Internet Control Message Protocol

Transcription

1 Internet Control Message Protocol The Internet Control Message Protocol is used by routers and hosts to exchange control information, and to inquire about the state and configuration of routers and hosts. Because IP is connectionless, with no error recovery along the way, serves the important purpose of reporting errors and recommending corrective action to the originating host. These notes will start with a discussion of for IPv4 (v4) and segue into a discussion of for IPv6 (v6). v4 v4 messages travel as the payload of an IPv4 packet and can be identified by the value 0x01 in the IPv4 protocol field. The format of an message is as shown below. type (8) code (8) checksum (16) information field(s) (variable length and structure based on message type) The type field identifies the type of message. The IANA shows about 30 types; we ll be interested in a few of the more commonly used messages. The code field adds further information (or further qualification of the base type, if you want to think of it that way). A destination unreachable message, type 3, makes the most use of this field, with 16 defined code values which give a more specific reason why the destination could not be reached (net unreachable, host unreachable, fragmentation needed, administrative prohibition, etc.). The checksum field is calculated in the same way as the IP checksum a one s complement sum but it covers the entire PDU (header and information portions). The checksum field is set to zero when calculating the checksum. The format of the information portion of the message depends on the message type. 1 June, 2014

2 Let s start with the echo and echo reply messages. These are used by the ping command, one of the basic tools for checking network connectivity. 8 (request) / 0 (reply) 0 checksum identifier sequence number optional data (variable length) For echo, type = 8; for echo reply, type = 0. There are no qualifying codes, so code should be 0. The (optional) identifier and sequence number can be used by the sender in an attempt to match up echo and echo reply messages. The data field is also optional; if present, the data received in an echo message must be returned in the resulting echo reply. The parameter problem message is used to tell the originating host that there was some problem with the IP header or options that was severe enough that the packet was dropped. 12 (parameter problem) varies checksum pointer unused IP header + 8 bytes of IP payload For parameter problem, type = 12. The code field, in combination with the pointer value and the portion of the original datagram included in the message, tell the originating host more about the problem. A code of 0 means that the pointer field is valid and points to the octet of the original datagram which triggered the message. A code of 1 indicates a required option is missing (e.g., lack of some security option in an environment where its use was expected). 2 June, 2014

3 A code of 2 indicates incorrect length (a runt packet, or nonsense values for the header and total length). The optional data includes the IP header (a maximum of 120 bytes) plus the first eight bytes of the IP payload. The reason for including the first eight bytes of the IP payload is that for UDP and TCP (the most common transport protocols) this will include the source and destination port numbers. The source port, in particular, is needed in order for the protocol stack to determine which process should receive the bad news. In general, some information from the header of the PDU carried as payload is required to determine the protocol module that should receive the error message. Currently, the recommended practice is to return as much of the original packet as possible, subject to the limitation that the total length of the message should not exceed 576 bytes (the minimum that any IP implementation should be able to receive). Eight bytes of payload isn t sufificient, for example, for IP-in-IP tunnelling, where one IP packet is carried as payload in another IP packet. The destination unreachable message is sent when a router or host cannot deliver a datagram. The format is very similar to a parameter problem message, with the exception that the code field alone supplies the specific reason for failure. 3 (dest unreachable) varies checksum unused IP header + 8 bytes of IP payload The type code for destination unreachable is 3. There are many codes to provide a more specific indication of why the datagram could not be delivered. Possibilities include an unknown address; loss of connectivity to the network or host due to hardware failure or administrative restriction; unavailability of the required protocol, type of service, source route, or link MTU (fragmentation prohibited); or unavailability of the specified port at the destination host. RFC 1191 modifies behaviour when the error is due to a link MTU which is too small for the IP packet. In this case, the router is required to return the MTU of the next hop in the least significant 16 bits of the unused 3 June, 2014

4 word. This supports path MTU discovery, so that a host can determine the maximum size packet which can be sent to a destination without fragmentation. It happens on occasion that a destination unreachable message will arrive and the header fragment will indicate a system with which you ve never exchanged packets. One possible cause is a DoS (denial of service) attack elsewhere in the Internet using IP packets with spoofed source addresses. Failure to deliver a packet due to a timeout rates its own message, time exceeded. The format is the same as that used for a destination unreachable message. The type code is set to 11. There are two possible causes for a timeout. It may be that the packet has spent too much time travelling (i.e., the IP TTL field has decremented to 0 and the packet is not at the destination). The other possibility is that the packet was fragmented in transit and some fragments were lost. The code is set to 0 or 1, for time-to-live or fragmentation reassembly timeout, respectively. It can happen that a host has an incorrect idea about how to route a packet and sends it to the wrong router. In this case, the router will reply with an redirect message. 5 (redirect) varies checksum first-hop IP address IP header + 8 bytes of IP payload The type for a redirect message is 5. The code field specifies the scope of the redirect for a particular host, or for a combination of type of service and net or host. This is a first-hop correction mechanism. There s no way for one intermediate router/host to use an redirect to correct another intermediate router/host, because the IP packet does not contain the address of the router/host at the other end of the hop, only the address of the originating host. 4 June, 2014

