9/8/2016. Network Architecture and Protocols. Outline. Layering: A Modular Approach. Layer Encapsulation. IP Layer. IP Layer

Transcription

1 Outline Network rchitecture and Protocols Network Layers Internet Protocol () TCP and UDP IT443 Network Security dministration Slides courtesy of o Sheng 1 2 Layering: Modular pproach Layer Encapsulation Sub-divide the problem Each layer relies on services from layer below Each layer exports services to layer above Interface between layers defines interaction Hides implementation details User Get index.html User Layers can change without disturbing other layers Connection ID TCP, UDP ernet, DSL WiFi, pplication Transport Network Link sical HTTP, FTP, TELNET POP/IMP, SSH, SSL, (v4, v6) Source/Destination Link ddress Layer Layer Data traffic divided into packets Each packet contains a header (w ith address) Packets travel separately through network Packet forw arding based on the header Netw ork nodes may store packets temporarily Destination reconstructs the message Packet Switching VS. Circuit Sw itching est-effort delivery Packets may be lost Packets may be corrupted Packets may be delivered out of order 5 6 1

2 What if the Data Doesn t Fit? Problem: Packet size What if the Data is Out of Order? Problem: Out of Order On ernet, max packet is 1500 bytes (MTU) ml inde x.ht GET Typical Web page is 10 kbytes GET x.htindeml Solution: Split the data across multiple packets Solution: dd Sequence Numbers ml x.ht inde GET ml 4 inde 2 x.ht 3 GET 1 GET index.html GET index.html bit 4-bit 8-bit Version Header Type of Service Length (TOS) 8-bit Time to Live (TTL) 16-bit Identification Packet 8-bit Protocol 16-bit Total Length (ytes) 3-bit Flags 32-bit Source ddress 13-bit Fragment Offset 16-bit Header Checksum 32-bit Destination ddress 20-byte header Transport Protocols Provide logical communication between application processes running on different s Datagram messaging service (UDP) No-frills extension of best-effort Options (if any) Payload eliable, in-order delivery (TCP) 9 10 Client Client Client Using Ports to Identify Services Service request for :80 (i.e., the Web server) Service request for :7 (i.e., the echo server) Server OS OS Web server (port 80) Echo server (port 7) Web server (port 80) Echo server (port 7) Knowing What Port Number To Use Popular applications have well-known ports E.g., port 80 f or Web and port 25 for Well-known ports listed at Well-known vs. ephemeral ports Serv er has a well-known port (e.g., port 80) etween 0 and 1023 Client picks an unused ephemeral (i.e., temporary) port Traditionally between 1024 and 65535, now typically > 32K Lots of registered ports higher than 1024 Uniquely identifying the traffic between the s Two addresses and two port numbers Underly ing transport protocol (e.g., TCP or UDP) 11 2

3 Unreliable Message Delivery Service User Datagram Protocol (UDP) plus port numbers Optional error checking on the packet contents SC port checksum DT DST port length Lightweight communication between processes void overhead and delays of ordered, reliable delivery For example: Vo, video conferencing, gaming Transmission Control Protocol Communication service (socket) Ordered, reliable byte stream Simultaneous transmission in both directions Key mechanisms at end s etransmit lost and corrupted packets Discard duplicate packets and put packets in order Flow control to avoid overloading the receiver buffer Congestion control to adapt sending rate to network load n nalogy: Talking on a Cell Phone lice and ob on their cell phones oth lice and ob are talking What if lice couldn t understand ob? ob asks lice to repeat what she said What if ob hasn t heard lice for a while? Is lice just being quiet? Or, have ob and lice lost reception? How long should ob just keep on talking? Maybe lice should periodically say uh huh or ob should ask Can you hear me now? etransmission, CK/NCK, timeout TCP Support for eliable Delivery Checksum Used to detect corrupted data at the receiver leading the receiver to drop the packet Sequence numbers Used to detect missing data and for putting the data back in order etransmission Sender retransmits lost or corrupted data Timeout based on estimates of round-trip time Establishing a TCP Connection TCP Header Each tells its ISN to the other. Flags: SYN FIN ST PSH UG CK Source port Destination port Sequence number cknowledgment HdrLen 0 Flags dvertised window Checksum Urgent pointer Options (variable) Three-way handshake to establish connection Host sends a SYN (open) to the Host returns a SYN acknowledgment (SYN CK) Host sends an CK to acknowledge the SYN CK 17 Data 18 3

4 Identifiers Transport Layer: port number Layer: address Link Layer: MC address Suite: End Hosts vs. outers HTTP message HTTP TCP segment TCP HTTP TCP router router packet packet packet ernet ernet SONET SONET ernet ernet Outline ddressing and Naming prefix, DNS, P Grouping elated Hosts The Internet is an inter-netw ork Used to connect networks together, not s Needs a way to address a network (i.e., group of s) LN 1 router router router LN 2 LN = Local rea Network = Wide rea Network Scalability Challenge Suppose s had arbitrary addresses Then every router would need a lot of information to know how to direct packets toward the Prefix Divided into network & portions (left and right) /24 is a 24-bit prefix with 2 8 addresses LN 1 router router router LN Network (24 bits) Host (8 bits) forwarding table

