Chapter 6 IPv4 Addresses

Transcription

1 Chapter 6 IPv4 Addresses

2 Network Math 2

3 Base 10 (Decimal) Number System Digits (10): 0, 1, 2, 3, 4, 5, 6, 7, 8, 9 Number of: ,000 s 1,000 s 100 s 10 s 1 s 1,

4 Number System Rules 1. All digits start with 0 2. A Base-n number system has n number of digits: Decimal: Base-10 has 10 digits Binary: Base-2 has 2 digits Hexadecimal: Base-16 has 16 digits 3. The first column is always the number of 1 s Each of the following columns is n times the previous column (n = Base-n) Base 10: 10,000 1, Base 2: Base 16: 65,536 4,

5 Digits (2): 0, 1 Number of: Dec s 8 s 4 s 2 s 1 s

6 Digits (2): 0, 1 Number of: Dec s 64 s 32 s 16 s 8 s 4 s 2 s 1 s

7 Digits (2): 0, 1 Number of: Dec s 64 s 32 s 16 s 8 s 4 s 2 s 1 s

8 Digits (2): 0, 1 Number of: Dec s 64 s 32 s 16 s 8 s 4 s 2 s 1 s

9 IPv4 Addresses

10 IPv4 Addresses IPv4 addresses are 32 bit addresses 10

11 IPv4 Addresses IPv4 Addresses are 32 bit addresses: We use dotted notation (or dotted decimal notation) to represent the value of each byte (octet) of the IP address in decimal

12 IPv4 Addresses An IP address has two parts: network number host number Which bits refer to the network number? Which bits refer to the host number? 12

13 IPv4 Addresses Answer: Newer technology - Classless IP Addressing The subnet mask determines the network portion and the host portion. Value of first octet does NOT matter (older classful IP addressing) Hosts and Classless Inter-Domain Routing (CIDR). Classless IP Addressing is what is used within the Internet and in most internal networks. Older technology - Classful IP Addressing (later) Value of first octet determines the network portion and the host portion. Used with classful routing protocols like RIPv1. The Cisco IP Routing Table is structured in a classful manner We shall see this on the CCNA Routing part 13

14 Types of Addresses Network Addresses have all 0 s in the host portion. Subnet Mask: Network address - The address by which we refer to the network Broadcast address - A special address used to send data to all hosts in the network Host addresses - The addresses assigned to the end devices in the network 14

15 Types of Addresses Broadcast Addresses have all 1 s in the host portion. Subnet Mask: Network address - The address by which we refer to the network Broadcast address - A special address used to send data to all hosts in the network Host addresses - The addresses assigned to the end devices in the network 15

16 Types of Addresses Host Addresses can not have all 0 s or all 1 s in the host portion. Subnet Mask: Network address - The address by which we refer to the network Broadcast address - A special address used to send data to all hosts in the network Host addresses - The addresses assigned to the end devices in the network 16

17 Dividing the Network and Host Portions Subnet Mask Used to define the: Network portion Host portion 32 bits Contiguous set of 1 s followed by a contiguous set of 0 s 1 s: Network portion 0 s: Host portion 17

18 Dividing the Network and Host Portions Expressed as: Dotted decimal Ex: Slash notation or prefix length /16 (the number of one bits) Dotted decimal: Slash notation: /16 18

19 Network Addresses Subnet Mask: Network address - The address by which we refer to the network All binary 0 s in the host portion of the address (more later) 19

20 Example 1 Network Address: Subnet Mask: Network Host Network Address in binary: Subnet Mask in binary: Prefix Length: /24 20

21 Example 2 Network Address: Subnet Mask: Network Host Network Address in binary: Subnet Mask in binary: Prefix Length : /8 21

22 Example 3 Network Address: Subnet Mask: Network Host Network Address in binary: Subnet Mask in binary: Prefix Length: /16 22

23 Why the mask matters: Number of hosts! Subnet Mask: or / or /16 1st octet 2nd octet 3rd octet 4th octet Network Host Host Host Network Network Host Host or /24 Network Network Network Host The more host bits in the subnet mask means the more hosts in the network. Subnet masks do not have to end on natural octet boundaries 23

