IPv4 (Part III) รศ.ดร.อน นต ผลเพ ม. Asso. Prof. Anan Phonphoem, Ph.D. Feb 2018

Transcription

1 Feb 2018 IPv4 (Part III) รศ.ดร.อน นต ผลเพ ม Asso. Prof. Anan Phonphoem, Ph.D. Computer Engineering Department Kasetsart University, Bangkok, Thailand 1

2 Outline IP Fundamental Operation Internet Protocol Addressing Supporting Protocol ARP ICMP: ping + traceroute NAT DHCP 2

3 Address Mapping 3

4 Addressing Host Address (Host Name) Port Number IP Address MAC Address (Physical Address) Applications Transport Network Data Link Physical iwing.cpe.ku.ac.th: :04:e2:05:8a:b3 4

5 Node-to-node delivery Need MAC Address to communicate between nodes 5

6 Source-to-destination delivery Need IP Address to route packets to destination 6

7 Resolve Name iwing.cpe.ku.ac.th Domain Name System (DNS) Applications Transport Network Data Link Physical Address Resolution Protocol (ARP) 00:04:e2:05:8a:b3 7

8 Address Resolution Protocol (ARP) 8

9 Address Resolution Protocol (ARP) Mapped IP to MAC address Manual configuration Automatic process by ARP MAC address Ethernet 6 bytes Token ring 2 or 6 bytes FDDI 2 or 6 bytes 9

10 ARP protocol RFC Address Resolution Protocol ARP maps any network level address (such as IP) to its corresponding data link address (such as Ethernet/MAC) IP add. MAC add. supported protocol in Data Link layers, not Data Link layer protocol 10

11 ARP in the TCP/IP protocol stack Data Link Layer 11

12 ARP Protocol PWR 10M100M ACTACT COLCOL SWITCH UPLINK R Internet I m looking for IP

13 ARP Protocol PWR 10M100M ACTACT COLCOL SWITCH UPLINK R Internet I m IP My physical address is AA-BB-CC 13

14 ARP packet 14

15 ARP Frame Type: 0x0806 Preamble and SFD Destination address Source address Type Data CRC 8 bytes 6 bytes 6 bytes 2 bytes 4 bytes Hardware type:16 Protocol type:16 hlen:8 plen:8 ARP Operation:16 Sender MAC addr (bytes 0-3) sender MAC addr (bytes 4-5) sender IP addr (bytes 0-1) sender IP addr (bytes 2-3) dest MAC addr (bytes 0-1) dest MAC addr (bytes 2-5) dest IP addr (bytes 0-3) 15

16 ARP packet 16

17 Hardware type:16 Protocol type:16 hlen:8 plen:8 ARP Operation:16 Sender MAC addr (bytes 0-3) Header details sender MAC addr (bytes 4-5) sender IP addr (bytes 0-1) sender IP addr (bytes 2-3) dest MAC addr (bytes 0-1) dest MAC addr (bytes 2-5) Hardware type (2 bytes): dest IP addr (bytes 0-3) Ethernet=1 ARCNET=7, localtalk=11 Protocol type (2 bytes): IP=0x0800 hlen (1 byte): length of hardware address, Ethernet=6 bytes plen (1 byte): length of protocol address, IP=4 bytes ARP operation (2 bytes): ARP request = 1, ARP reply = 2 RARP request = 3, RARP reply = 4 17

18 ARP Interaction 18

19 ARP mechanisms Each node maintains the ARP cache it first looks in the cache to find entry first if the entry is not used for a period (~15 minutes), it is deleted. Receive node can add an MAC addr. entry for source station in its own cache. ARP traffic load hosts quickly add cache entries. If all hosts on a subnet are booted at the same time? => flurry of ARP requests and reply 19

20 ARP flurry a flurry of snow Shirakawago, Japan 20

21 ARP as a command line % arp -a ( ) at 0:0:e8:15:cc:c % telnet cc : % arp -a router.cpe.ku.ac.th ( ) at 0:0:c:6:13:4a cc.cpe.ku.ac.th ( ) at 2:60:8c:2e:b5:8b ( ) at 0:0:e8:15:cc:c entry in ARP table more entries added 21

