1. ECEN5553 Telecom Systems Dr. George ScheetsWeek #5 Read [9a] "The Cognitive Net is Coming" [8b] "How Can the Internet Have Too Many Routes and Not Enough Addresses?" [10a] "Cybercrime: Dissecting the State of Underground Enterprise" [10b] "A Call to Cyber Arms" [11a] "The Complete Story of Phish" [11b] "Target Breach Happened Because of a Basic Network Segmentation Error" [11c] "Sony Hack Dubbed 'Unparalleled' Crime" Exam #1 Lecture 15, 21 September (Live) No later than 28 September (Remote DL) Outline 7 October 2015, Lecture 22 (Live) No later than 14 October (Remote DL)

2. Outlines Received due 7 October (local) 14 October (remote) 12 %

3. Exam #1 (90 points) Exam #1 (90 points) n Friday, 21 September (Local) Remote Distant Learners, no later than 28 September n Work 3 of 4 pages n Closed Book & Notes n Calculators & phones are NOT allowed...Set up numerical problem for full credit n Most equations are provided (on 5th page) n Approximately 40% of upcoming exam will be lifted from the Fall 2014 Exam #1 n Anything in the notes, on Power Point, or in reading assignments is fair game

4. On Short Answer or Essay Questions n Answer the Question! n Memory Dump in the space provided u Knowledgeable individual can write more u Grader will look for "Power Point bullets" u Same remarks as instructor's typically not required n To get "A" or "B", instructor needs to walk away with impression you could've said more u Got space? Anything else pertinent to add? u It is NOT necessary to write small or fill up allotted space to get a good score! u Lost points? No comments? → Insufficient info provided u Rule of Thumb: "X" point question needs > "X" facts

5. Wireshark Packet Capture n This interaction startedwith a click on a Firefox bookmark to a distance calculator from a computer in Engineering South at OSU Stillwater. Firefox then triggers a query to an OSU Domain Name Server asking for the IPv4 address of www.indo.com. This is next followed by a TCP 3 way handshake to open logical connections, an HTTP request to download the distance calculator page, and the beginning of the file transfer.

6. ISO OSI Seven Layer Model n Layer 7 Application n Layer 6 Presentation Windows API n Layer 5 Session Windows TCP n Layer 4 Transport Windows TCP n Layer 3 Network Windows IP n Layer 2 Data Link PC NIC n Layer 1 Physical PC NIC MSS = 1460 B = Size of Layer 6 & 7 info per packet Ethernet Payload = 1500 B

7. TCP Window Size (Layer 4) Effects End-to-End Throughput n Suppose u Window Size (set by PC) = 64 KB F Microsoft Windows XP u Maximum Segment Size = 1 KB u Server can send < 64 unACK'd packets Server PC 3,000 Km

8. Throughput on 64 Kbps Line Server PC 3,000 Km, 64 Kbps line n NPD = Prop Delay / Packet inject time u Prop Delay = distance / EM energy speed = 3,000,000 m / 200,000,000 m/sec = 0.015 seconds u Packet inject time = 8,376 bits / 64 Kbits/sec = 0.1309 seconds (7B PPP, 20B IPv4, 20B TCP) u NPD = 0.015 / 0.1309 = 0.1146 u Front end of packet arrives at far side prior to back end being transmitted. Packet #1

9. Throughput on 64 Kbps Line Server PC 3,000 Km, 64 Kbps line n At this instant in time... u 2nd unACK'd packet is being transmitted u ACK for #1 enroute back to server F TCP+IP+Layer 2 → 47 bytes if PPP u When ACK#1 arrives at server, only packet #2 is unacknowledged. n Will 64 packet unACK'd limit be reached? u No. At most, 1 packet likely unACK'd. Packet #2 #1 #1 ACK

10. Throughput on 45 Mbps Line Server PC 3,000 Km, 45 Mbps line n NPD = Prop Delay / Packet inject time u Prop Delay = distance / EM energy speed = 3,000,000 m / 200,000,000 m/sec = 0.015 seconds u Packet inject time = 8,376 bits / 45 Mbits/sec = 186.1 μseconds (PPP, IPv4, TCP overhead) u NPD = 0.015 / 0.0001861 = 80.60 u 80.60 average sized packets will fit back-to-back on this line #1#2#3

11. Throughput on 45 Mbps Line Server PC 3,000 Km, 45 Mbps line n At this instant in time, the Server... u Has transmitted 64 packets w/o ACK. u Has hit window limit. Halts. Packets 1 - 64