24 Subnet: (/8) Network Host Host Host 8 bits 8 bits 8 bits With 24 bits available for hosts, there a 2 24 possible addresses. That s 16,777,216 nodes! Only large organizations such as the military, government agencies, universities, and large corporations have networks with these many addresses. Example: A certain cable modem ISP has and a DSL ISP has

25 Subnet: (/16) Network Network Host Host 8 bits 8 bits With 16 bits available for hosts, there a 2 16 possible addresses. That s 65,536 nodes! 65,534 host addresses, one for network address and one for broadcast address. 25

26 Subnet: (/24) Network Network Network Host 8 bits With 8 bits available for hosts, there a 2 8 possible addresses. That s 256 nodes! 254 host addresses, one for network address and one for broadcast address. 26

27 IP Addresses There is a tradeoff between: The number of network bits and the number of networks (subnets) you can have AND The number of HOST bits and the number of hosts for each network you can have. This will be examined more closely, later. 27

28 Broadcast Addresses Broadcast address - A special address used to send data to all hosts in the network All binary 1 s in the host portion of the address (more later) 28

29 Bringing it all together Subnet Mask divides Network portion and Host portion: 1 s: Network portion 0 s: Host portion Network address: All 0 s in the host portion of the address Broadcast address: All 1 s in the host portion of the address 29

30 Host IP Addresses /24 Host IP Addresses contain: Network portion of the address Unique combination of 0 s and 1 s in the host portion of the address Cannot be all 0 s (network address) Cannot be all 1 s (broadcast address) Hosts have subnet masks to determine network portion (later) 30

31 Subnet Masks: Non-Natural Boundaries Subnet masks do not have to end on natural octet boundaries Convert these to binary: Network Address Subnet Mask

32 Subnet Masks: Non-Natural Boundaries Subnet masks do not have to end on natural octet boundaries What is the range of host addresses in dotted-decimal and binary? What is the broadcast address? How many host addresses? 32

33 Subnet Masks: Non-Natural Boundaries Subnet masks do not have to end on natural octet boundaries

34 Subnet Masks: Non-Natural Boundaries Subnet masks do not have to end on natural octet boundaries (broadcast) Number of hosts: = 4,096 2 = 4,094 hosts 34

35 Subnet Masks: Non-Natural Boundaries Subnet masks do not have to end on natural octet boundaries (broadcast) 35

36 Subnet Masks: Non-Natural Boundaries Subnet masks do not have to end on natural octet boundaries (broadcast) Number of hosts: = 32 2 = 30 hosts 36

37 Regional Internet Registries (RIR) The 5 RIR s are: AfriNIC (African Network Information Centre) - Africa Region APNIC (Asia Pacific Network Information Centre) - Asia/Pacific Region ARIN (American Registry for Internet Numbers) - North America Region LACNIC (Regional Latin-American and Caribbean IP Address Registry) - Latin America and some Caribbean Islands RIPE NCC (Reseaux IP Europeans) - Europe, the Middle East, and Central Asia

38 ISP (Internet Service Providers) Most companies or organizations obtain their IPv4 address blocks from an ISP. Tier 1 ISP: Large national or international ISPs that are directly connected to the Internet backbone. Customers of Tier 1 ISPs: lower-tiered ISPs large companies and organizations. Offer reliability and speed AOL, SPRINT, Global Crossing, AT&T, Level 3, Verizon, NTT, Quest, SAVVIS 38

39 ISP (Internet Service Providers) Most companies or organizations obtain their IPv4 address blocks from an ISP. Tier 2 ISP: Acquire their Internet service from Tier 1 ISPs. Tier 2 ISPs generally focus on business customers. Examples: Allstream, AboveNet, British Telecom, Cogent Communications, France Telecom, Teleglobe TeliaSonera International Carrier Time Warner Telecom, Tiscali International Network, XO Communications 39

40 ISP (Internet Service Providers) Most companies or organizations obtain their IPv4 address blocks from an ISP. Tier 3 ISP: Purchase their Internet service from Tier 2 ISPs. The focus of these ISPs is the retail and home markets in a specific locale. Examples: Local ISPs 40

41 Special Unicast IPv4 Addresses Default Route Loopback Address Special address that hosts use to direct traffic to themselves to Link-Local Addresses to ( /16) Can be automatically assigned to the local host by the operating system in environments where no IP configuration is available. TEST-NET Addresses to ( /24) Set aside for teaching and learning purposes. These addresses can be used in documentation and network examples. 41

