ARP Collision/Broadcast Domains

Transcription

1 Group Work CN APPLETS 2002 Group Members: Dave Wick Pengyu Wu ARP Collision/Broadcast Domains <ABSTRACT> Within the Internet and in networks in general, specified protocol addresses are used to address a machine connected to network. These addresses, assigned to the internet-layer according to the TCP/IP model, will be usefull to initiate host-to-host communication. If we re interested in what s going on below at the datalink-layer, responsible for the hop to hop communication, we need to understand how addresses are set and resolved. Higher protocol addresses can be configured and assigned independently of the networkinterface-address. The mapping between these addresses is done by a protocol called ARP, Address Resolution Protocol. It s been developed to simplify administration and reduce mapping errors. ARP is considered to be configured dynamic, it uses therefore broadcasts, caches and timeouts, but remains still adjustable manually. To show how it works in practice, we ve written a tiny simulator to visualize the packet flow within a network. <ARP RFC REFERENCES> [RFC 826] An Ethernet Address Resolution Protocol. [RFC 903] A Reverse Address Resolution Protocol. [RFC 948] Two methods for the transmission of IP Datagrams over IEEE networks. [RFC 1027] Using ARP to Implement Transparent Subnet Gateways. [RFC 1029] A more fault tolerant approach to Address Resolution for a multi-lan system of Ethernets [RFC 1042] A Standard for the Transmission of IP Datagrams over IEEE 802 Networks. [RFC 1051] A Standard for the Transmission of IP Datagrams and ARP Packets over ARCNET Networks. [RFC 1122] Requirements for Internet Hosts -- Communication Layers. [RFC 1188] A Proposed Standard for the Transmission of IP Datagrams over FDDI Networks. [RFC 1209] The Transmission of IP Datagrams over the SMDS Service. [RFC 1390] Transmission of IP and ARP over FDDI Networks. [RFC 1433] Directed ARP. [RFC 1716] Towards Requirements for IP Routers. [RFC 1868] ARP Extension - UNARP. [RFC 2834] ARP and IP Broadcast over HIPPI-800. [RFC 2835] IP and ARP over HIPPI-6400 (GSN). <MAIN TOPIC> What is ARP Before we show the process of ARP, we will first explain some basic concepts and ideas about this protocol. Address Resolution Protocol (ARP) is a protocol to map a protocol address (mostly used to resolve IP Addresses) to a physical machine address that is connected and recognized in the local network. It provides the protocol rules to make this correlation and providing address conversion in both directions. IP Address is a 32-bit number (in IP Version 4, IP Version 6 has 128 bits) that identifies each sender or receiver of information that is sent in packets across the Internet. It has two parts: the identifier of a particular network on the Internet and an identifier of the particular device (which can be a server or a workstation) within that network. The physical machine address is also known as a Media Access Control or MAC address. On a local area network (LAN) or other network, the MAC (Media Access Control) address is your computer's unique hardware number. (On an Ethernet LAN, it's the same as your Ethernet address.) It has a 6-

