Switch Configuration message sent 1 (1, 0, 1) 2

Transcription

1 UNIVESITY COLLEGE LONON EPATMENT OF COMPUTE SCIENCE COMP00: Networked Systems Problem Set istributed: nd November 08 NOT ASSESSE, model answers released: 9th November 08 Instructions: This problem set is not assessed - it is to help you to understand the material, and to challenge what you think you know. Model answers will be handed out. Collaboration: For this problem set, you are permitted to work with your classmates. However, you are likely to get more out of this if you attempt the answers first, before discussing them.. Spanning Tree Protocol Having just learned about the Spanning Tree Protocol (STP), UCL student Bill ibosco decides to build a bridged Ethernet running STP in his student housing. Keeping in mind that more paths offer more redundancy to link failures, he constructs the following topology: 4 B 6 C A F 5 E Here clouds labeled with letters represent LANs, and each Ethernet switch is a circle numbered with its identifier. The numbers just outside each switch in the figure above are port identifiers. Bill wires up the above topology, and powers up all the switches. (a) After waiting for the STP to converged, Bill examines the state of each switch in the network. i. eplicate the diagram above and label each port, B or depending on whether it is in the oot, Blocked, or esignated state. The diagram with ports labelled according to their state follows. The diagram also reports the configuration messages sent by each switch, as they help understand why each port is in a specific state.

2 ,,4,,6,, B 4 B 6 C B A B F 5 E,0,,,5,, ii. In this converged state, what configuration message will each switch send periodically? Copy out and fill in the following table. The first entry has been filled in for you: Switch Configuration message sent (, 0, ) Since the root is switch, the first value of every configuration message is. The last value of each configuration message depends only on the switch originating the message. The value in the middle is the distance to the root, in terms of number of LANs to be traversed. Hence, the following configuration messages are sent out. Switch Configuration message sent (, 0, ) (,, ) (,, ) 4 (,, 4) 5 (,, 5) 5 (,, 6) iii. List the switches and LANs along the path a packet will take to go from LAN to LAN C. The path traversed by any packet follows the spanning tree. In particular, the path used to forward packets from LAN to LAN C is:, E, 5, F,, A, 4, B, 6. (b) One evening one of Bill s flatmates unplugs switch 4 s power supply to plug in the prototype desktop synchrotron she s been building. i. Which LANs (if any) are temporarily disconnected from LAN E as a result of switch 4 s failure?

3 LAN B and C are temporarily disconnected from E. This happens because the path from E to each of these two LANs was traversing switch 4 prior to the switch failure. ii. Once the STP has re-stabilized, list the LANs and switches a packet sent from LAN to LAN C will traverse. The STP re-stabilizes excluding switch 4. Hence, the interface of switch 5 (i.e., the one facing LAN B) becomes esignated. Packets from LAN to C follow the new spanning tree, hence are forwarded over the path:, E, 5, B, 6. iii. When Bill disconnects the synchrotron and powers up switch 4 again, will traffic from LAN to LAN C suffer any interruption while the network reconverges? Explain why, or why not. Yes, there will be a temporary traffic interruption since switch 4 will go into preforwarding state when it powers up again: the network will reconverge so that packets from to C cross switch 4, but 4 won t forward them until pre-forwarding state ends.. TCP and High-Bandwidth Paths Your physicist friend C. King Higgs is running an experiment on the Large Hadron Collider (LHC) nuclear physics apparatus at CEN. He has enlisted your help as someone knowledgeable in networking in sending the data from Switzerland, where the LHC is located, to his own university laboratory at Caltech in California. The experiments your friend is conducting will generate measurement data at the impressive rate of 5 Gbits/s. He has arranged two 0 Gbits/s links, one to connect each of CEN and Caltech to the same international Internet Service Provider s (ISP s) backbone, and this backbone has sufficient capacity to carry the 5 Gbits/s data flow between CEN and Caltech. You decide to use TCP over the Internet to carry the data between CEN and Caltech over this ISP s network. Suppose that the round-trip time (TT) between CEN and Caltech is 0 ms. Throughout this question, ignore the bandwidth overhead of TCP and IP headers, and assume that the sender sends 460 user data bytes per TCP segment. (a) How large would the receiver s advertised window and the sender s send window both need to be at a minimum in order to achieve a throughput of 5 Gbits/s? In your answer, ignore TCP congestion control that is, assume that the congestion window is larger in size than the receiver s advertised window and sender s send window at all times. Justify your answer by explaining why TCP requires that window size. The receive window limits how much the sender can send without waiting for a response. To achieve 5Gb/s the sender must send at 5Gbit/s for the TT (0ms) without waiting for an ACK. The answer is therefore 75 Mbytes, as the bandwidth-delay product is 5 Gbits/s *.0 s = 600 MBits = 75 MBytes.

