CS 458 Internet Engineering Spring First Exam

Transcription

1 CS 458 Internet Engineering Spring 2005 First Exam Instructions (read carefully): There are 6 problems for a total of 60 points. This is a closed book and closed notes in-class exam. If any problem is unclear, or you believe some assumptions need to be made, state your assumptions at the beginning of your solution. Use extra sheets as needed. Keep your answers short. Make sure your answers are legible. If we cannot read an answer, we will not grade it. The exam must be pledged Total 60 Name: Pledge:

2 Problem 1. (10 Points) ARP Protocol In Figure 1, gemini and apollo are hosts and mercury is a router. Proxy ARP is enabled on mercury. The figure shows the IP addresses and MAC addresses of all interfaces (For simplicity, we assume that MAC addresses are 2 bytes long). Assume that the ARP caches are empty on all systems /25 98:28 Ethernet gemini mercury apollo PPP /24 a8: /24 e4:44 Figure /25 e1:32 Suppose gemini wants to send a single IP datagram to host apollo. a) Describe the ARP Request and Reply packets that are being sent in this scenario. For each ARP packet, indicate the source and destination MAC addresses, and describe the contents of the ARP packet. (In ARP Requests, the contents is What is the MAC address of IP address.?, and in ARP Replies, the contents is The MAC address of IP address. Is. ). b) When gemini sends the IP datagram, what is the source and destination IP address in the IP header, and what is the source and destination MAC address in the Ethernet header? Gemini sends ARP Request srcmac: a8:20 destmac: ff:ff:ff:ff:ff:ff Who has Tell a8:20 Mercury sends ARP Reply srcmac: e4:44 destmac: a8: is at e4:44 <<Now IP datagram is sent from Gemini to Mercury>> Mercury sends ARP Request srcmac: 98:28 destmac: ff:ff:ff:ff:ff:ff Who has Tell 98:28 Apollo sends ARP Reply srcmac: e1:32

3 destmac: 98: is at e1:32 <<Now IP datagram is sent from Mercuy to Apollo >> (b) srcmac: a8:20 destmac: e4:44 src IP: dest IP: Problem 2. (10 Points) IP Addresses (Subnets) Assume that you have been assigned the /22 block of IP addresses. a) Specify an extended network prefix that allows the creation of 200 hosts on each subnet. b) With your answer to (a), what is the maximum number of hosts that can be assigned to each subnet? c) With your answer to (a), what is the maximum number of subnets that can be defined? d) Give the IP address (in CIDR notation) of one of these subnets. Give the broadcast address for this subnet. (a) 8 bits are needed (2 8 >200 > 2 7 ) Extended network prefix is /24 or (b) = 254 hosts (broadcast address and network address need to be subtracted) (c) 2 2 =4 (d) Here are all subnet addresses with network addresses /24, / /24, / /24, / /24, /24 Problem 3. (10 points) Internet Engineering Terminology Explain the following terms: (a) Autonomous System (b) Intradomain Routing Protocol (c) Internet Assigned Number Authority (d) Maximum Transmission Unit (e) Subnetting See slides of lecture Problem 4. (10 Points) CIDR

4 CIDR helps to reduce the size of routing tables by allowing that routing table entries with a common prefix can be expressed by a single routing table entry. a) Aggregate the following set of four /24 IP network addresses to the highest degree possible / / / / /22 b) Aggregate the following set of four /24 IP network addresses to the highest degree possible / / / /24 Two answers are accepted: 1. First 19 bits are in common: /19. This answer may include other network addresses 2. First 23 bits are in common: /23 and /23. This answer only covers the listed network addresses. Problem 5. (10 points) IP Fragmentation The IP protocol allows host and routers to split a single IP datagram into multiple packets. This is referred to as fragmentation. (a) Describe a scenario when IP fragmentation is needed. (b) What information does an IP datagram carry so that a destination host can reassemble a fragmented IP datagram? (c) Explain why IP performs reassembly of fragmented IP datagrams only at the destination hosts. (a) IP datagram is longer than the MTU on the outgoing interface. (b) Offset of the datagram, IP datagram identifier, More fragments Flag (c) Fragments can take different routes, and only destination may see all fragments. Problem 6. (10 points) Security Vulnerabilities Suppose you have a program available that permits you to set the header fields of IP packets, ICMP packets, and ARP packets, and transmit these packets. This program can be used to stage the following malicious attacks:

5 Attack 1: Modify routing table entries of another host. (Without running a routing protocol such as RIP or OSPF). Attack 2: Redirect the traffic that is destined to another host with a given IP address to your host. Attack 3: Cause other hosts to send a lot of traffic to a selected target host. For each of the attacks: (a) Describe how the attack is staged. Describe which packets need to be transmitted and how the headers need to be set to stage the attack. (b) Describe the limitations of the attack. (c) Describe how to protect a host against the attack. Multiple answers are possible. Here are the most obvious answers: Attack 1: a. Attack: Send ICMP Route Redirect packets b. Limitations: Must be on the same IP network or only effects routing caches (in Linux) c. Prevention: Do not react to ICMP Route Redirect or clear route cache frequently Attack 2: d. Attack: Send ARP Replies e. Limitations: Must be on the same broadcast network. f. Prevention: Use static ARP entries, match ARP replies with previously sent ARP requests Attack 3: g. Attack: Send ICMP Echo Request with broadcast IP address as destination and target host as source. h. Limitations: Needs to have access to a large number of hosts. i. Prevention: Do not respond to ICMP Echo Requests with broadcast addre

6