1. Data and Computer Communications Eighth Edition by William Stallings Lecture slides by Lawrie Brown Chapter 18 – Internet Protocols

2. Internet Protocols The map of the London Underground, which can be seen inside every train, has been called a model of its kind, a work of art. It presents the underground network as a geometric grid. The tube lines do not, of course, lie at right angles to one another like the streets of Manhattan. Nor do they branch off at acute angles or form perfect oblongs. —King Solomon's Carpet. Barbara Vine (Ruth Rendell)

3. Protocol Functions  have a small set of functions that form basis of all protocols 1. Encapsulation 2. fragmentation and reassembly 3. connection control 4. ordered delivery 5. flow control 6. error control 7. Addressing 8. Multiplexing 9. transmission services

4. 1. Encapsulation  data usually transferred in blocks  called Protocol Data Units (PDUs)  have three categories of control  have three categories of control address address error-detecting code error-detecting code protocol control protocol control  encapsulation is addition of control information to data  have many examples of PDU’s in previous chapters e.g. TFTP, HDLC, frame relay, ATM, AAL5, LLC, IEEE 802.3, IEEE 802.11 e.g. TFTP, HDLC, frame relay, ATM, AAL5, LLC, IEEE 802.3, IEEE 802.11

5. 2. Fragmentation and Reassembly  protocol exchanges data between two entities  lower-level protocols may need to break data up into smaller blocks, called fragmentation  for various reasons network only accepts blocks of a certain size network only accepts blocks of a certain size more efficient error control & smaller retransmission units more efficient error control & smaller retransmission units fairer access to shared facilities fairer access to shared facilities smaller buffers smaller buffers  disadvantages smaller buffers smaller buffers more interrupts & processing time more interrupts & processing time

6. PDUS and Fragmentation

7. 3. Connection Control  have connectionless data transfer where each PDU treated independently where each PDU treated independently  and connection-oriented data transfer involves a logical association, or connection, established between entities involves a logical association, or connection, established between entities preferred (even required) for lengthy data exchange preferred (even required) for lengthy data exchange or if protocol details are worked out dynamically or if protocol details are worked out dynamically  three phases occur for connection-oriented connection establishment connection establishment data transfer data transfer connection termination connection termination

8. Phases of Connection Oriented Transfer

9. Connection Establishment  entities agree to exchange data  typically, one station issues connection request  may involve central authority  receiving entity accepts or rejects (simple)  may include negotiation  syntax, semantics, and timing  both entities must use same protocol  may allow optional features  must be agreed

10. Data Transfer and Termination  both data and control information exchanged  data flow and acknowledgements may be in one or both directions  one side may send termination request  or central authority might terminate

11. Sequencing  used by many, but not all, connection-oriented protocols e.g. HDLC, IEEE 802.11 e.g. HDLC, IEEE 802.11  connection-oriented protocols include some way of identifying connection  have PDUs numbered sequentially  each side tracks seq numbers in and out  to support three main functions ordered delivery ordered delivery llow control llow control error control error control

12. 4. Ordered Delivery  risk PDUs may arrive out of order  require PDU order must be maintained  hence number PDUs sequentially  easy to reorder received PDUs  use finite sequence number field numbers repeat modulo maximum number numbers repeat modulo maximum number max sequence number greater than max number of PDUs that could be outstanding max sequence number greater than max number of PDUs that could be outstanding

13. TCP/IP Concepts

14. 5. Flow Control  receiving entity limits amount / rate of data sent  simplest protocol is stop-and-wait  more efficient protocols use concept of credit amount of data sent without acknowledgment amount of data sent without acknowledgment  must be implemented in several protocols network traffic control network traffic control buffer space buffer space application overflow application overflow

15. 6. Error Control  to guard against loss or damage  implemented as separate error detection and retransmission functions sender inserts error-detecting code in PDU sender inserts error-detecting code in PDU receiver checks code on incoming PDU receiver checks code on incoming PDU if error, discard if error, discard if transmitter doesn’t get acknowledgment in reasonable time, retransmit if transmitter doesn’t get acknowledgment in reasonable time, retransmit  can use an error-correction code enables receiver to detect and possibly correct errors enables receiver to detect and possibly correct errors  performed at various protocol layers

16. 7. Addressing  addressing level  addressing scope  connection identifiers  addressing mode

17. Addressing Level  level in architecture where entity is named  have a unique address for each intermediate and end system  usually a network-level address to route PDU e.g. IP address or internet address e.g. IP address or internet address e.g. OSI - network service access point (NSAP) e.g. OSI - network service access point (NSAP)  at destination data must routed to some process e.g. TCP/IP port e.g. TCP/IP port e.g. OSI service access point (SAP) e.g. OSI service access point (SAP)