12. Throughput on 45 Mbps Line Server PC 3,000 Km, 45 Mbps line n At this instant in time, u The PC has processed 1st packet & sent an ACK u The Server is still halted, waiting for ACK #1. F When ACK #1 arrives, server can then transmit one additional packet. F Other ACK’s arrive fast enough to allow back-to- back transmission of next group of 64 packets Packets 2 - 64 #1 ACK#1

13. Can Estimate Throughput with a Time Line time t o = 0 n t o : Leading edge of 1st packet injected n t 1 : Trailing edge of 64th packet injected u t 1 = (64*1047B)(8b/B)/(45 Mb/sec) = 11.91 msec n t 2 : Leading edge of 1st packet hits far side u 15 msec (propagation delay) u If ACK injected right away... n t 3 :...ACK arrives at server at t = 30 msec n Process Repeats... t1t1 t2t2 t3t3

14. Can Estimate Throughput with a Time Line time (msec) t o = 0 n This system can transmit u 64(1,047) = 67,008 B = 536,064 bits u Every 30 msec (one round trip time) u Estimated throughput = 536,064/0.03 = 17.89 Mbps n Actual throughput a bit lower u 1st ACK not transmitted until packet #1 fully received... F... and processed by PC u 65th packet not transmitted until ACK #1 fully received... F... and processed by Server 11.9115.0030.00

15. Can Estimate Throughput with a Time Line time (msec) t o = 0 n Need to be able to fill the pipe for 1 RTT u 30 msec in our example u 45 Mbps *.030 sec = 1.35 M b = 168,750 B = 168,750/1,047 = 161.2 packets u Window Size needs to be = 161.2 segments*1,000 bytes/segment = 161,200 B n Actually would need another segment or two to cover source & sink processing 11.9115.0030.00

16. TCP Header Source PortDestination Port Sequence Number ACK Number Window Checksum 4 Bytes

17. UDP Header (8 Bytes) Source PortDestination Port Checksum 4 Bytes For interactive real-time traffic, usually used with Real Time Transport Protocol (12 bytes).

18. Virtual Circuits n Routing decisions made once when circuit is set up u Concerned switches have internal Look-Up tables updated n All packets part of info transfer follow the same path n Allows option of setting aside switch resources (buffer space, bandwidth) for specific traffic flows n MPLS, Frame Relay, ATM, & Carrier Ethernet use VC’s

19. Datagrams n IP uses Datagrams n Routing Tables updated independently of individual traffic flows u Routers continuously talking with each other u Packets may follow different paths n Routers get no advance warning of specific packet flows.

20. IP is Connectionless Data + Padding 20 20 up to 1,460 IPTCP I/O decisions based on IP address & look-up table. Tables updated independent of traffic, hence path thru network may suddenly change. TCP is connection oriented.

21. TCP, UDP, and IP n 30+ year old Protocols Designed for data One Utilized Priority & “Best Effort” services No QoS Guarantees Available bandwidth depends on other users n TCP (Layer 4 & 5) provides reliable transfer n UDP (Layer 4 & 5) unreliable transfer n IP at Layer 3 n Arbitrary Protocols at Layers 1 & 2

22. Internet Traffic 2008 - 2009 Comparison source: http://www.sandvine.coms

23. Fixed Access Internet Traffic Profile Source: www.sandvine.com/downloads/documents/Phenomena_2H_2012/ Sandvine_Global_Internet_Phenomena_Snapshot_2H_2012_NA_Fixed.pdf & www.sandvine.com/downloads/general/global-internet-phenomena/2014/1h-2014-global-internet-phenomena-report.pdf 2013

24. 2015 Fixed Access https://www.sandvine.com/downloads/general/global-internet-phenomena/2015/global-internet-phenomena-report-latin-america-and- north-america.pdf

25. 2012 Mobile Access Internet Traffic Profile http://www.sandvine.com/downloads/documents/Phenomena_2H_2012/ Sandvine_Global_Internet_Phenomena_Snapshot_2H_2012_NA_Mobile.pdf

26. 2013 Mobile Access Internet Traffic Profile source: www.sandvine.com/downloads/general/global-internet-phenomena/2014/1h-2014-global-internet-phenomena-report.pdf

27. 2015 Mobile Access https://www.sandvine.com/downloads/general/global-internet-phenomena/2015/global-internet-phenomena-report-latin-america-and- north-america.pdf

28. Internet Traffic Growth source: "The Road to 100G Deployment", IEEE Communications Magazine, March 2010

29. Internet Traffic Growth source: www.cisco.com/c/en/us/solutions/collateral/service-provider/visual-networking-index-vni/VNI_Hyperconnectivity_WP.html

