2017 session 1 TELE3118: Network Technologies Week 5: Network Layer Data Plane: Forwarding, Features Some slides have been adapted from: Computer Networking: A Top Down Approach, 7th (global) edition. Jim Kurose, Keith Ross. Pearson, April 2016. All material copyright 1996-2016. J.F Kurose and K.W. Ross, All Rights Reserved. Computer Networks, 5th edition. Andrew S. Tanenbaum, David J. Wetherall, Pearson, 2010. Network Layer

IP Forwarding IP datagram: Case I: hosts in same LAN (A B) misc fields source IP addr dest data A 223.1.1.1 Case I: hosts in same LAN (A B) Case II: hosts in different LANs (A  E) A note on terminology: Switch (bridge) vs. Router Hardware vs. software? layer-2 vs. layer-3? 223.1.2.1 223.1.1.2 223.1.1.4 223.1.2.9 B 223.1.2.2 E 223.1.1.3 223.1.3.27 223.1.3.1 223.1.3.2 Network Layer

Case I: hosts in same LAN misc fields 223.1.1.1 223.1.1.3 data routing table at A Dest Mask Next-hop 223.1.1.0 24 L: 223.1.1.1 0.0.0.0 223.1.1.4 Starting at A, dest. B: look up dest-IP in routing table dest is in LAN on interface 223.1.1.1 send datagram directly to B in Ethernet frame how to determine B’s Ethernet MAC address? 223.1.1.1 223.1.1.2 223.1.1.3 223.1.1.4 223.1.2.9 223.1.2.2 223.1.2.1 223.1.3.2 223.1.3.1 223.1.3.27 A B E B’s MAC addr A’s MAC A’s IP B’s IP IP payload datagram frame frame source, dest address datagram source, Network Layer

ARP: address resolution protocol Question: how to determine interface’s MAC address, knowing its IP address? ARP table: each IP node (host, router) on LAN has table IP/MAC address mappings for some LAN nodes: < IP address; MAC address; TTL> TTL (Time To Live): time after which address mapping will be forgotten (typically 20 min) 137.196.7.78 1A-2F-BB-76-09-AD 137.196.7.23 137.196.7.14 LAN 71-65-F7-2B-08-53 58-23-D7-FA-20-B0 0C-C4-11-6F-E3-98 137.196.7.88 Link Layer and LANs

ARP protocol: same LAN A wants to send datagram to B B’s MAC address not in A’s ARP table. A broadcasts ARP query packet, containing B's IP address destination MAC address = FF-FF-FF-FF-FF-FF all nodes on LAN receive ARP query B receives ARP packet, replies to A with its (B's) MAC address frame sent to A’s MAC address (unicast) A caches (saves) IP-to-MAC address pair in its ARP table until information becomes old (times out) soft state: information that times out (goes away) unless refreshed ARP is “plug-and-play”: nodes create their ARP tables without intervention from net administrator Link Layer and LANs

Case II: hosts in different LANs routing table at A misc fields 223.1.1.1 223.1.2.2 data Dest Mask Next-hop 223.1.1.0 24 L: 223.1.1.1 0.0.0.0 223.1.1.4 Starting at A, dest. E: look up network address of E in routing table E on different network A, E not directly attached routing table: next hop router to E is 223.1.1.4 link layer sends datagram to router 223.1.1.4 in Ethernet frame (ARP) datagram arrives at 223.1.1.4 continued….. 223.1.1.1 223.1.1.2 223.1.1.3 223.1.1.4 223.1.2.9 223.1.2.2 223.1.2.1 223.1.3.2 223.1.3.1 223.1.3.27 A B E Network Layer

Case II (contd.) routing table in router misc fields 223.1.1.1 223.1.2.2 data Dest Mask Next-hop 223.1.1.0 24 L: 223.1.1.4 223.1.2.0 L: 223.1.2.9 223.1.3.0 L: 223.1.3.27 Arriving at 223.1.4, destined for 223.1.2.2 look up network address of E in router’s routing table E on same network as router’s interface 223.1.2.9 router, E directly attached link layer sends datagram to 223.1.2.2 in Ethernet frame via interface 223.1.2.9 (ARP) datagram arrives at 223.1.2.2!!! (hooray!) 223.1.1.1 223.1.1.2 223.1.1.3 223.1.1.4 223.1.2.9 223.1.2.2 223.1.2.1 223.1.3.2 223.1.3.1 223.1.3.27 A B E Network Layer