42 Private IP Addresses RFC to ( /8) to ( /12) to ( /16) The addresses will not be routed in the Internet Need NAT/PAT (next) Should be blocked by your ISP Allows for any network to have up to 16,777,216 hosts (/8) 42

43 Introducing NAT and PAT NAT is designed to conserve IP addresses and enable networks to use private IP addresses on internal networks. These private, internal addresses are translated to routable, public addresses. IPv4 addresses are almost depleted. NAT/PAT has allowed IPv4 to be the predominant network protocol, keeping IPv6 at-bay (for now). 43

44 NAT Example The translation from Private source IP address to Public source IP address. 44

45 4 NAT Example 3 4 Translation back, from Public destination IP address to Private destination IP address. 3 45

46 PAT Example NAT/PAT table maintains translation of: DA, SA, SP

47 PAT Example NAT/PAT table maintains translation of: SA (DA), DA (SA), DP (SP)

48 The Subnet Mask and the AND Operation

49 Subnet Mask Host: I m a host on the /24 network. The subnet mask is used to separate the network portion from the host portion of the address. On a host, the subnet mask tells the host what network it belongs to. Why does a host need to know what network it belongs to? 49

50 Subnet Mask Host: I m a host on the /24 network. Why does a host need to know what network it belongs to? So, it knows whether to encapsulate the IP packet into an Ethernet frame with: The Destination MAC Address of the default gateway Must know the default gateway s IP address The Destination MAC Address of the host with the Destination IP address of the packet Later when we discuss Ethernet 50

51 Subnet Mask Network Host Host IP: Mask: Net Add: Devices such as hosts use the bit-wise AND operation on the: Host IP address Subnet mask AND operation: 1 AND 1 = 1 0 AND anything = 0 51

52 Subnet Mask Network Host Host IP: Mask: Net Add: AND operation: 1 AND 1 = 1 0 AND anything = 0 52

53 Subnet Mask Network Host Host IP: Mask: Net Add: AND operation: 1 AND 1 = 1 0 AND anything = 0 53

54 Subnet Masks: Non-Natural Boundaries Subnet masks do not have to end on natural octet boundaries (broadcast) Number of hosts: = 4,096 2 = 4,094 hosts 54

55 Subnetting: First Look

56 Subnets and Subnet Masks Formalized in 1985, the subnet mask breaks a single network in to smaller pieces. Allows network administrators to divide their network into small networks or subnets. Advantages will be discussed later. 56

57 What is subnetting? Network Network Host Host Network Network Subnet Host Subnetting is the process of borrowing bits from the HOST bits, in order to divide the larger network into small subnets. Subnetting does NOT give you more hosts, but actually costs you hosts. You lose two host IP Addresses for each subnet, one for the subnet IP address and one for the subnet broadcast IP address. You lose the last subnet and all of it s hosts IP addresses as the broadcast for that subnet is the same as the broadcast for the network. In older technology, you would have lost the first subnet, as the subnet IP address is the same as the network IP address. (This subnet can be used in most networks.) 57

58 Analogy 98 Apples (100 2) Before subnetting: In any network (or subnet) we can not use all the IP addresses for host addresses. We lose two addresses for every network or subnet. 1. Network Address - One address is reserved to that of the network. For Example: /16 2. Broadcast Address One address is reserved to address all hosts in that network or subnet. For Example: This gives us a total of 65,534 usable hosts 58

59 Analogy 10 barrels x 10 apples = 100 apples Apples (100 2) It is the same as taking a barrel of 100 apples and dividing it into 10 barrels of 10 apples each. 59

60 10 barrels x 8 apples = 80 apples (less 2) (less 2) (less 2) 98 Apples (100 2) 2 = 1 network address + 1 broadcast address (less 2) (less 2) (less 2) (less 2) (less 2) (less 2) However, in subnetting we will see that we lose two apples per subnet: one for the network address one for the broadcast address (less 2) 8 60

