1. SUBJECT NAME: COMPUTER NETWORKS –II SUBJECT CODE: 10CS63

2. QoS, VPNs, Tunneling, Overlay Networks UNIT 6 Prepared by Santhiya.M Madhuleena Avanthika

3. IP-based Networks - Internet Today Internet today – Provides “best effort” data delivery – Complexity stays in the end-hosts – Network core remains simple – As demands exceeds capacity, service degrades gracefully (increased jitter etc.) Delivery delays cause problems to real-time applications

4. QoS Defined The goal : Provide some level of predictability and control beyond the current IP “best-effort” service Fundamental principle Leave complexity at the “edges” and keep network “core” simple

5. QoS Metrics Performance attributes – Service availability – Delay – Delay variation (jitter) – Throughput – Packet loss rate Vary according to Service Level Agreement (SLA)

6. Service Level Agreements (SLA)

7. QoS Protocol Classification QoS can be achieved by : – Resource reservation (integrated services) – Prioritization (differentiated services) QoS can be applied : – Per flow (individual, uni-directional streams) – Per aggregate (two or more flows having something in common)

8. QoS Protocols Integrated Services – Traffic shaping – Packet scheduling – RSVP Differentiated Services (DiffServ)

9. IETF Integrated Services architecture for providing QOS guarantees in IP networks for individual application sessions resource reservation: routers maintain state info (a la VC) of allocated resources, QoS req’s admit/deny new call setup requests: QoS#9#9

10. #10 Building blocks Scheduling – Active Buffer Management Traffic Shaping – Leaky Bucket – Token Bucket Modeling – The (σ,ρ) Model – WFQ and delay guarantee Admission Control – QoS Routing

11. QoS#11 Scheduling: How Can Routers Help Scheduling: choosing the next packet for transmission – FIFO/Priority Queue – Round Robin/ DRR – Weighted Fair Queuing – We had a lecture on that! Packet dropping: – not drop-tail – not only when buffer is full Active Queue Management Congestion signaling – Explicit Congestion Notification (ECN)

12. QoS#12 Buffer Size Why not use infinite buffers? – no packet drops! Small buffers: – often drop packets due to bursts – but have small delays Large buffers: – reduce number of packet drops (due to bursts) – but increase delays Can we have the best of both worlds?

13. QoS#13 Traffic shaping controls the rate at which packets are sent (not just how many). – Used in ATM and Integrated Services networks. At connection set-up time, the sender and carrier negotiate a traffic pattern (shape). Two traffic shaping algorithms are: – Leaky Bucket – Token Bucket Traffic Shaping

14. QoS#14 The Leaky Bucket Algorithm – used to control rate in a network. – It is implemented as a single-server queue with constant service time. – If the bucket (buffer) overflows then packets are discarded. Leaky Bucket (parameters r and B): – Every r time units: send a packet. – For an arriving packet If queue not full (less than B) then enqueue Note that the output is a “perfect” constant rate.

15. QoS#15 The Leaky Bucket Algorithm (a) A leaky bucket with water. (b) a leaky bucket with packets.

16. QoS#16 Token Bucket Algorithm Highlights: – The bucket holds tokens. – To transmit a packet, we “use” one token. Allows the output rate to vary, – depending on the size of the burst. – In contrast to the Leaky Bucket Granularity – Packets (or bits) Token Bucket (r, MaxTokens): – Generate a token every r time units If number of tokens more than MaxToken, reset to MaxTokens. – For an arriving packet: enqueue – While buffer not empty and there are tokens: send a packet and discard a token

17. QoS#17 The Token Bucket Algorithm (a) Before. (b) After. 5-34

18. QoS#18 Token bucket example parameters: MaxTokens=6 1/r=3 (=3 token/time) arrivalqueueToken bucket sent p1 (5)-0- p2 (2)p13- p3 (1)p26-5=1p1 4-2-1=1p3,p2 4 6

19. QoS#19 Leaky Bucket vs Token Bucket Leaky Bucket Discard: – Packets Rate: – fixed rate (perfect) Arriving Burst: – Waits in bucket Token Bucket Discard: – Tokens – Packet management separate Rate: – Average rate – Bursts allowed Arriving Burst: – Can be sent immediately