4 (b) Now, let s consider some of the effects of TCP congestion control, and in particular the congestion window (cwnd), on this data transfer. Assume that the path between sender and receiver drops no packets, that the receiver s advertised window and sender s send window are not limiting factors, and that the TCP receiver does not use delayed ACKs. At the start of the connection between CEN and Caltech, how long will it take for the sender to reach the window size that will allow the sender to send at 5 Gbits/s (the window size that you found in the previous part of this question)? Justify your answer by explaining any relevant TCP congestion control behaviors that are invoked at the start of a connection. At the start of the connection, the sender uses slow start, and exponentially increases its window from one packet (460 bytes) up to 570 packets (75 Mbytes). The window doubles in size every round-trip time. So it takes log 570 = 6 TTs to reach that window size, or 6 * 0. seconds =.9 seconds. (c) Suppose that the sender is currently using the exact full congestion window (cwnd) size needed to sustain 5 Gbits/s throughput. uring the sending of this window s worth of data, a router along the path between sender and receiver drops a single packet of the sender s data. Assume that the sender detects this loss upon receiving three duplicate ACKs, and adjusts its congestion window (cwnd) accordingly. How long (in seconds) will it take before the sender s window once again reaches the exact full congestion window (cwnd) size needed to sustain a throughput of 5 Gbits/s? In your answer, you may assume that the network drops no packets after the single loss described above. Three duplicate ACKs will trigger fast retransmit, which in turn will induce the sender to halve the congestion window cwnd and enter additive increase. So, cwnd will drop from 570 packets (75 Mbytes) to 5685 packets (7.5 Mbytes). From this new value of cwnd, TCP will increase cwnd by one packet per TT (additive increase). Hence, it will take 5685 round-trip times, or 5685 * 0. seconds = 08 seconds, for cwnd to return to its previous value. (d) Your friend starts his experiment, which is intended to last for many days. Three hours into the experiment you receive a frantic phone call - the network is only delivering an average of approximately Gb/s rather than the 5Gb/s he expected. You ask him to run some diagnostic tests. He checks the network using ping and all seems well - when he pings between CEN and Caltech, ping shows 0ms TT as expected and no obvious packet loss, so the network is not congested. The send and receive socket buffers are large enough, and wireshark reports that the TCP ACKs show there is space in the receive window, so flow control is not a problem. However, when he runs netstat -i on the receiver, he sees that some some Input Errors have been logged - these are caused by packets that the TCP checksum shows to be corrupted. Specifically, netstat shows that in the last three hours his machine received 90 million packets and that Input Errors were recorded. Your friend does not believe that these Input Errors can possibly be the cause of the problem. Produce a quantative analysis to show the effect these errors should have on the throughput of his TCP traffic. Assume the errors are not clustered in time. These errored packets are dropped by the TCP stack before processing, so they count as packet loss as far as TCP congestion control is concerned. The question then is how fast would the sender be able to send (on average) with the packet loss rate stated. 4

5 The answer can be found by applying the TCP throughput equation: T = / B/(T T p) where T is the throughput, B is the packet size and p is the packet-loss probability. With a rate of Gb/s, and errored packets per 90 million, we have a packet-loss probability p = Feeding this value of p into the TCP throughput equation gives a throughput of Gb/s (after converting packet sizes in bits, as usual). (e) Your friend thinks that packets may be being corrupted on the 0Gb/s ethernet fibres out of CEN. o you agree with him? Explain why, or why not. If not, where do you think the errors are happening? You shouldn t agree with your friend. The reported errors are TCP errors. If the errors were on the fibre, they would be detected by the Ethernet CC. The data rate is just right for the TCP checksum errors that are being observed, hence there are no additional errors that caused packets to be dropped due to CC failure (which would not be observed as TCP checksum errors). The errors must be happening where they re not covered by Ethernet CC - probably in some router memory somewhere.. TCP Under Attack Suppose an attacker sends many SYN packets (i.e., the first packet in TCP s usual -way handshake) to a server, all to the same destination port, but each with a different source port. He sends one such packet every 0 ms, and continues this behavior for hours. He never sends any packets apart from these SYN packets (i.e., he does not attempt to pursue any of these handshakes beyond this first step). To hide his own identity, he sets the source IP address on each of these packets to be a random (probably unused) IP address from elsewhere on the Internet. A typical operating system (OS) implements the server side of TCP connection establishment as follows: When an application on a server asks the OS to listen for incoming TCP connections to a port, the OS allocates a listen queue for that TCP port. Each entry in this queue stores state about one incoming connection that has begun, but not yet completed, the full -way handshake. This queue is typically fairly short: it s only on the order of ten entries long. While the queue is full, no new incoming connection requests to the port can be processed, because there s nowhere to record state about the progress of the new incoming connection request. Entries in this queue are freed in one of two ways: when a connection completes the -way handshake successfully, O when the connection fails to complete the -way handshake within a long timeout period (on the order of minutes, to allow any severely delayed messages from the remote host to arrive) (a) What effect will the attacker s behavior have on legitimate users who wish to connect to the server at the same destination port that is under attack? efer specifically to the details of the -way handshake used by TCP and any relevant aspects of the server s handshake implementation described above in your answer. Assume that no packets are dropped in the middle of the network. Assume that the total rate at which legitimate users attempt to connect to the server at the destination port is far less than once every 0 ms. 5