61 8 barrels x 8 apples = 64 apples 98 Apples (100 2) X (less 2) (less 2) (less 2) = 1 network address + 1 broadcast address (less 2) (less 2) (less 2) In legacy networks, we also lost: The first basket (subnet) The network address of the first subnet is the network address of the entire network The last basket (subnet) The broadcast address for the last subnet is the same as for the entire network. (less 2) (less 2) (less 2) X (less 2) 8 61

62 Subnet Example Network address with /16 Base Network Mask Using Subnets: Subnet Mask or /24 Network Network Subnet Host Subnet addresses: All 0 s in host portion Etc Subnets Addresses 256 Subnets

63 Subnet Example Network address with /16 Base Network Mask Using Subnets: Subnet Mask or /24 Network Network Subnet Hosts Etc Each subnet has 254 hosts, Broadcast

64 With NO subnetting: Host IP Address: A host of the /24 network Network First Host Last Host Broadcast ,534 host addresses, one for network address and one for broadcast address. Host IP Address: A host of the /16 network 64

65 With subnetting: Host IP Address: A host of the /24 network Network First Host Last Host Broadcast

66 With subnetting: Network First Host Last Host Broadcast Hosts ,024 Total address = 256 subnets * (256 hosts 2) = 256 * 254 = 65,024 NOTE: It is common for some network administrator to not use the last subnet. 66

67 With subnetting: Network First Host Last Host Broadcast Major Network Address: Major Network Mask: Major Network Broadcast Address: Subnet Mask: First Subnet: Subnet Address: Subnet Broadcast Address: Last Subnet: Subnet Address: Subnet Broadcast Address:

68 Calculating the number subnets/hosts needed

69 Calculating the number subnets/hosts needed Network Host Network /24 Need: As many subnets as possible, 60 hosts per subnet 69

70 Calculating the number subnets/hosts needed Number of hosts per subnet Network Host 6 host bits Network /24 Need: As many subnets as possible, 60 hosts per subnet 70

71 Calculating the number subnets/hosts needed Number of subnets Network Host 6 host bits Network /24 Need: As many subnets as possible, 60 hosts per subnet New Subnet Mask: (/26) Number of Hosts per subnet: 6 bits, 64-2 hosts, 62 hosts Number of Subnets: 2 bits or 4 subnets 71

72 Calculating the number subnets/hosts needed Network Host Network /24 Need: As many subnets as possible, 12 hosts per subnet 72

73 Calculating the number subnets/hosts needed Number of hosts per subnet Network Host 4 host bits Network /24 Need: As many subnets as possible, 12 hosts per subnet 73

74 Calculating the number subnets/hosts needed Number of hosts per subnet Number of subnets Network Host 4 host bits Network /24 Need: As many subnets as possible, 12 hosts per subnet New Subnet Mask: (/28) Number of Hosts per subnet: 4 bits, 16-2 hosts, 14 hosts Number of Subnets: 4 bits or 16 subnets 74

75 Calculating the number subnets/hosts needed Network Host Network /24 Need: Need 6 subnets, as many hosts per subnet as possible 75

76 Calculating the number subnets/hosts needed Number of subnets subnet bits Network Host Network /24 Need: Need 6 subnets, as many hosts per subnet as possible 76

77 Calculating the number subnets/hosts needed Number of hosts per subnet subnet bits Network Host Number of subnets Network /24 Need: Need 6 subnets, as many hosts per subnet as possible New Subnet Mask: (/27) Number of Hosts per subnet: 5 bits, 32-2 hosts, 30 hosts Number of Subnets: 3 bits or 8 subnets 77

78 VLSM (Variable Length Subnet Masks)

79 VLSM If you know how to subnet, you can do VLSM. Example: /8 Subnet in /16 subnets: / / / /16 Etc. Subnet one of the subnets ( /16) / / / /24 etc 79

80 VLSM Host can only be a member of the subnet. Host can NOT be a member of the network that was subnetted. YES! / /16 All other /16 subnets are still available for use as /16 networks or to be subnetted. NO! 80

81 VLSM Using the chart This chart can be used to help determine subnet addresses. This can any octet. We ll keep it simple and make it the fourth octet. Network: /24 What if we needed 10 subnets with a minimum of 12 hosts? What would the Mask be? What would the addresses of each subnet be? What would the range of hosts be for each subnet? 81

