1. Connecting
The Network Layer
to Data Link Layer

2. MAC Addresses and ARP 32-bit IP address:
network-layer address
used to get datagram to destination IP subnet
MAC (or LAN or physical or Ethernet) address:
function: get frame from one interface to another physically-connected interface (same network)
48 bit MAC address (for most LANs)
burned in NIC ROM, also sometimes software settable
5: DataLink Layer

3. LAN Addresses and ARP Each adapter on LAN has unique LAN address
1A-2F-BB AD
Broadcast address =
FF-FF-FF-FF-FF-FF
LAN
(wired or
wireless)
= adapter
71-65-F7-2B-08-53
58-23-D7-FA-20-B0
0C-C4-11-6F-E3-98

4. ARP: Address Resolution Protocol
Question: how to determine
MAC address of B
knowing B’s IP address?
Each IP node (host, router) on LAN has ARP table
ARP table: IP/MAC address mappings for some LAN nodes
< IP address; MAC address; TTL>
TTL (Time To Live): time after which address mapping will be forgotten (typically 20 min)
1A-2F-BB AD
LAN
71-65-F7-2B-08-53
58-23-D7-FA-20-B0
0C-C4-11-6F-E3-98

5. ARP in the IP Layer The Address Resolution Protocol (ARP)
Part of the Internet Protocol (IP) to solve a specific problem
Usually considered to be a part of the link layer
The physical layer has 6 byte MAC addresses, while the network layer has independent (4 byte) IP addresses

6. ARP
What is the connection between IP and HW (MAC = Ethernet) addresses?
There is no a priori connection as they live in different layers
But they need some connection otherwise we won't be able to use a physical layer to send IP packets: we won't know where a particular IP packet should physically be sent

7. ARP
Every host on the Internet has (at least) one 32 bit (4 byte) IP address
It is unique to that host and so identifies that machine on the Internet

8. ARP
IP addresses are chosen by the local system administrator to suit the local network
Ethernet addresses are built into the interface hardware by the manufacturer
The two addresses bear absolutely no relationship to one another (as we would expect from the layering principles)‏

9. ARP Suppose want to send a packet over (say) an Ethernet
We only know the destination's IP address
To build the Ethernet frame we have to know the Ethernet address that the destination has
This is what ARP does: It finds the hardware address corresponding to an IP address

10. How ARP finds the Targets MAC Address
STEP 1:
ARP broadcasts an ARP Request packet that contains the target IP address in an Ethernet frame with destination address ff:ff:ff:ff:ff:ff and source (its own) Ethernet address‏
All hosts on the local network read this broadcasted frame
The target host recognises the request for its IP address

11. ARP
STEP 2:
The target sends an ARP Reply packet containing its own Ethernet address
It knows the source's Ethernet address as found in the request packet
The source gets the reply and reads out the target's Ethernet address
It can now use that Ethernet address to send IP packets

12. WHAT is ARP FRAME? The frame type for ARP is 0806
Hardware type: 1 for an Ethernet address
Protocol type: 0800 for an IP address
Sizes: sizes in bytes of the address fields, 6 for Ethernet, 4 for IP

13. ARP OP: 1 for a request, 2 for a reply Address fields: the data
In a request the target MAC address field is not filled in, which is what we are trying to find!
In a reply the sender MAC address is the address we seek

14. ARP
The source caches the address so it doesn't need to do an ARP for every IP packet
The cache expires after (say) 20 minutes, after which a fresh ARP exchange is needed
This is in case the Ethernet-to-IP address relationship changes, e.g., an IP address is reassigned to a new machine

15. What if the Target is not on the Same LAN?
If no machine on the local network has the requested IP address, or that machine is down, no reply will be forthcoming
In this case, after a few seconds (and a few repeated ARP requests), an error message is send to the application trying to make the IP connection
This might be “no such host” or “host unreachable”

