1 Connectivity with ARP and RARP

2 There needs to be a mapping between the layer 2 and layer 3 addresses (i.e. IP to Ethernet). Mapping should be dynamic (i.e. when you change NICs). Address Resolution Protocol (ARP): You have the layer 3 address and do not have the layer 2 address. Reverse ARP (RARP): You have the layer 2 address, but do not have the layer 3 address. Layer 2 provides the addressing needed to get to the next device and Layer 3 provides the addressing needed to get to the end-to-end destination. Need both layer 2 and layer 3 addressing. ARP and RARP Introduction

3 ARP ARP Request – layer 2 broadcast IP: MAC:FF-FF-FF-FF-FF-FF IP: MAC: A4-6E-F AB ARP reply - unicast A ARP Client B ARP associates an IP address to a layer 2 (physical or hardware) address. An ARP request is a broadcast. An ARP reply is a unicast. IP: MAC: A4-6E-F AB

4 Packet Format: HTYPE – Hardware Type (16 bits): Defines the type of network ARP is running on. Each LAN is assigned a unique HTYPE. Can be used on any network. Example: Ethernet HTYPE is 1. Protocol TypeHardware Type Hardware LengthOperation Target Hardware Address Sender Protocol Address Sender Hardware Address Protocol Length ARP and RARP ARP Target Protocol Address

5 Packet Format: PTYPE – Protocol Type (16 bits): Defines the type of protocol. Can be used with any layer 3 protocol. Example: IPv4 is 0x0800. HLEN – Hardware Length (8 bits): Defines the length of physical address in bytes. Example: Ethernet is 6 (6 * 8 = 48 bits). PLEN – Protocol Length (8 bits): Length of the layer 3 address in bytes. Example: IPV4 is 4 (4 * 8 = 32 bits). ARP and RARP ARP

6 Packet Format: OPER - Operation (16 bits): 2 operations: 1 = ARP Request3 = RARP Request 2 = ARP Reply4 = RARP Reply SHA/THA – Sender/Target Hardware Address (variable): Layer 2 address of the sender/target. Example: Ethernet is 48 bits in length. SPA/TPA – Sender/Target Protocol Address (variable): Layer 3 address of the sender/target. Example: IPv4 is 32 bits in length ARP and RARP ARP

7 Encapsulation: ARP packets are encapsulated directly into layer 2 frames. Example: ARP over Ethernet. Preamble and Start Frame Delimiter (SFD) (8 bytes) Addresses (6 bytes) Type (2 bytes): 0x0806 Data (Variable) CRC (4 bytes) ARP and RARP ARP Preamble & SFD (8) Destination Address (6) Source Address (6) Type (2) Data (Variable)CRC (4) ARP Request or ARP Reply

8 Operation: 1. Sender knows IP address of target. 2. IP asks ARP to create an ARP request with the SHA, SPA, TPA, and THA. THA is all 0s because ARP request does not know it. 3. ARP request is passed to layer 2 for frame encapsulation and broadcast. 4. Every node on the LAN receives this frame, decapsulates it, and passes the ARP request to ARP. All nodes discard the ARP request, except the target node. 5. The target node replies with an ARP unicast reply containing its layer 2 address. 6. The sender receives the ARP reply and knows the target’s layer 2 address. 7. Now packets can be encapsulated into frames and addresses to the target. ARP and RARP ARP

9 4 ARP Cases: 1. The sender is a host and wants to send a packet to another host on the same network. Host-to-host. 2. The sender is a host and wants to send a packet to another host on a different network. Host-to-router (default gateway). 3. The sender is a router that has received a packet destined for a host on a different network. Router-to-router. 4. The sender is a router that has received a packet destined for a host on the same network. Router-to host. ARP and RARP ARP

10 ARP and RARP Reverse ARP (RARP) Opposite of ARP. A device has its physical address (layer 2), but does not have a layer 3 address. RARP Request - broadcast IP: MAC: A4-6E-A AB RARP reply – direct to SHA IP: MAC: A4-6E-A RARP Server RARP Client MAC: A4-6E-A

11 Protocol TypeHardware Type Hardware LengthOperation Target Hardware Address Sender Protocol Address Sender Hardware Address Protocol Length ARP and RARP RARP Target Protocol Address Preamble & SFD (8) Destination Address (6) Source Address (6) Type (2) Data (Variable)CRC (4) RARP Request or RARP Reply Type = 0x8035

