ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE. TCP/IP for Dummies. Jean-Yves Le Boudec

Transcription

1 ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE TCP/IP for Dummies Jean-Yves Le Boudec 1

2 This lecture may not be for you First take quiz 1 (given in class) correct answer = +1 wrong answer = -1 no answer = 0 If you score 28 or more, this lecture is not for you; relax and come back when the review session is finished (see web site) If you score 23 or less, this lecture is for you take the lecture plus the first two exercise sessions but do not take its title seriously, I once was a dummy, too Else it is up to you to decide 2

3 Contents 1. Overview of TCP/IP 2. Layer 2, MAC addresses 3. IP 4. Transport 5. Application 3

4 1. Overview Network Services network services examples: distributed database, Web (3), file transfer, remote login, , news, talk, remote processing, resource sharing (file servers, printers, modems), network time, name service (2) user clicks: query name server 3 answer IP addr = IP addr = GET activities.html Web server data (HTML page) 4 In this lecture we study computer networks. We use a top-down approach, starting with applications. We present an overall picture, which will enable you to understand the layered model of networking software. Then in the following chapters, we will study the various components (called layers ), one by one. What are computer networks used for? Computer networks allow people and machines to communicate, using a number of services. The slide shows a small subset of services.

5 Network Infrastructure A computer network is made of distributed applications provide services to users on other machines, or to other machines execute on computers network infrastructure supports transport of data between computers where distributed applications reside in computers (Ethernet card, modem + software) + in special network devices (bridges, routers, concentrators, switches) focus of this lecture = network infrastructure 5 A computer network is made of two distinct subsets of components - distributed applications are programs running on interconnected computers; a web server, a remote login server, an exchanger are examples. This is the visible part of what people call the Internet. In this lecture we will study the simplest aspects of distributed applications. More sophisticated aspects are the object of lectures called Distributed Systems and Information Systems. - the network infrastructure is the collection of systems which are required for the interconnection of computers running the distributed applications. It is the main focus of this lecture. The network infrastructure problem has itself two aspects: - distance: interconnect remote systems that are too far apart for a direct cable connection - meshing: interconnect systems together; even in the case of systems close to each other, it is not possible in non-trivial cases to put cables from all systems to all systems (combinatorial explosion, cable salad management problems etc.). The distance problem is solved by using a network, such as the telephone network with modems (see later). The meshing problem was originally solved easily because the terminals were not able to communicate with each other, but always has to go through a main computer. The mesh in such cases is reduced to a star network. Today this is solved by a complex set of bridges and routers.

6 Physical Layer --Data Link Layer T1 point to point cables 1 to T3: Hello T2 T3 2 From T1: Hello terminals mainframe computer physical transmission = Physical function bits <-> electrical / optical signals transmit individual bits over the cable: modulation, encoding, synchronization frame transmission = Data Link function bits <-> frames frame boundaries addressing bit error detection: CRC Modems, Ethernets 6 The objective of this and the following slides is to introduce the concept of layers. Like any complex computer system, a network is made of components. This decomposition is, to a large extent, stable: computer networking people have agreed on a reasonable way to divide the set of functions into what is called layers. We use the term layer because the decomposition always assumes that different components can be ordered such that one component interfaces only with two adjacent components. We call layers the components. We start with the simplest, and the oldest network example: it is a mainframe connected to terminals. In this case, there are mainly two functions physical layer: translates bits into electromagnetic waves; data link layer: translates frames into bits. These two functions are implemented on cables or on radio links. The physical layer has to do with signal processing and coding; it is the object of the lecture called Telecommunications. The data link layer has to do with bits and bytes; we will study the data link layer in this lecture.

7 A Network network layer set of functions required to transport packets end-to-end examples: IP, Appletalk, IPX intermediate system forwards data not destined to itself T1 M1 T4 T2 1 1a 2 3 2a 3a M2 4, 6a 5a 4a T3 packet switch srce=t2, dest=m2, to T3: hello 7 Modern networks have more than the physical and the data link layers. The network layer is a set of mechanisms that can be used to send packets from one computer to another in the world. There are two types of networks: With packet switching, data packets can be carried together on the same link. They are differentiated by addressing information. Packet switching is the basis for all data networks today, including the Internet, public data networks such as Frame Relay or X.25, and even ATM. Packet switches have queues. Circuit switching is the way telephone networks operate. A circuit emulates the physical signals of a direct end-to-end cable. When computers are connected by a circuit switched network, they establish a direct data link over the circuit. This is used today for modem access to a data network. Modern circuit switches are based on byte multiplexing and are thus similar to packet switches, with the main difference that they perform non-statistical multiplexing (see later). A network has intermediate systems (ISs): those are systems that send data to next ISs or to the destination. Using interconnected ISs saves cable and bandwidth. Intermediate systems are known under various terms depending on the context: routers (TCP/IP, AppleTalk, ), switches (X.25, Frame Relay, ATM, telephone), communication controllers (SNA), network nodes (APPN)

8 Transport Layer why a transport layer? transport layer = makes network services available to programs is end-to-end only, not in intermediate systems such as routers may add additional functions to network services (reliability, ordering, congestion control, multiplexing) in TCP/IP there are two main transport protocols (there is also RTP) UDP (User Datagram Protocol) unreliable offers a datagram service to the application (unit of information is a message) TCP (Transmisssion Control Protocol) reliable offers a stream service (unit of information is a byte) application may use UDP or TCP depending on requirements programming interface socket API: a library of C functions socket is similar to a file descriptor; controls a communication endpoint is associated with an IP address, a port number 8 Physical, data link and network layers are sufficient to build a packet transport system between computers. However, this is not enough for the programmer. When you write a low-level program that uses the network (as we will do in this lecture), you do not handle packets, but data. The primary goal of the transport layer is to provide the programmer with an interface to the network. Second, the transport layer uses the concept of port. A port is an address that is used locally (on one machine) and identifies the source and the destination of the packet inside one machine. We will come back to the concept of ports later in this chapter. The transport layer exists in two varieties: unreliable and reliable. The unreliable variety simply sends packets, and does not attempt to guarantee any delivery. The reliable variety, in contrast, makes sure that data does reach the destination, even if some packets may be lost from time to time.

