CS 457 The Networking Layer: Forwarding, NAT, IPv6. Fall 2014

Transcription

1 CS 457 The Networking Layer: Forwarding, NAT, IPv6 Fall 2014

2 The Internet Network layer Host, router network layer functions: Transport layer: TCP, UDP Network layer Routing protocols path selection RIP, OSPF, BGP forwarding table IP protocol addressing conventions datagram format packet handling conventions ICMP protocol error reporting router signaling Link layer physical layer

3 IP Datagram Format IP protocol version number header length (bytes) type of data max number remaining hops (decremented at each router) upper layer protocol to deliver payload to how much header overhead with TCP? 20 bytes TCP + 20 bytes IP = 40 bytes + app layer overhead ver head. len 16-bit identifier time to live type of service upper layer 32 bits flgs length data (variable length, typically a TCP or UDP segment) Internet checksum 32 bit source IP address fragment offset 32 bit destination IP address Options (if any) total datagram length (bytes) for fragmentation/ reassembly E.g. timestamp, record route taken, specify list of routers to visit.

4 IP Fragmentation & Reassembly network links have MTU (max.transfer size) - largest possible link-level frame. different link types, different MTUs large IP datagram divided ( fragmented ) within net one datagram becomes several datagrams reassembled only at final destination IP header bits used to identify, order related fragments reassembly fragmentation: in: one large datagram out: 3 smaller datagrams

5 IP Fragmentation and Reassembly Example 4000 byte datagram MTU = 1500 bytes 1480 bytes in data field offset = 1480/8 length =4000 ID =x length =1500 fragflag =0 ID =x ID =x offset =0 One large datagram becomes several smaller datagrams length =1500 length =1040 ID =x fragflag =1 fragflag =1 fragflag =0 offset =0 offset =185 offset =370

6 Longest Prefix Match Recall CIDR: efficient use of address space But, CIDR makes packet forwarding much harder Forwarding table may have many matches E.g., table entries for /21 and /23 Packet to IP address matches both! /21 Provider 1 Provider / / / /23

7 Longest Prefix Match Forwarding Forwarding tables in IP routers Maps each IP prefix to next-hop link(s) Destination-based forwarding Packet has a destination address Router identifies longest-matching prefix Algorithmic problem: very fast lookups destination prefix / / / / /24 Forwarding Table outgoing link Serial1/0.1 Serial0/0.1

8 Address Prefix 1 Prefix 2 Longest Prefix Match / /

9 Simplest Algorithm Linear Search Scan the forwarding table one entry at a time See if the destination matches the entry If so, check the size of the mask for the prefix Keep track of the entry with longest-matching prefix Overhead is linear in size of the forwarding table Today, that means 400,000+ entries! And, the router may have just a few nanoseconds before the next packet comes Too Slow!! Need greater efficiency to keep up with line rate Better algorithms Hardware implementations

10 Patricia Tree Store the prefixes as a tree One bit for each level of the tree Some nodes correspond to valid prefixes... which have next-hop interfaces in a table When a packet arrives Traverse the tree based on the destination address Stop upon reaching the longest matching prefix * 00* *

11 Even Faster Lookups Patricia tree is faster than linear scan Proportional to number of bits in the address Patricia tree can be made faster Can make a k-ary tree E.g., 4-ary tree with four children (00, 01, 10, and 11) Faster lookup, though requires more space Can use special hardware Content Addressable Memories (CAMs) Allows look-ups on a key rather than flat address Huge innovations in the mid-to-late 1990s After CIDR was introduced (in 1994) and longest-prefix match was a major bottleneck

12 What is CAM? Content Addressable Memory is a special kind of memory! Read opera;on in tradi;onal memory: q Input is address loca;on of the content that we are interested in it. q Output is the content of that address. In CAM it is the reverse: q Input is associated with something stored in the memory. q Output is loca;on where the associated content is stored X X X X X Traditional Memory X X X X X Content Addressable Memory X 0 1 Source: University of Maryland lecture

13 CAM for Rou;ng Table Implementa;on CAM can be used as a search engine. We want to find matching contents in a database or Table. Example Rou;ng Table Source:

14 NAT: Network Address Translation rest of Internet local network (e.g., home network) / All datagrams leaving local network have same single source NAT IP address: , different source port numbers Datagrams with source or destination in this network have /24 address for source, destination (as usual) Did you know? NAT was invented by a CSU graduate..

15 NAT: Network Address Translation with One IP Address Motivation: local network uses just one IP address as far as outside word is concerned: no need to be allocated range of addresses from ISP: - just one IP address is used for all devices can change addresses of devices in local network without notifying outside world can change ISP without changing addresses of devices in local network devices inside local net not explicitly addressable, visible by outside world (a security plus). Similar operation if network has a pool of routable IP addresses

16 NAT Operation 2: NAT router changes datagram source addr from , 3345 to , 5001, updates table 2 NAT translation table WAN side addr LAN side addr , , 3345 S: , 5001 D: , S: , 3345 D: , : host sends datagram to , S: , 80 D: , : Reply arrives dest. address: , 5001 S: , 80 D: , : NAT router changes datagram dest addr from , 5001 to , 3345

17 NAT:Summary of Operation NAT router must: outgoing datagrams: replace (source IP, sport #) of every outgoing datagram to (NAT IP, new port #)... remote clients/servers will respond using (NAT IP, new port #) as destination addr. remember (in NAT translation table) every (source IP, sport #) to (NAT IP, new port #) translation pair incoming datagrams: replace (NAT IP, new port #) in dest fields of every incoming datagram with corresponding (source IP, sport #) stored in NAT table

18 NAT Impact Bad for connectivity NAT isolates machines from the Internet Bad for P2P applications Bunch of ugly hacks to work around NAT Port forwarding helps a little bit Helps security NAT isolates machines from the Internet But NOT a security solution!