16. SRC and DST on different Networks: ARP Bridging
A clever trick that shows ARP can be used for things other than it was designed to do
This trick allows us to extend an Ethernet (or other network) over a physically larger distance than its specifications allow, and to join a wireless network to a wired one so they appear to be a single network

17. ARP Bridging
A bridge is a host with two interfaces, one on each network
If host h1 wishes to send to host h2 it must determine its hardware address

18. ARP Bridging So h1 sends an ARP broadcast for h2
The bridge sees this request and responds on behalf of h2 (a proxy ARP), but it supplies its own hardware address b1

19. ARP Bridging
Now h1 sends data to what it thinks is h2, but is actually the bridge
The bridge reads the packet, sees it is destined for h2 (by its IP address) and forwards it to the other network where h2 can read it

20. ARP Bridging
The forwarded frame will be changed to have h2 as destination and b2 as source
If h2 replies, it can either use h2 which it got from the original packet or do an ARP request, which the bridge proxies in a symmetrical way

21. ARP Bridging
In either case the packet goes to the bridge, which forwards it to h1, again rewriting the frame addresses appropriately
This is all transparent to h1 and h2 who believe they are on the same network

22. ARP Bridging This is sometimes called transparent bridging
If h1 is communicating with both h2 and h3 its cache will show then to have the same hardware address b1: this is not a problem

23. ARP Bridging
ARP bridging is fine for joining a pair of small networks, but less so for larger collections of networks
IEEE 802.1d Ethernet Bridging standard addresses this, dealing with the cases of multiple routes between hosts

24. Remote ARP Bridging
Bridging can also connect networks that are widely separated, e.g., by a WAN, again to appear as a single network using remote bridging
Compare this with tunnelling

25. Remote ARP Bridging The endpoints are called half bridges
This is similar in principle to local bridging, but now the half bridges must cope with encapsulation over the WAN; differences in speed and packet sizes of the LAN and WAN and so on

26. Reverse Address Resolution Protocol (RARP)
Reverse ARP addresses to opposite problem to ARP: given a hardware address find the IP address
Needed by hosts that don't initially know their own IP address, e.g., a diskless computer, a laptop plugging into a network, a refrigerator, etc.

27. Reverse Address Resolution Protocol (RARP)
Very similar to ARP
Frame type 8035
Same frame layout
Op type 3 for a RARP request, type 4 for a RARP reply
RARP is OK for limited purposes, but much better protocols exist to solve the same problem (see DHCP)‏

28. DHCP a Sublayers Under the Network Layer
How does a host get allocated an IP address?
allocated manually by an administrator: OK as far as it goes but does not scale to large networks and some networks (e.g., home networks) don't have (competent) administrators
Use the Dynamic Host Configuration Protocol 28

29. DHCP a Sublayers Under the Network Layer
DHCP, and its predecessor BOOTP, exist to allocate IP addresses to hosts
We start with BOOTP then describe DHCP which is similar but massively extends BOOTP
Both extend RARP 29

30. Dynamic Host Configuration Protocol :DHCP
How Does DHCP Work?
Dynamic Host Configuration Protocol :DHCP
DHCP is designed for the general configuration of a host: address, subnet mask, gateway, name servers, and more
Needed usually for hosts with non-permanent connections, e.g., Internet service providers, etc 30

32. How Does DHCP Work?
DHCP has a pool of available addresses that it can assign to hosts as they need
When a host leaves, its address can be reused
DHCP gives a lease time on an address
If the lease expires the host can renew via DHCP
A well-behaved host will signal (via DHCP) when it no longer needs an address 32

33. How Does DHCP Work? DHCP supplies IP address Gateway Subnet mask
name servers
lease times
print servers
Gateway
boot servers
mail servers
host name
web servers 33

34. Prechecking of an IP Address
Before supplying an address, DHCP should ping the network for that address: this is to check that no host is accidentally using that address already 34