9 Protocol, service and other fancy definitions Peer entities two (or more) instances of the same layer Protocol and a PDU: the rules of the operation followed by peer entities the data exchanged is called PDU (Protocol Data Unit) there is one protocol (or more) at every layer Service and a SDU the interface between a layer and the layer above - SAP (Service Access Point) the interface data is called a SDU (Service Data Unit) Connection a protocol is connection oriented if the peer entity must be synchronized before exchanging useful data (connection set up); otherwise it is connectionless. 9 A protocol is the formal definition of external behaviour for communicating entities. It defines: - format of PDUs - rules of operation (PDU sent, data delivered, abort) Examples of protocols are: TCP UDP IP Ethernet Protocols are connection oriented or connectionless. A connection exists if the communication requires some synchronization of all involved parties before communication can take place. The telephone system is connection oriented: before A can send some information to B, A has to call B (or vice versa) and say hello. The postal (mail) system is connectionless. If A wants to send some information to B, A can write a letter and mail it, even if B is not ready to read it.

10 Protocol Architecture SDU SDU SAP Layer n entity service demultiplexing SAP protocol Layer n entity PDU PDU Layer n-1 10 Networking functions are structured as a layered model: - layer n communicates with other layer n entities using layer n PDUs - layer n uses the service of layer n-1 and offers a service to layer n+1. - entities at the same layer are said peer entities - operation rules between peer entities are called protocol Layering of protocol entities is reflected by the term of a protocol stack.

11 1 name name resolver resolver Example: name resolution user clicks: 2 DNS query DNS answer A name name server server TCP TCP UDP UDP UDP UDP TCP TCP IP IP (network (network layer) layer) Data Data Link Link (modem, (modem, PPP) PPP) IP IP DL DL DL DL (modem) (modem)(ether) (Ether) IP IP Data Data Link Link (Ether) (Ether) Physical Physical (twisted (twisted pair) pair) PHY PHY (TP) (TP) PHY PHY (TC) (TC) Physical Physical (thin (thin Coax) Coax) Host A P1 router R1 P2 Host B 11 Flow 2 illustrates the query/response protocol of the Domain Name System (DNS). The name resolver and the name server are two application programs, probably C programs making calls to the socket library. The programs use UDP, which is the non-reliable transport protocol in the TCP/IP stack. Let us apply the terminology on this example. name resolver uses the UDP service: it creates a request to send data to name server. name server is identified by its IP address (for example: ). name resolver also knows that name server can be reached by means of port 53 (a well known convention used in the Internet). The SDU is the request, with the data. The transport-pdu is called a datagram. It contains the data, the address and the port numbers. It is identified by 2 in the figure. UDP creates a request to IP to send data to the name server machine identified by the IP address The network-pdu is called an IP packet. It contains the UDP datagram plus the IP addressing information (and some other information, see later). IP creates a request to send a data frame over the modem. The modem card creates a data-link PDU, called a modem frame. The frame contains the IP packet, maybe compressed. Then the data link layer requests transmission of the frame; the physical layer SDU is a bit. The physical layer PDU is an electromagnetic signal. At the router the data frame is received, understood as an IP packet IP reads the IP destination address ( ) and decides to forward it over its Ethernet interface IP creates a request to send the data frame over the Ethernet. An Ethernet frame is created and sent to the name server machine

12 An example with TCP Web Web Browser Browser Web Web Server Server UDP UDP open connection to :80 open (SYN) TCP TCP connect (SYN ACK) connect ack (ACK) send DATA (GET activities.html) 80 TCP TCP passive open UDP UDP IP IP (network (network layer) layer) Data Data Link Link (modem, (modem, PPP) PPP) IP IP DL DL DL DL (modem) (modem)(ether) (Ether) IP IP Data Data Link Link (Ether) (Ether) Physical Physical (twisted (twisted pair) pair) PHY PHY (TP) (TP) PHY PHY (TC) (TC) Physical Physical (thin (thin Coax) Coax) Host A P1 router R1 P Host B 12 Here is a second example. A web browser always uses TCP for communication with a web server. The web browser starts by requesting from the transport layer the opening of a connection for reliable data transport. TCP opens a connection to the peer entity at the web server machine by starting a 3-way handshake. If the connection can successfully be opened, then data can flow between the web client and server. TCP monitors missing packets and retransmits them as appropriate. The web browser and server can thus assume that they have a reliable data pipe between them transporting data in sequence and without errors, at least as long as the TCP layer does not close the connection. TCP is connection oriented. What is shown is the connection setup phase. TCP uses IP, which is connectionless. UDP is connectionless. An observer at P1 or P2 would see the beginning of the message between web clients and servers only in the third data frame.