5 There s no point in a distant router attempting to correct the source host, because the fault could just as well lie with intermediate routers/ hosts. Note that routers use routing protocols to instruct one another on the correct route. Hosts do not normally participate in routing protocols, and redirect messages provide a way to correct the host s routing table. There is obvious potential for malicious use of redirect messages, and for this reason they are often disabled or firewalled. There are quite a few additional messages, many now considered obsolete. RFCs 6633 and 6918 formally deprecate a number of older message types. Consult the RFCs if you re interested. 5 June, 2014

6 v6 v6 is defined in RFC The Introduction starts with The Internet Protocol version 6 (IPv6) uses the Internet Control Message Protocol () as defined for IPv4 [RFC-792], with a number of changes. This is pretty accurate. The general format of an v6 message looks exactly like the general format of an v4 message, with an initial word containing type, code, and checksum fields, followed by whatever data is appropriate for the message. Many of the messages are the same. There s one new feature that we will see in other protocols: the checksum incorporates a pseudoheader that affords some protection against changes in IPv6 header fields. The form of the pseudoheader is defined in RFC Source Address Destination Address Upper-Layer Packet Length zero Next Header To calculate the v6 checksum, the pseudoheader is (conceptually) prepended to the v6 message. This provides some protection against corruption of the IPv6 header due to incorrect programming in routers because routers do not modify the contents of the IPv6 message. The pseudoheader is not transmitted from the sender to the receiver, nor is it ever a part of the IPv6 header or v6 message. It is a construct, used only for the purpose of calculating the checksum. All information contained in the pseudoheader is known to both the sender and receiver. The v6 protocol module in the receiver reconstructs the 6 June, 2014

7 pseudoheader when it performs its own calculation of the checksum for comparison with the checksum transmitted in the v6 message. We ve already looked at one of the additional features of v6, Neighbour Discovery (ND), in the context of mapping IP to link addresses. This is a good place to look at another set of extensions, for stateless autoconfiguration, also referred to as stateless address autoconfiguration (SLAAC). IPv6 Autoconfiguration One of the goals for IPv6 was to make it possible to connect a host to a network with no manual configuration at the host. To that end, IPv6 includes procedures for stateless autoconfiguration defined in RFC Hosts (and routers) always generate a link-local address for each interface. In addition, IPv6 routers use v6 Router Advertisement messages to periodically advertise routing prefixes for additional addresses and other information about the link. On receipt of a Router Advertisement, a host generates additional addresses by concatenating the advertised prefix(es) with its interface identifier. A host doesn t need to wait for a periodic advertisement; it can solicit Router Advertisements with a Router Solicitation message 2. Stateless autoconfiguration is compatible with stateful configuration 3 using DHCPv6 and hosts can use both at the same time. When a node is connected to a network, it constructs a link-local address using the link-local prefix fe80::/64 and the interface ID as the final 64 bits. The address is checked for uniqueness using the duplicate address detection exchange defined in the ND protocol. Failure of this check aborts autoconfiguration. This step is performed by routers and hosts; the steps which follow are performed by hosts only. The host now sends out a Router Solicitation message (a simple message, type 133) using its link-local address as the source and the all-routers multicast 1 IPv4 reserves the prefix /16 for autoconfiguration, but autoconfiguration is strictly limited to random address selection on isolated, ad hoc networks. 2 While implemented in v4, router discovery (RFC 1256) was not mandatory for IPv4 hosts. In contrast, router discovery is an integral part of IPv6, essential to the autoconfiguration function. 3 The distinction being made here is that routers do not maintain state about addresses configured by individual hosts in response to Router Advertisements. A DHCP server (DHCPv4 or DHCPv6) does maintain state about the addresses it has allocated. 7 June, 2014

8 address as the destination. For efificiency, the host s link address may be included as an option, thus avoiding a ND exchange when the router responds. Router Advertisements are more complicated than most messages; the format is shown below. 134 (Router Advert) 0 checksum Cur Hop Limit M O Reserved Router Lifetime Reachable Time Retrans Timer Options... Router advertisements use the router s link-local IP address as the source IP address and include a link layer address 4 for the interface as one of the options in the advertisement. Conceptually, the address of the router is entered in the node s Default Router List. Router Advertisements typically provide one or more address prefixes for the link 5. For example, if an organisation has two connections to the Internet through two distinct ISPs, the router advertisement would likely include distinct prefixes for each ISP. A Prefix Information option is added to the Router Advertisement for each such prefix. 4 Remember the distinction! The link layer address is specific to the link technology an Ethernet address, for example. The link-local IP address, as described earlier, is an IP address that s valid only on the link that s directly connected to the interface. 5 This is what you ll see in the VNL. The routers january, february, march, and december are configured to advertise on the net17 and net18 Ethernet segments. 8 June, 2014

