Network Layer Like the physical and data link layers, the network layer is present is all devices on the network. It's role is thus deceptively simple to move packets (datagrams) from a sending host to a receiving host. To do this, three network layer functions can be identified: 1) Path determination Must determine the route or path taken by packets as they flow from a sender to a receiver. Uses routing algorithms to calculate these paths. 2) Forwarding When a packet arrives at the input to a router, the router must move it to the appropriate output link. 3) Call Setup only for non-tcp/ip networks such as ATM. Routing refers to the overall network-wide process that determines the end-to-end paths that datagrams will take from source to destination. Forwarding refers to the router's local action of transferring a datagram from an input link interface to the appropriate output link interface. Uses a forwarding table of destination addresses. Network Service Model Defines the characteristics of end-to-end transport of data between one edge of the network and the other. Datagram or Virtual Circuit? The most importance abstraction provided by the network layer to the upper layers is whether or not the network layer uses virtual circuits. Three identifiable phases in a virtual circuit: 1. VC Setup: Sender -> NL (provides address) -> waits for the construction of the VC; a) determines path, and b) reserves resources. 2. Data Transfer data flows freely once the VC is built 3. VC Tear Down initiated by the sender (or receiver) which informs the NL of its desire to terminate the VC. Datagram Network Layer Routes do not maintain any state information. Instead, they forward a packet toward its destination by examining the packet's destination address, indexing a forwarding table with the destination address and forwarding the packet in the direction of the destination host. Because forwarding tables can be modified at any time, a series of packets sent from one host to another may follow different paths and may arrive out-of-order. Thus the basis of the Internet is based upon a best effort service ( no service at all ). Timing between packets is not guaranteed to be preserved packet receipt not guaranteed in the order in which they were sent delivery is not guaranteed The Internet Protocol (IP) [Layer Three, Network Layer] Three major components:
1. Network Layer Protocol (NL) defines NL addressing defines fields in the datagram header describes actions taken by routers and end systems bases on the datagram header fields 2. Path Determination determines the route a datagram follows from source to destination. 3. Error Reporting facility in datagrams and responds to requests for certain NL information. IPv4 Addressing A host typically has only one link into the network that the IP layer must use. Interface the boundary between the host and the physical link. Routers have multiple interfaces, one per each link. Each host and router interface must have its own IP address. Thus an IP address is technically associated with an interface rather than with the host or router. Must be globally unique. Each address is 32 bits long (four bytes) therefore there are 2 32 possible IP addresses (4,294,967,296) Uses a dotted-decimal notation each byte is separated by a period, in decimal form. Compose of two parts: network and host. IP Network address share the leftmost bits of an IP address and are interconnected to each other by a single physical link with no intervening routers. Example: 233.1.1.0/24 where the /24 represents a network mask indicating that the leftmost 24 bits of the 32 bit quantity define the network address. The remaining 8 bits would form the range of hosts available on this network. The original IP addressing scheme defined five classes of addresses (only four in use). A First 8 bits 2 7 networks (1st bit always 0) 128 2 24 interfaces/hosts B First 16 bits 2 14 networks (prefix of 10) 16,384 2 16 interfaces/hosts C First 24 bits 2 21 networks (prefix of 110) 2,097,152 D Reserved for Multicast addresses 2 8 interfaces/hosts This scheme was called classful addressing and is no longer formally part of IP addressing because of its rigid structure that led to a shortage of IP address blocks to assign. In 1993, the IETF standardized on Classless Interdomain Routing (CIDR) (RFC 1519) which allowed the network part of the IP address to be any number of bits long. The /x indicates the number of leading bits that constitutes the network portion of the address. For example: an organization needs 2,000 addresses and is allocated 2,048 (x.x.x.x/21) or 2 11