Routing to another LAN walkthrough: send datagram from A to B via R focus on addressing – at IP (datagram) and MAC layer (frame) assume A knows B’s IP address assume A knows IP address of first hop router, R (how?) assume A knows R’s MAC address (how?) R 1A-23-F9-CD-06-9B 222.222.222.220 111.111.111.110 E6-E9-00-17-BB-4B CC-49-DE-D0-AB-7D 111.111.111.112 111.111.111.111 74-29-9C-E8-FF-55 A 222.222.222.222 49-BD-D2-C7-56-2A 222.222.222.221 88-B2-2F-54-1A-0F B Link Layer and LANs

Routing to another LAN B A R A creates IP datagram with IP source A, destination B A creates link-layer frame with R's MAC address as destination address, frame contains A-to-B IP datagram MAC src: 74-29-9C-E8-FF-55 MAC dest: E6-E9-00-17-BB-4B IP Eth Phy IP src: 111.111.111.111 IP dest: 222.222.222.222 R 1A-23-F9-CD-06-9B 222.222.222.220 111.111.111.110 E6-E9-00-17-BB-4B CC-49-DE-D0-AB-7D 111.111.111.112 111.111.111.111 74-29-9C-E8-FF-55 A 222.222.222.222 49-BD-D2-C7-56-2A 222.222.222.221 88-B2-2F-54-1A-0F B Link Layer and LANs

Routing to another LAN B A R frame sent from A to R frame received at R, datagram removed, passed up to IP MAC src: 74-29-9C-E8-FF-55 MAC dest: E6-E9-00-17-BB-4B IP src: 111.111.111.111 IP dest: 222.222.222.222 IP src: 111.111.111.111 IP dest: 222.222.222.222 IP Eth Phy IP Eth Phy R 1A-23-F9-CD-06-9B 222.222.222.220 111.111.111.110 E6-E9-00-17-BB-4B CC-49-DE-D0-AB-7D 111.111.111.112 111.111.111.111 74-29-9C-E8-FF-55 A 222.222.222.222 49-BD-D2-C7-56-2A 222.222.222.221 88-B2-2F-54-1A-0F B Link Layer and LANs

Routing to another LAN B A R R forwards datagram with IP source A, destination B R creates link-layer frame with B's MAC address as destination address, frame contains A-to-B IP datagram MAC src: 1A-23-F9-CD-06-9B MAC dest: 49-BD-D2-C7-56-2A IP Eth Phy IP src: 111.111.111.111 IP dest: 222.222.222.222 IP Eth Phy R 1A-23-F9-CD-06-9B 222.222.222.220 111.111.111.110 E6-E9-00-17-BB-4B CC-49-DE-D0-AB-7D 111.111.111.112 111.111.111.111 74-29-9C-E8-FF-55 A 222.222.222.222 49-BD-D2-C7-56-2A 222.222.222.221 88-B2-2F-54-1A-0F B Link Layer and LANs

Routing to another LAN B A R R forwards datagram with IP source A, destination B R creates link-layer frame with B's MAC address as destination address, frame contains A-to-B IP datagram IP src: 111.111.111.111 IP dest: 222.222.222.222 MAC src: 1A-23-F9-CD-06-9B MAC dest: 49-BD-D2-C7-56-2A IP Eth Phy IP Eth Phy R 1A-23-F9-CD-06-9B 222.222.222.220 111.111.111.110 E6-E9-00-17-BB-4B CC-49-DE-D0-AB-7D 111.111.111.112 111.111.111.111 74-29-9C-E8-FF-55 A 222.222.222.222 49-BD-D2-C7-56-2A 222.222.222.221 88-B2-2F-54-1A-0F B Link Layer and LANs