12 ARP H1 H2H3 H4 H5H6 H7 H8H9 H10 H11H12 Switch D ff.ff.ff.ff.ff.ff SP SH fe d5.29 DP DH H10= IP , Ethernet 44.fe d ef.c e.c D ff.ff.ff.ff.ff.ff SP SH fe d5.29 DP DH D ff.ff.ff.ff.ff.ff SP SH fe d5.29 DP DH D ff.ff.ff.ff.ff.ff SP SH fe d5.29 DP DH D fe d5.29 SP SH 44.fe d5 DP DH fe d5.29 D fe d5.29 SP SH 44.fe d5 DP DH fe d5.29 D D 44.fe d5 S S fe d5.29 D D 44.fe d5 S S fe d5.29

13 ARP H1 H2H3 H4 H5H6 H7 H8H9 H10 H11H12 Router H10= IP , Ethernet 44.fe d ef.c e.c D ff.ff.ff.ff.ff.ff SP SH 55.7e.c DP DH D D ef.c S S fe d5.29 D ff.ff.ff.ff.ff.ff SP SH fe d5.29 DP DH D 55.7e.c SP SH 44.fe d5 DP DH 55.7e.c D fe d5.29 SP SH ef.c DP DH fe d5.29 D D 44.fe d5 S S 55.7e.c

14 ICMP Internet Control Message Protocol

15 Purpose of ICMP The Internet Control Message Protocol is a protocol for the exchange of error messages and other vital information between (Physical) Internet entities such as hosts and routers.

16 ICMP in the TCP/IP protocol suite ICMP is a network layer protocol, often it is placed next to the IP protocol. ICMP HeaderICMP Data Area IP HeaderIP Data Area Frame HeaderFrame Area

17 ICMP in the TCP/IP protocol suite  ICMP lies just above IP, as ICMP messages are carried inside IP Packets.  ICMP messages are carried as IP payload,

18 ICMP functions  Announce network errors: such as a host or entire portion of the network being unreachable, entire portion of the network being unreachable, due to some type of failure. A TCP or UDP packet due to some type of failure. A TCP or UDP packet directed at a port number with no receiver directed at a port number with no receiver attached is also reported via ICMP. attached is also reported via ICMP.  Announce network congestion: When a router begins buffering too many packets, due to router begins buffering too many packets, due to an inability to transmit them as fast as they are an inability to transmit them as fast as they are being received, it will generate ICMP Source being received, it will generate ICMP Source Quench messages. Directed at the sender, these Quench messages. Directed at the sender, these messages should cause the rate of packet messages should cause the rate of packet transmission to be slowed. transmission to be slowed.

19 ICMP Applications There are two simple and widely used applications which are based on ICMP:  Ping  Traceroute.

20 ICMP Applications The ping utility checks whether a host is alive & reachable or not. This is done by sending an ICMP Echo Request packet to the host, and waiting for an ICMP Echo Reply from the host  PING: The ping utility checks whether a host is alive & reachable or not. This is done by sending an ICMP Echo Request packet to the host, and waiting for an ICMP Echo Reply from the host. Traceroute is a utility that records the route (the specific gateway computers at each hop) through the Internet between your computer and a specified destination computer. It also calculates and displays the amount of time each hop took.  TRACE ROUTE: Traceroute is a utility that records the route (the specific gateway computers at each hop) through the Internet between your computer and a specified destination computer. It also calculates and displays the amount of time each hop took.gatewayhopgatewayhop

21 ICMP Operation

22  The DESTINATION UNREACHABLE message is used when the subnet or a router cannot locate the destination.  The TIME EXCEEDED message is sent when a packet is dropped because its counter has reached zero. This event is symptom that there is enormous congestion, or that the timer values are being set too low.  The PARAMETER PROBLEM message indicates that an illegal value has been detected in a header field. This problem indicates a bug in the sending host’s IP software or possibly in the router’s software.  The SOURCE QUENCH message was formerly used to throttle hosts that were sending too many packets. When a host received this message, it was expected to slow down. It is rarely used any more when congestion occurs. More about Message Types

23  The REDIRECT MESSAGE is used when a router notices that a packet seems to be routed wrong. It is used by the router to tell the sending host about the probable error.  The ECHO Request and ECHO REPLY messages are used to see if a given destination is reachable and alive. Upon receiving the ECHO message, the destination is expected to send an ECHO REPLY message back.  The TIMESTAMP REQUEST and TIMESTAMP REPLY messages are similar, except that the arrival time of the message and the departure time of the reply are recorded in the reply. This facility is used to measure network performance. More about Message Types

24 Questions ???