IPv4. IPv4 (Review) PROTOCOL ADDRESSING DEPLOYMENT MOBILITY. Connectionless Best effort delivery Transport independent

Transcription

1 IPv4 PROTOCOL ADDRESSING DEPLOYMENT MOBILITY IPv4 (Review) Cnnectinless Best effrt delivery Transprt independent Fixed header Optins (ptinal) Data paylad VERSION TOS/DS HEADER LENGTH TOTAL LENGTH IDENTIFICATION FLAGS FRAGMENTATION OFFSET TIME TO LIVE PROTOCOL CHECKSUM SOURCE ADDRESS DESTINATION ADDRESS 1

2 IPv4 Header Versin Header length TOS/DS Ttal length Identificatin Flags Fragmentatin ffset Time t live Prtcl Header checksum Surce address Destinatin address Optins Sme available ptins Strict surce ruting Lse surce ruting Recrd rute Time stamp Optins are rarely used Optins are ften blcked Strict surce ruting Surce specifies exact path thrugh netwrk Great fr trubleshting A security risk Lse surce ruting Surce specifies ndes the datagram must pass thrugh Great fr trubleshting A security risk 2

3 Surce ruting Sender decides rute + Sender can pick path with specific prperties + Mre predictible perfrmance - Sender must knw netwrk - Bad respnse t failure - Difficult t lad balance Netwrk decides rute + Respnds well t tplgy change + Relatively simple t implement + Can lad balance ver multiple netwrk paths - Unpredictible perfrmance - Difficult t ensure specific path prperties (e.g. QS) Lse Surce Ruting Uses Check return path tracerute g DEST ME Detect packet sniffers ping g HOST SNIFFER ICMP ECHO TO: LSR:

4 Trusted server Lse Surce Ruting Abuses Implementatins that reverse the surce rute makes spfing easy Victim Gain access t private netwrks Spf LSR: T: LSR: Attacker IP Addressing 4

5 IPv4 Addresses Five address classes: A 16 millin addresses B addresses C 255 addresses D Multicast grups E Reserved Prefix determines class 0 Class A 10 Class B 110 Class C 1110 Class D Class E Addresses are all the same N address classes N fixed netwrk bundaries Explicit netmask Determines netwrk size Determines address prefix Addresses are attached t interfaces Special addresses / / / / / / / /4 This netwrk RFC1918 Public-data netwrks Lpback Link lcal addresses RFC1918 Test-Net 6t4 Relay Anycast Netwrk intercnnect benchmark testing Multicast grups 5

6 Sidebar: Interfaces Link-level endpint Has netwrk address Send IP packet Multiple IP addresses Multiple prtcls Sent t Lpback? YES NO ETHERNET INTERFACE Lpback interface YES Sent t IF address? NO Fr lcal traffic NO YES Bradcast r Multicast? ETHERNET RECEIVE ETHERNET SEND INPUT QUEUE ENQUEUE DEQUEUE Receive IP packet CIDR Ntatin A.B.C.D/L A.B.C.D IPv4 Address L Prefix length The prefix Lng prefix: mre netwrks Shrt prefix: larger netwrks Crrespnds t the netmask Examples /32 A single address /24 Netwrk with 255 addresses /16 Netwrk with 65k addresses An ld class B netwrk /12 Netwrk with 1M addresses Aggregate f 16 ld class B netwrks 6

7 Try it ut! What is the netmask f / / /9 What prefix length Hw many hsts n / / / /31 What the Addressing PtP Links Use /30s Safe but wastes space Use unnumbered interfaces Special-case management Nt always available Use /32s Tricky t manage crrectly May intrduce new prblems (e.g. n bradcast) Use /31s Requires sme cnfiguratin Standard and prtable / /31 Bradcast: /31 7

8 Address Allcatin RIRs IANA NIRs allcate allcates and blcks LIRs blcks allcate t natinal (usually (mstly and /8s) PA) lcal t addresses reginal registries registries t (NIRs end users and (RIRs) LIRs) PI and PA addresses Multihming Better reliability Better perfrmance I can reach /24 Other Othernetwrks I can reach / /8 Tw kinds f addresses Prvider independent Prvider aggregable TeliaNet Qwest Qwest I can reach /24 Using prvider aggregable independent addresses 8

9 Aggregatin and subnetting Subnetting Creating mre but smaller netwrks by extending the prefix Expses internal details f the netwrk Aggregatin Creating fewer but larger netwrks by shrtening the prefix Hides internal details f the netwrk Reduces glbal ruting table size Subnetting example (basic) / / / / /

10 Subnetting example (VLSM) / / / / / Aggregatin example Cmbine netwrks A shrter prefix cvers mre netwrks than a lnger ne What abut hles? If yu wn the space OK! If yu dn t be careful / / / /27 10

11 Explicit Cngestin Ntificatin Dealing With Cngestin End-t-end (e.g. IP) N supprt fr cngestin cntrl in the netwrk layer Cngestin is inferred frm ther events Netwrk assisted (e.g. ATM) Explicit netwrk layer supprt fr cngestin cntrl Cngestin can be managed ACTIVE QUEUE MANAGEMENT 11