Routing to another LAN B A R R forwards datagram with IP source A, destination B R creates link-layer frame with B's MAC address as dest, frame contains A-to-B IP datagram MAC src: 1A-23-F9-CD-06-9B MAC dest: 49-BD-D2-C7-56-2A IP src: 111.111.111.111 IP dest: 222.222.222.222 IP Eth Phy B A R 111.111.111.111 222.222.222.222 49-BD-D2-C7-56-2A 74-29-9C-E8-FF-55 222.222.222.220 1A-23-F9-CD-06-9B 111.111.111.110 E6-E9-00-17-BB-4B 111.111.111.112 222.222.222.221 CC-49-DE-D0-AB-7D 88-B2-2F-54-1A-0F * Check out the online interactive exercises for more examples: http://gaia.cs.umass.edu/kurose_ross/interactive/ Link Layer and LANs

To switch or route? Assume unicast traffic Lookup dMAC in MAC-table 1 3 ?? sMAC dMAC sIP dIP ----Data---- vlan 100 vlan 200 2 4 Assume unicast traffic Lookup dMAC in MAC-table If (dMAC ≠ interface MAC)  switch switch (bridge) the frame as is onto learnt port Else frame is for upper layer (IP)  route Lookup dest-IP in routing table (discard if no match) Determine next hop MAC addr (ARP table) Send datagram with new Ethernet header Network Layer

Switch-Router MAC table VLAN MAC address port 3 08-00-60-00-09 10 08-00-60-00-17 6 00-4E-3A-02-08 Self 08-00-60-00-51 4 76 08-00-60-00-A3 7 08-00-60-00-46 8 08-00-60-00-1B 2018 08-00-60-00-92 00-4E-3A-02-10 router IP interfaces on VLANs 3 and 2018 No router IP interface on VLAN 76 Network Layer

Switch-Router routing table local destination mask next-hop default route 0.0.0.0 192.168.1.1 10.0.0.0 8 172.20.4.1 200.23.16.0 20 199.31.18.4 200.23.18.0 23 10.20.0.0 24 192.168.1.0 L 192.168.1.18 172.20.4.0 172.20.4.253 199.31.18.0 199.31.18.52 199.31.18.52/24 192.168.1.18/24 LAN interfaces 172.20.4.253/24 Network Layer

Unicast forwarding algorithm Host receive: dest-MAC address mine? Send: yes extract IP datagram Determine most specific match in routing table no dest-IP address mine? no found one? no yes discard yes local intf? drop packet yes no pass datagram data to upper layer dest on same LAN. nh-IP = dest-IP next-hop is router. nh-IP = gway-IP Switch/router receive: dest-MAC address mine? yes extract IP datagram nh-IP in ARP table? send ARP request and wait for response no no switch Ethernet frame yes dest-IP address mine? get ARP response and fill in ARP table no Route IP datagram yes construct Ethernet header and send frame pass datagram data to upper layer Network Layer

IP/Ethernet configuration Dest Mask Gateway 1.1.1.0 24 L: 1.1.1.1 0.0.0.0 1.1.1.100 IP interface: 1.1.1.1/24 Interface route 1.1.1.1/24 1.1.1.2/24 1.1.1.1/24 1.1.2.2/24 1.1.1.1/24 1.1.2.2/24 B A what’s going on ?? C 1.1.1.3/16 Network Layer

IP/Ethernet configuration Dest Mask Gateway 1.1.1.0 24 L:1.1.1.1 0.0.0.0 1.1.1.100 1.1.1.1/24 default route: 1.1.1.100 1.1.2.2/24 default route: 1.1.2.100 1.1.1.100/24 1.1.2.100/24 Internet Network Layer

IP/Ethernet configuration 192.168.1.1/16 default route: 192.168.1.100 A 192.168.1.100/24 192.168.2.100/24 B D switch 192.168.2.2/24 default route: 192.168.2.100 192.168.2.4/24 default route: 192.168.2.100 router C 192.168.1.3/24 default route: 192.168.1.100 IP reachability: to A B C D from A B C D --- Network Layer

32 bit destination IP address IP datagram format IP protocol version number ver length 32 bits data (variable length, typically a TCP or UDP segment) 16-bit identifier header checksum time to live 32 bit source IP address head. len type of service flgs fragment offset upper layer 32 bit destination IP address options (if any) total datagram length (bytes) header length (bytes) “type” of data for fragmentation/ reassembly max number remaining hops (decremented at each router) upper layer protocol to deliver payload to e.g. timestamp, record route taken, specify list of routers to visit. how much overhead? 20 bytes of TCP 20 bytes of IP = 40 bytes + app layer overhead Network Layer: Data Plane