13 What is the Client-Server model? distributed applications use the client-server model server = program that awaits data (requests) to be sent to it interprets a request and send a response clients send data (requests) to servers wait for a response user clicks: Internet 2 query answer IP addr = IP addr = GET activities.html name server Web server data (HTML page) 13 We use the terms client and server in the following sense. When two entities say A and B, want to communicate, there is a boostrap problem: how can you initialize both A and B such that the communication can take place. One solution is to manually start A, then B, but this defeats the purpose of networking. The only way we have found so far is to request that one of the two, say B, is started and immediately puts itself in a listening position. We say that B is a server. A system, such as A, which talks to B, is said to be a client. Being a server or a client is relative to a given protocol. For example, consider the application level protocol called FTP (file transfer protocol). The FTP server is a machine that waits for other machines to send requests for logging in. When an FTP client has contacted an FTP server, then after an initial navigation phase, the FTP client has to wait for the FTP server to open a connection back to the client (try it!). In that interaction, the FTP client is a TCP server, namely, a machine which waits for some other machine to open a TCP connection. In everyday s life, most people use the term server to designate a machine whose main function is to be a server for some protocol: a name server, a file server, a news server...

14 OSI Architecture end to end layers global layer Application Application Layer Layer Presentation Presentation Layer Layer Session Session Layer Layer Transport Transport Layer Layer Network Network Layer Layer local layers Data Data Link Link Layer Layer 2 Physical Physical Layer Layer 1 An architecture is a set of external behaviour specifications for a complete communication system. It describes protocols, but not how to implement them. 14 The OSI (Open Systems Interconnection) architecture defines protocols and service specifications. It is an official standard, similar to the TCP/IP architecture, but is not much implemented. However, the OSI model is used most frequently to describe all systems, including TCP/IP Architectures do not interoperate by themselves at the protocol level. For example, the OSI transport protocols are not compatible with TCP or UDP. Worse, there is no compatibility at the service level, so it is not possible to use layer n of one architecture and put it on top of layer n-1 of some other architectures. There are fortunately exceptions to this statement. Layer interfaces where service compatibility is often implemented are: the data link layer the transport layer. For example, it is possible to use various protocol families over the same local area network (LAN). The OSI presentation layer is in charge of hiding specific data representation formats. It defines ASN.1, an abstract, universal means for encoding all types of data structures. ASN.1 has also become part of the TCP/IP architecture, in the application layer. The OSI session layer synchronizes events between end-systems, in order for example to support failure recovery. It is implemented in TCP/IP over a number of application layer protocols and TCP.

15 The TCP/IP Architecture OSI layer Number Application Application Layer Layer 7-5 Application Application Layer Layer Transport Transport Layer Layer 4 Transport Transport Layer Layer Network Network Layer Layer 3 Network Network Layer Layer Network Network Layer Layer Data Data Link Link Layer Layer 2 Data Data Link Link Layer Layer Data Data Link Link Layer Layer Physical Physical Layer Layer 1 Physical Physical Layer Layer Physical Physical Layer Layer Host (= end-system) Router (= intermediate system) Host (= end-system) 15 The TCP/IP Architecture, or the Internet Architecture is described by a collection of Internet standards, published in documents called RFCs (Requests For Comments), available for example from ftp://ftp.switch.ch/standard. The picture shows all the layers of the Internet Architecture. There exists, inside every layer, a number of protocols that we will discover in this course. There exist other architectures, each of them having a different set of layers and names for layers. There are: proprietary architectures: SNA (IBM), Decnet (Digital), AppleTalk (Apple), XNS (Xerox), UUCP (Unix internal protocols), etc the ITU architecture defines public networks for telephony, telex, fax, data networks (X.25, Frame Relay, mail and directory services) and ATM the IEEE LAN architecture defines layers 1 and 2 for local area networks. We will see some details later. Having several architectures is a nuisance; everything would be simpler if there would be only one. Today, the TCP/IP architecture has become dominant, so this is the only one we will study in detail. The ITU architecture (Frame Relay and ATM) does also play an important role and we will study it at the end of the course.

16 Physical Layer layer 1 function is to transmit/receive a sequence of bits on electrical or optical system Bits are encoded as analog signal; here are examples different channel coding (Ethernet uses Manchester encoding) NRZ NRZI Manchester Differential Manchester modulation adapt signal to fit a channel, eg. modems (telephone frequency band Hz) amplitude, frequency, phase modulation, or hybrid (amplitude and phase) 16 We see here some rudiments of transmission. The diagram shows some very primitive channel encoding methods. They are used on short distances, for example with Ethernet or Token Ring.

17 Bit Rates Bit Rate of a transmission system = number of bits transmitted per time unit; improperly called bandwidth in some books and papers units: b/s, kb/s = 1000 b/s, Mb/s = 10e+06 b/s, Gb/s=10e+09 b/s Shannon-Hartley law: C max = B log 2 ( 1 + S/N ), with B = bandwidth (Hz), S/N = signal to noise ratio (not expressed in db) example: telephone circuit: B = 3 khz, S/N = 30 db, C max 30 kb/s Practical Bit Rates: modem: 2.4 kb/s to 33.6 kb/s (56kb/s on reception over ISDN at server), 9.6 kb/s GSM ADSL line: 124 kb/s to 2 Mb/s Ethernet: 10 Mb/s, 100 Mb/s, 1Gb/s Wireless LAN: 1 to 50 Mb/s ATM: 2 Mb/s to 622 Mb/s Optical carriers: 155 Mb/s to 9.6 Gb/s Transmission time = time to send x bits at a given bit rate Example: time to send 1 MB at 10 kb/s =? 17 The bit rate of a channel is the number of bits per second. The bandwidth is the width of the frequency range that can be used for transmission over the channel. The bandwidth limits the maximal bit rate that can be obtained using a given channel. In general, the information theory gives the maximum bit rate available under some modelling assumptions. The Shannon-Hartley laws gives the maximum bit rate, for a given bandwidth, assuming the channel is a white noise channel. Many people confuse bandwidth and bit rate, but you should keep the distinction. The bit rate and the number of bits to transmit determine the transmission time.