20. QoS#20 Approaches to QoS Integrated Services Network wide control Admission Control Absolute guarantees Traffic Shaping Reservations – RSVP Differentiated Services Router based control – Per hop behavior Resolves contentions – Hot spots Relative guarantees Traffic policing – At entry to network

21. QoS#21 Call Admission Arriving session must : declare its QOS requirement – R-spec: defines the QOS being requested characterize traffic it will send into network – T-spec: defines traffic characteristics signaling protocol: needed to carry R-spec and T-spec to routers (where reservation is required) – RSVP

22. RSVP - Integrated Services Enables integrated services (IntServ) IntServ types – Guaranteed : as close as possible to a dedicated virtual circuit – Controlled Load : equivalent to best-effort service under unloaded conditions

23. RSVP - Resource Reservation Attributes – The most complex of all QoS technologies – Closest thing to circuit emulation on IP networks – The biggest departure from “best-effort” IP service Provides the highest level of QoS in terms of : – Service guarantees – Granularity of resource allocation – Detail of feedback to QoS-enabled applications

24. RSVP - Implementation

25. Sender – PATH message containing traffic specification (bitrate, peak rate etc.) Receiver – RECV message containing the reservation specification (guaranteed or controlled) the filter specification (type of packets that the reservation is made for)

26. RSVP - Queuing IntServ uses a token-bucket model to characterize I/O queuing Token bucket attributes – Token rate – Token bucket depth – Peak rate – Minimum policed size – Maximum packet size

27. RSVP - Conclusions Reservations are “soft” – Periodic refresh is necessary It is a network (control) protocol – Works in parallel to TCP and UDP APIs are required to specify flow requirements Reservations are receiver-based Has to maintain a state for each flow Multicast reservations – Merged at replication points, difficult to understood algorithms have to be used though

28. DiffServ - Prioritization Description – Applied on flow aggregates – Services requirements are classified – Classification is performed at network ingress points – A predefined per-hop behavior (PHB) is applied to every service class – Traffic is smoothed according to PHB applied

29. DiffServ - Traffic Classes Two traffic classes are available : – Expeditied Forwarding (EF) - 1 codepoint Minimizes delay and jitter Provides the highest QoS Traffic that exceeds the traffic profile is discarded – Assured Forwarding (AF) - 12 codepoints 4 classes, 3 drop-precedences within each class Traffic that exceeds the traffic profile is not delivered with such high probability

30. DiffServ - Implementation

31. DiffServ codepoints (DSCPs) redefine the Type-of-Service (ToS) IPv4 field Precedence bits are preserved Type-of-Service bits are NOT

32. DiffServ - Conclusions Traffic classes are equivalent to IP precedence service descriptors – DiffServ unaware routers pass-through DiffServ traffic Easy to be implemented / integrated even into the network core. Proper classification can lead to efficient resource allocation and though improved QoS

33. Overlay Networks 33

34. Overlay Networks 34 Focus at the application level

35. IP Tunneling to Build Overlay Links IP tunnel is a virtual point-to-point link – Illusion of a direct link between two separated nodes Encapsulation of the packet inside an IP datagram – Node B sends a packet to node E – … containing another packet as the payload 35 A B E F tunnel Logical view: Physical view: A B E F

36. Tunnels Between End Hosts 36 A C B Src: A Dest: B Src: A Dest: B Src: A Dest: C Src: A Dest: B Src: C Dest: B

37. Overlay Networks A logical network built on top of a physical network – Overlay links are tunnels through the underlying network Many logical networks may coexist at once – Over the same underlying network – And providing its own particular service Nodes are often end hosts – Acting as intermediate nodes that forward traffic – Providing a service, such as access to files Who controls the nodes providing service? – The party providing the service – Distributed collection of end users 37

38. Using Overlays to Evolve the Internet Internet needs to evolve – IPv6 – Security – Mobility – Multicast But, global change is hard – Coordination with many ASes – “Flag day” to deploy and enable the technology Instead, better to incrementally deploy – And find ways to bridge deployment gaps 38

