Network Layer 4- density - A Top Down Approach

Transcription

1 Internet-Technologien (CS262) 2. IP und DNS Christian Tschudin Departement Mathematik und Informatik, Universität Basel 4-1 Wiederholung/Einstiegsfragen Was ist ein Socket? Weshalb braucht es UDP? Was ist ein TCP segment? Was sind die Auswirkungen auf read()? Weshalb bietet UNIX einen select() Systemaufruf an? Network Layer 4-2

2 Chapter 4 Network Layer (original slides + UBasel modifs CS262, 2015) A note on the use of these ppt slides: We re making these slides freely available to all (faculty, students, readers). They re in PowerPoint form so you see the animations; and can add, modify, and delete slides (including this one) and slide content to suit your needs. They obviously represent a lot of work on our part. In return for use, we only ask the following: If you use these slides (e.g., in a class) that you mention their source (after all, we d like people to use our book!) If you post any slides on a www site, that you note that they are adapted from (or perhaps identical to) our slides, and note our copyright of this material. Thanks and enjoy! JFK/KWR Computer Networking: A Top Down Approach 6 th edition Jim Kurose, Keith Ross Addison-Wesley March 2012 All material copyright J.F Kurose and K.W. Ross, All Rights Reserved Network Layer 4-3 Chapter 4: layer chapter goals: understand principles behind layer services: layer service models forwarding versus routing how a router works routing (path selection) broadcast, multicast instantiation, implementation in the Internet Network Layer 4-4

3 Chapter 4: outline 4.1 introduction 4.2 virtual circuit and datagram s 4.3 what s inside a router 4.4 IP: Internet Protocol datagram format IPv4 addressing ICMP IPv6 4.5 routing algorithms link state distance vector hierarchical routing 4.6 routing in the Internet RIP OSPF BGP 4.7 broadcast and multicast routing Network Layer 4-5 Network layer transport segment from sending to receiving host on sending side encapsulates segments into datagrams on receiving side, delivers segments to transport layer layer protocols in every host, router router examines header fields in all IP datagrams passing through it application transport data link physical data link physical data link physical data link physical data link physical data link physical data link physical data link physical data link physical data link physical data link physical data link physical application transport data link physical Network Layer 4-6

4 Two key -layer functions forwarding: move packets from router s input to appropriate router output routing: determine route taken by packets from source to dest. routing algorithms analogy: routing: process of planning trip from source to dest forwarding: process of getting through single interchange Network Layer 4-7 Interplay between routing and forwarding routing algorithm local forwarding table header value output link routing algorithm determines end-end-path through forwarding table determines local forwarding at this router value in arriving packet s header Network Layer 4-8

5 Chapter 4: outline 4.1 introduction 4.2 virtual circuit and datagram s 4.3 what s inside a router 4.4 IP: Internet Protocol datagram format IPv4 addressing ICMP IPv6 4.5 routing algorithms link state distance vector hierarchical routing 4.6 routing in the Internet RIP OSPF BGP 4.7 broadcast and multicast routing Network Layer 4-39 IP addressing: introduction IP address: 32-bit identifier for host, router interface interface: connection between host/router and physical link router s typically have multiple interfaces host typically has one or two interfaces (e.g., wired Ethernet, wireless ) IP addresses associated with each interface = Network Layer 4-40

6 IP addressing: introduction Q: how are interfaces actually connected? A: we ll learn about that in chapter 5, 6. A: wired Ethernet interfaces connected by Ethernet switches For now: don t need to worry about how one interface is connected to another (with no intervening router) A: wireless WiFi interfaces connected by WiFi base station Network Layer 4-41 Subnets IP address: subnet part - high order bits host part - low order bits what s a subnet? device interfaces with same subnet part of IP address can physically reach each other without intervening router subnet consisting of 3 subnets Network Layer 4-42

7 Subnets recipe to determine the subnets, detach each interface from its host or router, creating islands of isolated s each isolated is called a subnet / / subnet /24 subnet mask: /24 Network Layer 4-43 Subnets how many? Network Layer 4-44

8 IP Addresses (classic split) given notion of, let s re-examine IP addresses: class-full addressing: class A 0 host B 10 host C 110 host to to to D 1110 multicast address 32 bits to Network Layer 4-45 IP addressing: CIDR CIDR: Classless InterDomain Routing subnet portion of address of arbitrary length address format: a.b.c.d/x, where x is # bits in subnet portion of address subnet part /23 host part Network Layer 4-46

