Examination 2D1392 Protocols and Principles of the Internet 2E1605 Internetworking Date: June 1 st 2007 at 14:00 19:00 SOLUTIONS
1. IP and addressing (5p) a) Your company would like to have all its 511 computers connected to the Internet. You are assigned the network address 167.87.64.0/23. How many of the computers can you connect to the network? (1p) /23 net gives 512 addresses, one reserved for directed broadcast, one the network address, you will have to use one for the router(unless it is one of your computers with two NICs), at most 509 can connect. b) What is the directed broadcast address of your network? (1p) 167.87.65.255 c) After a year you decide to purchase 10 more computers and you would like to connect them to the Internet. You plan to install a private network with a NAT box. Propose a suitable network address. You would like to have one subnet only. (1p) Any correct /22 address is suitable (e.g., 172.16.0.0/22). e) One of the IP options provides a means to discover the path between two hosts on the Internet. Which IP option is it and how does it work? Name at least one reason why its use is limited! (2p) The RecordRoute IP option. Every router on the path inserts its IP address into the options field at the position indicated by a pointer. The address is the address on the outgoing interface. The IP options s size is at most 40 bytes, hence the number of entries is limited. 2. ARP and bridging (5p) Consider the following network consisting of 2 bridges and 1 router. Hosts H 1 to H 6 have one interface each. B 1 and B 2 are learning bridges. R 1 is a router with an appropriate routing table. All ARP caches and the bridges learning tables are empty. Assume that ARP snooping is used. H 1 B 1 H 2 B 2 H 3 H 4 H 5 H 6 a) Add the necessary physical (MAC) and logical (IP) addresses, and identify the subnets! Use symbols to denote the addresses. (1p) Host=Mac,IP : H 1 =a,a, H 2 =b,b, H 3 =c,c, H 4 =d,d, H 5 =e,e, H 6 =f,f, R 1,l =g,g, R 1,u =h,h, R 1,r =i,i b) Host H 6 sends a packet to host H 5. Show the contents of the learning tables and the ARP caches after the packet has been delivered. (1p) R 1 : F,f, E,e H 6 :I,i H 5 :G,g c) Host H 5 sends a packet to host H 2. Show the new contents of the ARP caches and the learning tables. (2p) R 1 : B,b H 1, H 2, H 3, H 4 : H,h B 2 : h-south,b-north B 1 :h-south,b-east R 1
d) Host H 3 sends a packet to host H 6. Show the contents of the learning tables and the ARP caches after the packet has been delivered. (1p) R 1 :C,c B 2 :c-west 3. IPv4 forwarding (5p) A router has the routing table shown below. Determine the next-hop address and the outgoing interface for the packets arriving to the router with destination addresses as given in points (a)-(e). Destination Next hop Flags Interface 10.16.0.0/16 - U m0 172.18.64.0/18 - U m1 192.168.138.0/24 - U m2 172.18.65.124/32 10.16.0.1 UGH m0 192.168.19.0/24 172.18.65.173 UG m1 10.17.0.0/16 10.16.0.245 UG m0 172.31.0.0/16 192.168.138.3 UG m2 192.168.19.5/32 192.168.138.3 UGH m2 a) 10.17.167.83 (1p) 10.26.0.245 on m0 b) 192.168.138.245 (1p) Direct delivery on m2 c) 192.168.19.5 (1p) 172.18.65.173 on m1 d) 130.235.15.67 (1p) Discarded, no matching entry in FIB e) 172.18.67.13 (1p) Direct delivery on m1 4. UDP and fragmentation (5p) a) An application wants to transmit 4097 bytes of data via UDP from host A to host B. The UDP header is 8 bytes long, there are no IP options used. The path consists of two networks: the MTU of the first network is 1500 bytes and the MTU of the second network is 1000 bytes. How many IP fragments arrive at host B? Give the segment sizes, the fragmentation offset and the more fragments (MF) bit of all fragments. (3p) Data to be transmitted including the UDP header 4105 bytes. Fragment 1: 976 bytes IP payload, offset=0, MF=1 Fragment 2: 504 bytes IP payload, offset=122, MF=1 Fragment 3: 976 bytes IP payload, offset=185, MF=1 Fragment 4: 504 bytes IP payload, offset=307, MF=1 Fragment 5: 976 bytes IP payload, offset=370, MF=1 Fragment 6: 169 bytes IP payload, offset=492, MF=0 b) Assume that one of the fragments gets delayed in the intermediate router. It arrives 1s before the reassembly timer expires. How does this affect the application? (1p) Reassembly occurs at the IP layer, so the application will only notice some delay in the delivery of the packet. c) In host B the UDP checksum of the packet is calculated. What value would indicate error free transmission? (1p) 0 indicates error free delivery.