5 ddress and Subnet Mask ddress Scalability Improved Number related s from a common subnet /24 on the left LN /24 on the right LN LN 1 router router router LN 2 Mask / /24 forwarding table Easy to dd New Hosts No need to update the routers E.g., adding a new on the right Doesn t require adding a new forwarding entry LN 1 router router router / /24 forwarding table LN Classful ddressing In the olden days, only fixed allocation sizes Class : Very large /8 blocks (e.g., MIT has /8) Class : Large /16 blocks (e.g,. Princeton has /16) Class C: Small /24 blocks (e.g., T&T Labs has /24) Classless Inter-Domain outing (CID) Use two 32-bit numbers to represent a network. Network number = address + Mask ddress : Mask: Private Networks Not globally delegated /8 ( ) /12 ( ) /16 ( ) Mask Network Prefix for s Written as /

6 Growth History GP (roader Gatew ay Protocol) Table Size utonomous systems (routing prefixes) re 32-bit ddresses Enough? Not all that many unique addresses 2 32 = 4,294,967,296 (just over four billion) Plus, some are reserved for special purposes nd, addresses are allocated in larger blocks nd, many devices need addresses Computers, PDs, routers, smartphones, toasters, Long-term solution: a larger address space v6 has 128-bit addresses (2 128 = ) Short-term solutions: limping along with v4 Private addresses Network address translation (NT) Dynamically-assigned addresses (DHCP) Naming: Domain Name System (DNS) Properties of DNS Hierarchical name space divided into zones Translation of names to/from addresses Distributed over a collection of DNS servers 13 root servers (see Labeled through M DNS oot Servers Verisign, Dulles, V C Cogent, Herndon, V (also Los ngeles) D U Maryland College Park, MD G US DoD Vienna, V H L berdeen, MD J Verisign, ( 11 locations) E NS Mt View, C F Internet Software C. Palo lto, C (and 17 other locations) K E London (also msterdam, Frankfurt) I utonomica, Stockholm (plus 3 other locations) m WIDE Tokyo USC-ISI Marina del ey, C L ICNN Los ngeles, C Domain Name System unnamed root DNS esolver and Local DNS Server oot server com edu org ac uk zw arpa west foo bar east generic domains my my.east.bar.edu country domains ac cam usr usr.cam.ac.uk /24 inaddr pplication 1 10 DNS resolver DNS query 2 DNS response 9 DNS cache Local DNS server Caching based on a time-to-live (TTL) assigned by the DNS server responsible for the name to reduce latency in DNS translation Top-level domain server Second-level domain server 36 6

7 ecursive and Iterative ecursive query sk server to get answ er for you E.g., request 2 and response 9 Iterative query sk server w ho to ask next E.g., all other request-response pairs DNS Caching Performing all these queries take time nd all this before the actual communication takes place E.g., 1-second latency before starting Web download Caching can substantially reduce overhead The top-level servers very rarely change Popular sites (e.g., visited often Local DNS server often has the information cached How DNS caching works DNS servers cache responses to queries esponses include a time to live (TTL) field Server deletes the cached entry after TTL expires Negative Caching emember things that don t work Misspellings like w ww.cnn.comm and w ww.cnnn.com These can take a long time to fail the first time Good to remember that they don t w ork so the failure takes less time the next time around ddress Translation MC (or LN or physical or ernet) address: function: get frame from one to another physically-connected (same network) 48 bit MC address (for most LNs) burned in NIC OM, also sometimes software settable nalogy: MC address: like Social Security Number address: like postal address P: ddress esolution Protocol Each node (, router) on LN has P table P table: /MC address mappings for some LN nodes < address; MC address; TTL> TTL (Time To Live): time after which address mapping will be forgotten (typically 20 min) First time ( ): broadcastsan P query packet, containing 's address destination MC address = FF-FF-FF-FF-FF-FF all machines on LN receive P query ddressing: routing to another LN walkthrough: send datagram from to via. focus on addressing - at both (datagram) and MC layer (frame) CC-49-DE-D0--7D E6-E D-D2-C F F

8 creates datagram with source, destination creates link-layer frame with 's MC address as dest, frame contains -to- datagram frame sent from to frame received at, datagram removed, passed up to MC src: MC dest: E6-E MC src: MC dest: E6-E src: dest: src: dest: 49-D-D2-C D-D2-C CC-49-DE-D0--7D E6-E F F CC-49-DE-D0--7D E6-E F F forwards datagram with source, destination creates link-layer frame with 's MC address as dest, frame contains -to- datagram forwards datagram with source, destination creates link-layer frame with 's MC address as dest, frame contains -to- datagram MC src: 1-23-F9-CD MC dest: 49-D-D2-C MC src: 1-23-F9-CD MC dest: 49-D-D2-C src: dest: 49-D-D2-C src: dest: 49-D-D2-C CC-49-DE-D0--7D E6-E F F CC-49-DE-D0--7D E6-E F F forwards datagram with source, destination creates link-layer frame with 's MC address as dest, frame contains -to- datagram MC src: 1-23-F9-CD MC dest: 49-D-D2-C src: dest: CC-49-DE-D0--7D E6-E D-D2-C F F