39. 6Bone: Deploying IPv6 over IP4 39 A B E F IPv6 tunnel Logical view: Physical view: A B E F IPv6 C D IPv4 Flow: X Src: A Dest: F data Flow: X Src: A Dest: F data Flow: X Src: A Dest: F data Src:B Dest: E Flow: X Src: A Dest: F data Src:B Dest: E A-to-B: IPv6 E-to-F: IPv6 B-to-C: IPv6 inside IPv4 B-to-C: IPv6 inside IPv4

40. Secure Communication Over Insecure Links Encrypt packets at entry and decrypt at exit Eavesdropper cannot snoop the data … or determine the real source and destination 40

41. Communicating With Mobile Users A mobile user changes locations frequently – So, the IP address of the machine changes often The user wants applications to continue running – So, the change in IP address needs to be hidden Solution: fixed gateway forwards packets – Gateway has a fixed IP address – … and keeps track of the mobile’s address changes 41 gateway www.cnn.com

42. IP Multicast Multicast – Delivering the same data to many receivers – Avoiding sending the same data many times IP multicast – Special addressing, forwarding, and routing schemes 42 unicastmulticast

43. MBone: Multicast Backbone A catch-22 for deploying multicast – Router vendors wouldn’t support IP multicast – … since they weren’t sure anyone would use it – And, since it didn’t exist, nobody was using it Idea: software implementing multicast protocols – And unicast tunnels to traverse non-participants 43

44. Multicast Today Mbone applications starting in early 1990s – Primarily video conferencing, but no longer operational Still many challenges to deploying IP multicast – Security vulnerabilities, business models, … Application-layer multicast is more prevalent – Tree of servers delivering the content – Collection of end hosts cooperating to delivery video Some multicast within individual ASes – Financial sector: stock tickers – Within campuses or broadband networks: TV shows – Backbone networks: IPTV 44

45. RON: Resilient Overlay Networks 45 Premise: by building application overlay network, can increase performance and reliability of routing Two-hop (app-level) Berkeley-to-Princeton route app-layer router Princeton Yale Berkeley http://nms.csail.mit.edu/ron/

46. RON Circumvents Policy Restrictions IP routing depends on AS routing policies – But hosts may pick paths that circumvent policies 46 USLEC PU Patriot ISP me My home computer

47. RON Adapts to Network Conditions Start experiencing bad performance – Then, start forwarding through intermediate host 47 A C B

48. RON Customizes to Applications VoIP traffic: low-latency path Bulk transfer: high-bandwidth path 48 A C B voice bulk transfer

49. How Does RON Work? Keeping it small to avoid scaling problems – A few friends who want better service – Just for their communication with each other – E.g., VoIP, gaming, collaborative work, etc. Send probes between each pair of hosts 49 A C B

50. How Does RON Work? Exchange the results of the probes – Each host shares results with every other host – Essentially running a link-state protocol! – So, every host knows the performance properties Forward through intermediate host when needed 50 A C B B

51. RON Works in Practice Faster reaction to failure – RON reacts in a few seconds – BGP sometimes takes a few minutes Single-hop indirect routing – No need to go through many intermediate hosts – One extra hop circumvents the problems Better end-to-end paths – Circumventing routing policy restrictions – Sometimes the RON paths are actually shorter 51

52. RON Limited to Small Deployments Extra latency through intermediate hops – Software delays for packet forwarding – Propagation delay across the access link Overhead on the intermediate node – Imposing CPU and I/O load on the host – Consuming bandwidth on the access link Overhead for probing the virtual links – Bandwidth consumed by frequent probes – Trade-off between probe overhead and detection speed Possibility of causing instability – Moving traffic in response to poor performance – May lead to congestion on the new paths 52

53. Why Tunnel? Reliability – Fast Reroute, Resilient Overlay Networks (Akamai SureRoute) Flexibility – Topology, protocol Stability (“path pinning”) – E.g., for performance guarantees Security – E.g., Virtual Private Networks (VPNs) Bypassing local network engineers – Censoring regimes: China, Pakistan, … 53

