolve the IP address $1.2.2.1$ to a physical MAC address. Once the router $R1$ receives the frame, it strips the Layer 2 header and examines the IP header. The router uses Longest Prefix Matching to search its forwarding table for the best route to the destination. This hop-by-hop process repeats until the packet reaches the final destination.

Longest Prefix Matching

Longest Prefix Matching ensures that a packet is sent to the most specific matching route in a forwarding table. A match occurs only if all bits of the prefix in the table entry are identical to the leading bits of the destination IP address. If multiple matches exist, the router selects the entry with the longest prefix (the highest CIDR value). For instance, if a destination matches one entry with a $/24$ prefix and another with a $/8$ prefix, the $/24$ prefix is selected because it is more specific.

Routing vs. Forwarding and Local Planes

Forwarding is the data plane process of receiving a packet and using a local lookup table to determine which interface the packet should be sent through. At Layer 2 (switches), this is based on exact MAC address matches; at Layer 3 (routers), it uses longest prefix matching. Forwarding is a local, node-specific action.

Routing is the control plane process responsible for building and maintaining the forwarding tables. It involves distributed algorithms that communicate information across the network to compute the optimal paths between sources and destinations. While forwarding is the act of making a decision at every turn (e.g., turning left or right), routing is the high-level planning of the entire path (e.g., choosing the route from Kelburn to Pipitea).

Distance Vector Routing and the RIP Protocol

The Distance Vector algorithm, exemplified by the Routing Information Protocol (RIP), relies on nodes maintaining a data structure called a distance vector. This vector contains the known distance (cost, hops, or delay) from that node to various destinations. Nodes periodically exchange their distance vectors with their immediate neighbors. Upon receiving an advertisement, a node updates its own table if it discovers a route with a lower cost.

In a network modeled as a graph with nodes $A$ through $F$, each link is assigned a cost. Initially, a node like $A$ only knows the costs to its direct neighbors (e.g., cost $3$ to $B$, cost $1$ to $E$, and cost $6$ to $F$). When neighbor $B$ advertises its distance to node $C$ (cost $4$), node $A$ calculates that it can reach $C$ through $B$ with a total cost of $3 + 4 = 7$. If neighbor $E$ later advertises a path to $B$ with a cost of $1$, node $A$ updates its path to $B$ from the direct link (cost $3$) to a path through $E$ (cost $1 + 1 = 2$) because it is cheaper. The network eventually converges to the most efficient topology through these iterations.

Periodic and Triggered Updates

Distance vector protocols use two types of updates to maintain accuracy. Periodic updates occur at regular intervals even if the topology has not changed, serving as a "heartbeat" to inform neighbors that a router is still active. Triggered updates occur immediately when a node detects a link failure. Rapid propagation of link failure information is critical to prevent data from piling up at a broken link and being dropped, ensuring the network can quickly reroute traffic.

Questions & Discussion

Question regarding the jump in TraceRoute delay: What could it mean when the delay reading suddenly jumps from approximately $18-19\,ms$ to $280\,ms$ between hops $5$ and $9$?

Answer: This typically indicates that the path has traversed an intercontinental link. If a trace starts in Europe and enters a global ISP, it might cross several continents to reach a destination in Australia. The presence of a hop like telstraglobal.net suggests the packet has physically moved across a vast distance, causing the significant jump in round trip time.