2 byte number (48 bits) programmed into the physical hardware device by the manufacturer and is typically displayed in hexadecimal. Ethernet is the most widely-installed local area network (LAN) technology. Specified in a standard, IEEE An Ethernet LAN typically uses coaxial cable or special grades of twisted pair wires. Devices are connected to the cable and compete for access using a Carrier Sense Multiple Access with Collision Detection (CSMA/CD) protocol. Ethernet is also used in wireless LANs. Router is a device or, in some cases, software in a computer, that determines the next network point to which a packet should be forwarded toward its destination. It is connected to at least two networks and decides which way to send each information packet based on its current understanding of the state of the networks it is connected to. A router may create or maintain a table of the available routes and their conditions and use this information along with distance and cost algorithms to determine the best route for a given packet. Repeater is a two-ports network device that regenerates and amplifies digital or analogue signal, so it can extend the cable length. Switch is a multiple ports network device that selects a path or circuit for sending a unit of data to its next destination. It can provide a private connection between two nodes on a network speeding up the rata at which data is sent along the network and eliminating collisions. Why do we need ARP Although every machine on the Internet has one(or more) IP Addresses, these cannot actually be used for sending packets because the data link layer hardware does not understand Internet addresses. Nowadays, most hosts are attached to a LAN by an interface board that only understands LAN addresses. If a packet will be sent, there exists a big problem: the data link layer knows nothing about IP Addresses. Through the usage of the ARP this problem will be good solved. ARP can automatic translate the both different addresses. The another benefits of the usage of ARP are that, it shields TCP/IP from the details of how the offered services and make the TCP/IP independent of the physical hardware. Furthermore the administrator can simple use the IP address, not take more care of the fixed complex hexadecimal MAC Address. How ARP works If a application program in a host that uses TCP/IP wants to send some data to an another host, these data will first be divided into some fixed length smaller packets, then IP adds the same IP address to each such packet. After these processes IP software will check to see if it knows the hardware address associated with the destination IP address. The ARP program will complete this step. It looks first in the ARP cache, a table, usually called the ARP cache, is used to maintain a correlation between each MAC address and its corresponding IP address. Now there are two situations: A. If the cache knows the MAC address associated with the destination IP address, then the sender just transmits the data to the destination system, using the protocols and addressing appropriate for whatever network medium is in use by the two machines. B. If the destination system s MAC address is not known, then the IP software has to locate it before any data can be sent. At this point, IP will call on ARP to locate the hardware address of the destination system. ARP achieves this by issuing a low-level broadcast onto the network, requesting that the system that is using the specified IP address respond with its MAC address. If the destination system is powered up and on the network, it will see this broadcast (as will all of the other hosts on the local network), and it will return an ARP response back to the original system. Note that the response is not broadcast back over the network, but is instead sent directly (unicast) to the requesting system. All of the local hosts should monitor the network for ARP broadcasts, and whenever they recognize a request for themselves, they should generate a response packet and send it back to the requesting system. At the same time the destination system saves the IP and MAC addresses of the sender in its cache. The response packet will consist of the receiver s IP and MAC addresses, and the IP and MAC address of the original sender. When the sender receives the response packet, it updates its ARP cache for future reference. Now the both hosts can communicate with each other. The following simple illustration will show this process:

3 About the packet flow When a ARP packet is sent, this packet will have many different ways facing to the different internet devices. Now we talk something about this difference. Repeater is a familiar hardware device in our network. It is assigned to the first layer of the OSI/ISO-Model and realizes (broadcasted) forwarding of packets from one port to another. Because it only forwards any incoming packets to all ports, so we can see it as a simple one-to-multi linker and the packets can flow through it as on a whole wire. It will take no influence to the packet flow. Switch is assigned to the second layer of the OSI/ISO-Model and can connect the different topologies and bandwidths networks. It also can select a private path or circuit between two nodes and at the same time hold multiple connections between several nodes. Because ARP also belongs to the second layer of the OSI/ISO-Model, so a ARP packet can problem free travel through the switch. A bit of difference here between repeater and switch is, switch is a one-to-one device and can not broadcast. Router is assigned to the third layer of the OSI/ISO-Model, can determine the route and specifically what adjacent network point the data should be sent to. Because router can not forward Ethernetlevel (layer 2) broadcasts, so when a sender host will know about the MAC address of a destination host that is not on this local network, a ARP request packet of the sender host can not travel though the router. In this situation, the router will first accept this request packet and generate a response packet, send it back to the requesting host. The rest steps the router will complete. It then forwards the request to the destination host through the same ARP process, at last knows the MAC address of the destination host. But the sender doesn't know about it, it believes forever it holds the MAC address of the destination host! The following illustration shows how ARP resolves IP addresses to MAC addresses for two hosts on different physical networks connected by a common router. Note that the ARP request reaches only the router and does not through it.