Under the old system, they would have been assigned a Class B block of 65,536 addresses and thus wasting appropriatly 63,000 addresses. The site can furthermore sub-divide their remaining 11 bits into subnets to create individual networks within their organization. How do you obtain a Network address? Typically from your ISP, then you subdivide to meet your needs. Route aggregation is using a single network prefix to advertise multiple networks. Internet Corporation for Assigned Names and Numbers (ICANN) allocates IP address blocks and manages DNS root servers. Assigns domain names and resolves domain name disputes. How do you obtain a Host address? On routers, it is manually entered. On hosts, it can be manually entered or dynamically assigned using the Dynamic Host Configuration Protocol (DHCP). DHCP can assign a persistent IP address or a temporary IP address. How do you move a datagram from source to destination? 1. Same Network. Sending host consults own forwarding table to find an entry whose network address matches the leading bits in the IP address of the receiving host. The forwarding table show that the number of hops is one, indicating it is on the same network as itself. Can use ARP to send datagram to neighbor. 2. Different Network. Sending host consults own forwarding table and finds an entry whose network address matches the leading bits. The forwarding table show the number of hops is two, i.e., on another network. Table also contains the router address that handles that network. Uses ARP to send datagram to router interface. Note: the destination address remains the same; it is not changed to the router's address. When the datagram arrives at the router, it consults its own forwarding table and finds the correct interface to forward it to. If one hop, then it is on the same network as the router interface but if hops is greater than one, it would forward the datagram to the appropriate router. Forwarding tables play a central role in routing datagrams through the Internet. How do they deal with so many possibilities? They use algorithms. Datagram Format (Key Fields) Version Number 4 bits; used to interpret the remainder of the datagram Header Length due to IPv4's variable number of datagram options, these four bits are needed to determine where in the datagram the data actually begins. (Usually a 20 byte header). Type of Service (TOS) allows for different type of datagrams to be distinguished from each other, e.g., distinguish between real-time datagrams and non-real-time datagram traffic. Datagram Length total length (header + data) in bytes. 16 bit field where 2 16 is the
theoretical maximum size of a datagram (65,535 bytes). In reality, they are rarely greater than 1500 bytes and are often limited in size to 576 bytes. Identifier, Flags and Fragmentation Offset deal with fragmentation issues. Time-to-Live (TTL) - included to ensure that datagrams do not circulate forever. Decremented by one each time the datagram is processed by a router. If the TTL field reaches 0, the datagram must be discarded. Protocol only used when the datagram reaches its final destination. The value of this field indicates the specific transport layer protocol to which the data portion should be passed. 6=TCP, 17=UDP This code is analogous to the role of the port number in the transport layer segment. The glue that binds the network and transport layers together. Header Checksum aids a router in detecting bit errors in a received datagram. A router computes the header checksum for each received datagram and detects an error condition if the checksum carried in this field does not equal the computed checksum. Typical behavior is to discard the datagram if there is no match. Note: the checksum must be recomputed and stored at each router because the TTL and possibly other fields may change. Only the header is checksumed. Source and Destination IP Addresses - 32 bit IP addresses. There is an IP broadcast address: 255.255.255.255 which is to all hosts on the same network. Options all the header to be extended; meant to be rarely used but complicates header processing due to variable length. Data payload IP Datagram Fragmentation Three datagram header fields are used to handle fragmentation (the deconstruction of datagrams due to the differing storage capacity of various data link layer frames). Identification Field needed to allow the destination host to determine which datagram a newly arrived fragment belongs to. All fragments of a datagram contain the same identification value. Flags one bit is unused; the other two are Do not fragment (DF) and More Fragments (MF). DF is an order to the routers not to fragment the datagram because the destination is incapable of putting the pieces back together again (e.g., boot RAM requiring a single datagram). MF all fragments except the last one has this bit set. It is needed to know whne all fragments of a datagram has arrived. Fragment Offset tells where in the current datagram this fragment belongs. All fragments except the last one in a datagram must be a multiple of eight bytes, the elementary fragment unit. Since 13 bits are provided, there is a maximum of 8192 fragments per datagram giving a maximum datagram length of 65,536, one more than the total length field. Concerning Fragmentation Not all link layer protocols can carry packets of the same size. Ethernet has a maximum payload of 1500 bytes while other technologies have 576 byte maximums. Maximum Transfer Unit (MTU) maximum amount of data that a link layer packet can carry. Places a hard limit on the length of an IP datagram. The problem is that datagrams must