12 Queue management Tail drp Drp packets when queue becmes full Randm Early Drp Drp packets when queue is getting full Prblems Queues remain full Glbal synchrnizatin Prblems Increases jitter Fairness issues in TCP Tuning issues ECN: Detect, Dn t Drp New field in IP header Lw tw bits f TOS Fur ECN cdepints IP Header DSCP ECN Nt-ECT 0 0 ECT(1) 0 1 ECT(0) 1 0 CE 1 1 New flags in TCP header TCP header Explicit Cngestin Ech Cngestin Windw Reduced Reserved CWR ECE URG ACK PSH RST SYN FIN 12

13 ECN in TCP Perfrmance Fairness issues Imprves gdput Tuning issues ECT Ruter CE Deplyment Brken firewalls Anternate implementatins CWR ECE Mbile IP 13

14 Mbile IP Mbility Mving between netwrks Nt the same as prtability Examples Wrking frm a htel Raming between WLANs Care-f address: Hme address: Internet Freign Agent /24 Mbile nde Alternative t VPNs Hme Agent Hme Netwrk /24 Crrespndent Nde Mbile IP Cmpnents Mbile Nde (MN) The entity that mves between netwrks Has a permanent hme address in its hme netwrk Care-f address: Hme address: Freign Agent /24 Mbile nde Hme Agent (HA) Ruter n hme netwrk Binds hme address with care-f address Frwards packets t MN Internet Hme Agent Hme Netwrk /24 Crrespndent Nde 14

15 Mbile IP Cmpnents Freign Agent (FA) Ruter n freign netwrk MN registers with FA n attach MN sends/receives via HA thrugh FA (FA de-capsulates) Care-f address: Hme address: Freign Agent /24 Mbile nde Care-f Address (COA) Address f MN in freign netwrk Sent by FA t HA when MN registers Often address f FA Internet Hme Agent Hme Netwrk /24 Crrespndent Nde Mbile IP Supprt Services Agent discvery MN must discver FA r HA in current netwrk FA and HA bradcast their presence Uses ICMP Ruter Discvery Prtcl (IDRP) Registratin When MN is nt at hme it registers its COA with its HA Registratin request Registratin reply Internet Registratin request Registratin reply Hme Agent 15

16 Mbile IP Tables Hme Agent Mbility Binding Table Freign Agent Visitr List Hme Address COA Lifetime Hme Address Hme Agent MAC Lifetime :8: :2c: 0:2c: Binds hme address t COA Identifies visiting mbile ndes Maps MNs hme address t its HA and MAC address Mbile IP Ruting Triangle ruting MN sends packets using hme address Traffic t MN is sent t HA HA encapsulates and sends packets t FA FA de-capsulates and sends packets t MN Care-f address: Hme address: Internet Freign Agent /24 Mbile nde Hme Agent Hme Netwrk /24 Crrespndent Nde 16

17 Mbile IP Ruting SRC MN DST CN 1 MN CN 5 2 HA COA CN MN MN CN 4 3 CN MN Mbile IP Cncerns Packet filtering BCP is t nt allw utbund traffic frm nn-lcal surces Freign netwrk firewalls Security Registratin and authenticatin Perfrmance What if FA and CN are clse, but HA is a lng way ff? Reliability Single HA is vulnerable COA: HA: Internet Freign Agent /24 Mbile nde Hme Agent Hme Netwrk /24 Crrespndent Nde 17

18 Rute Optimizatin IPv4 Direct ntificatin f CN CN tunnels t MN Issues What if MN mves? Security Binding warning FA Internet MN CN Binding update Binding request Binding acknwledge HA Hme Netwrk Mbile IP Challenges Smth handffs Rute ptimizatin Security Qualit f Service IPv6 Additinal mbility supprt Supprts rute ptimizatin Supprts smth handffs Still a research area 18

19 IP Implementatin Issues Fragmentatin Identificatin Which IP datagram is this? Flags Are there fragments? May I fragment yu? Fragmentatin is needed when the datagram is larger than the path MTU. Fragmentatin is an integral part f IP. Fragmentatin ffset Which fragment is this? IDENTIFICATION FLAGS FRAGMENTATION OFFSET 19

20 IP HEADER IP HEADER IP HEADER Reassembly f fragments ID: 131 Flags: MF Offset: 0 Length: 100 ID: 131 Flags: MF Offset: 200 Length: 100 ID: 131 Flags: Offset: 300 Length: 45 REASSEMBLY BUFFER IP HEADER Reassembly f fragments ID: 131 Flags: MF Offset: 0 Length: 100 REASSEMBLY BUFFER IP HEADER ID: 131 Flags: Offset: 300 Length: 45 IP HEADER ID: 131 Flags: MF Offset: 50 Length:

21 Ping f Death Create IP datagram larger than bytes Sme IP implementatins wuld crash during reassembly Fragment 1 Size: bytes Offset: Zer Fragment 2 Size 2048 bytes Offset: bytes REASSEMBLY BUFFER IP HEADER IP HEADER Offset: Length: 2048 Offset: 0 Length: S what? Unspecified brder cases Different implementatins behave differently Sme implementatins dn t behave well at all Deplyment issues Failure t cmmunicate Security issues Direct attacks Infrmatin gathering Other examples Reassembly timeuts (IP) ID field generatin (IP) Retransmissin timeuts (TCP) Overlapping segments (TCP) Initial windw size (TCP) ISN generatin (TCP) Query ID generatin (DNS) 21