18 Statistical and Non-statistical Multiplexing Multiplexing several sources use the same link Statistical Multiplexing the bit rate is less than the sum of the incoming bit rates may produce packet loss; requires congestion control T1 T T3 18 Multiplexing means putting several sources on the same link. The most common ways of multiplexing is by sharing time slots (temporal multiplexing) or frequency bands (frequency multiplexing). Temporal multiplexing is used in many telecommunication networks - in circuit switching each source is allocated with one time slot. When a source does not use the link during its slot, the available capacity is unused. In statistical multiplexing data units are stamped with identifiers so that a source may send data at will. On a packet switch, the bit rate of the output (4) is often less than the sum of the bit rates of all inputs (1 to 3). There is a queue at the output; if several packets arrive at the same time, then only one of them is transmitted whiles others have to wait. If nothing special is done, then once in a while, the queue may overflow and packets are lost. This happens everyday on the Internet. Special mechanisms, called congestion control, are required to avoid that packet losses happen too frequently. Congestion control is the object of the advanced lecture on networking. In contrast, with circuit switching, the bit rate of the outgoing circuit (4 on the picture) is at least equal to the sum of the incoming circuits bit rates (1 to 3). There is no loss of data. What is the value of statistical multiplexing? Well, economy. Most of the time, sources are not active, so circuit switching tends to waste bit rates.

19 Propagation Propagation between A and B = time for the head of signal to travel from A to B A time t 0 t 1 t n B s 0 s 1 s n s i - t i = D (propagation delay) D = d /c, where d = distance, c =signal celerity copper: c= 2.3e+08 m/s; glass: c= 2e+08 m/s; Rule of thumb: 5 µs/km; example: earth round trip in fiber: D = 0.2 s time through circuits also adds to propagation delays Lausanne - Concarneau over acoustic channel. D =??? 19 Propagation is the time taken by the front of a signal to reach the destination. It is independent of the bit rate. Propagation of an electro magnetic signal is the speed (also called celerity) of light. It depends on the wavelength and the element in which the signal is propagating. Acoustic waves move at ca. 300 m/s. What is the propagation time if we use an acoustic phone system between two cities which are 1000 km apart?

20 Examples At time 0, computer A sends a packet of size 1000 bytes to B; at what time is the packet received by B for each of the following cases? distance 20 km km 2 km 20 m bit rate 10 kb/s 1 Mb/s 10 Mb/s 1 Gb/s 1-way propagation? transmission? reception time? 20 Compute the values for these examples and try to find scenarios where they apply. Meditate the results.

21 Examples At time 0, computer A sends a packet of size 1000 bytes to B; at what time is the packet received by B (c = 2e+08 m/s)? distance 20 km km 2 km 20 m bit rate 10 kb/s 1 Mb/s 10 Mb/s 1 Gb/s 1-way propagation 0.1 ms 100 ms 0.01 ms 0.1µs transmission 800 ms 8 ms 0.8 ms 8 µs reception time ms 108 ms 0.81 ms 8.1 µs GSM WAN WiFi LAN Gb-LAN 21

22 Throughput Throughput (am thruput, f débit utile, g Durchsatz) for a transmission system or a communication flow = number of useful data bits / time unit units: b/s, kb/s, Mb/s Example 1: PCM voice ( 8 khz, 8 bits per sample -> 64 kb/s) throughput = 64 kb/s Example 2: Stop and Go protocol 22 The throughput defines how much data can be moved by time unit. It is equal to the bit rate if there is no protocol (example 1). However, in most practical cases, the throughput is less than the bit rate for two reasons: - protocol overhead: protocols like UDP use some bytes to transmit protocol information. This reduces the throughput. If you send one-byte messages with UDP, then for every byte you create an Ethernet packet of size = 53 bytes, thus the maximum throughput you could ever get at the UDP service interface if you use a 64 kb/s channel would be 1.2 kb/s. - protocol waiting times: some protocols may force you to wait for some event, as we show on the next page.

23 Test Your Understanding Packets may be lost during transmission: bit errors due to channel imperfections, various noises. Computer A sends packets to B; B returns an acknowledgement packet immediately to confirm that B has received the packet; A waits for acknowledgement before sending a new packet; if no acknowledgement comes after a delay T1, then A retransmits Question: What is the maximum throughput assuming that there are no losses? notation: packet length = L, constant (in bits); acknowledgement length = L, constant channel bit rate = b; propagation delay = D processing time is negligible 23 This example is a simple protocol, often used, for repairing packet or message losses. The idea is simple - identifiy all packets with some number or some other means - when you send one packet, wait until you receive a confirmation - after some time, if no confirmation arrives, consider that the packet has been lost and retransmit. Compute the maximum throughput of this protocol, assuming the source has an infinite supply of packets to send, the destination generates the confirmation instantly, and the bit rate of the channel is constant.