30. Combining the Figures

31. VoIP  PC to PC  Internet Phone to Internet Phone Commodity Internet

32. VoIP  PC to Wired Phone  Internet Phone to Wired Phone Commodity Internet Gateway Phone System

33. VoIP (Wired Phone-to-Wired Phone)  Carrier prioritizes VoIP traffic (DiffServ)  Paths nailed down (MPLS)  Gateways control # of voice calls  Good Quality Possible with this configuration "QoS Enabled" Internet Gateway Phone System Gateway Phone System

34. Traditional Videoconferencing Camera Codec 384 Kbps fixed rate output (video + audio) Codec Audio Video Dedicated Bandwidth Network: Circuit Switched TDM 6 Bytes @ 8000 times/sec *State Owned Fiber *ISDN

35. 2002 Videoconferencing V2.0 Camera Codec 384 Kbps fixed rate output (video + audio) Now > 784 Kbps Codec Audio Video Packet Switched StatMuxed Prioritized *State Owned Fiber This is technique being used in this class for video to & from Tulsa & Stillwater.

36. Internet Video Streaming PC Disk Drive The Internet Quality of Received Stream depends on: (1) Size of your pipe. (2) Internet congestion. (3) Server congestion.

37. Internet Video Streaming Stillwater Video Server generates packets. Fairly steady generation if server not swamped. Rate depends on pipe size. Disk Drive

38. Internet Video Streaming Disk Drive Internet Video Server Packets exit at an irregular rate. Random delays. Non-Dedicated Bandwidth (Packet Switched, Stat Muxing)

39. ISP Routes can be Roundabout Launched 30 January 2007, 2 miles from OSU campus n n 1 Dr. Scheets' home router n n 6 SBC routers u u adsl-70-233-191-254.dsl.okcyok.sbcglobal.net u u ex2-p11-0.eqchil.sbcglobal.net n n 7 Level3 routers u u Te-3-2.Chicago1.Level3.net u u kscymo2wcx010-pos9-0-oc48.wcg.net u u tulsok6wcx2-pos11-0-oc48.wcg.net n n 5 ONENET routers u u at least 1 in Oklahoma City n 3 Oklahoma State routers Using DiffServe, End-to-End performance on this 22 router path...

40. ISP Routes can be Roundabout Launched 5 September 2008, 2 miles from OSU campus n n 1 Scheets' home router n n 4 SBC routers u u adsl-70-233-191-254.dsl.okcyok.sbcglobal.net u u bb1-g1-0-2.rcfril.sbcglobal.net n n 1 Equinix router n n 1 Transitrail router u u onenet.chcgil01.transitrail.net n n 3 ONENET routers u u at least 1 in Oklahoma City n 4 Oklahoma State routers n rtt = 55 msec...may be worse than End-to-End performance on this 14 router path when not using DiffServ.

41. LAN Internet Service Provider Network Router Trunks Leased Line PC Corporate sites using Internet as WAN. Can pay ISP extra $$ → Traffic between sites gets preferential treatment.

42. Interactive VOICE & VIDEO over the commodity INTERNET (Best Effort, No Priorities) n Is not ready for Prime Time n Delay & Quality problems difficult to solve under the current system... n...although throwing Bandwidth at the problem will alleviate n Has a place for the user whose main concern is $$$$ or convenience

43. LAN Internet Service Provider Network Routers operate at Layers 1-3. PC’s operate at Layers 1-7. Routers do not monitor opening of TCP Logical Connections. RSVP would change this. Router Trunks Leased Line PC

44. Multi-Protocol Label Switching n Enables Virtual Circuits u End-to-End Paths nailed down u Traffic Engineering Easier u Resource Reservation Easier n Seeing fairly widespread ISP deployment

45. Internet QoS n Most every ISP is installing or testing one or more of following... u DiffServ u MPLS u Resource Reservation capability u Pricing structure to reflect different QoS... but they are not yet widely deployed. n As a result, currently the Commodity Internet remains mostly u Best Effort, FIFO Routing

46. Thinking of moving large amounts of high quality, time sensitive traffic over the Commodity Internet? Check back in 2-3 years when... n Priorities Enabled (IPv6 and/or DiffServ) n Resources Guaranteed (Resource Reservation Protocol (RSVP) or equivalent is deployed) n Flat rate pricing is gone

47. The Internet Is...  A superb information source  Sometimes difficult to separate wheat from chaff  IEEE Communications or Proceedings  Peer Reviewed  IEEE Spectrum  Reviewed by editor  Jane Doe's Web site  Reviewed by Jane Doe  A good marketing tool