18. Addressing Scope  global address which identifies unique system unambiguous unambiguous synonyms permitted synonyms permitted system may have more than one global address system may have more than one global address global applicability global applicability enables internet to route data between any two systems enables internet to route data between any two systems  need unique address for each interface on network MAC address on IEEE 802 network and ATM host address MAC address on IEEE 802 network and ATM host address enables network to route data units through network enables network to route data units through network  only relevant for network-level addresses  port or SAP above network level is unique within system

19. Connection Identifiers  is used by both entities for future transmissions  advantages: reduced overhead since smaller reduced overhead since smaller routing using a fixed route tagged by connection ID routing using a fixed route tagged by connection ID multiplexing of multiple connections multiplexing of multiple connections use of state information use of state information

20. Addressing Mode  address usually refers to single system individual or unicast address individual or unicast address  can refer to more than one system for multiple simultaneous recipients for data multiple simultaneous recipients for data broadcast for all entities within domain broadcast for all entities within domain multicast for specific subset of entities multicast for specific subset of entities

21. 8. Multiplexing  multiple connections into single system e.g. frame relay, can have multiple data link connections terminating in single end system e.g. frame relay, can have multiple data link connections terminating in single end system e.g. multiple TCP connections to given system e.g. multiple TCP connections to given system  upward multiplexing have multiple higher level connections over a single lower level connection have multiple higher level connections over a single lower level connection  downward multiplexing have single higher level connection built on multiple lower level connections have single higher level connection built on multiple lower level connections

22. 9. Transmission Services  may have additional services to entities: priority on connection basis or message basis priority on connection basis or message basis quality of service quality of service e.g. minimum throughput or maximum delay thresholde.g. minimum throughput or maximum delay threshold security mechanisms, restricting access security mechanisms, restricting access  these depend on underlying transmission system and lower-level entities

23. Protocol case study: Internetworking

24. Internetworking Terms  communications Network  internet  the Internet  intranet  End System (ES)  Intermediate System (IS)  bridge  router

25. Requirements of Internetworking  link between networks  routing and delivery of data between processes on different networks  accounting services and status info  independent of network architectures

26. Network Architecture Features  addressing  packet size  access mechanism  timeouts  error recovery  status reporting  routing  user access control  connection based or connectionless

27. Architectural Approaches  connection oriented virtual circuit virtual circuit  connectionless datagram datagram PDU’s routed independently from source ES to dest ES through routers and networks PDU’s routed independently from source ES to dest ES through routers and networks share common network layer protocol, e.g. IP share common network layer protocol, e.g. IP below have network access on each node below have network access on each node

28. Connectionless Internetworking  advantages flexibility flexibility robust robust no unnecessary overhead no unnecessary overhead  unreliable not guaranteed delivery not guaranteed delivery not guaranteed order of delivery not guaranteed order of delivery packets can take different routespackets can take different routes reliability is responsibility of next layer up (e.g. TCP) reliability is responsibility of next layer up (e.g. TCP)

29. IP Operation

30. Design Issues  routing  datagram lifetime  fragmentation and re-assembly  error control  flow control

31. The Internet as a Network

32. Routing  ES / routers maintain routing tables indicate next router to which datagram is sent indicate next router to which datagram is sent static static dynamic dynamic  source routing source specifies route to be followed source specifies route to be followed can be useful for security & priority can be useful for security & priority  route recording

33. Datagram Lifetime  datagrams could loop indefinitely consumes resources consumes resources transport protocol may need upper bound on lifetime of a datagram transport protocol may need upper bound on lifetime of a datagram  can mark datagram with lifetime Time To Live field in IP Time To Live field in IP when lifetime expires, datagram discarded when lifetime expires, datagram discarded simplest is hop count (it is what actually is implemented) simplest is hop count (it is what actually is implemented) TTL=0 is for same host TTL=1 is for same subnetTTL=0 is for same host TTL=1 is for same subnet TTL= 32 is for same site TTL=64 is for same regionTTL= 32 is for same site TTL=64 is for same region TTL=128 is for same continent TTL=255 is unrestrictedTTL=128 is for same continent TTL=255 is unrestricted

34. Fragmentation and Re-assembly  may have different packet sizes on networks along path used by datagram on networks along path used by datagram  issue of when to re-assemble at destination at destination packets get smaller as data traverses internetpackets get smaller as data traverses internet intermediate re-assembly intermediate re-assembly need large buffers at routersneed large buffers at routers buffers may fill with fragmentsbuffers may fill with fragments all fragments must go through same routerall fragments must go through same router