24 Solution (1) packet P1 sent packet P1 acknowledged A T=L/b 2D T =L /b time B cycle time = T + 2D + T useful bits per cycle time = L throughput = L / (T + 2D + T ) = b / (1 + L /L + 2Db/L) overhead «bandwidth»-delay product 24

25 Solution (2) distance 20 km km 2 km 20 m bit rate 10 kb/s 1 Mb/s 10 Mb/s 1 Gb/s propagation 0.1ms 100 ms 0.01 ms 0.1µs transmission 800 ms 8 ms 0.8 ms 8 µs reception time ms 108 ms 0.81 ms 8.1 µs modem WAN LAN Hippi bw delay product 2 bits bits 200 bits 200 bits throughput = b 99.98% 3.8% 97.56% 97.56% 25

26 Consider the scenario : Bandwidth-Delay Product A time B says: stop B β = 2Db last bit sent by A arrives β = maximum number of bits B can receive after saying stop large β means: delayed feedback 26 As an illustration of the effect of propagation, consider the scenario above. The number β is called the bandwidth -delay product (why with quotation marks?). It expresses the latency (in terms of number of bits) of a channel. We will find it important in the rest of the lecture.

27 Facts to Remember (this section) Computer networks are organized using a layered model There is one layered model per architecture ex. TCP/IP, Appletalk, Novell Netware, OSI but the numbering is standard (1 to 7) Layers 1 and 2 correspond to cables (or wireless channels) Layer 3 = network layer; has mainly intermediate systems, eg. routers Layer 4 = transport; is in end systems only UDP provide the simplest access to network services Layer 5-7 is the application layer (web, , etc) Concepts you should know protocol, peer entities, PDU, service transmission time versus propagation time bandwidth delay product 27

28 2. Layer 2, MAC Addresses Local Area networks use mainly Ethernet and WLAN see part II for details Ethernet is originally a cable sharing protocol Design goal: interconnect n systems without switch in-between Requires an Access Method: (Medium Access Control = MAC); for Ethernet. CSMA/CD 28 If you want to understand something in the world of local area networks, you should keep in mind the design requirements. Today, they are: (1) interconnect many pieces of equipment without complex cabling, inside a limited geographical area, and inside one organization (2a) be easy to manage, in particular, detect cable faults easily. When Ethernet was first conceived, the requirements were a little bit different. The second requirement was replaced by: (2b) use one shared cable for the entire network. Today most people would agree that this is not necessarily a good idea, because fault isolation is difficult on a shared cable. Originally, it was believed to be good because it would reduce the amount of cabling, and because traffic is bursty. Burstiness means that, most of the time, sources are idle; once in a while, they send a large amount of traffic. The response time is better with a shared medium system than if you allocate a fixed share to all (see exercise).

29 CSMA / CD Time Diagram 1 A senses idle channel, 0 starts transmitting T shortly before T, B senses idle channel, starts transmitting A B 29 The access method for Ethernet is Carrier Sense Multiple Access / Collision Detection (CSMA/CD). It works as follows i = 1 while (i <= maxattempts) do listen until channel is idle transmit and listen wait until (end of transmission) or (collision detected) if collision detected then stop transmitting /* after 32 bits ( jam )*/ else wait for interframe delay leave wait random time increment i end do

30 CSMA / CD Time Diagram 2 A senses collision, continues to transmit 32 bits ( jam ) B senses collision, continues to transmit 32 bits ( jam ) 0 T A B t2 30

31 CSMA / CD Time Diagram 3 A waits random time t1 B waits random time t2 B senses channel idle and transmits A senses channel busy and defers to B A now waits until channel is idle 0 T A B t2 t1 31 Collisions cannot be avoided because of propagation delays, but they are always resolved by the collision detection mechanisms. Collisions are normal with Ethernet, though they tend to indicate a high load. There is no packet loss due to collision: the sending station simply retransmits the packet if a collision occurs. The operating system is not aware of the collision, only the Ethernet adapter.

32 Ethernet at 10, 100 and 1000 Mb/s Ethernet exists at 10 Mb/s, 100 Mb/s and 1 Gb/s slotsize is 512 bits at 10 Mb/s and 100 Mb/s This means that the network size is 2 km at 10 Mb/s, and at 100 Mb/s At 1 Gb/s, slotsize is 512 Bytes The network size is ca. the same as at 100 Mb/s what does it implies? See also network aspects: is there CSMA/CD in Gigabit Ethernet? 32 This implies that the minimum packet size is larger. This can be achieved by grouping several small packets together otherwise, padding Padding means that bit rate is wasted.

33 Ethernet / IEEE Ethernet = CSMA/CD with exponential backoff as shown in part A originally over a coaxial cable 10 Mb/s to 1 Gb/s local area only (<= 0.2 to 2 kms) Ethernet history 1980 : Ethernet V1.0 (Digital, Intel, Xerox) 1982 : Ethernet V : IEEE standard small differences in both specifications; adapters today support both 1995 : IEEE Mb/s standard frame Ethernet V.2 frame preamble SFD DA SA Length SNAP data pad FCS 7 B 1 B = B 6 B 2 B <= 1500 B 4 B preamble SFD DA SA Type data FCS DA = destination address SA = source address 33 The preamble is used for the receivers to synchronize ( terminated by 0). With Ethernet, transmission starts asynchronously (stations start independently), and between transmissions, the channel is idle. SFD (start frame delimiter) is used to validate the beginning of a frame. Destination length is used to indicate the total length before padding. Padding is required if the minimum frame size of 512 bits = 64 bytes is not reached. With the Ethernet proprietary (=non standard) format, this field is not present. It is up to the layer using Ethernet to know that frames have to be at least 512 bits, and perform the padding. Maximum size of data part is 1500 Bytes (limitation imposed by buffer size considerations in adapters). The type field indicates the type of upper layer that uses the protocol (for example: IP or Appletalk). With 802.3, this field is absent; it is replaced by an intermediate layer, called LLC that provides mainly this multiplexing function. LLC is not needed with the non-standard Ethernet. Type values are larger than the maximum size so both formats can exist on the same network (even on the same station). The FCS (frame check sequence) is a 32-bit cyclic redundancy check. It can detect all single, double, triple errors, all error bursts of length <= 32, most double bursts of length up to 17. The probability that a random collection of bit errors is undetected is 2e-10. Ethernet works for a local area only. This is because the CSMA/CD protocol has poor utilization as the bandwidth-delay product becomes large compared to the frame sizes. The first network of Apple (Appletalk) was CSMA/CA (collision avoidance) at kb/s.