19 Arguments Against NAT NAT is controversial NAT is evil routers should only process up to layer 3 violates end-to-end argument NAT possibility must be taken into account by app designers, e.g., P2P applications address shortage should instead be solved by IPv6 But NAT is a fact of life in the Internet today, and will probably stay for a long time

20 Internet Control Message Protocol (ICMP) Application Transport Network Link ICMP Control protocol used for diagnostics and testing Sits on top of the network layer, but below transport Carries back error messages Tools that use it include ping and traceroute

21 ICMP: Internet Control Message Protocol used by hosts & routers to communicate network-level information error reporting: unreachable host, network, port, protocol echo request/reply (used by ping) network-layer above IP: ICMP msgs carried in IP datagrams ICMP message: type, code plus first 8 bytes of IP datagram causing error Type Code description 0 0 echo reply (ping) 3 0 dest. network unreachable 3 1 dest host unreachable 3 2 dest protocol unreachable 3 3 dest port unreachable 3 6 dest network unknown 3 7 dest host unknown 4 0 source quench (congestion control - not used) 8 0 echo request (ping) 9 0 route advertisement 10 0 router discovery 11 0 TTL expired 12 0 bad IP header

22 Traceroute and ICMP Source sends series of UDP segments to dest First has TTL =1 Second has TTL=2, etc. Unlikely port number When nth datagram arrives to nth router: Router discards datagram And sends to source an ICMP message (type 11, code 0) Message includes name of router& IP address When ICMP message arrives, source calculates RTT Traceroute does this 3 times Stopping criterion UDP segment eventually arrives at destination host Destination returns ICMP port unreachable packet (type 3, code 3) When source gets one of these messages, it stops

23 IPv6 Initial motivation: 32-bit address space soon to be completely allocated. Additional motivation: new header format that helps speed processing/forwarding header changes to facilitate QoS IPv6 datagram format: fixed-length 40 byte header no fragmentation allowed

24 Recall: IPv4 Datagram Format IP protocol version number header length (bytes) type of data max number remaining hops (decremented at each router) upper layer protocol to deliver payload to how much overhead with TCP? 20 bytes of TCP 20 bytes of IP = 40 bytes + app layer overhead ver head. len 16-bit identifier time to live type of service upper layer 32 bits flgs length data (variable length, typically a TCP or UDP segment) Internet checksum 32 bit source IP address fragment offset 32 bit destination IP address Options (if any) total datagram length (bytes) for fragmentation/ reassembly E.g. timestamp, record route taken, specify list of routers to visit.

25 IPv6 Header Priority: identify priority among datagrams in flow Flow Label: identify datagrams in same flow. (concept of flow not well defined). Next header: identify upper layer protocol for data

26 Other Changes from IPv4 Checksum: removed entirely to reduce processing time at each hop Options: allowed, but outside of header, indicated by Next Header field ICMPv6: new version of ICMP additional message types, e.g. Packet Too Big multicast group management functions

27 Transition From IPv4 To IPv6 Not all routers can be upgraded simultaneously no flag days How will the network operate with mixed IPv4 and IPv6 routers? Tunneling: IPv6 carried as payload in IPv4 datagram among IPv4 routers

28 Tunneling Logical view: A B E F tunnel IPv6 IPv6 IPv6 IPv6 Physical view: A B C D E F IPv6 IPv6 IPv4 IPv4 IPv6 IPv6 Flow: X Src: A Dest: F data Src:B Dest: E Flow: X Src: A Dest: F Src:B Dest: E Flow: X Src: A Dest: F Flow: X Src: A Dest: F data data data A-to-B: IPv6 B-to-C: IPv6 inside IPv4 D-to-E: IPv6 inside IPv4 E-to-F: IPv6

29 HELPFUL SLIDES

30 IP Addressing IP address: 32-bit identifier for host, router interface interface: connection between host/router and physical link router s typically have multiple interfaces host may have multiple interfaces IP addresses associated with each interface =

31 Subnets IP address: subnet part (high order bits) host part (low order bits) What s a subnet? device interfaces with same subnet part of IP address can physically reach each other without intervening router What are the similarities and differences with CIDR? LAN network consisting of 3 subnets

32 Subnets / /24 Recipe To determine the subnets, detach each interface from its host or router, creating islands of isolated networks. Each isolated network is called a subnet /24 Subnet mask: /24

33 Subnets How many subnets?

34 Example: Addressing at CSU Assigned prefix block /16 3 Different Sub-Organizations Assign addresses to create the smallest possible forwarding table at the router To Internet CS Dept 243 hosts Interface 0 Interface 3 Interface 1 Math Dept 100 hosts ?.? ?.? Interface 2 Wireless LAN - up to 500 hosts ?.?