35. Prechecking of an IP Address
Before supplying an address, DHCP should ping the network for that address: this is to check that no host is accidentally using that address already
Inform others: After getting an address, the host can send an ARP reply containing its own address. This gratuitous ARP informs other hosts on the network of the new address association so they can update their ARP caches 35

36. How Does DHCP Work? The data is encoded in a DHCP packet as
a tag byte to indicate the type of data
a length byte
the data itself
Tag 0 to pad data for alignment
Tag 255 to indicate end of data 36

37. The Packet Header 37

42. DHCP Message Flow

44. Ethernet Topologies “dominant” wired LAN technology: cheap $20 for NIC
first widely used LAN technology
simpler, cheaper than token LANs and ATM
kept up with speed race: 10 Mbps – 10 Gbps
Metcalfe’s Ethernet
sketch
5: DataLink Layer

45. Star topology bus topology popular through mid 90s
all nodes in same collision domain (can collide with each other)
today: star topology prevails
active switch in center
each “spoke” runs a (separate) Ethernet protocol (nodes do not collide with each other)
switch
bus: coaxial cable
star
5: DataLink Layer

46. Ethernet Frame Structure
Sending adapter encapsulates IP datagram (or other network layer protocol packet) in Ethernet frame
Preamble:
7 bytes with pattern followed by one byte with pattern
used to synchronize receiver, sender clock rates
5: DataLink Layer

47. Ethernet Frame Structure (more)
Addresses: 6 bytes
if adapter receives frame with matching destination address, or with broadcast address (eg ARP packet), it passes data in frame to network layer protocol
otherwise, adapter discards frame
Type: indicates higher layer protocol (mostly IP but others possible, e.g., Novell IPX, AppleTalk)
CRC: checked at receiver, if error is detected, frame is dropped
5: DataLink Layer

48. Ethernet: Unreliable, connectionless
connectionless: No handshaking between sending and receiving NICs
unreliable: receiving NIC doesn’t send acks or nacks to sending NIC
stream of datagrams passed to network layer can have gaps (missing datagrams)
gaps will be filled if app is using TCP
otherwise, app will see gaps
Ethernet’s MAC protocol: unslotted CSMA/CD
5: DataLink Layer

49. Hubs … physical-layer (“dumb”) repeaters:
bits coming in one link go out all other links at same rate
all nodes connected to hub can collide with one another
no frame buffering
no CSMA/CD at hub: host NICs detect collisions
twisted pair
hub
5: DataLink Layer

50. Switch link-layer device: smarter than hubs, take active role
store, forward Ethernet frames
examine incoming frame’s MAC address, selectively forward frame to one-or-more outgoing links when frame is to be forwarded on segment, uses CSMA/CD to access segment
transparent
hosts are unaware of presence of switches
plug-and-play, self-learning
switches do not need to be configured
5: DataLink Layer

51. Switch: allows multiple simultaneous transmissions
hosts have dedicated, direct connection to switch
switches buffer packets
Ethernet protocol used on each incoming link, but no collisions; full duplex
each link is its own collision domain
switching: A-to-A’ and B-to-B’ simultaneously, without collisions
not possible with dumb hub C’ B 1 2 6 3 4 5 C B’ A’
switch with six interfaces
(1,2,3,4,5,6)
5: DataLink Layer

52. switch with six interfaces
Switch Table A
Q: how does switch know that A’ reachable via interface 4, B’ reachable via interface 5?
A: each switch has a switch table, each entry:
(MAC address of host, interface to reach host, time stamp)
looks like a routing table!
Q: how are entries created, maintained in switch table?
something like a routing protocol? C’ B 1 2 6 3 4 5 C B’ A’
switch with six interfaces
(1,2,3,4,5,6)
5: DataLink Layer