34 Addressing MAC address: 48 bits (16 bits) = adapter name sender puts destination MAC address in the frame all stations read all frames; keep only if destination address matches all 1 address (FF:FF:FF:FF:FF:FF) = broadcast MAC address A 08:00:20:71:0d:d4 B C D 00:00:c0:3f:6c:a4 01:00:5e:02:a6:cf (group address) 34 Ethernet addresses are known as MAC addresses. Every Ethernet interface has its own MAC address, which is in fact the serial number of the adapter, put by the manufacturer. MAC addresses are 48 bit-long. The 1st address bit is the individual/group bit, used to differentiate normal addresses from group addresses. The second bit indicates whether the address is globally administered (the normal case, burntin) or locally administered. Group addresses are always locally administered. When A sends a data frame to B, A creates a MAC frame with source addr = A, dest addr = B. The frame is sent on the network and recognized by the destination. Some systems like DEC networks require that MAC addresses be configured by software; those are so-called locally administered MAC addresses. This is avoided whenever possible in order to simplify network management. Data on Ethernet is transmitted least significant bit of first octet first (a bug dictated by Intel processors). Canonical representation thus inverts the order of bits inside a byte(the first bit of the address is the least significant bit of the first byte); examples of addresses: 01:00:5e:02:a6:cf (a group address) 08:00:20:71:0d:d4 (a SUN machine) 00:00:c0:3f:6c:a4 (a PC ) 00:00:0c:02:78:36 (a CISCO router) FF:FF:FF:FF:FF:FF the broadcast address

35 Ethernet Cabling Ethernet cabling is originally shared cable Today: mainly point to point UTP - twisted pair Thick Coax How is that possible? repeaters bridges Thin Coax UTP 35 Contrary to the original design requirement, Ethernet cabling is today mainly point to point. Why do network managers prefer point to point cabling? - because fault isolation is simpler - because configuration management is simpler How is point to point cabling possible with a shared medium protocol? - using repeaters (shown on the next slide) - or using bridges (called Ethernet Switches)

36 Repeaters Extend network beyond cable length limit Function of a simple, 2 port repeater: - repeat bits received on one port to other port - if collision sensed on one port, repeat random bits on other port One network with repeaters = one collision domain Even with repeaters, network is limited propagation time 51.2µs slottime includes repeaters at most 4 repeaters in one path Repeaters perform only physical layer functions (bit repeaters) Repeater 36 From ethernet.faq: There are limitations on the number of repeaters and cable segments allowed between any two stations on the network. There are two different ways of looking at the same rules: 1. The Ethernet way: A remote repeater pair (with an intermediate point-topoint link) is counted as a single repeater (IEEE calls it two repeaters). You cannot put any stations on the point to point link (by definition!), and there can be two repeaters in the path between any pair of stations. This seems simpler to me than the IEEE terminology, and is equivalent. 2. The IEEE way: There may be no more than five (5) repeated segments, nor more than four (4) repeaters between any two Ethernet stations; and of the five cable segments, only three (3) may be populated. This is referred to as the "5-4-3" rule (5 segments, 4 repeaters, 3 populated segments). From 3Com, for 10 Mb/s Ethernet: The 100BASE-T standard defines two classes of repeaters, called Class I and Class II repeaters. A collision domain can include at most one Class I or two Class II repeaters. Key topology rules are as follows: Using two Class II repeaters, the maximum diameter of the collision domain is 205 meters (typically 100m + 5m + 100m). With just a single Class II repeater in the collision domain, the diameter can be extended to 309 meters using fiber (typically 100m UTP + 209m fiber downlink). With a single Class I repeater in the collision domain, the diameter can be extended to 261 meters using fiber (typically 100m UTP + 161m fiber downlink). Connecting from MAC to MAC (switch to switch, or end-station to switch) using halfduplex 100BASE-FX, a 412-meter fiber run is allowed. For very long distance runs, a nonstandard, full-duplex version of 100BASE-FX can be used to connect two devices over a 2-kilometer distance. The IEEE is currently working on a standard for full duplex, but at this time all full-duplex solutions are proprietary.

37 From Repeaters to Hubs Multiport repeater (n ports) logically equivalent to: - n simple repeaters - connected to one internal Ethernet segment Multiport Repeater Multi-port repeaters make it possible to use point-to-point segments (Ethernet in the box) Value of point to point cabling? - ease of management - fault isolation S1 S2 S3 Ethernet Hub UTP segment Multiport Repeater to other hub 37 Repeaters are the first building block that made it possible to have point-topoint star based cabling.

