Final Network Exam 01-02

Transcription

1 1 ENSTB ITAM Final Network Exam This exam is focused on Load balancing mechanisms. First part is related to "RFC 2391 : Load Sharing using IP Network Address Translation (LSNAT)" that was previously distributed. There is no absolute answer, every correctly justified answer is acceptable. Question 1 Is this a standard track document? Question 2 How works a "traditional" NAT? Question 3 On which IPv4 field the modification introduced by LSNAT is applied? Question 4 Give a definition of "Load Balancing" In the rest of this exam we will call: LS-NAT, the scenario described in paragraph 3.1, LSNAT with NAPT, the scenario decribed paragraph 3.2, LS-NAPT the scenario described paragraph 3.3.

2 2 Fill the following figure where three requests coming from three different clients arrive on a shared LS-NAPT server. Question > > serv1 / LSNAT > > serv2 / > > serv3 / /24 notation : adresse IPv4 N de port A network engineer decide to subscribe a connection to two ISPs to improve the server fiabilitiy. he installs two LSNAT with an addresses belonging to each ISP as displayed in the following picture.. ISP 1 LSNAT serv serv2 ISP LSNAT serv3

3 3 Question 6 With which LSNAT version this architecture can work? justified your answer? LS-NAT, : LSNAT with NAPT : LS-NAPT : File transferts with the FTP protocol can be established the following way. When an user (client) wants to transfert a file or visualize the content of a directory, the ftp program sends a request to the server (for example PORT a,b,c,d,p,p) on the control connection (port number 21) to open a new data connection. The server opens the connection and sends a acknowledgement message on the control connection. The client receiving the acknowledgment for this opening, sends the command (for example LIST, Put <file>, GET <file>) on the control connection and receives data on the other connection. For example: Packet 211 Frame Length: 82 Slice Length: 78 ethr: Station F3 ----> B4 32 Type IP ip: TCP > tcp: Port: > FTP PSH ACK seq: ack: win: F C 39 2C C 31 PORT 192,9,200, C 34 2C D 0A 1,4,8... Packet 212 Frame Length: 82 Slice Length: 78 ethr: Station B > F3 Type IP ip: TCP > tcp: Port: FTP -> 1104 PSH ACK seq: ack: win: F F 6D 6D 61 6E PORT command F 6B E 0D 0A okay... Packet 213 Frame Length: 64 Slice Length: 60 ethr: Station F3 ----> B4 32 Type IP ip: TCP >

4 4 tcp: Port: > FTP PSH ACK seq: ack: win: C D 0A LIST.. Packet 214 Frame Length: 130 Slice Length: 126 ethr: Station B > F3 Type IP ip: TCP > tcp: Port: FTP -> 1104 PSH ACK seq: ack: win: F E 69 6E Opening data F 6E 6E F 6E F connection for F E 2F 6C E 39 2E 32 /bin/ls ( E C ,1107) (0 b E 0D 0A ytes)... Packet 215 Frame Length: 64 Slice Length: 60 ethr: Station B > F3 Type IP ip: TCP > tcp: Port: FTP-DATA -> 1107 SYN seq: ack: 0 win: 4096 Packet 216 Frame Length: 64 Slice Length: 60 ethr: Station F3 ----> B4 32 Type IP ip: TCP > tcp: Port: > FTP-DATA SYN ACK seq: ack: win: 4096 Options Maximum Segment Size Size 1024 End of Option List Packet 217 Frame Length: 64 Slice Length: 60 ethr: Station B > F3 Type IP ip: TCP > tcp: Port: FTP-DATA -> 1107 ACK seq: ack: win: 4096 Packet 218 Frame Length: 64 Slice Length: 60 ethr: Station F3 ----> B4 32 Type IP ip: TCP > tcp: Port: > FTP ACK seq: ack: win: 4096 Packet 219 Frame Length: 570 Slice Length: 566 ethr: Station B > F3 Type IP ip: TCP > tcp: Port: FTP-DATA -> 1107 ACK seq: ack: win: F C D 0A 2D D 72 2D total 86..-rw-r D 72 2D 2D F E 20 -r-- 1 toutain C wheel A 61 6E A Jan 26 15: E D 0A 2D D 72 2D 2D.XXXdef..-rw-r D 2D F E r-- 1 toutain C wheel A E 3 Feb 3 11: C D 0A 2D D 72 Xdefaults..-rw-r

