1. CS 3214 Introduction to Computer Systems
Lecture 26
Godmar Back

2. Announcements Project 5 due Dec 11
Exercise 13 (Virtualization) due Dec 11
Tuesday: teaching evaluation
Must be in class to fill out
Minimum requirement criteria
Projects 1-2 are graded
You have pre-indication on project 3
Can verify minimum requirements for projects 4 and 5 yourselves
CS 3214 Fall 2009
4/14/2018

3. Some of these slides are substantially derived from slides provided by Jim Kurose & Keith Ross. Copyright on this material is held by Kurose & Ross. Used with permission. The textbook is Computer Networking: A Top Down Approach Featuring the Internet Jim Kurose, Keith Ross, Addison-Wesley, July 2004
Part 3
Networking
CS 3214 Fall 2009
4/14/2018

4. Network Address Translation
CS 3214 Fall 2009
4/14/2018

5. NAT: Network Address Translation
rest of
Internet
local network
(e.g., home network)
/24
gogo.rlogin
/hn1.rlogin
umaro.rlogin
hn1.cs.vt.edu
kefka.rlogin
All datagrams leaving local
network have same single source NAT IP address: ,
different source port numbers
Datagrams with source or
destination in this network
have * address for
source, destination (as usual)
CS 3214 Fall 2009
4/14/2018

6. NAT: Network Address Translation
Motivation: local network uses just one IP address as far as outside word is concerned:
no need to be allocated range of addresses from ISP: - just one IP address is used for all devices
can change addresses of devices in local network without notifying outside world
can change ISP without changing addresses of devices in local network
devices inside local net not explicitly addressable, visible by outside world (a huge security plus).
CS 3214 Fall 2009
4/14/2018

7. NAT: Network Address Translation
Implementation: NAT router must:
outgoing datagrams: replace (source IP address, port #) of every outgoing datagram to (NAT IP address, new port #)
. . . remote clients/servers will respond using (NAT IP address, new port #) as destination addr.
remember (in NAT translation table) every (source IP address, port #) to (NAT IP address, new port #) translation pair
incoming datagrams: replace (NAT IP address, new port #) in dest fields of every incoming datagram with corresponding (source IP address, port #) stored in NAT table
CS 3214 Fall 2009
4/14/2018

8. NAT: Network Address Translation
NAT translation table
WAN side addr LAN side addr
1: host
sends datagram to
, 80
2: NAT router
changes datagram
source addr from
, 3345 to
, 5001,
updates table
, , 3345
…… ……
S: , 3345
D: , 80 1
S: , 80
D: , 3345 4
S: , 5001
D: , 80 2
S: , 80
D: , 5001 3
4: NAT router
changes datagram
dest addr from , to , 3345
3: Reply arrives
dest. address:
, 5001
CS 3214 Fall 2009
4/14/2018

9. Managing NAT table
NAT Gateway (usually) adds entries for datagrams traveling private to public automatically
Allows UDP/TCP clients to transparently sendto/connect to outside servers
Removal of entries
UDP: timeout due to inactivity
TCP: timeout + TCP connection teardown
Other direction requires configuration so NAT Gateway knows where to forward incoming datagram even if no private host previously punched a hole by initiating UDP traffic/TCP connection
CS 3214 Fall 2009
4/14/2018

10. NAT Disadvantages 16-bit port-number field: NAT is controversial:
Only 60,000 simultaneous connections with a single LAN-side address!
NAT is controversial:
routers should only process up to layer 3
violates end-to-end argument
NAT possibility must be taken into account by app designers, eg, P2P applications
address shortage should instead be solved by IPv6
really annoying if you time out on rlogin.cs.vt.edu
CS 3214 Fall 2009
4/14/2018

11. NAT Challenges
Considering that most Internet hosts are behind NAT these days – how should applications be written to deal with that?
No problem as long as server has public IP and client knows where to connect (HTTP, XMPP, SMTP, POP)
If server has private IP, entries in NAT forwarding table can be manually configured
What about P2P applications?
Could relay through server, but that would defeat purpose of P2P
Instead, a technique called “hole punching” is widely used (e.g., in Skype)
Discussed in [Ford/Srisuresh/Kegel 2005]
UDP hole punching is widely used, but TCP hole punching is possible as well
CS 3214 Fall 2009
4/14/2018

12. NAT Relaying All traffic goes through S
Source: [Ford/Srisuresh/Kegel 2005]
CS 3214 Fall 2009
4/14/2018

13. UDP Hole Punching
Rendezvous server only directs punches, traffic goes P2P
Details in [Ford/Srisuresh/Kegel 2005]
CS 3214 Fall 2009
4/14/2018