53. Switch: self-learning
Source: A
Dest: A’ A
A A’
switch learns which hosts can be reached through which interfaces
when frame received, switch “learns” location of sender: incoming LAN segment
records sender/location pair in switch table C’ B 1 2 6 3 4 5 C B’ A’
MAC addr interface TTL A 1 60
Switch table
(initially empty)
5: DataLink Layer

54. Switch: frame filtering/forwarding
When frame received: 1. record link associated with sending host 2. index switch table using MAC dest address 3. if entry found for destination then { if dest on segment from which frame arrived then drop the frame else forward the frame on interface indicated } else flood
forward on all but the interface
on which the frame arrived
5: DataLink Layer

55. Self-learning, forwarding: example
Source: A
Dest: A’
Self-learning, forwarding: example A
A A’ C’ B
frame destination unknown: 1 2
flood
A A’
A A’
A A’
A A’
A A’ 6 3 4 5
destination A location known: C
A’ A
selective send B’ A’
MAC addr interface TTL A 1 60
Switch table
(initially empty) A’ 4 60
5: DataLink Layer

56. Interconnecting switches
switches can be connected together D E F S2 S4 S3 H I G S1 A B C
Q: sending from A to G - how does S1 know to forward frame destined to F via S4 and S3?
A: self learning! (works exactly the same as in single-switch case!)
5: DataLink Layer

57. Self-learning multi-switch example
Suppose C sends frame to I, I responds to C S4 1 S1 2 S3 S2 A F D I B C H G E
Q: show switch tables and packet forwarding in S1, S2, S3, S4
5: DataLink Layer

58. Institutional network
mail server
to external
network
web server
router
IP subnet

59. Switches vs. Routers both store-and-forward devices
routers: network layer devices (examine network layer headers)
switches are link layer devices
routers maintain routing tables, implement routing algorithms
switches maintain switch tables, implement filtering, learning algorithms
5: DataLink Layer

60. VLANs: motivation What happens if:
CS user moves office to EE, but wants connect to CS switch?
single broadcast domain:
all layer-2 broadcast traffic (ARP, DHCP) crosses entire LAN (security/privacy, efficiency issues)
each lowest level switch has only few ports in use
What’s wrong with this picture?
Computer
Science
Computer
Engineering
Electrical
Engineering
5: DataLink Layer

61. VLANs
Port-based VLAN: switch ports grouped (by switch management software) so that single physical switch …… 1 7 9 15
Virtual Local
Area Network 2 8 10 16 … …
Switch(es) supporting VLAN capabilities can be configured to define multiple virtual LANS over single physical LAN infrastructure.
Electrical Engineering
(VLAN ports 1-8)
Computer Science
(VLAN ports 9-15)
… operates as multiple virtual switches 1 8 2 7 9 16 10 15 … …
Electrical Engineering
(VLAN ports 1-8)
Computer Science
(VLAN ports 9-16)
5: DataLink Layer

62. Electrical Engineering
Port-based VLAN
router
traffic isolation: frames to/from ports 1-8 can only reach ports 1-8
can also define VLAN based on MAC addresses of endpoints, rather than switch port
forwarding between VLANS: done via routing (just as with separate switches)
in practice vendors sell combined switches plus routers 1 7 9 15 2 8 10 16
dynamic membership: ports can be dynamically assigned among VLANs … …
Electrical Engineering
(VLAN ports 1-8)
Computer Science
(VLAN ports 9-15)
5: DataLink Layer

63. VLANS spanning multiple switches1 7 9 15 16 1 3 5 7 2 8 10 2 4 6 8 … …
Electrical Engineering
(VLAN ports 1-8)
Computer Science
(VLAN ports 9-15)
Ports 2,3,5 belong to EE VLAN
Ports 4,6,7,8 belong to CS VLAN
trunk port: carries frames between VLANS defined over multiple physical switches
frames forwarded within VLAN between switches can’t be vanilla frames (must carry VLAN ID info)
802.1q protocol adds/removed additional header fields for frames forwarded between trunk ports
5: DataLink Layer