1. Introduction: Part-11 CSCI 6781 Advanced Computer Networks Ram Dantu

2. Introduction: Part-12 Course Overview

3. Introduction: Part-13 Syllabus This class IS about... Recent advances in Computer Networks New developments in Physical Layer, Layer 2 (ATM/MPLS), Layer 3 (mobile IP, ForCES), Layer 4 (SCTP) and application layers like SIP, MIDCOM, MobileIP, etc. Vulnerability of these protocols, threat models Risk analysis using behavior, attack profile and graph theory Working together and learning together ….

4. Introduction: Part-14 Background r My background r Your background, thesis topic and why are you talking this course m Need some course to finish the degree m Want to be network security engineer m Want to be a hacker r Check your email often (atleast twice a day) r Office Hours and appointment (available most of the week days, get an appointment)

5. Introduction: Part-15 Grading

6. Introduction: Part-16 HomeWork1 r Document the state diagram and a short description for two protocols. In addition, survey and collect exploits for at least two protocols. You can use CERT, NIST, NSA, DHS or any other source for collecting the exploits. You can consider some of the following protocols: i)TCP and UDP ii) ICMP iii) SMTP iv) HTTP v) SNMP vi) SSL vii) DNS viii) BGP (if you like to work on any other protocols, let me know) r The documentation should include the following: r - The effect of the exploit r - Reason for the exploit (hole in the spec., DOS, improper implementation, etc.,) r - Vendors effected r - Date when it was detected r (with a metric, how many places it was detected) r - What are the sequence of actions to arrive the exploit.

7. Introduction: Part-17 Homework1 r Collect 25 exploits for each protocol (where ever it is applicable) r Search the IEEE database, web and books etc., and get the state diagram for the protocol. Make sure you relate the state diagram with the list of exploits. r Make sure you have conclusions m Relate the exploits with spec. See where and how it was broken; Is there any pattern ? Which vendor is more prone to these vulnerabilities ? Do you foresee any other holes will be exploited ?

8. Introduction: Part-18 Project  Project Description (suggested) r Threat models and quantitative derivations for vulnerability. For example, you can start with a state diagram of the protocol and draw an attack graph. In this attack graph, you can use behavior attributes (or probabilistic, or any other methods) for traversing the graph and compute the vulnerability (using analytical methods). An example for BGP is given in the reference. The following protocols can be used for the analysis: RSVP, LDP, SIP, SCTP, and routing protocols. r Guidelines: Do not try to cut and past from documents. Creativity and innovation will be the only factors during evaluation of the project.

9. Introduction: Part-19 Issues in Internet r QoS r Security r Availability

10. Introduction: Part-110 What’s the Internet: “nuts and bolts” view r millions of connected computing devices: hosts, end-systems m pc’s workstations, servers m PDA’s phones, toasters running network apps r communication links m fiber, copper, radio, satellite r routers: forward packets (chunks) of data thru network local ISP company network regional ISP router workstation server mobile

11. Introduction: Part-111 What’s the Internet: “nuts and bolts” view r protocols: control sending, receiving of msgs m e.g., TCP, IP, HTTP, FTP, PPP r Internet: “network of networks” m loosely hierarchical m public Internet versus private intranet r Internet standards m RFC: Request for comments m IETF: Internet Engineering Task Force local ISP company network regional ISP router workstation server mobile

12. Introduction: Part-112 What’s the Internet: a service view r communication infrastructure enables distributed applications: m WWW, email, games, e- commerce, database., voting, m more? r communication services provided: m connectionless m connection-oriented r cyberspace [Gibson]: “a consensual hallucination experienced daily by billions of operators, in every nation,...."