9 IP addresses: how to get one? Q: How does a host get IP address? hard-coded by system admin in a file Windows: control-panel->->configuration- >tcp/ip->properties UNIX: /etc/rc.config : Dynamic Host Configuration Protocol: dynamically get address from as server plug-and-play Network Layer 4-47 : Dynamic Host Configuration Protocol goal: allow host to dynamically obtain its IP address from server when it joins can renew its lease on address in use allows reuse of addresses (only hold address while connected/ on ) support for mobile users who want to join (more shortly) overview: host broadcasts discover msg [optional] server responds with offer msg [optional] host requests IP address: request msg server sends address: ack msg Network Layer 4-48

10 client-server scenario / server arriving client needs address in this / /24 Network Layer 4-49 client-server scenario server: discover src : , 68 dest.: ,67 yiaddr: transaction ID: 654 Broadcast: is there a server out there? arriving client request offer src: , 68 dest:: , 67 yiaddrr: that transaction IP address! ID: 655 lifetime: 3600 secs Broadcast: OK. I ll take src: , 67 dest: , 68 yiaddrr: transaction ID: 654 lifetime: 3600 secs Broadcast: I m a server! Here s an IP address you can use ACK src: , 67 dest: , 68 yiaddrr: transaction ID: 655 lifetime: 3600 secs Broadcast: OK. You ve got that IP address! Network Layer 4-50

11 : more than IP addresses can return more than just allocated IP address on subnet: address of first-hop router for client name and IP address of DNS sever mask (indicating versus host portion of address) Network Layer 4-51 : example UDP IP Eth Phy UDP IP Eth Phy router with server built into router connecting laptop needs its IP address, addr of first-hop router, addr of DNS server: use request encapsulated in UDP, encapsulated in IP, encapsulated in Ethernet Ethernet frame broadcast (dest: FFFFFFFFFFFF) on LAN, received at router running server Ethernet demuxed to IP demuxed, UDP demuxed to Network Layer 4-52

12 : example UDP IP Eth Phy UDP IP Eth Phy router with server built into router DCP server formulates ACK containing client s IP address, IP address of first-hop router for client, name & IP address of DNS server encapsulation of server, frame forwarded to client, demuxing up to at client client now knows its IP address, name and IP address of DSN server, IP address of its first-hop router Network Layer 4-53 : Wireshark output (home LAN) Message type: Boot Request (1) Hardware type: Ethernet Hardware address length: 6 Hops: 0 request Transaction ID: 0x6b3a11b7 Seconds elapsed: 0 Bootp flags: 0x0000 (Unicast) Client IP address: ( ) Your (client) IP address: ( ) Next server IP address: ( ) Relay agent IP address: ( ) Client MAC address: Wistron_23:68:8a (00:16:d3:23:68:8a) Server host name not given Boot file name not given Magic cookie: (OK) Option: (t=53,l=1) Message Type = Request Option: (61) Client identifier Length: 7; Value: D323688A; Hardware type: Ethernet Client MAC address: Wistron_23:68:8a (00:16:d3:23:68:8a) Option: (t=50,l=4) Requested IP Address = Option: (t=12,l=5) Host Name = "nomad" Option: (55) Parameter Request List Length: 11; Value: 010F03062C2E2F1F21F92B 1 = Subnet Mask; 15 = Domain Name 3 = Router; 6 = Domain Name Server 44 = NetBIOS over TCP/IP Name Server Message type: Boot Reply (2) Hardware type: Ethernet reply Hardware address length: 6 Hops: 0 Transaction ID: 0x6b3a11b7 Seconds elapsed: 0 Bootp flags: 0x0000 (Unicast) Client IP address: ( ) Your (client) IP address: ( ) Next server IP address: ( ) Relay agent IP address: ( ) Client MAC address: Wistron_23:68:8a (00:16:d3:23:68:8a) Server host name not given Boot file name not given Magic cookie: (OK) Option: (t=53,l=1) Message Type = ACK Option: (t=54,l=4) Server Identifier = Option: (t=1,l=4) Subnet Mask = Option: (t=3,l=4) Router = Option: (6) Domain Name Server Length: 12; Value: E F ; IP Address: ; IP Address: ; IP Address: Option: (t=15,l=20) Domain Name = "hsd1.ma.comcast.net." Network Layer 4-54

13 IP addresses: how to get one? Q: how does get subnet part of IP addr? A: gets allocated portion of its provider ISP s address space ISP's block /20 Organization /23 Organization /23 Organization / Organization /23 Network Layer 4-55 Hierarchical addressing: route aggregation hierarchical addressing allows efficient advertisement of routing information: Organization /23 Organization /23 Organization /23 Organization Fly-By-Night-ISP Send me anything with addresses beginning /20 Internet /23 ISPs-R-Us Send me anything with addresses beginning /16 Network Layer 4-56