IP fragmentation, reassembly network links have MTU (max.transfer size) - largest possible link-level frame different link types, different MTUs large IP datagram divided (“fragmented”) within net one datagram becomes several datagrams “reassembled” only at final destination IP header bits used to identify, order related fragments … fragmentation: in: one large datagram out: 3 smaller datagrams reassembly … Network Layer: Data Plane

IP fragmentation, reassembly ID =x offset =0 fragflag length =4000 example: 4000 byte datagram MTU = 1500 bytes ID =x offset =0 fragflag =1 length =1500 =185 =370 =1040 one large datagram becomes several smaller datagrams 1480 bytes in data field offset = 1480/8 Network Layer: Data Plane

ICMP: Internet Control Message Protocol used by hosts & routers to communicate network-level information error reporting: unreachable host, network, port, protocol echo request/reply (used by ping) network-layer “above” IP: ICMP msgs carried in IP datagrams ICMP message: type, code plus first 8 bytes of IP datagram causing error Type Code description 0 0 echo reply (ping) 3 0 dest. network unreachable 3 1 dest host unreachable 3 2 dest protocol unreachable 3 3 dest port unreachable 3 6 dest network unknown 3 7 dest host unknown 4 0 source quench (congestion control - not used) 8 0 echo request (ping) 9 0 route advertisement 10 0 router discovery 11 0 TTL expired 12 0 bad IP header Network Layer

Traceroute and ICMP Source sends series of UDP segments to dest First has TTL =1 Second has TTL=2, etc. Unlikely port number When nth datagram arrives to nth router: Router discards datagram And sends to source an ICMP message (type 11, code 0) Message includes name of router& IP address When ICMP message arrives, source calculates RTT Traceroute does this 3 times Stopping criterion UDP segment eventually arrives at destination host Destination returns ICMP “host unreachable” packet (type 3, code 3) When source gets this ICMP, stops. Network Layer

IPv6: motivation initial motivation: 32-bit address space soon to be completely allocated. additional motivation: header format helps speed processing/forwarding header changes to facilitate QoS IPv6 datagram format: fixed-length 40 byte header no fragmentation allowed Network Layer: Data Plane

IPv6 datagram format priority: identify priority among datagrams in flow flow Label: identify datagrams in same “flow.” (concept of“flow” not well defined). next header: identify upper layer protocol for data ver pri flow label payload len next hdr hop limit source address (128 bits) destination address (128 bits) data 32 bits Network Layer: Data Plane

Other changes from IPv4 checksum: removed entirely to reduce processing time at each hop options: allowed, but outside of header, indicated by “Next Header” field ICMPv6: new version of ICMP additional message types, e.g. “Packet Too Big” multicast group management functions Network Layer: Data Plane

Transition from IPv4 to IPv6 not all routers can be upgraded simultaneously no “flag days” how will network operate with mixed IPv4 and IPv6 routers? tunneling: IPv6 datagram carried as payload in IPv4 datagram among IPv4 routers IPv4 header fields UDP/TCP payload IPv6 source dest addr IPv6 header fields IPv4 payload IPv4 source, dest addr IPv6 datagram IPv4 datagram Network Layer: Data Plane

connecting IPv6 routers Tunneling logical view: IPv4 tunnel connecting IPv6 routers E IPv6 F A B A B IPv6 C D E IPv6 F physical view: IPv4 IPv4 Network Layer: Data Plane

connecting IPv6 routers Tunneling logical view: IPv4 tunnel connecting IPv6 routers E IPv6 F A B A B IPv6 C D E IPv6 F physical view: IPv4 IPv4 flow: X src: A dest: F data A-to-B: IPv6 Flow: X Src: A Dest: F data src:B dest: E B-to-C: IPv6 inside IPv4 B-to-C: IPv6 inside IPv4 Flow: X Src: A Dest: F data src:B dest: E E-to-F: IPv6 flow: X src: A dest: F data Network Layer: Data Plane