82 VLSM Using the chart Network: /24 What if we needed 5 subnets? What would the Mask be? (/28) What would the addresses of each subnet be? / / / / / / / /28 What would the range of valid hosts for each subnet? /26: /26: /26: /26: Etc. 82

83 16 /30 subnets VLSM Using the chart What if we needed several (four) /30 subnets for our serial links? Take one of the /27 subnets and subnet it again into /30 subnets. Still have 7 / 27 subnets 16 /30 subnets 83

84 Apply the information to this topology Using the worksheet provided apply the subnetting scheme to the topology. 84

85 Classful Subnetting

86 Classful IP Addressing In the early days of the Internet, IP addresses were allocated to organizations based on request rather than actual need. When an organization received an IP network address, that address was associated with a Class, A, B, or C. This is known as Classful IP Addressing The first octet of the address determined what class the network belonged to and which bits were the network bits and which bits were the host bits. There were no subnet masks. It was not until 1992 when the IETF introduced CIDR (Classless Interdomain Routing), making the address class meaning less. This is known as Classless IP Addressing. For now, all you need to know is that today s networks are classless, except for some things like the structure of Cisco s IP routing table and for those networks that still use Classful routing protocols. 86

87 IPv4 Address Classes 87

88 Address Classes Class A Class B 1st octet 2nd octet 3rd octet 4th octet Network Host Host Host Network Network Host Host Class C Network Network Network Host N = Network number assigned by ARIN (American Registry for Internet Numbers) H = Host number assigned by administrator 88

89 Class A addresses Default Mask: (/8) First octet is between 0 127, begins with 0 Network Host Host Host Number between bits 8 bits 8 bits With 24 bits available for hosts, there a 2 24 possible addresses. That s 16,777,216 nodes! There are 126 class A addresses. 0 and 127 have special meaning and are not used. 16,777,214 host addresses, one for network address and one for broadcast address. Only large organizations such as the military, government agencies, universities, and large corporations have class A addresses. For example ISPs have and Class A addresses account for 2,147,483,648 of the possible IPv4 addresses. That s 50 % of the total unicast address space, if classful was still used in the Internet! 89

90 Class B addresses Default Mask: (/16) First octet is between , begins with 10 Network Network Host Host Number between There are 16,384 (2 14 ) class B networks. 8 bits 8 bits With 16 bits available for hosts, there a 2 16 possible addresses. That s 65,536 nodes! 65,534 host addresses, one for network address and one for broadcast address. Class B addresses represent 25% of the total IPv4 unicast address space. Class B addresses are assigned to large organizations including corporations (such as Cisco, government agencies, and school districts). 90

91 Class C addresses Default Mask: (/24) First octet is between , begins with 110 Network Network Network Host Number between bits With 8 bits available for hosts, there a 2 8 possible addresses. That s 256 nodes! There are 2,097,152 possible class C networks. 254 host addresses, one for network address and one for broadcast address. Class C addresses represent 12.5% of the total IPv4 unicast address space. 91

92 IPv4 Address Classes No medium size host networks In the early days of the Internet, IP addresses were allocated to organizations based on request rather than actual need. 92

93 Network based on first octet The network portion of the IP address was dependent upon the first octet. There was no Base Network Mask provided by the ISP. The network mask was inherent in the address itself. 93

94 IPv4 Address Classes Class D Addresses A Class D address begins with binary 1110 in the first octet. First octet range 224 to 239. Class D address can be used to represent a group of hosts called a host group, or multicast group. Class E Addresses First octet of an IP address begins with 1111 Class E addresses are reserved for experimental purposes and should not be used for addressing hosts or multicast groups. 94

95 Fill in the information Class Default Mask: Network: Broadcast: Hosts: through Class Default Mask: Network: Broadcast: Hosts: through Class Default Mask: Network: Broadcast: Hosts: through 95

96 Fill in the information Class C Default Mask: Network: Broadcast: Hosts: through Class A Default Mask: Network: Broadcast: Hosts: through Class B Default Mask: Network: Broadcast: Hosts: through

97 Class separates network from host bits The Class determines the Base Network Mask! Class C Default Mask: Network: Class A Default Mask: Network: Class B Default Mask: Network:

98 Know the classes! First First Network Host Class Bits Octet Bits Bits A B C D E

99 IP addressing crisis Address Depletion Internet Routing Table Explosion 99

100 IPv4 Addressing Subnet Mask One solution to the IP address shortage was thought to be the subnet mask. Formalized in 1985 (RFC 950), the subnet mask breaks a single class A, B or C network in to smaller pieces. This does allow a network administrator to divide their network into subnets. Routers still associated an network address with the first octet of the IP address. 100

101 All Zeros and All Ones Subnets Using the All Ones Subnet There is no command to enable or disable the use of the all-ones subnet, it is enabled by default. Router(config)#ip subnet-zero The use of the all-ones subnet has always been explicitly allowed and the use of subnet zero is explicitly allowed since Cisco IOS version RFC 1878 states, "This practice (of excluding all-zeros and all-ones subnets) is obsolete! Modern software will be able to utilize all definable networks." Today, the use of subnet zero and the all-ones subnet is generally accepted and most vendors support their use, though, on certain networks, particularly the ones using legacy software, the use of subnet zero and the all-ones subnet can lead to problems. CCO: Subnet Zero and the All-Ones Subnet tech/tk648/tk361/technologies_tech_note09186a f18.shtml 101

102 Long Term Solution: IPv6 (coming) IPv6, or IPng (IP the Next Generation) uses a 128-bit address space, yielding 340,282,366,920,938,463,463,374,607,431,768,211,456 possible addresses. IPv6 has been slow to arrive IPv6 requires new software; IT staffs must be retrained IPv6 will most likely coexist with IPv4 for years to come. Some experts believe IPv4 will remain for more than 10 years. 102

103 Short Term Solutions: IPv4 Enhancements Discussed in CIS 83 and CIS 185 CIDR (Classless Inter-Domain Routing) RFCs 1517, 1518, 1519, 1520 VLSM (Variable Length Subnet Mask) RFC 1009 Private Addressing - RFC 1918 NAT/PAT (Network Address Translation / Port Address Translation) RFC More later when we discuss TCP 103

104 ICMP: Ping and Trace

105 Partial list ICMP (Internet Control Message Protocol) ICMP: A Layer 3 protocol Used for sending messages Encapsulated in a Layer 3, IP packet Uses Type and Code fields for various messages 105

106 ICMP Unreachable Destination or Service Used to notify a host that the destination or service is unreachable. When a host or router receives a packet that it cannot deliver, it may send an ICMP Destination Unreachable packet to the host originating the packet. The Destination Unreachable packet will contain codes that indicate why the packet could not be delivered. From a router: 0 = network unreachable Does not have a route in the routing table 1 = host unreachable Has a route but can t find host. (end router) From a host: 2 = protocol unreachable 3 = port unreachable Service is not available because no daemon is running providing the service or because security on the host is not allowing access to the service. 106

107

108 Ping Uses ICMP message encapsulated within an IP Packet Protocol field = 1 Does not use TCP or UDP Format ping ip address (or ping <cr> for extended ping) ping

109 Echo Request The sender of the ping, transmits an ICMP message, Echo Request Echo Request - Within ICMP Message Type = 8 Code = 0 109

110 Echo Reply The IP address (destination) of the ping, receives the ICMP message, Echo Request The ip address (destination) of the ping, returns the ICMP message, Echo Reply Echo Reply - Within ICMP Message Type = 0 Code = 0 110

111 Ping example 111

112 Pings may fail Q: Are pings forwarded by routers? A: Yes! This is why you can ping devices all over the Internet. Q: Do all devices forward or respond to pings? A: No, this is up to the network administrator of the device. Devices, including routers, can be configured not to reply to pings (ICMP echo requests). This is why you may not always be able to ping a device. Also, routers can be configured not to forward pings destined for other devices. 112

113 Traceroute Traceroute is a utility that records the route (router IP addresses) between two devices on different networks. 113

114 Traceroute On modern Unix and Linux-based operating systems, the traceroute utility by default uses UDP datagrams with a destination port number starting at The traceroute utility usually has an option to specify use of ICMP echo request (type 8) instead. The Windows utility uses ICMP echo request, better known as ping packets. Some firewalls on the path being investigated may block UDP probes but allow the ICMP echo request traffic to pass through. There are also traceroute implementations sending out TCP packets, such as tcptraceroute or Layer Four Trace. In Microsoft Windows, traceroute is named tracert. A new utility, pathping, was introduced with Windows NT, combining ping and traceroute functionality. All these traceroutes rely on ICMP (type 11) packets coming back. 114