5 5 Question 7 Draw the previous exchange on a graph with a different color for every micro-flow. Question 8 Indicate on the following frame with flied of the packet 221 will be modified in case of a LS-NAPT ip: TCP > tcp: Port: > FTP PSH ACK seq: ack: win: F C 39 2C C 31 PORT 192,9,200, C 34 2C D 0A 1,4,8...

6 6 Question 9 Is it possible to install some FTP servers and use LSNAT to spread the load? Which version of LSNAT works? why? LS-NAT, : LSNAT with NAPT : LS-NAPT : Partage de charge avec OSPF The juniper router, like most of routers, can send packet on different exit interfaces, as the following document describe it. For the active route, when there are multiple equal-cost paths to the same destination, by default, the JUNOS software chooses in a random fashion one of the next-hop addresses to install into the forwarding table. Whenever the set of next hops for a destination changes in any way, the next-hop address is rechosen, also in a random fashion. You can configure the JUNOS software so that, for the active route, all next-hop addresses for a destination are installed in the forwarding table. This is called per-packet load balancing. You can use load balancing to spread traffic across multiple paths between routers. The behavior of per-packet load balancing function varies, according to the version of the Internet Protocol ASIC in the router. On routers with an Internet Processor I ASIC, when per-packet load balancing is configured, traffic between routers with multiple paths is spread in a random fashion across the available interfaces. The forwarding table balances the traffic headed to a destination, transmitting it in round-robin fashion among the multiple next hops (up to a maximum of 8 equal-cost oad-balanced paths). The traffic is load-balanced on a per-packet basis. On routers with the Internet Processor II ASIC, when per-packet load balancing is configured, traffic between routers with multiple paths is divided into individual traffic flows (up to maximum of 16 equal-cost load-balanced paths). Packets for each individual flow are kept on a single interface. To recognize individual flows in the transit traffic, the router examines each of the following: -Source IP address, -Destination IP address -Protocol -Source port number

7 7 -Destination port number -Interface through which the packet entered the router The router recognizes packets that have all of these parameters identical, and it ensures that these packets are sent out through the same interface. This prevents problems that might otherwise occur with packets arriving at their destination out of their original sequence. Question 10 3 points Quelles modifications à l algorithme de calcul de l arbre des plus courts chemins vu en cours doivent être prises en compte pour permettre un partage de charge sur plusieurs chemins? We suppose thet our juniper routers use the "Internet Processor I ASIC" Question 11 what are the consequences of load balancing on telephny flows?

8 8 Question 12 fill the gaps in the following picture that describe a TCP connection where segment X is delayed. : [X, X+1000[ [X+1000, X+2000[ [X+2000, X+3000[ [X+3000, X+4000[ Ack Ack Ack Ack Question 13 What are the consequences of load balancing on a TCP flow? Question 14 Why Internet Processor II ASIC improve the network performances copared to Internet Processor I ASIC""? Someone in a IETF working group propose to improve load balancing by sending tra-