14. Application Protocols
Part 2: DNS

15. DNS: Domain Name System
People: many identifiers:
SSN, name, passport #
Internet hosts, routers:
IP address (32 bit) - used for addressing datagrams
“name”, e.g., - used by humans
Q: map between IP addresses and name ?
Domain Name System:
distributed database implemented in hierarchy of many name servers
application-layer protocol host, routers, name servers to communicate to resolve names (address/name translation) – not built into the network!
CS 3214 Fall 2009
4/14/2018

16. DNS Why not centralize DNS? single point of failure traffic volume
distant centralized database
maintenance
doesn’t scale!
DNS services
Hostname to IP address translation
Host aliasing
Canonical and alias names
Mail server aliasing
Load distribution
Replicated Web servers: set of IP addresses for one canonical name
CS 3214 Fall 2009
4/14/2018

17. Distributed, Hierarchical Database
Root DNS Servers
com DNS servers
org DNS servers
edu DNS servers
poly.edu
DNS servers
umass.edu
yahoo.com
amazon.com
pbs.org
Client wants IP for 1st approx:
Client queries a root server to find .com DNS server
Client queries .com DNS server to get amazon.com DNS server
Client queries amazon.com DNS server to get IP address for
CS 3214 Fall 2009
4/14/2018

18. Resource Types Type Name Value AAAA Hostname www.l.google.com
IPv6 Address 2001:4860:b004::68 A
Hostname
IP Address
CNAME
Alias
rlogin.cs.vt.edu
Canonical Hostname
hn1.cs.vt.edu NS
Domainname
vt.edu
Authoritative Nameserver
nomen.cns.vt.edu MX
Mail Domain
cs.vt.edu
Mail Server
antispam.cs.vt.edu
CS 3214 Fall 2009
4/14/2018

19. DNS: Root Name Servers List published at Replicated using IP anycast
a Verisign, Dulles, VA
c Cogent, Herndon, VA (also Los Angeles)
d U Maryland College Park, MD
g US DoD Vienna, VA
h ARL Aberdeen, MD
j Verisign, ( 11 locations)
13 root name servers worldwide
k RIPE London (also Amsterdam, Frankfurt)
i Autonomica, Stockholm (plus 3 other locations)
m WIDE Tokyo
e NASA Mt View, CA
f Internet Software C. Palo Alto, CA (and 17 other locations)
b USC-ISI Marina del Rey, CA
l ICANN Los Angeles, CA
List published at
ftp://ftp.internic.net/domain/named.cache
See
Replicated using IP anycast
CS 3214 Fall 2009
4/14/2018

20. TLD and Authoritative Servers
Top-level domain (TLD) servers: responsible for com, org, net, edu, etc, and all top-level country domains uk, fr, ca, jp, ....
Network solutions maintains servers for com TLD
Educause for edu TLD
Authoritative DNS servers: organization’s DNS servers, providing authoritative hostname to IP mappings for organization’s servers (e.g., Web and mail).
Can be maintained by organization or service provider
CS 3214 Fall 2009
4/14/2018

21. Caching and Local Name Servers
Q: do we want every (of the 280 million) Internet hosts be contacting a dozen or so root servers all the time?
A: No. Caching is needed
Local Name Servers bundle queries by clients they serve and cache their results
CS 3214 Fall 2009
4/14/2018

22. Local Name Server Does not strictly belong to hierarchy
When a host makes a DNS query, query is sent to its local DNS server
Acts as a proxy, forwards query into hierarchy.
Each ISP (residential ISP, company, university) has one (or more.)
Also called “default name server” or resolver
Contacted by resolver library (libresolv.so, or part of libc – provides such functions as gethostbyname(), getaddrinfo() etc.
CS 3214 Fall 2009
4/14/2018

23. Caching Records Aside: Local Name Server crucial resource
Once (any) name server learns mapping, it caches mapping
cache entries time out (disappear) after some time
86,400 seconds per day
TLD servers typically cached in local name servers
Thus root name servers not often visited
Aside: Local Name Server crucial resource
Proper cache management required
See Bernstein’s comments on caching in BIND (Berkeley Internet Name Domain) program
CS 3214 Fall 2009
4/14/2018

24. DNS Protocol: Query Types
Possible constellations:
Client’s resolver library talks to local name server
Local name server talks to other name servers: root server, TLD servers, …
Beauty of DNS Protocol: same protocol can be used for either constellation
Uses two query types
Recursive: “please resolve this name for me and send me the result”
Good for client, harder for server
Iterated: “please tell me what you know about the name – partial resolution is okay, I’ll ask the next server in hierarchy”
Easy for server, harder for client
CS 3214 Fall 2009
4/14/2018

25. Recursive vs. Iterative Queries
root DNS server
a.root-servers.net 2
TLD DNS server
a3.nstld.com 3
Host at
gback.cs.vt.edu
wants IP address for
godmar.stanford.edu
Sends recursive query to voodoo
Voodoo performs iterative queries
(Animation assumes voodoo has nothing cached yet) 4 5
local DNS server
voodoo.slo.cs.vt.edu 7 6 1 8
authoritative DNS server
argus.stanford.edu
requesting host
gback.cs.vt.edu
godmar.stanford.edu
CS 3214 Fall 2009
4/14/2018