13. Introduction: Part-113 Perspective r Network users: Does the network support the users’ applications m Reliability m Error free service m Speed of data transfer r Network designers: Cost efficient network design m Good utilization of network resources m Cost of building the network m Types of services to be supported m Security

14. Introduction: Part-114 Perspective r Network providers: Network administration and customer service m Maximize Revenue m Minimize Operations Expenses m Survivability and Resiliency (Why) Discuss the difference! Give examples

15. Introduction: Part-115 A closer look at network structure: r network edge: applications and hosts r network core: m routers m network of networks r access networks, physical media: communication links

16. Introduction: Part-116 Building Blocks r Switches, Routers, Gateways m Special network components responsible for “moving” packets across the network from source to destination. r Network hosts, workstations, etc. m they generally represent the source and sink (destination) of data traffic (packets) r We can recursively build large networks by interconnecting networks via gateways and routers.

17. Introduction: Part-117 An Interconnection Network

18. Introduction: Part-118 The network edge: r end systems (hosts): m run application programs m e.g., WWW, email m at “edge of network” r client/server model m client host requests, receives service from server m e.g., WWW client (browser)/ server; email client/server r peer-peer model: m host interaction symmetric m e.g.: teleconferencing

19. Introduction: Part-119 Network edge: connection-oriented service Goal: data transfer between end sys. r handshaking: setup (prepare for) data transfer ahead of time m Hello, hello back human protocol m set up “state” in two communicating hosts r TCP - Transmission Control Protocol m Internet’s connection- oriented service TCP service [RFC 793] r reliable, in-order byte- stream data transfer m loss: acknowledgements and retransmissions r flow control: m sender won’t overwhelm receiver r congestion control: m senders “slow down sending rate” when network congested

20. Introduction: Part-120 Network edge: connectionless service Goal: data transfer between end systems m same as before! r UDP - User Datagram Protocol [RFC 768]: Internet’s connectionless service m unreliable data transfer m no flow control m no congestion control App’s using TCP: r HTTP (WWW), FTP (file transfer), Telnet (remote login), SMTP (email) App’s using UDP: r streaming media, teleconferencing, Internet telephony

21. Introduction: Part-121 The Network Core r mesh of interconnected routers r the fundamental question: how is data transferred through net? m circuit switching: dedicated circuit per call: telephone net m packet-switching: data sent thru net in discrete “chunks”

22. Introduction: Part-122 Different Types of Switching r Different Types of Switching: m Circuit Switching (telephone network) dedicated circuit, sending and receiving bit streams m Message Switching m Packet Switching store and forward, sending and receiving packets m Virtual Circuit Switching m Cell Switching (ATM) r What are Packets? m Data to be transmitted is divided into discrete blocks

23. Introduction: Part-123 Network Core: Circuit Switching End-end resources reserved for “call” r link bandwidth, switch capacity r dedicated resources: no sharing r circuit-like (guaranteed) performance r call setup required

24. Introduction: Part-124 Cost-Effective Resource Sharing r Must share (multiplex) network resources among multiple users. r Common Multiplexing Strategies m Time-Division Multiplexing (TDM) m Synchronous TDM (STDM) m Frequency-Division Multiplexing (FDM) r Multiplexing multiple logical flows over a single physical link.

25. Introduction: Part-125 Network Core: Circuit Switching network resources (e.g., bandwidth) divided into “pieces” r pieces allocated to calls r resource piece idle if not used by owning call (no sharing) r dividing link bandwidth into “pieces” m frequency division m time division

26. Introduction: Part-126 Network Core: Packet Switching each end-end data stream divided into packets r user A, B packets share network resources r each packet uses full link bandwidth r resources used as needed, resource contention: r aggregate resource demand can exceed amount available r congestion: packets queue, wait for link use r store and forward: packets move one hop at a time m transmit over link m wait turn at next link Bandwidth division into “pieces” Dedicated allocation Resource reservation

27. Introduction: Part-127 Network Core: Packet Switching Packet-switching versus circuit switching: human restaurant analogy r other human analogies? A B C 10 Mbs Ethernet 1.5 Mbs 45 Mbs D E statistical multiplexing queue of packets waiting for output link