22 arp command arp -a fe-cpegw2-server.cpe.ku.ac.th ( ) at 00:1e:f7:11:11:ff [ether] on eth0 delta.cpe.ku.ac.th ( ) at 00:16:3e:22:22:00 [ether] on eth0 ping jabber.cpe.ku.ac.th PING jabber.cpe.ku.ac.th ( ) 56(84) bytes of data. 64 bytes from jabber.cpe.ku.ac.th ( ): icmp_seq=1 ttl=64 time=0.188 ms 64 bytes from jabber.cpe.ku.ac.th ( ): icmp_seq=2 ttl=64 time=0.232 ms ^C arp -a entry in ARP table entry in ARP table fe-cpegw2-server.cpe.ku.ac.th ( ) at 00:1e:f7:11:11:ff [ether] on eth0 jabber.cpe.ku.ac.th ( ) at 00:04:75:33:33:ca [ether] on eth0 delta.cpe.ku.ac.th ( ) at 00:16:3e:22:22:00 [ether] on eth0 22

23 Proxy ARP One node answers ARP request for another: Router R answers for Y X IP: MAC: 02:60:8c:2e:b5:8b X to Y request IP: MAC: 00:00:0c:06:13:4a R IP: MAC: 00:00:e8:15:cb:0c Y R send with 00:00:0c:06:13:4a Useful when some nodes on a network cannot support subnet X do not understand subnet, so it thinks that Y is on the same subnet Router must be configured to be a proxy ARP 23

24 RARP Reverse ARP : map MAC to IP addr For device that can not store IP, usually diskless workstations Need to setup server with RARP table Use the same frame format 0x0835 for Ethernet RARP request operation 0x003 = RARP request 0x004 = RARP reply RARP can not operate across router, BOOTP is more spread 24

25 Internet Control Message Protocol (ICMP) 25

26 ICMP IP supporter For error generating Transmission problem TTL exceed Destination unreachable etc. Serve as useful diagnostics ping, traceroute 26

27 ICMP ICMP error messages never generates due to: ICMP error messages selves Broadcast/Multicast (prevent broadcast Storms) What are Broadcast Storms? A large number of broadcast datalink frames transmitted nearly simultaneous LAN may be freeze! 27

28 Positioning of ICMP 28

29 ICMP encapsulation L4 * L 3.5 * L3 L2 Type: 0x0806 Preamble and SFD Destination address Frame Header Source address Type Data CRC 8 bytes 6 bytes 6 bytes 2 bytes 4 bytes 29

30 ICMP packet DA L2 L3 IP SA T Type Code Other info. header Frame (Ethernet) Header IP Header ICMP Type Code Description 8 0 Echo request 0 0 Echo reply 11 0 Time exceed 3 3 Port unreachable 30

31 ICMP header type - relevant ICMP message code - more detail information checksum - covers ICMP header/data (not IP hdr) type:8 code:8 checksum:16 Content specific 31

32 ping ping request ping reply Generate an ICMP echo request Receive the ICMP echo reply All TCP/IP nodes are supposed to implement ICMP and respond to ICMP echo 32

33 ping command Send an echo request message every seconds Records the time it takes for each reply Every echo request contains a unique sequence number to match replies and request Record round-trip timing Perform packet lost statistics 33

34 ping example anan]$ ping iwing.cpe.ku.ac.th PING iwing.cpe.ku.ac.th ( ) from : 56(84) bytes of data. Warning: time of day goes back, taking countermeasures. 64 bytes from iwing.cpe.ku.ac.th ( ): icmp_seq=0 ttl=252 time=1.187 msec 64 bytes from iwing.cpe.ku.ac.th ( ): icmp_seq=1 ttl=252 time=601 usec 64 bytes from iwing.cpe.ku.ac.th ( ): icmp_seq=2 ttl=252 time=594 usec 64 bytes from iwing.cpe.ku.ac.th ( ): icmp_seq=3 ttl=252 time=594 usec 64 bytes from iwing.cpe.ku.ac.th ( ): icmp_seq=4 ttl=252 time=585 usec 64 bytes from iwing.cpe.ku.ac.th ( ): icmp_seq=5 ttl=252 time=590 usec 64 bytes from iwing.cpe.ku.ac.th ( ): icmp_seq=6 ttl=252 time=584 usec 64 bytes from iwing.cpe.ku.ac.th ( ): icmp_seq=7 ttl=252 time=587 usec --- iwing.cpe.ku.ac.th ping statistics packets transmitted, 8 packets received, 0% packet loss round-trip min/avg/max/mdev = 0.584/0.665/1.187/0.198 ms 34

