Chapter 9 Caching, NAT Professor Rick Han University of Colorado at Boulder

Prof. Rick Han, University of Colorado at Boulder Announcements HW #4 due April 16 Programming Assignment #3 tonight Next, Caching, NAT

Prof. Rick Han, University of Colorado at Boulder Recap of Previous Lecture HTTP Proxies Reasons to use: Caching advantages, Security, Protocol translation Prefetching GET, POST, PUT Load Balancing HTTP Redirect for load balancing DNS Returns a list of IP addresses matching a name DNS round robin on order of IP addresses, Akamai Routing-based techniques SMTP, MIME

Prof. Rick Han, University of Colorado at Boulder Caching Policy at Proxy Relevant HTTP fields Request If-Modified-Since Response Last-Modified Expires Caching proxy doesn’t cache pages with: “Pragma : no-cache” header field “WWW-Authenticate : “ or “Authorization:” headers Server and proxy clocks must be reliable

Prof. Rick Han, University of Colorado at Boulder Caching Policy at Proxy (2) Browser has its own browser cache. Browser sends a “conditional” GET with If- Modified-Since header field when a user hits “Reload”, or a page expired in browser cache, or browser set to always ask for a page, A conditional GET will only succeed in returning a page if that page has been modified since the If-Modified-Since date. Otherwise, get back a status code 304 “Not Modified” Caching proxy receives a conditional GET – what is its policy?

Prof. Rick Han, University of Colorado at Boulder Caching Policy at Proxy (3) If page not in proxy’s cache, or cached page has expired, or if cached page was Last-Modified earlier than request’s If-Modified-Since date, then Forward Conditional GET to server. If server finds its page was Last-Modified earlier than If-Modified-Since date, then server’s response to proxy is status 304 “Not Modified” Proxy returns status 304 “Not Modified” to client Else, server returned fresher page, so proxy caches it and returns it to client Else return cached page to client (it’s not expired and it’s freshly modified)

Prof. Rick Han, University of Colorado at Boulder Caching Policy at Proxy (4) Summary: cached page returned only if not expired and new enough (recently modified), otherwise return fresher page from server or status 304 message “Expires : “ header may be missing, so proxy has to guess a probable expiration date If Last-Modified is recent, then guess the page is changing frequently, so choose a quick expiration date Chaining of caches is allowed, e.g. Browser cache chained with Proxy caches SQUID caching proxies are common freeware based on Harvest caches developed in part at the University of Colorado, see cache.org

Prof. Rick Han, University of Colorado at Boulder More on MIME Displaying non-ASCII character sets augment MIME type and subtype with a qualifying parameter: Content-type: text/plain; charset="utf-8" … Some other character set codes are: korean for Korean KSC 5601, big5 for Chinese big5, x- euc-jp for Japanese EUC, iso-2022-jp for Japanese JIS, utf-8 for UniCode MIME also supports non-ASCII headers, RFC 2047

Prof. Rick Han, University of Colorado at Boulder Well-Known TCP Ports Many application-level protocols rely on client- server paradigm Server or daemon should be up and running on a well- known port Client then contacts server on well-known destination TCP port Client’s source TCP port can be any # above the reserved limit of 1023, for safety choose > 5000 IANA reserved/well-known TCP ports 80 = http 20 = ftp-data, 21 = ftp control 23 = telnet 25 = smtp

Prof. Rick Han, University of Colorado at Boulder Network Address Translation (NAT) Enables reuse of IP addresses, gets around IP’s limited 32-bit address space TCP-level semantic knowledge is required TCP/IP source Wants to send to cnn.com creates packet NAT has a local IP LAN address and an external IP address NAT Network Addr Trans TCP/IP destination cnn.com TCP/IP source LANExternal

Prof. Rick Han, University of Colorado at Boulder NAT (2) NAT receives packet and Replaces IP sender addr with its own external IP address Replaces TCP sender port with its own TCP source port, chosen from a list of available source ports Sends packet to destination Stores a mapping of to NAT Network Addr Trans TCP/IP destination cnn.com TCP/IP source LANExternal

Prof. Rick Han, University of Colorado at Boulder NAT (3) When a reply packet is received from cnn.com on NAT TCP src port NAT substitutes the original sender’s IP sender address and TCP sender port Even if two sources on same LAN choose the same TCP sending port, they’ll differ in their IP addresses – input/output mapping still unique Extends IP address spaces by qualifying addresses with TCP port #’s NAT Network Addr Trans TCP/IP destination cnn.com TCP/IP source LANExternal

Prof. Rick Han, University of Colorado at Boulder NAT (4) NAT needs to modify IP address and TCP port and TCP/IP checksums Adds latency The type of NAT described thus far is called a “Dynamic” NAT Internal hosts can use any non-reserved IP address to connect to external hosts External hosts don’t know about internal IP addresses – NAT’s as “masquerading” firewalls! NAT Network Addr Trans TCP/IP destination TCP/IP source LANExternal

Prof. Rick Han, University of Colorado at Boulder NAT (5) Static NAT’s allow an external client to connect to an internal TCP/IP server, e.g. a Web server, at a specific address External host can’t just send a Web request to NAT’s external IP address, port 80, because NAT won’t know to which internal host to route the http request Static NAT allocates a fixed IP address for the Web server and constructs a static mapping from ISP- assigned external IP to internal IP Static NAT also called “inbound mapping” NAT Network Addr Trans TCP/IP source/ client TCP/IP destination Web server LANExternal

Prof. Rick Han, University of Colorado at Boulder NAT (6) Static NAT’s work with FTP and other application layer protocols as well Static NAT’s introduce security risk – allowing unknown outsiders to connect into a local computer Configure your NAT router to have two Ethernet LAN ports with separate IP addresses Place machines you wish to be public on one IP addresses, and keep private hosts on 2 nd IP address NAT Network Addr Trans TCP/IP source/ client TCP/IP destination Web server LANExternal

Prof. Rick Han, University of Colorado at Boulder NAT (7) NAT’s can be used a load balancers too TCP/IP Packets into a NAT are rewritten with the IP address and TCP port of the most lightly loaded destination Reply packets from destination also rewritten by NAT on way back to source NAT Network Addr Trans TCP/IP destination TCP/IP source LAN TCP/IP destination

Prof. Rick Han, University of Colorado at Boulder NAT (8) Comparing NATs and Proxies: Similar architecture of intermediary between client and server NATs are lower level (IP and TCP) vs. Proxies (HTTP) NATs are arguably faster than higher-layer proxies NATs are “transparent” to source and destination nodes, whereas HTTP clients are explicitly aware that there is an HTTP proxy intermediary in their path to the HTTP server NAT Network Addr Trans TCP/IP destination cnn.com TCP/IP source LANExternal