35. IP Fragmentation  IP re-assembles at destination only  uses fields in header Data Unit Identifier (ID) Data Unit Identifier (ID) identifies end system originated datagramidentifies end system originated datagram Data length Data length length of user data in octetslength of user data in octets Offset Offset position of fragment of user data in original datagramposition of fragment of user data in original datagram in multiples of 64 bits (8 octets)in multiples of 64 bits (8 octets) More flag More flag indicates that this is not the last fragmentindicates that this is not the last fragment

36. Fragmentation Example

37. Dealing with Failure  re-assembly may fail if some fragments get lost  need to detect failure  re-assembly time out assigned to first fragment to arrive assigned to first fragment to arrive if timeout expires before all fragments arrive, discard partial data if timeout expires before all fragments arrive, discard partial data  use packet lifetime (time to live in IP) if time to live runs out, kill partial data if time to live runs out, kill partial data

38. Error Control  no guaranteed delivery  router should attempt to inform source if packet discarded  source may modify transmission strategy  may inform high layer protocol  need datagram identification  see ICMP in next section

39. Flow Control  allows routers and/or stations to limit rate of incoming data  limited in connectionless systems  send flow control packets to request reduced flow  see ICMP in next section

40. Internet Protocol (IP) v4  IP version 4  defined in RFC 791  www.rfc-editor.org www.rfc-editor.org  part of TCP/IP suite  two parts specification of interface with a higher layer specification of interface with a higher layer e.g. TCPe.g. TCP specification of actual protocol format and mechanisms specification of actual protocol format and mechanisms  will (eventually) be replaced by IPv6

41. IP Services  Primitives functions to be performed functions to be performed form of primitive implementation dependent form of primitive implementation dependent Send - request transmission of data unit Send - request transmission of data unit Deliver - notify user of arrival of data unit Deliver - notify user of arrival of data unit  Parameters used to pass data and control info used to pass data and control info

42. IP Parameters  source & destination addresses  protocol  type of Service  identification  don’t fragment indicator  time to live  data length  option data  user data

43. IP Options  security  source routing  route recording  stream identification  timestamping

44. IPv4 Header

45. Header Fields  http://www.tcpipguide.com/free/t_IPDatagr amGeneralFormat.htm http://www.tcpipguide.com/free/t_IPDatagr amGeneralFormat.htm http://www.tcpipguide.com/free/t_IPDatagr amGeneralFormat.htm

46. Header Fields (1)  Version currently 4 currently 4 IP v6 - see later IP v6 - see later  Internet header length in 32 bit words in 32 bit words including options including options  DS/ECN (was type of service)  total length of datagram, in octets of datagram, in octets

47. Header Fields (2)  Identification sequence number sequence number identify datagram uniquely with addresses / protocol identify datagram uniquely with addresses / protocol  Flags More bit More bit Don’t fragment Don’t fragment  Fragmentation offset  Time to live  Protocol Next higher layer to receive data field at destination Next higher layer to receive data field at destination

48. Header Fields (3)  Header checksum reverified and recomputed at each router reverified and recomputed at each router 16 bit ones complement sum of all 16 bit words in header 16 bit ones complement sum of all 16 bit words in header set to zero during calculation set to zero during calculation  Source address  Destination address  Options  Padding to fill to multiple of 32 bits long to fill to multiple of 32 bits long

49. Data Field  carries user data from next layer up  integer multiple of 8 bits long (octet)  max length of datagram (header plus data) is 65,535 octets

50. IPv4 Address Formats

51. IP Addresses - Class A  start with binary 0  all 0 reserved  01111111 (127) reserved for loopback  range 1.x.x.x to 126.x.x.x  all allocated

52. IP Addresses - Class B  start with binary 10  range 128.x.x.x to 191.x.x.x  second octet also included in network address  2 14 = 16,384 class B addresses  all allocated

53. IP Addresses - Class C  start with binary 110  range 192.x.x.x to 223.x.x.x  second and third octet also part of network address  2 21 = 2,097,152 addresses  nearly all allocated see IPv6 see IPv6