14 Hierarchical addressing: more specific routes ISPs-R-Us has a more specific route to Organization 1 Organization /23 Organization /23 Organization / Organization /23 Fly-By-Night-ISP ISPs-R-Us Send me anything with addresses beginning /20 Send me anything with addresses beginning /16 or /23 Internet Network Layer 4-57 IP addressing: the last word... Q: how does an ISP get block of addresses? A: ICANN: Internet Corporation for Assigned Names and Numbers allocates addresses manages DNS assigns domain names, resolves disputes Network Layer 4-58

15 Exhaustion of Ipv4 addresses Network Layer 4-59 Chapter 4: outline 4.1 introduction 4.2 virtual circuit and datagram s 4.3 what s inside a router 4.4 IP: Internet Protocol datagram format IPv4 addressing ICMP IPv6 4.5 routing algorithms link state distance vector hierarchical routing 4.6 routing in the Internet RIP OSPF BGP 4.7 broadcast and multicast routing Network Layer 4-68

16 The Internet layer host, router layer functions: transport layer: TCP, UDP layer routing protocols path selection RIP, OSPF, BGP forwarding table link layer physical layer IP protocol addressing conventions datagram format packet handling conventions ICMP protocol error reporting router signaling IP datagram format Network Layer 4-69 IP protocol version number header length (bytes) type of data max number remaining hops (decremented at each router) upper layer protocol to deliver payload to how much overhead? 20 bytes of TCP 20 bytes of IP = 40 bytes + app layer overhead ver head. len 16-bit identifier time to live type of service upper layer 32 bits flgs length fragment offset header checksum 32 bit source IP address 32 bit destination IP address options (if any) data (variable length, typically a TCP or UDP segment) total datagram length (bytes) for fragmentation/ reassembly e.g. timestamp, record route taken, specify list of routers to visit. Network Layer 4-70

17 ICMP: internet control message protocol used by hosts & routers to communicate level information error reporting: unreachable host,, port, protocol echo request/reply (used by ping) -layer above IP: ICMP msgs carried in IP datagrams ICMP message: type, code plus first 8 bytes of IP datagram causing error Type Code description 0 0 echo reply (ping) 3 0 dest. unreachable 3 1 dest host unreachable 3 2 dest protocol unreachable 3 3 dest port unreachable 3 6 dest unknown 3 7 dest host unknown 4 0 source quench (congestion control - not used) 8 0 echo request (ping) 9 0 route advertisement 10 0 router discovery 11 0 TTL expired 12 0 bad IP header Network Layer 4-71 Traceroute and ICMP source sends series of UDP segments to dest first set has TTL =1 second set has TTL=2, etc. unlikely port number when nth set of datagrams arrives to nth router: router discards datagrams and sends source ICMP messages (type 11, code 0) ICMP messages includes name of router & IP address when ICMP messages arrives, source records RTTs stopping criteria: UDP segment eventually arrives at destination host destination returns ICMP port unreachable message (type 3, code 3) source stops 3 probes 3 probes 3 probes Network Layer 4-72

18 IP fragmentation, reassembly links have MTU (max.transfer size) - largest possible link-level frame different link types, different MTUs large IP datagram divided ( fragmented ) within net one datagram becomes several datagrams reassembled only at final destination IP header bits used to identify, order related fragments reassembly fragmentation: in: one large datagram out: 3 smaller datagrams Network Layer 4-73 IP fragmentation, reassembly example: 4000 byte datagram MTU = 1500 bytes length =4000 ID =x fragflag =0 offset =0 one large datagram becomes several smaller datagrams 1480 bytes in data field length =1500 ID =x fragflag =1 offset =0 offset = 1480/8 length =1500 ID =x fragflag =1 offset =185 length =1040 ID =x fragflag =0 offset =370 Network Layer 4-74

19 Chapter 2: outline 2.1 principles of applications app architectures app requirements 2.2 Web and HTTP 2.3 FTP 2.4 electronic mail SMTP, POP3, IMAP 2.5 DNS 2.6 P2P applications 2.7 socket programming with UDP and TCP Application Layer DNS: domain name system people: many identifiers: SSN, name, passport # Internet hosts, routers: IP address (32 bit) - used for addressing datagrams name, e.g., - used by humans Q: how to map between IP address and name, and vice versa? Domain Name System: distributed database implemented in hierarchy of many name servers application-layer protocol: hosts, name servers communicate to resolve names (address/name translation) note: core Internet function, implemented as applicationlayer protocol complexity at s edge Application Layer 2-167

20 DNS: services, structure DNS services hostname to IP address translation host aliasing canonical, alias names mail server aliasing load distribution replicated Web servers: many IP addresses correspond to one name why not centralize DNS? single point of failure traffic volume distant centralized database maintenance A: doesn t scale! Application Layer DNS: a distributed, hierarchical database Root DNS Servers com DNS servers org DNS servers edu DNS servers yahoo.com DNS servers amazon.com DNS servers pbs.org DNS servers poly.edu umass.edu DNS serversdns servers client wants IP for 1 st approx: client queries root server to find com DNS server client queries.com DNS server to get amazon.com DNS server client queries amazon.com DNS server to get IP address for Application Layer 2-169