traverse multiple networks of differing technologies and link layer protocols, each with a different MTU. This causes the need to fragment datagrams. Datagram fragments need to be reassembled before they reach the transport layer on the destination host. The job of reassembly is placed on the end systems rather than the network routers following the KISS principle. Process Destination host receives a series of datagrams from the same source. 1. Must determine if any are fragments of the original datagrams. 2. If fragments exists: Must determine when it has received the last fragment and how the fragment received should be pieced back together. The destination host will use the identification, flag and fragmentation fields as described above. Router fragmentation technique: Each original datagram has an unique value in its Identification field that is incremented for each datagram of the total sent. When a router needs to fragment a datagram each fragment is given the same original identification number. Destination host can then use this common value to identify all of the fragments of the original datagram. Because the IP layer is unreliable, the MF flag is used: in all fragments except the last one, MF is set to '1' and the last fragment MF = '0'. To preserve fragment order and to determine if a fragment is missing, the offset field is filled in with byte order of the individual fragments created. For example, a datagram of 4,000 bytes (20 for the header and 3980 for data) needs to fit within a frame MTU of 1500: [1] 0 1499 (20+(0-1480)) [2] 1500 2999 (20+(1481-2961)) [3] 3000 4000 (20+(2961-3980)) Fragmentation places an additional burden on routers so it is desirable to keep fragmentation to a minimum. How? Limit the TCP/UDP segment to a relatively small size using the Maximum Segment Size (MSS) setting. Because all data link layer protocols supported by IP are supposed to have MTUs of at least 576 bytes (536 data + 20 TCP header + 20 IP header), fragmentation can be entirely eliminated by using a MSS of 536 bytes. This is why most TCP segments for bulk data transfer are 512 to 536 bytes long.
Internet Control Message Protocol (ICMP) (RFC 792) Used by hosts, routers and gateways to communicate network layer information to each other. The most typical usage is for error reporting; e.g. Destination Network Unreachable Often considered part of the IP layer but architecturally lies just above the IP layer, as ICMP messages are carried inside IP datagrams. When a host receives an IP datagram with ICMP specified as the upper-level protocol, it demultiplexes the packet to ICMP just like TCP or UDP. ICMP messages have a type and code field and also contain the header and the first eight bytes of the IP datagram that caused the ICMP message to be generated in the first place (so the sender can determine the packet that caused the error.) See Wikipedia article for header layer and typical error messages: https://en.wikipedia.org/wiki/internet_control_message_protocol Header The ICMP header starts after the IPv4 header and is identified by protocol number '1'. All ICMP packets will have an 8-byte header and variable-sized data section. The first 4 bytes of the header will be consistent. The first byte is for the ICMP type. The second byte is for the ICMP code. The third and fourth bytes are a checksum of the entire ICMP message. The contents of the remaining 4 bytes of the header will vary based on the ICMP type and code. ICMP error messages contain a data section that includes the entire IP header plus the first 8 bytes of data from the IP datagram that caused the error message. The ICMP datagram is then encapsulated in a new IP datagram. Bits 0 7 8 15 16 23 24 31 0 Type Code Checksum 32 Rest of Header Type ICMP type as specified below. Code Subtype to the given type. Checksum Error checking data. Calculated from the ICMP header+data, with value 0 for this field. The checksum algorithm is specified in RFC 1071. Rest of Header Four byte field. Will vary based on the ICMP type and code. Select ICMP Messages 0 Echo Reply 0 Echo reply (used to ping) 3 Destination Unreachable 0 Destination network unreachable 1 Destination host unreachable 2 Destination protocol unreachable 3 Destination port unreachable 4 Fragmentation required, and DF flag set 8 Echo Request 0 Echo request (used to ping) 11 Time Exceeded 0 TTL expired in transit 1 Fragment reassembly time exceeded