115 Trace (Traceroute) Trace ( Cisco = traceroute, tracert, ) is used to trace the probable path a packet takes between source and destination. Probable, because IP is a connectionless protocol, and different packets may take different paths between the same source and destination networks, although this is not usually the case. Trace will show the path the packet takes to the destination, but the return path may be different. This is more likely the case in the Internet, and less likely within your own autonomous system. Linux/Unix Systems Uses ICMP message within an IP Packet Both are layer 3 protocols. Uses UDP as a the transport layer. We will see why this is important in a moment. 115

116 Trace Format (trace, traceroute, tracert) RTA# traceroute ip address RTA# traceroute

117 Trace How it works (using UDP) - Fooling the routers & host! Traceroute uses ping (echo requests) Traceroute sets the TTL (Time To Live) field in the IP Header, initially to 1 117

118 Trace RTB - TTL: When a router receives an IP Packet, it decrements the TTL by 1. If the TTL is 0, it will not forward the IP Packet, and send back to the source an ICMP time exceeded message. ICMP Message: Type = 11, Code = 0 118

119 RTB After the traceroute is received by the first router, it decrements the TTL by 1 to 0. Noticing the TTL is 0, it sends back a ICMP Time Exceeded message back to the source, using its IP address for the source IP address. Router B s IP header includes its own IP address (source IP) and the sending host s IP address (dest. IP). 119

120 RTA, Sending Host The traceroute program of the sending host (RTA) will use the source IP address of this ICMP Time Exceeded packet to display at the first hop. RTA# traceroute Type escape sequence to abort. Tracing the route to msec 4 msec 4 msec 120

121 RTA The traceroute program increments the TTL by 1 (now 2 ) and resends the ICMP Echo Request packet. 121

122 RTB This time RTB decrements the TTL by 1 and it is NOT 0. (It is 1.) So it looks up the destination ip address in its routing table and forwards it on to the next router. RTC RTC however decrements the TTL by 1 and it is 0. RTC notices the TTL is 0 and sends back the ICMP Time Exceeded message back to the source. RTC s IP header includes its own IP address (source IP) and the sending host s IP address (destination IP address of RTA). The sending host, RTA, will use the source IP address of this ICMP Time Exceeded message to display at the second hop. 122

123 RTA to RTB RTB to RTC. 123

124 The sending host, RTA: The traceroute program uses this information (Source IP Address) and displays the second hop. RTA# traceroute Type escape sequence to abort. Tracing the route to msec 4 msec 4 msec msec 16 msec 16 msec 124

125 The sending host, RTA: The traceroute program increments the TTL by 1 (now 3 ) and resends the Packet. 125

126 RTA to RTB RTB to RTC. RTC to RTD 126

127 RTB This time RTB decrements the TTL by 1 and it is NOT 0. (It is 2.) So it looks up the destination ip address in its routing table and forwards it on to the next router. RTC This time RTC decrements the TTL by 1 and it is NOT 0. (It is 1.) So it looks up the destination ip address in its routing table and forwards it on to the next router. RTD RTD however decrements the TTL by 1 and it is 0. However, RTD notices that the Destination IP Address of is it s own interface. Since it does not need to forward the packet, the TTL of 0 has no affect. 127

128 RTD RTD sends the packet to the UDP process. UDP examines the unrecognizable port number of 35,000 and sends back an ICMP Port Unreachable message to the sender, RTA, using Type 3 and Code

129 Sending host, RTA RTA receives the ICMP Port Unreachable message. The traceroute program uses this information (Source IP Address) and displays the third hop. The traceroute program also recognizes this Port Unreachable message as meaning this is the destination it was tracing. 129

130 Sending host, RTA RTA, the sending host, now displays the third hop. Getting the ICMP Port Unreachable message, it knows this is the final hop and does not send any more traces (echo requests). RTA# traceroute Type escape sequence to abort. Tracing the route to msec 4 msec 4 msec msec 16 msec 16 msec msec 16 msec 16 msec 130