48. The Internet Is... a Security Nightmare  Any-to-Any connectivity is both strength and weakness  Tracert yields Router IP Addresses  Could Telnet or HTTP to many. Password?  Espionage  Read “The Cuckoo’s Egg” by Cliff Stoll  Former #1 on New York Times Best Seller  Recommended by Dr. Scheets’ Mom

49. The Internet Is... a Security Nightmare The Internet Is... a Security Nightmare   Bad things have been out there for years   Viruses, Worms, Trojans, Denial of Service, etc.   November 2, 1988 Internet Worm   Network shut down for 2-3 days   Took advantage of   Unix buffer overflow problems   Poor password choices  2009-2010 Stuxnet Worm  State sponsored?  Seemed to target Iran's nuclear bomb program

50. The Internet Is... a Security Nightmare n TCOM5223 Information Assurance Management n TCOM5233 Applied Information Systems Security n TCOM5243 Information Technology Forensics n “Remember, when you connect with another computer, you're connecting to every computer that computer has connected to.” u Dennis Miller, Saturday Night Live

51. Pros of Using the Internet n n Any-to-Any Connectivity n n It’s Inexpensive (save $$$$) n n Tons of valuable information available n n Excellent marketing/sales tool

52. Cons of Using the Commodity Internet n n Any-to-Any Connectivity puts all attached machines at risk n n Slightly higher risk of Theft of Traffic n n Tons of Worthless Information Available n n No QoS guarantees or Guaranteed Bandwidth May have trouble rapidly moving large files May have trouble reliably moving time sensitive traffic WARNING: SECURITY HAZARD!

53. 802.3 Ethernet Packet Format MAC Destination Address MAC Source Address CRC Data + Padding Bytes: 7 1 6 6 2 40 20 6-1440 4 IPv6TCP

54. Connectionless vs. Connection Oriented n n Connectionless * Packet delivery may be out of order * Packet delivery NOT guaranteed * Packets may be mangled * End User’s responsibility to fix any problems n n Connection Oriented * Packet delivery in order * Packet delivery usually guaranteed

55. IP is Connectionless Data + Padding 20 20 up to 1,460 IPTCP I/O decisions based on IP address & look-up table. Tables updated independent of traffic.

56. Wide Area Connectivity Options n n Leased Line (a.k.a. Private Line) Network u u Switches are byte aware u u Circuit is assigned trunk BW via TDM F F BW required is based on peak input rates u u Route through system determined in advance. u u Pricing function of distance & peak rate u u Most expensive connectivity option u u Highest quality connectivity option

57. Leased Line Usage nUnUnUnU.S. Revenues still around $34 Billion in 2009 uDuDuDuDrop in Corporate uIuIuIuIncrease in wireless backhaul n$n$n$n$30 Billion in 2014 uSuSuSuShift is to Internet Services source: Insight Research

58. Switched Ethernet LAN's 100, 1,000 Mbps 10/100 Mbps Edge Router PC Switched Hub Switched Hub Switched Hub Leased Lines

59. Telecom Carriers dedicate 320, 128, and 256 Kbps links for our sole use via Circuit Switching. OKC Detroit NYC Carrier Leased Line Network Router Leased Line Ex) Corporate Leased Line Connectivity 320 Kbps 256 Kbps 128 Kbps

60. OKC Detroit NYC Carrier Leased Line Network Router 384 Kbps From/ToOKCDETNYC OKC-14476 DET88-28 NYC11234- 320 Kbps Ex) Corporate Leased Line Connectivity

61. How will company connect to Internet? n Configuration u Every site connect locally? u All sites connect thru, say, OKC? n Type of connection u Leased Line u DSL? u Cable Modem? u Other?

62. Ex) Internet thru OKC Traffic matrix should expand to include ISP. Faster line speeds likely required. OKC Detroit NYC Carrier Leased Line Network Router Leased Line ISP

63. OKC Detroit NYC Carrier Leased Line Network Router ISP Ex) Internet thru OKC From\ToOKCDETNYCISP OKC-1447660 DET88-2850 NYC11234-40 ISP11010090- How big should the pipe to the ISP be? 300 Kbps is outbound from ISP > 640 Kbps circuit needed. 640 Kbps

64. OKC Detroit NYC Carrier Leased Line Network Router 576 Kbps ISP 448 Kbps Ex) Internet thru OKC From\ToOKCDETNYCISP OKC-1447660 DET88-2850 NYC11234-40 ISP11010090- Need to bump size of other 2 pipes. 194/186 I/O @ NYC → 448 Kbps 278/166 I/O @ DET → 576 Kbps 640 Kbps