21 DNS: root name servers contacted by local name server that can not resolve name root name server: contacts authoritative name server if name mapping not known gets mapping returns mapping to local name server e. NASA Mt View, CA f. Internet Software C. Palo Alto, CA (and 48 other sites) c. Cogent, Herndon, VA (5 other sites) d. U Maryland College Park, MD h. ARL Aberdeen, MD j. Verisign, Dulles VA (69 other sites ) a. Verisign, Los Angeles CA (5 other sites) b. USC-ISI Marina del Rey, CA l. ICANN Los Angeles, CA (41 other sites) g. US DoD Columbus, OH (5 other sites) k. RIPE London (17 other sites) i. Netnod, Stockholm (37 other sites) m. WIDE Tokyo (5 other sites) 13 root name servers worldwide Application Layer TLD, authoritative servers top-level domain (TLD) servers: responsible for com, org, net, edu, aero, jobs, museums, and all top-level country domains, e.g.: uk, fr, ca, jp Network Solutions maintains servers for.com TLD Educause for.edu TLD authoritative DNS servers: organization s own DNS server(s), providing authoritative hostname to IP mappings for organization s named hosts can be maintained by organization or service provider Application Layer 2-171

22 Local DNS name server does not strictly belong to hierarchy each ISP (residential ISP, company, university) has one also called default name server when host makes DNS query, query is sent to its local DNS server has local cache of recent name-to-address translation pairs (but may be out of date!) acts as proxy, forwards query into hierarchy Application Layer DNS name resolution example root DNS server host at cis.poly.edu wants IP address for gaia.cs.umass.edu TLD DNS server iterated query: contacted server replies with name of server to contact I don t know this name, but ask this server local DNS server dns.poly.edu 1 8 requesting host cis.poly.edu 7 6 authoritative DNS server dns.cs.umass.edu gaia.cs.umass.edu Application Layer 2-173

23 DNS name resolution example root DNS server recursive query: puts burden of name resolution on contacted name server heavy load at upper levels of hierarchy? local DNS server dns.poly.edu TLD DNS server requesting host cis.poly.edu authoritative DNS server dns.cs.umass.edu gaia.cs.umass.edu Application Layer DNS: caching, updating records once (any) name server learns mapping, it caches mapping cache entries timeout (disappear) after some time (TTL) TLD servers typically cached in local name servers thus root name servers not often visited cached entries may be out-of-date (best effort name-to-address translation!) if name host changes IP address, may not be known Internet-wide until all TTLs expire update/notify mechanisms proposed IETF standard RFC 2136 Application Layer 2-175

24 DNS records DNS: distributed db storing resource records (RR) RR format: (name, value, type, ttl) type=a name is hostname value is IP address type=ns name is domain (e.g., foo.com) value is hostname of authoritative name server for this domain type=cname name is alias name for some canonical (the real) name is really servereast.backup2.ibm.com value is canonical name type=mx value is name of mailserver associated with name Application Layer DNS protocol, messages query and reply messages, both with same message format 2 bytes 2 bytes msg header identification: 16 bit # for query, reply to query uses same # flags: query or reply recursion desired recursion available reply is authoritative identification flags # questions # answer RRs # authority RRs # additional RRs questions (variable # of questions) answers (variable # of RRs) authority (variable # of RRs) additional info (variable # of RRs) Application Layer 2-177

25 DNS protocol, messages 2 bytes 2 bytes identification # questions flags # answer RRs name, type fields for a query RRs in response to query records for authoritative servers additional helpful info that may be used # authority RRs # additional RRs questions (variable # of questions) answers (variable # of RRs) authority (variable # of RRs) additional info (variable # of RRs) Application Layer Inserting records into DNS example: new startup Network Utopia register name uptopia.com at DNS registrar (e.g., Network Solutions) provide names, IP addresses of authoritative name server (primary and secondary) registrar inserts two RRs into.com TLD server: (utopia.com, dns1.utopia.com, NS) (dns1.utopia.com, , A) create authoritative server type A record for type MX record for utopia.com Application Layer 2-179

26 Attacking DNS DDoS attacks Bombard root servers with traffic Not successful to date Traffic Filtering Local DNS servers cache IPs of TLD servers, allowing root server bypass Bombard TLD servers Potentially more dangerous Redirect attacks Man-in-middle Intercept queries DNS poisoning Send bogus relies to DNS server, which caches Exploit DNS for DDoS Send queries with spoofed source address: target IP Requires amplification Application Layer 2-180