IPv6: adoption Google: 8% of clients access services via IPv6 NIST: 1/3 of all US government domains are IPv6 capable Long (long!) time for deployment, use 20 years and counting! think of application-level changes in last 20 years: WWW, Facebook, streaming media, Skype, … Why? Network Layer: Data Plane

Future of IPv6? hourglass  wineglass? Network Layer

Generalized Forwarding and SDN Each router contains a flow table that is computed and distributed by a logically centralized routing controller logically-centralized routing controller control plane data plane local flow table headers counters actions 1 0100 1101 2 3 values in arriving packet’s header Network Layer: Data Plane

OpenFlow data plane abstraction flow: defined by header fields generalized forwarding: simple packet-handling rules Pattern: match values in packet header fields Actions: for matched packet: drop, forward, modify, matched packet or send matched packet to controller Priority: disambiguate overlapping patterns Counters: #bytes and #packets Flow table in a router (computed and distributed by controller) define router’s match+action rules Network Layer: Data Plane

OpenFlow data plane abstraction flow: defined by header fields generalized forwarding: simple packet-handling rules Pattern: match values in packet header fields Actions: for matched packet: drop, forward, modify, matched packet or send matched packet to controller Priority: disambiguate overlapping patterns Counters: #bytes and #packets * : wildcard src=1.2.*.*, dest=3.4.5.*  drop src = *.*.*.*, dest=3.4.*.*  forward(2) 3. src=10.1.2.3, dest=*.*.*.*  send to controller

OpenFlow: Flow Table Entries Rule Action Stats Packet + byte counters Forward packet to port(s) Encapsulate and forward to controller Drop packet Send to normal processing pipeline Modify Fields Now I’ll describe the API that tries to meet these goals. Switch Port VLAN ID MAC src MAC dst Eth type IP Src IP Dst IP Prot TCP sport TCP dport Link layer Network layer Transport layer 37

Examples Destination-based forwarding: Firewall: Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Action * * * * * * 51.6.0.8 * * * port6 IP datagrams destined to IP address 51.6.0.8 should be forwarded to router output port 6 Firewall: Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Forward * * * * * * * * * 22 drop do not forward (block) all datagrams destined to TCP port 22 Switch Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Forward drop * * * * * 128.119.1.1 * * * * do not forward (block) all datagrams sent by host 128.119.1.1

Examples Destination-based layer 2 (switch) forwarding: Port MAC src dst Eth type VLAN ID IP Src Dst Prot TCP sport dport Action * 22:A7:23: 11:E1:02 * * * * * * * * port3 layer 2 frames from MAC address 22:A7:23:11:E1:02 should be forwarded to output port 6 Network Layer: Data Plane

OpenFlow abstraction match+action: unifies different kinds of devices Router match: longest destination IP prefix action: forward out a link Switch match: destination MAC address action: forward or flood Firewall match: IP addresses and TCP/UDP port numbers action: permit or deny NAT match: IP address and port action: rewrite address and port Network Layer: Data Plane

OpenFlow example Example: datagrams from hosts h5 and h6 should be sent to h3 or h4, via s1 and from there to s2 IP Src = 10.3.*.* IP Dst = 10.2.*.* forward(3) match action Host h6 10.3.0.6 controller 1 s3 2 4 3 Host h5 10.3.0.5 s1 1 s2 1 2 Host h4 10.2.0.4 4 2 4 ingress port = 2 IP Dst = 10.2.0.3 IP Dst = 10.2.0.4 forward(3) match action forward(4) ingress port = 1 IP Src = 10.3.*.* IP Dst = 10.2.*.* forward(4) match action Host h1 10.1.0.1 3 3 Host h2 10.1.0.2 Host h3 10.2.0.3

Network Layer Data Plane: done! Overview of Network layer: data plane and control plane IP addressing; DHCP/NAT What’s inside a router IP forwarding Switching vs routing Datagram format Fragmentation ICMP IPv6 SDN match plus action OpenFlow example Question: how do forwarding tables (destination-based forwarding) or flow tables (generalized forwarding) computed? Answer: by the control plane (next week) Network Layer: Data Plane