28. Introduction: Part-128 Network Core: Packet Switching Packet-switching: store and forward behavior

29. Introduction: Part-129 Packet switching versus circuit switching r 1 Mbit link r each user: m 100Kbps when “active” m active 10% of time r circuit-switching: m 10 users r packet switching: m with 35 users, probability > 10 active less that.004 Packet switching allows more users to use network! N users 1 Mbps link

30. Introduction: Part-130 Packet switching versus circuit switching r Great for bursty data m resource sharing m no call setup r Excessive congestion: packet delay and loss m protocols needed for reliable data transfer, congestion control r Q: How to provide circuit-like behavior? m bandwidth guarantees needed for audio/video apps still an unsolved problem (chapter 6) Is packet switching a “slam dunk winner?”

31. Introduction: Part-131 Packet-switched networks: routing r Goal: move packets among routers from source to destination m we’ll study several path selection algorithms (chapter 4) r datagram network: m destination address determines next hop m routes may change during session m analogy: driving, asking directions r virtual circuit network: m each packet carries tag (virtual circuit ID), tag determines next hop m fixed path determined at call setup time, remains fixed thru call m routers maintain per-call state

32. Introduction: Part-132 Access networks and physical media Q: How to connect end systems to edge router? r residential access nets r institutional access networks (school, company) r mobile access networks Keep in mind: r bandwidth (bits per second) of access network? r shared or dedicated?

33. Introduction: Part-133 Residential access: point to point access r Dialup via modem m up to 56Kbps direct access to router (conceptually) r ISDN: intergrated services digital network: 128Kbps all- digital connect to router r ADSL: asymmetric digital subscriber line m up to 1 Mbps home-to-router m up to 8 Mbps router-to-home m ADSL deployment: UPDATE THIS

34. Introduction: Part-134 Residential access: cable modems r HFC: hybrid fiber coax m asymmetric: up to 10Mbps upstream, 1 Mbps downstream r network of cable and fiber attaches homes to ISP router m shared access to router among home m issues: congestion, dimensioning r deployment: available via cable companies, e.g., MediaOne

35. Introduction: Part-135 Institutional access: local area networks r company/univ local area network (LAN) connects end system to edge router r Ethernet: m shared or dedicated cable connects end system and router m 10 Mbs, 100Mbps, Gigabit Ethernet r deployment: institutions, home LANs soon r LANs: chapter 5

36. Introduction: Part-136 Wireless access networks r shared wireless access network connects end system to router r wireless LANs: m radio spectrum replaces wire m e.g., Lucent Wavelan 10 Mbps r wider-area wireless access m CDPD: wireless access to ISP router via cellular network base station mobile hosts router

37. Introduction: Part-137 Physical Media r physical link: transmitted data bit propagates across link r guided media: m signals propagate in solid media: copper, fiber r unguided media: m signals propagate freelye.g., radio Twisted Pair (TP) r two insulated copper wires m Category 3: traditional phone wires, 10 Mbps ethernet m Category 5 TP: 100Mbps ethernet

38. Introduction: Part-138 Physical Media: coax, fiber Coaxial cable: r wire (signal carrier) within a wire (shield) m baseband: single channel on cable m broadband: multiple channel on cable r bidirectional r common use in 10Mbs Ethernet Fiber optic cable: r glass fiber carrying light pulses r high-speed operation: m 100Mbps Ethernet m high-speed point-to-point transmission (e.g., 5 Gps) r low error rate

39. Introduction: Part-139 Physical media: radio r signal carried in electromagnetic spectrum r no physical “wire” r bidirectional r propagation environment effects: m reflection m obstruction by objects m interference Radio link types: r microwave m e.g. up to 45 Mbps channels r LAN (e.g., waveLAN) m 2Mbps, 11Mbps r wide-area (e.g., cellular) m e.g. CDPD, 10’s Kbps r satellite m up to 50Mbps channel (or multiple smaller channels) m 270 Msec end-end delay m geosynchronous versus LEOS