ping Program 1. Sends a Type 8, Code 0 ICMP message to the specified host. 2. Destination host, seeing the echo request, sends back a Type 0, Code 0 echo reply First level troubleshooting tool. Just bounces datagrams off a target host to see if it is there but reveals its IP address, status and route/network availability. The output includes sequence numbers and round-trip times computed as minimum, average, maximum, and maximum deviation from the mean. If examined by a packet capture program such as Wireshark, you see that four pings take eight packets; request-reply pairs using ICMP. The source sends an Echo Request to the destination which is basically saying, Send an ICMP Echo Message back to me. The message is carried inside an IP datagram but it is not a Transport Layer protocol; it is part of the IP Layer. You use ping as a first choice to determine connectivity between hosts: Can you ping it? Has lost some usefulness in the Internet because firewalls now block ping replies for security reasons and as a defense against Denial of Service (DOS) attacks or Ping of Death. traceroute Program Used to determine the names and addresses of the routers between the source and destination hosts. The program running on the source machine sends a series of ordinary IP datagrams to the destination each with a incremented Time-to-Live value, e.g., Datagram TTL Action 1 1 Start timer 2 2 Start timer 3 3 Start timer When the nth datagram arrives at the nth router, the nth router observes that the TTL of the datagram has just expired. The IP protocol rule: discard datagram and send an ICMP warning message (Type 11 Code 0) to the source that includes the name of the router and its IP address. When the nth error message arrives at the source, it stops the timer associated with it and obtains the round-trip time. Dynamic Host Configuration Protocol (DHCP) Actually an application layer protocol (client server) that assigns an IP address and other configuration information to a particular host. Follows a four step process: 1) DHCP Server Discovery uses a DHCP discover message which the client sends within a UDP segment to port 67. But the client does not know even what network it is on. Uses 255.255.255.255 as a destination and 0.0.0.0 as the source. This broadcast will go to all machines on the local network. The discover message contains a transaction ID that allows subsequent responses to be matched to the discovery
request. 2) DHCP Server Offers the server responds back to the client with a DHCP offer message containing the transaction ID of the received discover message, the proposed IP address, network mask, and an IP address lease time (amount of time for which the IP address will be valid). 3) DHCP Request the client will accept the offer and respond with a DHCP request message, echoing back the configuration parameters. 4) DHCP ACK server responds with an ACK (acknowledgment) message confirming the requested parameters. This completes the interaction and the client can now use this address for the duration of the lease.
ICMP The only function of the IP layer is to provide addressing for and routing the IP datagrams. Although we categorized it as best effort and unreliable in today's modern equipment it works well with low error rates. It just lacks guarantees. Yet it does have an error detection mechanism for error reporting to the layers above it. Without error condition feedback, the natural response is to repeat the sending, which usually works but repetitive sending in the face of a serious error condition could make matters worse create unneeded congestion; e.g., Do not fragment flag set so all datagrams are rejected. ICMP Message Format The IP TOS field is set to 0 if the datagram is carrying ICMP. It has two formats, both starting with the same three fields: Type, Code, Checksum. Then depending on the Type, the following fields vary, e.g., Destination Unreachable Type 8 bits that define the major purpose of the ICMP message. Most indicate error conditions but two, 8 and 0 are Echo Request and Echo Reply. 3 = Destination Unreachable Type determines the remaining fields beyond the first three. Code 8 bits that provide additional information about the condition in the Type field; often unnecessary and left as 0. Some Types have many code values to allow the source to report the true problem, e.g., Destination Unreachable has 16 codes (0-15) defined. Checksum 16 bits used by internal process to trust results ICMP Type and Codes 40 defined message types and 41 255 are reserved for future use. Only a handful have more than a single code value of 0 defined. Two major categories: 1) Error Messages no response expected 2) Queries response expected 3) Other Which are essential?