9 9 fic regarding the cost of the path to reach the prefix. For example, if a first path have a cost of 10 and a second a cost of 20, the router can send twice more packets on the first path.. Question 15 What do you think of this proposal? Can loops be created? anycast IPv4 address Another solution to do load balancing is to use anycast addresses. RFC 1546, published in 1993 coming from IRTF research, describe this proposal which is a premise to IPv6 anycast addresses. There are a number of situations in networking where a host, application, or user wishes to locate a host which supports a particular service but, if several servers support the service, does not particularly care which server is used. Anycasting is a internetwork service which meets this need. A host transmits a datagram to an anycast address and the internetwork is responsible for providing best effort delivery of the datagram to at least one, and preferably only one, of the servers that accept datagrams for the anycast address. The motivation for anycasting is that it considerably simplifies the task of finding an appropriate server. For example, users, instead of consulting a list of archie servers and choosing the closest server, could simply type: telnet archie.net and be connected to the nearest archie server. DNS resolvers would no longer have to be configured with the IP addresses of their servers, but rather could send a query to a well-known DNS anycast address. Mirrored FTP sites could similarly share a single anycast address, and users could simply FTP to the anycast address to reach the nearest server. Anycast Addresses [...] As an example, consider a situation where a portion of each IP network number can be used for anycasting. I.e., a site, if it desires, could assign a set of its subnet addresses to be anycast addresses. If, as some experts expect, anycast routes are treated just like host routes by the routing protocols, the anycast addresses would not require special advertisement outside the site -- the host routes could be folded in with the net route. [...] The idea is that the Internet might establish that a particular anycast address is the logical address of the DNS server. Then host software could be configured at the manufacturer to always

10 10 send DNS queries to the DNS anycast address. In other words, anycasting could be used to support autoconfiguration of DNS resolvers. [...] Transmission and Reception of Anycast Datagrams [...] On a shared media network, such as an Ethernet and or Token Ring, it must be possible to transmit an anycast datagram to a server also on the same network without consulting a (possibly non-existent) router. There are at least two ways this can be done. One approach is to ARP for the anycast address. Servers which support the anycast address can reply to the ARP request, and the sending host can transmit to the first server that responds. This approach is reminiscent of the ARP hack (RFC 1027) and like the ARP hack, requires ARP cache timeouts for the anycast addresses be kept small (around 1 minute), so that if an anycast server goes down, hosts will promptly flush the ARP entry and query for other servers supporting the anycast address. We suppose that the following archictecture is used, where α designe a prefix associated to the link and β.1, the anycast address associated to FTP servers: Serv 1 Serv 2 Serv 3 Serv 4 Router α.1 α.2 α.3 α.4 β.1 β.1 β.1 β.1 Question 16 Can gratuitious ARP be used during the interface configuration with the anycast address? Question 17 The RFC propse to keep a mapping between the anycast address and MAC address in the router ARP table for 1 minute. What are the consequences for FTP connection? The RFC propose this solution to keep TCP connection: How UDP and TCP Use Anycasting It is important to remember that anycasting is a stateless service. An internetwork has no obligation to deliver two successive packets sent to the same anycast address to the same host.

11 11 Because UDP is stateless and anycasting is a stateless service, UDP can treat anycast addresses like regular IP addresses. A UDP datagram sent to an anycast address is just like a unicast UDP datagram from the perspective of UDP and its application. A UDP datagram from an anycast address is like a datagram from a unicast address. Furthermore, a datagram from an anycast address to an anycast address can be treated by UDP as just like a unicast datagram (although the application semantics of such a datagram are a bit unclear). TCP's use of anycasting is less straightforward because TCP is stateful. It is hard to envision how one would maintain TCP state with an anycast peer when two successive TCP segments sent to the anycast peer might be delivered to completely different hosts. The solution to this problem is to only permit anycast addresses as the remote address of a TCP SYN segment (without the ACK bit set). A TCP can then initiate a connection to an anycast address. When the SYN-ACK is sent back by the host that received the anycast segment, the initiating TCP should replace the anycast address of its peer, with the address of the host returning the SYN-ACK. (The initiating TCP can recognize the connection for which the SYN-ACK is destined by treating the anycast address as a wildcard address, which matches any incoming SYN-ACK segment with the correct destination port and address and source port, provided the SYN-ACK's full address, including source address, does not match another connection and the sequence numbers in the SYN-ACK are correct.) This approach ensures that a TCP, after receiving the SYN-ACK is always communicating with only one host. Question 18 What do you think of this proposal? Is it necessary to modify every TCP implementation?