5. TCP (5p) a) Describe the TCP silly window syndrome! How can it occur? (1p) Occurs if the sender sends data in small chunks (sender driven) or the receiver consumes data in small chunks (receiver driven). Causes TCP to send small packets, results in big overhead (packet header is 40 bytes at least). b) How does delay jitter affect TCP s performance? How do the update rules of the retransmission timeout (RTO) of TCP try to handle delay jitter? (2p) In TCP the RTO tells when to retransmit a segment. Due to delay jitter the acknowledgements do not arrive at regular time instants, but there is some variation even if the average RTT is constant. There are at least two consequences: (i) big jitter can lead to unnecessary retransmissions; (ii) the RTO has to be kept high compared to the smoothed average RTT in order to avoid such retransmissions, but this leads to increased waiting time in the case of an actual loss. Delay jitter is accounted for with the inclusion of RTTdev in the calculation of the RTO. c) Explain the difference between the operation of TCP congestion control and the equation based rate control (e.g., TCP friendly rate control, TFRC) employed in DCCP. (1p) In TCP loss events and acknowledgements influence the evolution of the CWND size. The influence depends on whether TCP is the slow-start or the CA phase. In the case of equation based rate control the feedback from the receiver is used to estimate the channel parameters (RTT, loss rate), and an equation is used to calculate the rate that TCP s congestion control would achieve under the measured channel conditions. This rate is then used to transmit the data. The latter leads to smoother transmission rate variations. d) You use TCP to transmit data over a satellite link with 100Mbps bandwidth and round trip time 600ms. You observe that the throughput is 10Mbps, even though the link is loss free. What could be the reason for the poor performance and how could you improve the throughput? Can you improve the throughput of an existing connection? (1p) The reason is most likely that the window size is too small. The way to improve the throughput is to increase the window size. The TCP window scale option can be used to increase the window size above 65535 bytes, but it can only be used during connection setup (handshake). 6. Application layer (5p) a) In order to compare the performance of TCP and TFTP we made a measurement on a link with a round trip time of 300ms. We transmitted 68000 bytes in 5s. How much time would TFTP need to transmit the same amount of data? (2p) The maximum payload is 512 bytes, that is, you need 133 data packets, plus the connection setup, total 134 packets. You use Stop-and-wait, so that the time it takes is 40.2 seconds. b) HTTP 1.1 includes two important changes that improve its performance (throughput, efficiency and TCP fairness) compared to HTTP 1.0. What are these changes and how do they improve the performance? (2p) Persistent connections and compression. Persistent connections allow HTTP to transfer multiple documents over the same TCP connection. This way there is no need for connection setup, teardown, and congestion control can operate better. Compression decreases the amount of data that has to be transferred. d) In Telnet option negotiation is performed among others using the DO and WILL control messages. What do these messages mean and how can the receiving party answer? (1p) The DO control message is used to instruct the other party to use some optional feature. The other party can respond with a WILL or a WONT control message. The WILL control message can as well be used to tell that the sending would like to use some feature. The receiver can then reply with a DO or a DONT message.