54.  Decimal code to simplify address management.  Decimal code to simplify address management.  00001010 00000000 00000000 00000000 = 10.0.0.0 (classe A) Class A examples: Class A examples: BBN (4.0.0.0), General Electric (3.0.0.0), Hewlett-Packard (15.0.0.0), Apple (17.0.0.0), AT&T (12.0.0.0), IBM (9.0.0.0), DEC (16.0.0.0), MIT (18.0.0.0)BBN (4.0.0.0), General Electric (3.0.0.0), Hewlett-Packard (15.0.0.0), Apple (17.0.0.0), AT&T (12.0.0.0), IBM (9.0.0.0), DEC (16.0.0.0), MIT (18.0.0.0) Class B example : UQAC (132.212.0.0) Class B example : UQAC (132.212.0.0)

55.  Special cases :  Special cases : "loopback address" : 127.0.0.1 "loopback address" : 127.0.0.1 Non-routable addresses : Non-routable addresses : 10.0.0.0 à 10.255.255.25510.0.0.0 à 10.255.255.255 172.16.0.0 à 172.31.255.255172.16.0.0 à 172.31.255.255 192.168.0.0 à 192.168.255.255192.168.0.0 à 192.168.255.255  if hostid = 111....1, "broadcast" in the local network  if hostid = 111....1, "broadcast" in the local network  Addresses assigned by central organisations ARIN, RIPR NCC, LACNIC and APNIC ARIN, RIPR NCC, LACNIC and APNIC ARIN InterNIC: www.internic.net InterNIC: www.internic.netwww.internic.net

56.  IP addresses index : www.flumps.org/ip/ www.flumps.org/ip/  Subnet mask: Allows to define netid and subnetid. Allows to define netid and subnetid. Document 1Document 1Document 1Document 1 Document 2Document 2Document 2Document 2  ipconfig /all netmask, default gateway… netmask, default gateway… ping 127.0.0.1 (and pinging his own address) ping 127.0.0.1 (and pinging his own address)

57. Subnets and Subnet Masks  allows arbitrary complexity of internetworked LANs within organization  insulate overall internet from growth of network numbers and routing complexity  site looks to rest of internet like single network  each LAN assigned subnet number  host portion of address partitioned into subnet number and host number  local routers route within subnetted network  subnet mask indicates which bits are subnet number and which are host number

58. Subnet Mask Calculation

59.  Animation : address management Animation  When the default gateway is actually used Decision based on netmask Decision based on netmask  Notes: RFC 950 suggest not to use subnets having all 0s and all 1s. (2 subnets not used) RFC 950 suggest not to use subnets having all 0s and all 1s. (2 subnets not used) Modern routers can use those two particular subnets.. Modern routers can use those two particular subnets.. To display routing table on a PC : netstat –r To display routing table on a PC : netstat –r Example of use : route.xlsExample of use : route.xlsroute.xls extracted from : Document extracted from : DocumentDocument

60. Routing Using Subnets

61.  IP masquarading (using LINUX) is also called NAT (network address translation) Local linkl : IP masquarading Local linkl : IP masquaradingIP masquaradingIP masquarading Link to www.linux.org (more up to date) : Link to www.linux.org (more up to date) : http://www.linux.org/docs/ldp/howto/IP- Masquerade-HOWTO/index.html http://www.linux.org/docs/ldp/howto/IP- Masquerade-HOWTO/index.html http://www.linux.org/docs/ldp/howto/IP- Masquerade-HOWTO/index.html http://www.linux.org/docs/ldp/howto/IP- Masquerade-HOWTO/index.html  table of correspondence table of correspondence table of correspondence  Proxy server Netscape : "Edit->Preferences->Advanced" Netscape : "Edit->Preferences->Advanced" Internet Explorer : « Tools"-> « Internet Options" -> "Connexion" -> « LAN Parameter Internet Explorer : « Tools"-> « Internet Options" -> "Connexion" -> « LAN Parameter

62. ICMP  Internet Control Message Protocol  RFC 792 (get it and study it)  transfer of (control) messages from routers and hosts to hosts  feedback about problems e.g. time to live expired e.g. time to live expired  encapsulated in IP datagram hence not reliable hence not reliable

63. ICMP Message Formats

64. Common ICMP Messages  destination unreachable  time exceeded  parameter problem  source quench  redirect  echo & echo reply  timestamp & timestamp reply (used for synchronization)  address mask request & reply

65. Address Resolution Protocol (ARP)  need MAC address to send to LAN host manual manual included in network address included in network address use central directory use central directory use address resolution protocol use address resolution protocol  ARP (RFC 826) provides dynamic IP to ethernet address mapping source broadcasts ARP request source broadcasts ARP request destination replies with ARP response destination replies with ARP response