40. Introduction: Part-140 Different Types of Links Sometimes you install your own!

41. Introduction: Part-141 Bigger Pipes! Sometimes leased from the phone company STS: Synchronous Transport Signal

42. Introduction: Part-142 Delay in packet-switched networks packets experience delay on end-to-end path r four sources of delay at each hop r nodal processing: m check bit errors m determine output link r queueing m time waiting at output link for transmission m depends on congestion level of router A B propagation transmission nodal processing queueing

43. Introduction: Part-143 Delay in packet-switched networks Transmission delay: r R=link bandwidth (bps) r L=packet length (bits) r time to send bits into link = L/R Propagation delay: r d = length of physical link r s = propagation speed in medium (~2x10 8 m/sec) r propagation delay = d/s A B propagation transmission nodal processing queueing Note: s and R are very different quantitites!

44. Introduction: Part-144 Bandwidth (throughput) r Amount of data that can be transmitted per time unit r Example: 10Mbps r link versus end-to-end r Notation m KB = 2 10 bytes m Mbps = 10 6 bits per second Performance

45. Introduction: Part-145 r Bandwidth related to “bit width” Performance a) b) 1 second

46. Introduction: Part-146 Latency (delay) r Time it takes to send message from point A to point B r Example: 24 milliseconds (ms) r Sometimes interested in in round-trip time (RTT) r Components of latency Latency = Propagation + Transmit + Queue + Proc. Propagation = Distance / SpeedOfLight Transmit = Size / Bandwidth

47. Introduction: Part-147 The “hard” limit r Speed of light m 3.0 x 10 8 meters/second in a vacuum m 2.3 x 10 8 meters/second in a cable m 2.0 x 10 8 meters/second in a fiber r Notes m no queuing delays in direct link m bandwidth not relevant if Size = 1 bit m process-to-process latency includes software overhead m software overhead can dominate when Distance is small

48. Introduction: Part-148 r Relative importance of bandwidth and latency m small message (e.g., 1 byte): 1ms vs. 100ms dominates 1Mbps vs. 100Mbps m large message (e.g., 25 MB): 1Mbps vs. 100Mbps dominates 1ms vs. 100ms r Consider two channels of 1Mbps and 100 Mbps respectively. For a 1 byte message, the available bandwidth is relatively insignificant given a RTT of 1 ms. The transmit delay for each channel is 8  s and 0.08  s, respectively.

49. Introduction: Part-149  Delay x Bandwidth Product e.g., 100ms RTT and 45Mbps Bandwidth = 560KB of data r We have to view the network as a buffer. This may have interesting consequences: m How much data did the sender transmit before a response can be received? Bandwidth Delay

50. Introduction: Part-150 r Application Needs m bandwidth requirements: burst versus peak rate m jitter: variance in latency (inter-packet gap) r Average Bandwidth Requirement is Not enough: m consider a source with an avg. BW-requirement of 2Mbps. If the application generates 1 Mbit in one second interval and 3Mbit in a second, a channel that can support 2 Mbps max. will have a tough time. r Other Quality of Service (QOS) Parameters: m max. and min. delay m max. and min. bandwidth demand m rates for dynamic increase of demands m Cell-Loss Rate

51. Introduction: Part-151 Queueing delay (revisited) r R=link bandwidth (bps) r L=packet length (bits) r a=average packet arrival rate traffic intensity = La/R r La/R ~ 0: average queueing delay small r La/R -> 1: delays become large r La/R > 1: more “work” arriving than can be serviced, average delay infinite!

52. Introduction: Part-152 What Goes Wrong in the Network? r Different types of Error: m Bit-level errors (electrical interference) 1 in 10 6 -10 7 in copper - 1 in 10 12 - 10 14 in fiber m Packet-level errors (congestion) m Link and node failures r How should we deal with these types of error? r What are the consequences of errors?

53. Introduction: Part-153 Other types of problems in the Network? r Messages are delayed r Messages are deliver out-of-order r Third parties eavesdrop The key problem is to fill in the gap between what applications expect and what the underlying technology provides.