ECE 461 Internetworking Fall Quiz 1

Transcription

1 ECE 461 Internetworking Fall 2013 Quiz 1 Instructions (read carefully): The time for this quiz is 50 minutes. This is a closed book and closed notes in-class exam. Non-programmable (Type 2) calculators are permitted The only other aid permitted are the aid sheets included in this quiz. Write your answers on the pages provided, using front and back if needed. Use extra sheets if needed. Do not give aid or receive aid from other students. Show all steps of your solutions. Make sure your answers are legible. Max Points Total 30 STAPLE EXTRA SHEETS WITH YOUR SOLUTIONS TO THIS SHEET BEFORE TURNING IN! Name: 1

2 Problem 1. (20 points) Address Resolution Protocol In the figure below, H1 and H2 are hosts and R is a router. The figure shows the IP addresses and MAC addresses of all interfaces (For simplicity, we assume that MAC addresses are 2 bytes long). Assume that ARP caches are empty on all systems at the start of each sub-problem /16 4d:1d eth /24 e4:44 eth /24 33:c0 eth /24 2a:d0 eth0 H1 Hub R Hub H2 The routing tables are: Network Prefix Interface Next hop At H1: /16 eth0 direct Network Prefix Interface Next hop At R: /24 eth0 direct /24 eth1 direct Network Prefix Interface Next hop At H2: /24 eth0 direct /0 eth Consider a scenario where H1 issues a ping to IP address ( ping ). The ping is successful, when H1 receives an ICMP Reply from H2. a. (5 points) Suppose that Proxy ARP is disabled on R. Describe the ARP packets that are exchanged when the ping is issued. Will the ping be successful? Explain your answer! b. (5 points) Suppose that Proxy ARP is enabled on R. Describe the ARP packets that are exchanged when the ping is issued. Will the ping be successful? Explain your answer! c. (5 points) Suppose again that Proxy ARP is disabled on R. H1 can ensure that the ping will be successful by adding an entry to its routing table. Provide such an entry. d. (5 points) Now suppose that the topology is changed as given in the figure below. H1, H2, and R all connect to a single hub. Also, the eth0 interface of R is not used, and Proxy ARP is disabled. Describe the ARP packets that are exchanged when the ping is issued at H1. Explain why the ping fails in this scenario. H /16 4d:1d eth0 R /24 33:c0 eth /24 2a:d0 eth0 Note: For describing ARP packets, include the MAC source and destination addresses and describe the content (for ARP Request: Who has IP address X? Tell IP address Y? ; for ARP Reply: IP address X is at MAC address Z. ). Hub H2 2

3 Solution: (a) Sender Source MAC address Destination MAC address ARP Content H1 4d:1d ff:ff Who has ? Tell ? Ping is not successful, since there is no reply to ARP Request from H1. (b) Sender Source MAC address Destination MAC address ARP Content H1 4d:1d ff:ff Who has ? Tell ? R e4:44 4d:1d is at e4:44. H1 sends ICMP Request to R R 33:c0 ff:ff Who has ? Tell ? H2 2a:d0 33:c is at 2a:d0. R sends ICMP Request to H2 H2 2a:d0 ff:ff Who has ? Tell ? R 33:c0 2a:d is at 33:c0. H1 sends ICMP Reply to R R e4:44 ff:ff Who has ? Tell ? H1 4d:1d e4: is at 4d:1d. H1 sends ICMP Reply to R Ping is successful. (Explanation follows from table above). (c) Add a routing table for network /24 (or for a host route /32): Network Prefix Interface Next hop At H1: /16 eth0 direct /24 eth For destination address , both routing entries, however, the newly added entry has a better prefix. Therefore, the packet is sent to R (at IP address ), and from there to H2. (d) Sender Source MAC address Destination MAC address ARP Content H1 4d:1d ff:ff Who has ? Tell ? 3

4 H2 2a:d0 4d:1d is at 2a:d0. H1 sends ICMP Request to H2 H2 2a:d0 ff:ff Who has ? Tell ? R 33:c0 2a:d is at 33:c0. H1 sends ICMP Reply to R At this time R wants to forward the datagram to However, R does not have a routing table entry for network (since the eth0 interface is no longer there). Therefore, R will now send an ICMP destination unreachable to H2. Ping is not successful. (Explanation is given in the table). 4

5 Problem 2. (30 marks) Below is the traffic capture of three packets in hexadecimal notation. The packets consist of an Ethernet II header, followed by an IP header, possibly followed by a UDP header, followed by UDP payload. The traffic capture shows the Ethernet II header, the IP header, and 14 bytes following the IP header. The remaining bytes from the packets are not shown. Packet #1: c8 2a a f f3 56 8a 9f d fe af 0a a c Packet #2: c8 2a a f f3 56 8a 9f a 42 d f 62 0a a c Packet #3: c8 2a a f f3 56 8a 9f d fe f7 0a a c8 c5 b c be a. (3 marks) Provide the values of the Source IP Address and the Destination IP addresses of the packets. (Use dotted decimal notation!) b. (4 marks) Determine the length in bytes of each of the packets, including the Ethernet headers, IP headers, and all data following the IP headers. Describe how you determined the length. c. (20 marks) The above packets have been undergoing IP fragmentation. (Note: The fragments are not in the correct order.) a. (4 marks) How can you tell that the above packets have been fragmented? Explain your answer, and support your answer with names and values of relevant IP header fields. b. (4 marks) How can you tell that the fragments belong to the same ( original ) IP datagram? Explain your answer, and support your answer with names and values of relevant IP header fields. c. (4 marks) Give the names and values of the IP header fields needed to determine that no fragments are missing, that is, the three packets can be reassembled to reconstitute the original IP datagram before fragmentation. Identify which of the captured packets contains the first, second, and third fragment of the payload. d. (4 marks) Determine the size of the IP payload of the original IP datagram, i.e., before fragmentation. The IP payload refers to the data following the IP header. e. (4 marks) Provide the MTU value at the network interface that required performing IP fragmentation of the above fragments. Justify your answer. d. (3 marks) Which information in the packet headers determines that the data following the IP headers belongs to UDP. Provide the UDP source and destination ports. 5

