1. Dr. Richard Spillman Fall 2006
The
Lord
Net
Of the
NETWORK S
Dr. Richard Spillman
Fall 2006
One net to rule them all
One net to find them
One net to bring them all
And in the darkness bind them

2. Network Structures & Operation
The
Lord
Net
Of the
Lecture 5
Network Structures & Operation
One net to rule them all
One net to find them
One net to bring them all
And in the darkness bind them

3. Class Topics Network Structure Network Structure VPN Database Security
Audits
VPN
Database
Security
Audits
Database
Security
Wireless
Network Structure
Net Attacks
Firewalls
VPN
IDS
Wireless
Firewalls
IDS
Net Attacks

4. Review – Layer Structures
Each layer has a specific application and carries specific information to communicate with a peer layer on another system
As a result of this configuration model, it is possible to discuss each layer separately
New features can be added to a layer without affecting other layers
The operation of a layer can be understood without involving the other layers
Application
Transport
Network
Link
Physical

5. Review – TCP Header
The TCP protocol adds a header to the data + application header package
TCP
app
data
Identifies the application
32 bits
Source Port #
Destination Port #
Sequence Number
Acknowledgement Number
Head
Length
Reserved U A P R S F
Receiver Window Size
CheckSum
Urgent Data Pointer
Options (variable length)

6. OUTLINE
Network Layer
IP Addressing
IP Format

7. Network Layer

8. Network Layer
The application layer provides the necessary structure to run an application on a network
The transport layer sets up a connection for the application
However neither the application layer nor the transport layer identify the target machine – this is the role of the network layer
Application
Transport
Network
Link
Physical

9. Router Complex device that determines where to forward packets
Used in large-scale networks (i.e., it is typically not used to forward packets within a LAN)
a packet arrives on one interface
leaves on other(s) heading toward desired destination(s)
routers must
determine where to forward packets with given destination address
use routing protocols to communicate with other routers
How does it know?

10. Main Goal Network Layer Protocols
allow packets to be routed across multiple routers from a source host to a destination host, even if the routers come from different vendors
provides an end-to-end connection
Route
The protocol for routing across the
Internet is called IP (Internet Protocol)

11. General
The Network Layer is responsible for delivering traffic between two hosts
each host is identified by a unique host address (e.g. IP address)
The Network Layer not concerned about delivery to particular applications on the host (that’s up to the Transport Layer)

12. Network Layer Functions
Host, router network layer functions: N E T W O R k
Transport Layer: TCP, UDP
Routing protocols
path selection
RIP, OSPF, BGP
IP protocol
addressing conventions
datagram format
packet handling conventions
ICMP protocol
error reporting
router “signaling”
Link Layer
Physical Layer

13. IP Addressing

14. A host interface has 3 types of addresses:
Internet Addressing
A host interface has 3 types of addresses:
host name (Application Layer): e.g.,
IP address (Network Layer): e.g.,
MAC address (Link Layer): e.g., E6-E BB-4B

15. Why 3 Addresses? Internet
host names: convenient app-to-app communication
IP: efficient large-scale network communication
MAC: quick-n-easy LAN forwarding
Internet
E6-E BB-4B

16. IP Address Consists of the network portion and a host portion.
Every host must have a unique IP address
IP address is a 32 bit number
Usually written as four 8 bit numbers (dotted decimal):
Consists of the network portion and a host portion.
Network [ ] Host [3]
Each network segment requires its own network number
The number of bits dedicated to network versus host is configurable.
By allocating more bits to the network portion you can increase the number of networks at the expense of the size of each network (called subnetting).

17. Default IP Address Types
Default netmasks exists for three sizes of networks (class A, B, and C)
Class A networks (netmask )
126 possible networks with 16,777,216 hosts per network
First octet always in the range from 1 to 126
Class B networks (netmask )
16384 possible networks with 65,536 hosts per network
First octet always in the range from 128 to 191
Class C networks (netmask )
2,097,152 possible networks with 254 hosts per network
First octet always in the range from 192 to 223
Old Method

18. Netmasks 1
Netmasks are used to configure the number of bits to use for the network portion
A Netmask is logically anded with the IP address to determine the network portion
Decimal Notation Binary Notation
&

19. Netmasks 2 Can be written as dotted decimal or as a bit count
address netmask
/24
Typical netmask (class C network) is
Allows for 256 address of which 254 can be used to number hosts. (The first and last number of any IP network are reserved)
Do not need to end on an 8 bit boundary.
or are valid netmasks. The first would allow networks with 16,382 hosts per network, the later 126 hosts per network.