54. MPLS Overview Main idea: Virtual circuit – Packets forwarded based only on circuit identifier Destination Source 1 Source 2 Router can forward traffic to the same destination on different interfaces/paths. 54

55. MPLS Overview Main idea: Virtual circuit – Packets forwarded based only on circuit identifier Destination Source 1 Source 2 Router can forward traffic to the same destination on different interfaces/paths. 55

56. Circuit Abstraction: Label Swapping Label-switched paths (LSPs): Paths are “named” by the label at the path’s entry point At each hop, MPLS routers: – Use label to determine outgoing interface, new label – Thus, push/pop/swap MPLS headers that encapsulate IP Label distribution protocol: responsible for disseminating signalling information A 1 2 3 A 2D Tag Out New D 56

57. Reconsider security problem 57

58. Layer 3 Virtual Private Networks Private communications over a public network A set of sites that are allowed to communicate with each other Defined by a set of administrative policies – Determine both connectivity and QoS among sites – Established by VPN customers – One way to implement: BGP/MPLS VPN (RFC 2547)

59. Layer 2 vs. Layer 3 VPNs Layer 2 VPNs can carry traffic for many different protocols, whereas Layer 3 is “IP only” More complicated to provision a Layer 2 VPN Layer 3 VPNs: potentially more flexibility, fewer configuration headaches 59

60. Layer 3 BGP/MPLS VPNs Isolation: Multiple logical networks over a single, shared physical infrastructure Tunneling: Keeping routes out of the core VPN A/Site 1 VPN A/Site 2 VPN A/Site 3 VPN B/Site 2 VPN B/Site 1 VPN B/Site 3 CE A1 CE B3 CE A3 CE B2 CE A2 CE 1 B1 CE 2 B1 PE 1 PE 2 PE 3 P1P1 P2P2 P3P3 10.1/16 10.2/16 10.3/16 10.1/16 10.2/16 10.4/16 BGP to exchange routes MPLS to forward traffic 60

61. High-Level Overview of Operation IP packets arrive at PE Destination IP address is looked up in forwarding table Datagram sent to customer’s network using tunneling (i.e., an MPLS label-switched path) 61 PE 1 PE 2 PE 3

62. BGP/MPLS VPN key components Forwarding in the core: MPLS Distributing routes between PEs: BGP Isolation: Keeping different VPNs from routing traffic over one another – Constrained distribution of routing information – Multiple “virtual” forwarding tables Unique Addresses: VPN-IPv4 extensions – RFC 2547: Route Distinguishers 62

63. Virtual Routing and Forwarding Separate tables per customer at each router 10.0.1.0/24 RD: Purple 10.0.1.0/24 RD: Blue 10.0.1.0/24 Customer 1 Customer 2 Customer 1 63

64. Forwarding PE and P routers have BGP next-hop reachability through the backbone IGP Labels are distributed through LDP (hop-by-hop) corresponding to BGP Next-Hops Two-Label Stack is used for packet forwarding Top label indicates Next-Hop (interior label) Second label indicates outgoing interface / VRF (exterior label) IP Datagram Label 2 Label 1 Layer 2 Header Corresponds to LSP of BGP next-hop (PE) Corresponds to VRF/interface at exit 64

65. Forwarding in BGP/MPLS VPNs Step 1: Packet arrives at incoming interface – Site VRF determines BGP next-hop and Label #2 IP Datagram Label 2 Step 2: BGP next-hop lookup, add corresponding LSP (also at site VRF) IP Datagram Label 2 Label 1 65

66. Layer 3 BGP/MPLS VPNs VPN A/Site 1 VPN A/Site 2 VPN A/Site 3 VPN B/Site 2 VPN B/Site 1 VPN B/Site 3 CE A1 CE B3 CE A3 CE B2 CE A2 CE 1 B1 CE 2 B1 PE 1 PE 2 PE 3 P1P1 P2P2 P3P3 10.1/16 10.2/16 10.3/16 10.1/16 10.2/16 10.4/16 BGP to exchange routes MPLS to forward traffic 66