6 Solution: (e) Source address Destination address Packet # Packet # Packet # Location of addresses is marked in red in captured packets. Source address is in bold face. (f) Length of all Headers and Payload = Ethernet II header + Total length field in IP header = 14 + Total length field in IP header IP total length field (hex) IP total length field (dec) Length (decimal) Packet # Packet #2 015a Packet # Location of IP total length field is marked in blue/boldface. (g) (c1) Let us identify the flags and the offset fields, which are the 7th and 8th byte in the IP header. The fields are marked in black/boldface. From these two bytes: The first 3 bits are the flags (Reserved, DF, MF) The remaining bits are the offset field (Note that the field has 13 bits. Fortunately, the first 5 bits of the offset field are zero in all packets, and can be ignored. Byte 7-8 of IP Header (hex) R DF MF Value of offset field (Hex) Value of offset field (Decimal) Offset in bytes (decimal) Packet # *8=576 Packet # *8=1152 Packet #

7 The following information tells that the packets have been fragmented: Packet #1: MF bit is set (and offset value is nonzero) Packet #2: nonzero offset value Packet #3: MF bit is set. (c2) Fragments that belong to the same IP datagram have same source/destination address + same identification field. Packet #1 Packet #2 Packet #3 Identification field (hex) 42d8 42d8 42d8 Location of Identification field is marked in magenta. It follows that the fragments belong together. (c3) Note: Stating that two packets have the MF bit set is not sufficient, since fragments could be missing. The answer must verify that the there are no holes in the payload. To do this we need to compare the values of the offset and the number of bytes in the packets. To get the correct answer we need to put the packets in the correct order. We can sort the packets with the values of the offset field. Offset in bytes (decimal) Order of fragments total length (in IP header) IP Payload (=total length IP header length) Packet #1 72*8=576 Second Packet #2 144*8=1152 Third Packet #3 0 First Packet #1 (2 nd fragment) has offset 576. Since Packet #3 (first fragment, offset 0) has 576 bytes of payload, nothing is missing between 1 st and 2 nd fragment. Packet #2 (3 rd fragment) has offset Since the sum of the payloads of Packet #1 (2 nd fragment) and #3 (first fragment) is 1152, nothing is missing between 2 nd and 3 rd fragment. 7

8 Since Packet #2 is last fragment (since MF=0), there are no holes. (c4) Two methods: We need to add the IP payload of the three packets. For this we need to add the total length in the IP headers and subtract the length of the IP headers (20 bytes *3). Take the offset of the third packet and add IP payload of third packet The result is 1478 bytes. (c5) The size of the payload in a fragment (not the last) is the largest number evenly divisible by 8 such that IP payload+ip header<= MTU. Select MTU such that floor((mtu-20) / 8)* 8 = 576. With the given IP payload (576 bytes) and IP header (20 bytes), the following MTU are feasible: 597,598,599,600,601,602,603. (d) The IP protocol field (decimal value 17) in the IP header means the payload is UDP. For the source and destination port, note that only the first IP fragment (Packet #3) contains a UDP header. The port numbers are in the first 4 bytes of the UDP header (The values are marked in green/bold) hexadecimal decimal Source port c5 b Destination port

9 Problem 3. (10 marks) Routing Tables a. (5 marks) A router has the following routing table entries: Network Prefix Interface (1) /26 eth0 (2) /4 eth1 (3) /11 eth2 (4) /19 eth3 (5) /0 eth4 For each of the following IP addresses, indicate the entries with a prefix, and indicate the entry with the longest prefix. (You may use the row number or the interface name to indicate an entry): a1) a2) a3) a4) a5) b. (5 marks) Aggregate the following network prefixes to the highest degree possible / / / / / / /14 Solution: (h) (1) Address eth0 (a1) best (a2) (a3) (2) eth1 (3) eth2 (4) eth3 (5) eth4 best best (a4) (a5) best best 9

10 (b): (1) /10 : (2) /11: (3) /13: (4) /14: (5) /16: (6) /12: (7) /14: Summarize (4)+(7) to: (8) /13: Summary (8)+(3) to: (9) /12: Summary (9)+(6) to: (10) /11: Summary (10)+(2) to: (11) /10: Nothing else can be summarized. The result is (1),(5),(11), i.e., / / /10 10

11 Hexadecimal-to-Decimal Conversion Table Hex Dec Hex Dec Hex Dec Hex Dec A 10 A0 160 A A B 11 B0 176 B B C 12 C0 192 C C D 13 D0 208 D D E 14 E0 224 E E F 15 F0 240 F F

12 Packet Format of Ethernet, IP, and UDP header 4 bytes Ethernet header (14 bytes) destination address type source address IP Header version header length Identification DiffServ Field flags (3 bits) source IP address destination IP address total length fragment offset time-to-live protocol header checksum Flags in the IP header: Bit 1: Reserved Bit 2: DF Bit 3: MF Options (if applicable) UDP Header source port length destination port checksum 12

13 Binary-Decimal Conversion Last 4 bitsà First 4 bitsâ