20. Class A Address Internet IP Address Ranges Network Host
Class A: to
(127 networks) (16,711,680 hosts)
Network 1
Network 2
Network 3
Network
Network 127
Networks: Few
Internet 1
16,711,680
Networks: Many

21. Class B Address Internet IP Address Ranges Network Host
Class B: to to
(16,320 networks) (65,024 hosts)
Network 1
Network 2
Network 3
Network
Network 16,320
Networks: Average
Internet 1
65,024
Networks: Average

22. Class C Address Internet IP Address Ranges Network Host
Class C: to to 254
(2,088,960 networks) (255 hosts)
Network 1
Network 2
Network 3
Network
Network 2,088,960
Networks: Many
Internet 1
255
Networks: Few

23. CIDR Address
Classless Interdomain Routing – the new method for IP addresses
network part can be any # of bits
Format: a.b.c.d/x, where x indicates # of bits in network part (the prefix) high order bits form the prefix
once inside the network, can subnet: divide remaining 24-x bits
/18 =

24. DHCP
DHCP (Dynamic Host Configuration Protocol) is a protocol that lets network administrators manage centrally and automate the assignment of IP (Internet Protocol) configurations on a computer network.
Without DHCP, the IP address must be entered manually at each computer system.
DHCP lets a network administrator supervise and distribute IP addresses from a central point.
The purpose of DHCP is to provide the automatic (dynamic) allocation of IP client configurations for a specific time period (called a lease period) and to eliminate the work necessary to administer a large IP network.

25. DHCP Protocol
GOAL: allow the host to dynamically obtain its IP address from the network server when it joins the network
Can renew its lease on the address
Allows reuse of addresses (only hold the address while connected and “on”)
Support for mobile users who want to the join the network
Process
Host broadcasts “DHCP discover” message
DHCP server responds with “DHCP offer” message
Host requests IP address with a “DHCP request” message
DHCP server sends the address with a “DHCP ack” message

27. Transport Layer: TCP, UDP
Network Level Format
Physical Layer
Link Layer N E T W O R k
Transport Layer: TCP, UDP
ICMP protocol
error reporting
router “signaling”
IP protocol
addressing conventions
datagram format
packet handling conventions
Routing protocols
path selection
RIP, OSPF, BGP

28. IP Header The Network Layer adds an IP header to the data: IP TCP app
32 bits
Version
Length
TOS
Total Length (in bytes)
Identification D M
Fragment Offset
Time to Live
Protocol
Header Checksum
Source IP Address
Destination IP Address
Options (variable length)

29. Version & Header Length
Version number of IP protocol
Current is version 4 (IPv4)
Moving to version 6 (IPv6)
Note: no versions 1, 2, 3 or 5 were used
The header length defines the size of the data unit in multiplies of four bytes (32 bits).
The minimum length is five bytes and the maximum is bytes.
Padding bytes fill any unused spaces.
Options (variable length)
Destination IP Address
Source IP Address
Time to Live
Protocol
Header Checksum
32 bits
Identification D M
Fragment Offset
Version
Length
TOS
Total Length (in bytes)

30. Type of Service & Total Length
Type of Service (TOS) is designed to provide “hints” to routers
Normal delay vs. low delay
Normal throughput vs. high throughput
Normal reliability vs. high reliability
Just the total length in bytes of the packet
Options (variable length)
Destination IP Address
Source IP Address
Time to Live
Protocol
Header Checksum
32 bits
Identification D M
Fragment Offset
Version
Length
TOS
Total Length (in bytes)

31. ID, Flags & Fragment Fields
Identification (16 bits).
A value which is assigned by the sender to aid the assembly of the frames of a datagram.
D and M bits.
A gateway may route a datagram and split it into smaller fragments.
The D bit informs the gateway that it should not fragment the data and thus it signifies that a receiving node should receive the data as a single unit or not at all.
The M bit is the ‘more fragments’ bit and is used when data is split into fragments.
Fragment offset (13 bits).
Indicates which datagram this fragment belongs to.
The fragment offset is measured in units of eight bytes (64 bits).
The first fragment has an offset of zero.
Options (variable length)
Destination IP Address
Source IP Address
Time to Live
Protocol
Header Checksum
32 bits
Identification D M
Fragment Offset
Version
Length
TOS
Total Length (in bytes)

32. Time to Live Field Options (variable length) Destination IP Address
Initially set by sending transport layer (0-255)
Decremented by each router that handles packet
Packet discarded when TTL = 0
avoids infinite loops
Time To Live can usually be configured in operating system
e.g. through Windows registry
Example defaults:
MS Windows prior to NT4: TTL = 32
MS Windows NT 4.0: TTL = 128
MacOS/MacTCP 2.0.x: TTL = 60
Sun Solaris 2.x: TTL = 255
Most other Unixes: TTL = 60 or 64
Options (variable length)
Destination IP Address
Source IP Address
Time to Live
Protocol
Header Checksum
32 bits
Identification D M
Fragment Offset
Version
Length
TOS
Total Length (in bytes)

33. Protocol & Checksum Field
Indicates the type of protocol in data field
e.g. TCP = “6”
e.g. UDP = “17”
Checks for errors in the header only
bad headers can harm the network
very little work compared to checking entire packet
verified & recomputed at every router
Options (variable length)
Destination IP Address
Source IP Address
Time to Live
Protocol
Header Checksum
32 bits
Identification D M
Fragment Offset
Version
Length
TOS
Total Length (in bytes)

34. Options (variable length)
ICMP Protocol
The Internet Control Message Protocol (ICMP) is the protocol used for error and control messages in the internet
It provides an error reporting mechanism between routers and hosts
All ICMP packets are encapsulated as IP datagrams:
32 bits
Type
Code
Checksum
Options (variable length)

35. Message Types
ICMP messages are either query messages or error messages
ICMP query messages:
Echo request/Echo reply (‘ping’)
Router advertisement/Router solicitation
Timestamp request/Timestamp reply
ICMP error messages
Host unreachable
Time exceeded
Parameter problem