9 type length Prefix Length L A Reserved Valid Lifetime Preferred Lifetime Reserved Prefix (up to 128 bits) The first two fields (type and length) are standard for any v6 option. The Prefix Length and Prefix fields specify the prefix. Recall that by default IPv6 addresses are leased for a limited amount of time. The Valid Lifetime and Preferred Lifetime fields specify the length of time that the address can be used. An address can be used freely until the Preferred Lifetime interval expires. After that, the address cannot be used in new communication. The address can be used for communication that is already in progress until the Valid Lifetime interval expires. After that, it cannot be used for any purpose. Since routers send out Router Advertisements at regular intervals, the preferred and valid lifetimes can be extended indefinitely. If a network administrator wishes to stop using an address prefix, or introduce a new address prefix, it s simply a matter of adjusting the times advertised by the router. A router advertises prefixes for two purposes: to inform a host that addresses with given prefix are directly connected to the link ( on-link ); and to inform a host of a prefix that it should use as part of stateless autoconfiguration. The two purposes are logically separate. A Prefix Information option will specify whether the host should assume that addresses with this prefix are connected to the same link as the interface receiving the advertisement by setting the L flag. Conceptually, an on-link prefix will be entered in the node s Prefix List. The Prefix List contains all on-link prefixes. An address that does not match a prefix in the Prefix List is considered to be off-link. A Prefix Information option will specify whether the host should use the prefix for stateless autoconfiguration by setting the A flag. 9 June, 2014

10 A prefix can be flagged as identifying addresses on the same link without being used for autoconfiguration. This allows a router to advertise prefixes that are on-link without triggering automatic generation of addresses (e.g., when addresses with this prefix are obtained by stateful configuration). It s also possible for a prefix to be advertised as suitable for stateless autoconfiguration without advertising it as on-link. This can be useful in a situation where even the trafific between hosts on the same segment should be passed through a router for trafific control purposes. Often, a prefix will be advertised as both on-link and available for autoconfiguration. A prefix that does not identify addresses on the same link and cannot be used for autoconfiguration is useless in a Router Advertisement. Remember that Router Advertisements are not a routing protocol, in the sense that the router advertising a prefix may not be the best router to use as the first hop for packets whose destination IP address matches the prefix. Conceptually, when an IPv6 node wants to send a packet, it uses the information in the Default Router List and Prefix List as follows: If the destination address matches a prefix in the Prefix List, the destination is considered to be on-link. If the node does not already know the link layer address of the destination, it will use Neighbour Discovery to get it. If the destination address does not match a prefix in the Prefix List, the destination is considered to be off-link. The node will select a router from the Default Router List (by some method) and send the packet to the router for forwarding. The node should already know the link-local and link layer addresses of the router from its Router Advertisement. In practice, the information in the Default Router List and Prefix List are combined to produce a forwarding table. This is what you see if you use ip or route to show IPv6 forwarding table entries. To avoid doing the full lookup for a given IP destination each time it s used, a host keeps a Destination Cache with the correct forwarding information for each specific destination. As mentioned above, Router Advertisements are not a routing protocol, and it may happen that when there are multiple routers in the Default Router List, the one selected might not be the best choice for a given prefix. In this case, the host will receive an v6 Redirect message specifying the best router for that destination. The information in the Redirect is used to correct the entry in the Destination Cache. 10 June, 2014

11 In addition to address prefixes, Router Advertisements can specify other information: The Router Lifetime field is used to specify whether, and for how long, the router can act as a default gateway. The Cur Hop Limit field specifies a default value that hosts should use for the IPv6 hop count. The M (managed address configuration) and O (other configuration information) flags indicate whether the host should contact a DHCPv6 server for additional addresses and other configuration information. If no Router Advertisements are received in reply to its Router Solicitation message, the host can conclude that the link it s connected to does not have an IPv6-capable router. It is first required to try for stateful configuration (e.g., DHCPv6). If no server can be located, the host can proceed to communicate with any other IPv6 hosts on the link using the link-local address. If a Router Advertisement is received in reply to a host s Router Solicitation, the host is expected to follow the instructions it contains. In particular, for each address prefix flagged for stateless address configuration, the host should construct an IP address using the prefix and the interface ID and bind it to the interface. Addresses in IPv6 are in general time-limited, and router advertisements will include a lifetime for each prefix. The lifetime can be infinite. As mentioned above, Router Discovery isn t a routing protocol a router advertisement specifies whether a router can be used as a default router but it doesn t contain any information about how to choose the best router for off-link destinations. That function is still handled by redirect messages. A router can use a redirect message to inform a host that some other router is a better choice for the destination, or that the destination is attached to the link and can be reached directly. As with an v4 redirect, the redirect message contains the IP address of a better first hop (another router, or the destination itself ). In addition, the router can also include the link address of the new first hop to avoid the need for a ND exchange. 11 June, 2014