38 One word on Bridges port 1 Bridge A Repeater port 2 D port 3 B C Forwarding Table Dest Dest Port Port MAC MAC Nb Nb addr addr A 1 B 2 C 3 D 2 Bridges are intermediate systems, or switches, that forward MAC frames to destinations based on MAC addresses Bridges perform connectionless data forwarding Bridges separate collision domains a bridged LAN maybe much larger than a repeated LAN there may be several frames transmitted in parallel in a bridged LAN 38 A bridge is an intermediate system for the MAC layer. It receives MAC frames and forwards them further.

39 Repeaters and Bridges in OSI Model 5 to 7 Application Presentation Session Application Presentation Session 5 to Transport Network LLC MAC Physical L2 PDU (MAC Frame) Physical MAC Physical L2 PDU (MAC Frame) Transport Network LLC MAC Physical End System Repeater Bridge End System Bridges are layer 2 intermediate systems Repeaters are in layer 1intermediate systems There also exist layer 3 intermediate systems (IP routers) -> see next chapter 39

40 Switched Ethernet Switched Ethernet = Bridge in the box Total bandwidth is not shared: parallel frame transmission An Ethernet Switch = Multiport Bridge is a connectionless data switch Ethernet used as a point-to-point mechanism! Frame Switching Hub Frame Switching Hub B1 Bridge B2 Bridge A B C D U V W X 40

41 Full duplex Ethernet A shared medium Ethernet cable is half duplex Full duplex Ethernet = a point to point cable, used in both directions no access method, no CSMA/CD 100 Mb/s and Gigabit Ethernet switches use full duplex links to avoid distance limitations and to guarantee bandwidth for stations 41

42 Congestion Control A network of buffers require some form of congestion control otherwise congestion collapse may occur Known forms of congestion control are reservations (ex: ATM) end-to-end (ex: TCP) hop by hop (ex: machine bus) Ethernet concentrators use hop-by-hop flow control STOP signal can be simulated by collisions on half duplex links on full duplex links: PAUSE ( n ) frames, where n is the duration of required stopping time P0 P1 P2 P3 P=0 P=1 P=2 P=3 STOP P=4 STOP P=5 P=6 P=7 GO 42

43 Architecture versus Products architecture = set of protocols and functions defined by standards or proprietary specifications (SNA, Decnet, AppleTalk) examples: MAC layer, Ethernet Physical Layer Bridge, Repeater Products = implementations of various architecture components examples: a concentrator that performs repeating, bridging an adapter that performs MAC + PHY frame switching performed store and forward cut through 43 Bridging is a well defined architecture concept. Switching is a commercial name with different meanings depending on the context. In a LAN context, a switching Ethernet concentrator is simply a bridge.

44 Facts to Remember (this section) Computers communicate in a local area network using Ethernet and MAC addresses A MAC address is the serial number of the Ethernet adapter Original Ethernet is a shared medium: one collision domain per LAN Using bridging we can have several collision domains per LAN An Ethernet switch uses bridging Repeaters are bit-forwarding devices inside one Ethernet segment Bridges are connectionless intermediate systems that separate Ethernet segments 44

45 3. IP subnetwork host 45

46 Why a network layer? MAC addresses and bridging are not sufficient bridging does not scale well to large networks MAC have no topological structure Solution: connectionless network layer (eg. Internet Protocol, IP): every host receives a network layer address (IP address) intermediate systems forward packets based on destination address 46 Forwarding tables in bridges contain the list of all the MAC addresses that are reachable in a LAN. It is not possible to aggregate MAC addresses because they are not structured in a way that would reflect the topology of the network. The Internet Protocol solves this problem.

47 Connectionless Network Layer Connectionless network layer = no connection Host A.H1 to output B.x 2 A.x 0 to output A.x 1 B.D.x 2 B.C.x 3 to output A.x 1 B.D.x 1 B.C.x 0 Host B.C.H router R1 router R2 router R3 1 2 to output A.x 1 B.x 2 1 router R4 2 Host B.D.H2 47 The connectionless network layer is similar to the postal system; every packet behaves like a postcard: - the destination address is present in every packet, - intermediate systems (called routers) use routing tables to forward packets, - changes in routing tables are not synchronized with end systems. This is why we say that this type of operation is connectionless. Contrary to MAC addresses, network layer addresses have a topological (= geographical) structure. For example, all IP addresses of the form x.x belong to EPFL. This enables aggregation of tables in routers. Routers in the Internet need only to know in which direction x.x is; they do not need a list of all addresses in use at EPFL.

48 ezci7-ethz-switch ETHZ-Backbone Network Example Komsys ezci7-ethz-switch with IP Addresses Modem + PPP sic500cs ed0-ext EPFL-Backbone ed0-swi stisun lrcsuns :00:20:71:0D:D4 lrcpc :00:C0:B8:C2:8D in-inr :00:0C:02:78:36 LRC ed2-in DI lrcmac :00:07:01:a2:a Switch x.x in-inj :00:0C:17:32:96 disun :00:20:20:46:2E Anneau SIDI SUN ed2-el LEMA lrcmac :00:07:01:a2:a5 48

49 IP Addresses An IP addreess is 32 bits, noted in dotted decimal notation An IP address has a prefix and a host part: prefix:host Subnet mask identifies the prefix by bitwise & operation Examples subnet mask at EPFL = question: net:subnet and host parts of : lrcsuns.lrc.epfl.ch? IP addresses are associated (in a complicated way) with a network topology for fixed hosts not true for mobile hosts 49 answer: address is prefix is host part is