35 ping as debugging tools What do we get from ping? Timing information Connection reliability Destination is reachable (routable) Layer is functional, but not guaranteed application (e.g. WWW, telnet) 35

36 ping results no response no end node, no connection lost packet (significant when >2-3%) transmission error on WAN/LAN, overloading bridges/routers time acknowledge vary host/network overloading (>100 ms make telnet less acceptable) no lost and echo time is reasonably constant Hulay Congratulation! That s all we want. 36

37 traceroute Command to determine the active route to a destination address How? send a UDP messages to an unused port on the target host with ttl=1 router decrease ttl to 0, it has to return an ICMP time exceed message traceroute sets ttl =2 and retransmits, this time go one more hop ttl++ until UDP messages reach the destination. the target returns an ICMP service unavailable because there is no UDP port service. 37

38 How traceroute works? UDP(TTL =1) Destination unused port # 38

39 How traceroute works? UDP(TTL = 0=1) ICMP(time UDP(TTL =1) exceed) 39

40 How traceroute works? UDP(TTL ICMP(time = 0=1) exceed) UDP(TTL ICMP(time =1) =2) exceed) UDP(TTL ICMP(time =2) exceed) 40

41 How traceroute works? UDP(TTL =8) UDP(TTL =9) ICMP(port UDP(TTL =10) unreachable) ICMP(port UDP(TTL unreachable) =0) Various of traceroute: TCP sync (not common) 41

42 Traceroute example anan]$ /usr/sbin/traceroute iwing.cpe.ku.ac.th traceroute to iwing.cpe.ku.ac.th ( ), 30 hops max, 38 byte packets 1 fe-cpegw2-server ( ) ms ms ms 2 gb-cpegwbb-cpegw ( ) ms ms ms 3 gb-cpec4k6-cpec6k ( ) ms ms ms 4 iwing ( ) ms ms ms 42

43 Traceroute example anan]$ /usr/sbin/traceroute traceroute to ( ), 30 hops max, 38 byte packets 1 fe-cpegw2-server ( ) ms ms ms 2 gb-cpegwbb-cpegw ( ) ms ms ms ( ) ms ms ms ( ) ms ms ms ( ) ms ms ms ( ) ms ms ms ( ) ms ms ms ( ) ms ms ms 9 S1-1.R00.LA-POP.uni.net.th ( ) ms ms ms ( ) ms ms ms 11 snvang-losang.abilene.ucaid.edu ( ) ms ms ms 12 dnvrng-snvang.abilene.ucaid.edu ( ) ms ms * 13 kscyng-dnvrng.abilene.ucaid.edu ( ) ms ms ms 19 nox300gw1-peer-nox-umass nox.org ( ) ms ms ms 20 lgrc-rt gw.umass.edu ( ) ms ms ms 21 lgrc-rt gw.umass.edu ( ) ms ms ms 22 * * * 23 * * * 43

44 Example GUI Traceroute program: Visual Route 44

45 Example GUI Traceroute program: Visual Route 45

46 Example GUI Traceroute program: Open Visual Traceroute on Ubuntu To install on Ubuntu: 46

47 Assignment Select 2 URLs from any site in the world Not the same continent On different times (e.g. 9AM, 3PM, 11PM) of the day ping traceroute (from your machine) Create an example graphical route for each URL a comparison table for different times / sites Summarize and criticize the results 47

48 Ping Example Ping Time results Average (ms) % loss 9AM [ ] with 32 bytes of data: Reply from : bytes=32 time=322ms TTL=127 Reply from : bytes=32 time=506ms TTL=127 Reply from : bytes=32 time=502ms TTL=127 Reply from : bytes=32 time=325ms TTL= PM 11PM 48