66. IP Versions  IP v 1-3 defined and replaced  IP v4 - current version  IP v5 - streams protocol  IP v6 - replacement for IP v4 during development it was called IPng (IP Next Generation) during development it was called IPng (IP Next Generation)

67. Why Change IP?  Address space exhaustion two level addressing (network and host) wastes space two level addressing (network and host) wastes space network addresses used even if not connected network addresses used even if not connected growth of networks and the Internet growth of networks and the Internet extended use of TCP/IP extended use of TCP/IP single address per host single address per host  requirements for new types of service

68. IPv6 RFCs  RFC 1752 - Recommendations for the IP Next Generation Protocol requirements requirements PDU formats PDU formats addressing, routing security issues addressing, routing security issues  RFC 2460 - overall specification  RFC 2373 - addressing structure  many others  www.rfc-editor.org www.rfc-editor.org

69. IPv6 Enhancements  expanded 128 bit address space  improved option mechanism most not examined by intermediate routes most not examined by intermediate routes  dynamic address assignment  increased addressing flexibility anycast & multicast anycast & multicast  support for resource allocation labeled packet flows labeled packet flows

70. IPv6 PDU (Packet) Structure

71. IP v6 Header

72. IP v6 Flow Label  related sequence of packets  needing special handling  identified by src & dest addr + flow label  router treats flow as sharing attributes e.g. path, resource allocation, discard requirements, accounting, security e.g. path, resource allocation, discard requirements, accounting, security  may treat flows differently buffer sizes, different forwarding precedence, different quality of service buffer sizes, different forwarding precedence, different quality of service  alternative to including all info in every header  have requirements on flow label processing

73. IPv6 Addresses  128 bits long 6.6 X 10 23 addresses per m 2 (optimistic) 6.6 X 10 23 addresses per m 2 (optimistic) 1500 addresses per m 2 (pessimistic) 1500 addresses per m 2 (pessimistic)  assigned to interface  single interface may have multiple unicast addresses  three types of addresses: unicast - single interface address unicast - single interface address anycast - one of a set of interface addresses anycast - one of a set of interface addresses multicast - all of a set of interfaces multicast - all of a set of interfaces

74. IPv6 Extension Headers

75. Hop-by-Hop Options  must be examined by every router if unknown discard/forward handling is specified if unknown discard/forward handling is specified  next header  header extension length  options Pad1 Pad1 PadN PadN Jumbo payload (over 65535 bytes) Jumbo payload (over 65535 bytes) Router alert Router alert

76. Fragmentation Header  fragmentation only allowed at source  no fragmentation at intermediate routers  node must perform path discovery to find smallest MTU of intermediate networks  set source fragments to match MTU  otherwise limit to 1280 octets  header includes fragment offset fragment offset more fragments bit more fragments bit identification identification

77. Routing Header  list of one or more intermediate nodes to visit  header includes Next Header Next Header Header extension length Header extension length Routing type Routing type Segments left Segments left  Type 0 routing provides a list of addresses initial destination address is first on list initial destination address is first on list current destination address is next on list current destination address is next on list final destination address will be last in list final destination address will be last in list

78. Destination Options Header  carries optional info for destination node  format same as hop-by-hop header

79. Virtual Private Networks

80.  set of computers interconnected using an insecure network e.g. linking corporate LANs over Internet e.g. linking corporate LANs over Internet  using encryption & special protocols to provide security to stop eavesdropping & unauthorized users to stop eavesdropping & unauthorized users  proprietary solutions are problematical  hence development of IPSec standard

81. IPSec  RFC 1636 (1994) identified security need  encryption & authentication to be IPv6  but designed also for use with current IPv4 http://en.wikipedia.org/wiki/IPSec http://en.wikipedia.org/wiki/IPSec http://en.wikipedia.org/wiki/IPSec  applications needing security include: branch office connectivity branch office connectivity remote access over Internet remote access over Internet extranet & intranet connectivity for partners extranet & intranet connectivity for partners electronic commerce security electronic commerce security

82. IPSec Scenario

83. IPSec Benefits  provides strong security for external traffic  resistant to bypass  below transport layer hence transparent to applications  can be transparent to end users  can provide security for individual users if needed  IP addresses of end points can be encrypted (two modes: encrypted or not)

84. IPSec Functions  Authentication Header for authentication only for authentication only  Encapsulating Security Payload (ESP) for combined authentication/encryption for combined authentication/encryption  a key exchange function manual or automated manual or automated  VPNs usually need combined function  see chapter 21

85. Summary  basic protocol functions  internetworking principles  connectionless internetworking  IP  IPv6  IPSec