4 The ARP cache To minimize the number of broadcasts, ARP maintains a cache of IP address-to-mac address mappings for future use. The ARP cache can contain both dynamic and static entries. Static entries remain in the cache until the computer is restarted. Dynamic entries are added and removed automatically over time. Because most systems have a very limited ARP cache, with only enough room for a few entries, so the cache entry (dynamic) has a potential lifetime of few minutes. When a entry will not be reused in its lifetime, it will be moved from the cache to save the limit cache room and not to be overwritten. Note so that many large, multi-user systems and network routers often have very large ARP caches in order to prevent this type of problem from occurring. The ARP format There are so many different frame formats in the numerous protocols. The structure of the ARP frame is a very simple format to use by any network types. The only restriction is that the broadcast can not be supported by the high layer hardware device(e.g. router). The format of ARP is shown below: The ARP frame has following fields: Hardware Type: This field defines the type of the network hardware used by the initiator (e.g. 0x0001 for ethernet). Protocol Type: In this field the entry indicates which protocol uses this ARP process (e.g. 0x0800 for IP). HLEN: This field will indicate the length of the hardware address in octal. Ethernet uses 6byte addresses. PLEN: This field explains the length of the IP address in octal. IPv4 has normally the PLENvalue 4, Ipv6 6. Operation Code: All defined operations can be used by setting this field. For example: 1. If the choice is 1, this is a ARP request packet. 2. If the choice is 2, it will be an ARP response packet. 3. RARP request packet will use the value the RARP response packet uses the value 4. Addresses: In these fields the both addresses (IP and MAC) will be given, they come from the sender and the receiver. About the simulation The simulation has been written to allow you an as realistic as possible approach to the ARP protocol and its characteristics. To achieve a bit more flexibility and give you the possibility to configure the network we took care of the layer-based architecture of communication protocols and allow you to set the properties of the hosts and the router (ip, mac, netmask and gateway). The switch connecting the machines is assumed as running and messages sent therefore are ignored. Several protocol-specific properties can be set from commandline. The protocols are implemented in a way that allows to use and extend them as you need. A few words about - Ethernet. Instead of using a CSMA/CD we implemented a stack-token version. Packets will be stacked in order of their creation. To visualize the packet-flow there will be only one packet shown at time. - IP. As far just used to transport ICMP packets. Frame is not fully implemented. - ARP. Requests and replies are fully implemented. Number of cachelines and line-timeout can be set during runtime. We created a third type of cacheline called boot which will be added if a machine is booting and broadcasting its mac-address (e.g. arp b 1 ).

5 - ICMP. - Verbose level. To trace the packetflow in an appropriate way you can set the verbose level for every protocol (e.g. set v arp 2 ). Set to 1 will just show the initiating protocol frame, set to 2 will stack as well the frame of the protocol-layer below etc. - Hex and decimal. For better readability we ve used the following conversions: header content will be listed in hex characters, except ip s, which will be shown in decimal symbols. ASCII data-content will not be converted as well. For more information and a little manual please read the help-pages at the program. Feel free to implement or extend some protocols or expand the network topology. Source will be attached.

6 <MULTIPLE CHOICE QUESTIONS> Multiple-Choice questions 1. Which of the following hardware devices can forward a broadcast on the Ethernet layer? A. Gateway B. Hub C. Router D. Switch 2. When a host wants to communicate with an another host that is on this local network, which of the following steps will be done by the sender? A. The sender first tries to lookup the destination hardware address in its ARP cache. B. If the sender knows noting about the MAC address of the other host, it sends its data directly to the router, the router then will find the MAC address and transmits the Data. C. If the sender knows noting about the MAC address of the other host, it sends a ARP request directly to the router and the router answers with the requested MAC address. D. If the sender knows noting about the MAC address of the other host, the sender will initiate an ARP broadcast. 3. If a host will communicate with another host that is not connected to the local network, which of the following statements are correct? A. The sender will obtain the MAC address of the destination host through the usage of ARP. B. If the sender knows about the MAC address of the destination host, it can send its data directly to the other host. C. The sender will never know the MAC address of the destination host. D. The router will transmit all the data sent by the sender. 4. Which of the following statements about ARP caches is correct? A. The ARP cache has two types: dynamic and static. B. Even though the host is power-cut, the cache can still keep the static entries. C. The ARP cache record keeps both, IP and MAC, addresses of a host. D. All dynamic entries in the ARP cache of a machine have the same fixed lifetime. 5. Which devices or protocols belong to the Datalink layer of the TCP/IP Model? A. Hub B. Switch C. ARP D. LLC 6. If you want to find out the MAC address of your computer or somebody s computer that is connected to the same LAN, which commands can help you? A. ipconfig B. arp a C. ping D. route