6 This attack is the classic SYN flooding attack: the receiver s listen queue fills with the attacker s requests, which arrive more quickly (every 0 ms) than they are expired (order of minutes). The listen queue will be full almost entirely of the attacker s bogus SYNs. When a legitimate user attempts to connect, there will usually not be any free space in the listen queue, so the legitimate user s SYN will be dropped, no SYN/ACK will be returned to the legitimate user, and the legitimate user s connection cannot complete. The vast majority of legitimate users connections will fail to complete in this way. (b) Q.. Fender proposes a change (described below) to the server s OS implementation of TCP s three-way handshake. He doesn t change the TCP packet format, nor the OS s TCP code on clients. Your task in this part of the question is to decide whether Q.. s -way handshake implementation behaves any better than the original implementation described in the previous part of this question, and why or why not. Q.. s scheme makes use of a cryptographic hash function, y = H(x). For the purposes of this question, H() has the following properties: The length of the output given by H() is 4 bits, regardless of the length of the input to H(). Given the output of H(x), it s computationally infeasible to determine x. The input x to H(x) can be of arbitrary length. We denote the concatenation of data items by a vertical bar, such that, e.g., H(a b c) refers to computing H() on the entire concatenation of a to b to c. Q.. s scheme is implemented at the receiver,, which wishes to accept incoming TCP connections to destination port p. It works as follows: does not have any queue to hold state for connections in progress. Suppose receives the first packet in the three-way handshake from S, and that S s TCP source port is q. replies to S with a packet whose sequence number is the concatenation of the following pieces of data: first 8 bits: t, a time counter; t increments once every 64 seconds on, and wraps from 55 back to 0 next 4 bits: H(S q p t x), where x is a secret 6-byte string chosen randomly by the server each time the server reboots, and all other variables are as defined above When receives the next packet from S in the three-way handshake, with ACK number a, and with TCP source port q and TCP destination port p, it does as follows: Let b = a set t ACK to top 8 bits of b, and y to low 4 bits of b if t 5 <= t ACK <= t, and y == H(S q p t ACK x), record the connection from S as ESTABLISHE, and notify the appropriate listening application running on of the new connection otherwise, ignore the packet received; do not record any new connection Assume that the table for ESTABLISHE connections is very large, and never fills up. i. How will legitimate (non-source-address-spoofed) connection requests be processed by Q.. s scheme? Be specific: show how the three-way handshake proceeds with Q.. s scheme running on the receiver, with reference to the relevant TCP header fields. 6

7 A legitimate sender S will send a SYN with source address S, source port q, and initial sequence number i to port p on the receiver. When receives this SYN, it will reply by sending a SYN/ACK to S, with ACK i +, and initial sequence number t H(S q p t x). S will receive this SYN/ACK, and reply with ACK H(S q p t x)+ to. then subtracts from the received ACK number, and verifies that the resulting number indeed equals t H(S q p t x) for a recent t. then marks this connection from S as ESTABLISHE. Thus, the legitimate connection succeeds. ii. How will source-address-spoofed connection requests like those discussed in part (b) of this question be processed by Q.. s scheme? Again, refer to the relevant TCP header fields during the handshake in your answer. Malicious sender M will send a SYN with spoofed source address S, source port q, and initial sequence number i to port p on receiver. When receives this SYN, it will reply by sending a SYN/ACK to S (not M), with ACK i +, and initial sequence number H(S q p t x). It was stated in the question that S, the spoofed source address, is an unused address. So no host receives s SYN/ACK, and nothing further happens. 7