26. Server Models
CS 3214 Fall 2009
4/14/2018

27. Server Models Should more than one more client at a time be supported?
No: use iterative approach: one at a time
If Yes: How do we manage n clients (and be able to accept more at the same time)?
Option 1: use multiple execution contexts (aka “thread-based”, concurrent model)
Option 2: multiplex multiple connections in single execution context (aka “event-based”, achieves “apparent concurrency”)
CS 3214 Fall 2009
4/14/2018

28. High-Concurrency Servers
Ideal
Key goal:
Maintain throughput: measure of useful work seen by clients
Peak: some resource at max
Performance
Overload: some resource thrashing
Load (concurrent tasks)
Source: von Behren, SOSP 2003
CPU and resource management is critical
Must weigh which connections to accept vs. to drop
Ensure that requests in pipeline are completed
CS 3214 Fall 2009
4/14/2018

29. Multiple Contexts
Option A: fork a new process for every connection on-demand
Option B: fork a new thread for every connection to handle it
Option C/D: pre-fork a certain number of processes (or threads) and hand connections to them
CS 3214 Fall 2009
4/14/2018

30. Handling multiple clients using multiple execution contexts
A/B:
# grows &
shrinks A B
C/D:
fixed # C D
Q.: When would you use which?
CS 3214 Fall 2009
4/14/2018

31. Multiplexing Multiple Connections
Problem: need to avoid blocking
Different solutions:
Always test before you read/write (would I block?)
NB: does not require use of nonblocking mode
Use socket in nonblocking mode: try to read, let it fail if it would block
Then try again later (when?), or:
use in combination with notification: send a signal or event if the socket becomes readable.
Many combinations possible
CS 3214 Fall 2009
4/14/2018

32. Multiplexing multiple connections in a single execution context
Use an event-based programming style
Problem: need to avoid blocking
Split code in before and after part, assign an event to ‘after’ part, record all information needed to continue
“stack ripping”
Can make event-based code hard to write
See TAME [Krohn 2007]
CS 3214 Fall 2009
4/14/2018

33. OS interfaces to avoid blocking
Different solutions:
Always test before you read/write (would I block?)
NB: does not require use of nonblocking mode
Use socket in nonblocking mode: try to read, let it fail if it would block
Then try again later (when?), or:
use in combination with notification: send a signal or event if the socket becomes readable.
Many combinations possible
CS 3214 Fall 2009
4/14/2018

34. select(2) fd_set’s are bit vectors that implement a set of integers
int select(int maxn, fd_set *readfds, fd_set *writefds, fd_set *exceptfds,
struct timeval *timeout);
FD_CLR(int fd, fd_set *set);
FD_ISSET(int fd, fd_set *set);
FD_SET(int fd, fd_set *set);
FD_ZERO(fd_set *set);
fd_set’s are bit vectors that implement a set of integers
maxn is max{fds in set} + 1
If fd is in return set, read/write will not block
Java implementation is in java.nio.*
CS 3214 Fall 2009
4/14/2018

35. Problems with select()
select(2) is portable, but not scalable:
Time to scan fd_sets depends on maximum fd value – O(n)
OS must scan entire fd_set every time (+copy-in from user space, +copy-out to user space)
[Banga Mogul 1998]
Found some systems spend >53% of time in select()
Led to development of new mechanisms
CS 3214 Fall 2009
4/14/2018

36. Alternative 1: poll() poll(2) Win if ready set is sparse
Specify array with fds of interest
OS returns (shorter) array with ready fds
Win if ready set is sparse
Otherwise same problems as select
Before call
0 RWE ???
1 RWE ???
5 RWE ???
9 RWE ???
1 RWE R--
9 RWE --E
After call
CS 3214 Fall 2009
4/14/2018

37. Alternative 2: epoll() Linux: epoll(4)
Specify interest set to OS only once
Then refer to it by descriptor
Add new fds to set, remove fds from set
Edge-triggered vs. Level-triggered versions
ET: Notify on change
Adopted from Solaris’s: /dev/poll
Further improve performance by mmap’ing /dev/poll
CS 3214 Fall 2009
4/14/2018

38. Alternative 3: RT signals
Key idea: RT Signals carry fd information with them in their siginfo struct (unlike SIGIO)
Avoid delivery overhead by polling for them with sigwaitinfo
Problem: Finite signal queue requires overflow mechanism
Discussed in [Chandra Mosberger 2001]
“multi-accept” select – reduce frequency of select by accepting multiple connections
CS 3214 Fall 2009
4/14/2018