ECE 526 – Network Processing Systems Design Network Address Translator II

Ning WengECE 5262 Overview Review ─ Network Address Translation Basic ─ Conceptually Implementation Today ─ IXP Implementation ─ IXP Optimization Header caching Alignment ARP Checksum

Ning WengECE 5263 NAT Basic What is NAT: ─ System allowing multiple computers share single global IP address ─ Changing packet header: address, port number, IDs and etc ─ Located between a set of computers at a site and rest of the Internet Mechanism: header modification ─ Source/destination IP address, source/destination port, checksum

Ning WengECE 5264 Conceptual Implementation Simplifying assumptions ─ No fragmentation (why) ─ No packet with IP option (why) ─ Flows initiated from local computer only (why) NAT table ─ Creation: automatic ─ Updating policy: LRU and priority heuristic ─ Optimization Bucket hashing Independent tables

Ning WengECE 5265 NAT Complexity Fragmentation causes header of encapsulated protocol are only present in first fragment ─ E.g., no port number available for later fragments IP datagram with options Memory requirement for NAT table

Ning WengECE 5266 NAT Table Management Creation ─ Automatically ─ Add one entry when it is first packet for new flow Table entry lifetime ─ Based on packet header E.g., Fin or reset for TCP ─ Aging Counter down timer –Reset to maximum value once used –Decrease one every cycle Table entry update ─ Least recent used ─ Priority heuristic TCP > UDP > ARP >others

Ning WengECE 5267 NAT IXP Implementation

Ning WengECE 5268 NAT Overall Structure What are implementation ideas to improve throughput?

Ning WengECE 5269 NAT Microblock Organization

Ning WengECE IXP Optimization Header caching Byte alignment ARP lookup: Checksum computation: incremental modification

Ning WengECE Header caching NAT need access multiple header fields External DRAM access is very slow Read packet header from buffer in DRAM to local memory Modify headers using local memory copy Write back from local memory to DRAM after processing

Ning WengECE Byte alignment Local memory is organized 4-byte words Ethernet frame header is 14 byte Simply copy: IP source/destination spanned into two entries Use byte_align_be or byte_align_le to read and write local memory

Ning WengECE ARP Lookup ( IP address, MAC address) 16 bytes each entry: IP address in one entry of LM; easily convert index to address by shifting Checksum computation: incremental modification

Ning WengECE Reminder Read Chapter 10