50 IP Address Hierarchies The prefix of an IP address is itself structured in order to support aggregation For example: x.y represents an EPFL host / 24 represents the LRC subnet at EPFL / 16 represents EPFL Used between routers by routing algorithms This way of doing is called classless and was first introduced in inter domain routing under the name of CIDR (classless interdomain routing) Notation: /16 means : the prefix made of the 16 first bits of the string In the past, an old model was used: class based addresses, with networks of class A, B or C; now only the distinction between class D and non-class D is relevant. IP address changes when host moves to another subnet (ex: Ethernet split into 2); compare to bridging 50

51 IP Address Classes class A class B class C class D class E Net Id Subnet Id Host Id 10 Net Id Subnet Id Host Id 110 Net Id Host Id 1110 Multicast address Reserved Examples: x.x = EPFL host; x.x = ETHZ host 9.x.x.x = IBM host 18.x.x.x = MIT host Class A B C D E Range to to to to to Class B addresses are close to exhausted; new addresses are taken from class C, allocated as continuous blocks 51 At the origin, the prefix of an IP address was defined in a very rigid way. For class A addresses, the prefix was 8 bits. For class B, 16 bits. For class C, 24 bits. The interest of that scheme was that by simply analyzing the address you could find out what the prefix was. It was soon recognized that this form was too rigid. Then subnets were added. It was no longer possible to recognize from the address alone where the subnet prefix ends and where the host identifier starts. For example, the host part at EPFL is 8 bits; it is 6 bits at ETHZ. Therefore, an additional information, called the subnet mask, is necessary. Class C addresses were meant to be allocated one per network. Today, they are allocated in contiguous blocks.

52 IP Principles Homogeneous addressing an IP address is unique across the whole network (= the world in general) IP address is the address of an interface communication between IP hosts requires knowledge of IP addresses Routers between subnetworks only: a subnetwork = a collection of systems with a common prefix inside a subnetwork: hosts communicate directly without routers ARP used to find MAC address between subnetworks: one or several routers are used Terminology: host = end system; router = intermediate system subnetwork = one collection of hosts that can communicate directly without routers 52

53 ARP Protocol 1: lrcsuns has a packet to send to (lrcpc1) lrcsuns lrcpc1 lrcpc2 in-inr :00:20:71:0D:D :00:C0:B3:D2:8D :00:0C:02:78:36 this address is on the same subnet lrcsuns sends an ARP request to all systems on the subnet (broadcast) target IP address = ARP request is received by all IP hosts on the local network is not forwarded by routers 53

54 ARP Protocol lrcsuns lrcpc1 lrcpc2 in-inr :00:20:71:0D:D :00:C0:B3:D2:8D :00:0C:02:78:36 2: lrcpc1 has recognized its IP address sends an ARP reply packet to the requesting host with its IP and MAC addresses 54

55 ARP Protocol lrcsuns lrcpc1 lrcpc2 in-inr :00:20:71:0D:D :00:C0:B3:D2:8D :00:0C:02:78:36 3: lrcsuns reads ARP reply, stores in a cache and sends IP packet to lrcpc1 55 Systems learn from ARP-REQUESTs. At the end of flow 1, all systems have learnt the mapping IP <-> MAC addr for the source of the ARP-REQUEST, namely, they have updated the following entry in their ARP table: IP addr: MAC addr: 08:00:20:71:0D:D4. As a result, lrcpc1 will not send an ARP-REQUEST to communicate back with lrcsuns. Gratuitous ARP consists in sending an ARP-REQUEST to self s address. This is used at bootstrap to test the presence of a duplicate IP address. It is also used to force ARP cache entries to be changed after an address change (because systems learn from the ARP-REQUEST). As flow 2 shows, the ARP-REPLY is not broadcast, but sent directly to the system that issued the request. The arp command on Unix can be used to see or modify the ARP table.

56 Test Your Understanding What are the MAC and IP source and destination addresses at points 1 and 2 for packets sent by M1 to M3 (Mx= MAC address)? What must the router do when it receives a packet to M2 for the first time? subnet p subnet q Ethernet Concentrator 1 Ethernet Concentrator M1 p.h1 M9 p.1 Router M8 q.1 2 M4 q.h3 M2 p.h2 M3 q.h1 56 The solution is given in class.

57 The Internet Service Packet sequence is not guaranteed Routing tables are updated asynchronously Temporary loops may exist time to live field avoids that a packet loops for ever at source : TTL = 64 decremented at every router upon expiration, packet is discarded 57

58 ICMP: Internet Control Message Protocol used by router or host to send error or control messages to other hosts or routers error or control messages relate to layer 3 only carried in IP datagrams (protocol type = 1) ICMP message types echo request ( reply) -> used by ping destination unreachable time exceeded (TTL = 0) -> used for traceroute responses address mask request/reply source quench redirect - router discovery timestamps ICMP messages never sent in response to ICMP error message - datagram sent or multicast or broadcast IP or layer 2 address - fragment other than first 58 echo contains data part to be returned destination unreachable = routing error or administrative error (sent if possible) no message sent for buffer overflow TTL exceeded not used on multicast address address mask sent to router (broadcast address if not known) source quench not used timestamp have fields for: time sent time received time responded sources computes transit delay ->real time (icmptime) NTP (proctocol RFC 1305) has a precision of the order of 1ms. Broadcast storms message sent to broadcast Ethernet address with unicast IP address all systems send a host unreachable or redirect (see exercise)