7. DNS (5p) a) What is the method called that is used to reduce the time it takes for a slave server to detect that a zone has changed at a master server. How does the method work? (2p) DNS NOTIFY. The master server advises the slave servers that the master's data has been changed and that a query should be initiated to discover the new data. This changes the traditional polling model with an interrupt model. b) If you have a large zone file and only make small modifications to it, there is a method to decrease the traffic at updates between the master server and the slave server. What is this method called and how does it work? (2p) Incremental zone transfer, IXFR. The traditional AXFR zone transfer has the drawback of always transferring the whole database from a server to a set of slaves which is inefficient if the database is large. The client can instead request incremental changes by sending an IXFR message. In this message, the SOA serial number is given which corresponds to its old data. The server keeps a record of changes between versions so that it can respond with the changes. The IXFR can be made by either UDP or TCP. TCP is used if the complete response does not fit within a single DNS packet. c) What is a glue record? In which situation is it required? What does it consist of?(1p) A glue record is a set of resource records for the parent zone to point out a subzone. It consists of at least one NS RR and typically one or more A records (for IPv4). This is necessary so that a zone has all data required tro setup communication with a subzone. If the A records are not present, the zone may not be able to contact the subzones nameservers. The glue record data is typically not authoritative. 8. Security (5p) a) Describe the four aspects of security that were defined in the course book and in the lecture slides. For each aspect describe which kind of security it addresses, and how it is usually implemented (by what mechanism)? (2p) Forouzan defines Privacy, Authentication, Integrity and Nonrepudiation as the four aspects of security. Other classifications are possible. Privacy means that only the sender and receiver can understand the message and is typically implemented by encryption. Authentication means that the receiver is certain of the sender's identity. Authentication is often implemented by digital signatures.digital signatures are also typically used for the remaining aspects. Integrity means that the message arrives at the receiver exactly as it was sent. Nonrepudiation means that it can be verified that the sender actually sent the message (and that the receiver actually received it). b) Secret-key and public-key encryption are two methods used for encrypting data in the Internet. Describe both methods and compare them. Describe their disadvantages and advantages. Describe some typical scenarios where they are deployed. (3p) In secret-key encryption the same key is used by both parties. In public-key encryption, there are two keys: a public and a secret key. In secret-key encryption, the sender uses a key to encrypt the data, and the receiver uses the same key to decrypt. Secret-key encryption uses symmetric algorithms because the same key is used in both directions. Secret-key encryption is more efficient (when encrypting/decrypting) than public-key encryption. Disadvantages involve the large numbers of keys involved if a large number of parties communicate N(N-1)/2. The distribution of keys can also be difficult, and typically requires the use of key-distribution centers. In public-key encryption, the private key is kept by the receiver, and the public key is announced publically. The sender uses the public key to encrypt data which can only be decrypted by the receiver knowing the secret key. Key handling is much easier in public-key
encryption, since keys may be re-used by everyone communicating with one user (2N). Also, key distribution is easier since the public key can be communicated publicly. However, to be certain that a public key is actually associated with an entity, some kind of verification must be provided, for example by certification authorities (CA:s). Another drawback is that asymmetrical public-key algorithms are more comples than secret-key algorithms and are therefore less efficient, and should be avoided for large data sets. Public-key and secret-key encryption are often combined. For example, public-key encryption can be used to exchange private keys. In this way, the advantages of both schemes can be used. 9. Multicast: IGMP (5p) IGMP is a protocol for relaying group membership information between hosts and routers. Describe how IGMP (v2) works: Which messages exist? Who sends which messages? What is the purpose of the messages? Describe the dynamics of the protocol, i.e., in what order are messages sent, how are messages sent in response to other messages, etc? Describe which methods in the protocol exist to make the protocol scale. That is, so that a large number of nodes or groups does not cause a large number of packets being sent. You should cover all membership cases (join, leave, etc) including the case of multiple routers. Discuss also some advantages and drawbacks with the IGMP design. Finally, you should describe which new functionality is added in IGMP version 3, and why. (5p) Membership query sent by multicast routers to query membership on a network. Two situations: general query sent to 224.0.0.1, or specific group queries to specified address. Membership report sent by hosts to multicast routers to report group membership, sent on group address. Leave group Sent by hosts to multicast routers when leaving a multicast group. Sent on 224.0.0.2 General queries are sent by routers periodically, period ca 60s. Membership reports are sent by hosts when joining group, or as reply to membership queries. In the later case, hosts set a random timer and checks whether any other hosts reports membership of that group. If no other membership reports are detected within the timeout, the hosts sends its report. Leave group is sent by hosts when last process leaves a multyicast group. On reception, the multicast router sends a specific-query, and awaits membership reports from other hosts. If no-ones are received within a timeout, the router clears the state about the group on that interface. Several routers do leave-immediately which means that the specific query is not sent. Finally, several multicast routers attached to the same network resolve who is querier by choosing the router with the lowest address. New functionality in IGMPv3 is primarily the support for Source-specific multicast (SSM). Messages are extended with sender information, so that a (S,G) membership can be queried, reported and left, not only (*, G). 10. Dynamic Routing (5p) RIP, OSPF and BGP are three routing protocols that are used in the Internet today. Each protocol has its own characteristics and is therefore used in certain scenarios for different tasks. Describe and compare each of the three protocols with respect to the following criteria:
In what network scenario is it mainly used? Why is it used in that scenario? What are the mechanisms or properties that make it suitable for that scenario? Why is it not used in other scenarios? Also compare the protocols with respect to scalability and convergence. (5p) RIP is a distance-vector protocol sometimes used as IGP. RIP is very simple which is its main advantage: it is easy to configure and its availability is high. However, RIP has severe scaling and convergence problems, it cannot handle network diameters larger than 15 due to the limited metrics, which in turn is low to limit the effects of the count-to-infinity problem. RIP also uses a lot of bandwidth since it repeatibly sends its whole routing table to all of its neighbours. RIP can be used in conjunction with another IGP such as OSPF to take care of a limited part of the network. OSPF is a link-state protocol also used as IGP but has much better scaling properties. OSPF can handle large networks and has support for hierarchical domains using areas. OSPF is mainly used by enterprise organisations, network providers (operators) often use IS-IS as an alternate solution. Many operators think ISIS converges faster and is easier to configure. However, ISIS is not available on many regular computer platforms. A link-state protocol distributes changes much faster than distance-vector and therefore converges faster. An efficient flooding protocol ensures that it is (nearly) optimal in terms of bandwidth consumption. However, a link-state protocol may consume a lot of memory since all peers store the complete link-state databse in memory. Today, this is typically not a problem due to the advancement in memories, but forced many to use areas extensively in the past, which increases the complication in configuration and design. A drawback with OSPF (v2) is that it is tailor -made for IPv4. BGP is path-vector protocol, which is essentially distance-vector enhanced with AS-paths that ensures loop-detection. BGP is used as an inter-domain protocol mainly because of its ability to support routing policies using a wide set of attributes, and its extensibility in terms address families. BGP has several convergence and scaling problems that are mainly due in its distance-vector's origins, but is still considered good-enough as the inter-domain protocol in use today. 11. Mobile IP (5p) a) Describe the triangular delivery and two crossing problem that may appear in Mobile IP. What is it, how does it appear, what are the drawbacks? (2p) When the mobile and the remote system is close (in a network sense) to each other in relation to the home agent, then the messages go from the remote host, to the home agent, to the mobile, and back to the remote system, thus resembling a triangle. The drawbacks are an increased latency due to the extra distance the traffic must pass as well as home load on the home agent. Double crossing is just an extreme variant of triangular delivery when the remote host and the mobile are essentially on the same subnetwork but the traffic has to pass the network to the home agent twice (and thus cross itself). The problems are further highlighted by the fact that most communication is local, that is, there is a higher probability that two peers communicating are close to each other in a geographical sense. b) Discovery, Registration and Tunneling are three phases of the Mobile IP protocol. Describe each of them. What is the purpose of each phase? How are they implemented? Can you see any advantage/disadvantage with the solutions? (3p) Discovery: A mobile node uses a discovery procedure to identify home agents and foreign agents. Mobile discovery extends ICMP router advertisements and solicitations. Registration: A mobile node uses an authenticated registration procedure to inform its home agent of its care-of address. Registration uses a special application-level header and transports the registration information over UDP. The foreign agent may relay the registration to the home agent.
Tunneling: Used by the home agent to forward IP-datagrams to a care-of address. Tunneling can use IP-in-IP tunnelling, GRE tunnelling or IPSec tunnelling. 12. General (5p) A technique used today to increase the capacity of links is to group them into Link Aggregate Groups (LAGs) sometime called trunks. This is a way to increase the bandwidth of a link by bundling several physical links together, while they appear as one from the link- and network layer. Packets are then load-balanced between the two physical links. For example, an ISP can add two 1Gbps Ethernet links into a 2G LAG. This is a cheaper solution than to upgrade to 10Gbps, for example. However, if packets are just randomly load-balanced over the two links, the end-to-end performance of IP may suffer. For example, TCP is said to break. Explain in detail why TCP breaks if packets are load-balanced randomly over two links. Also, describe how this problem can (and is solved) by current bridges. (5p) LAGs consists of a set of links that are grouped into one common link. If two bridges (or routers) are connected by a LAG, the bridge (or router) will try to load-balance between the two links. Typically, the load balancing is made in such a way that the same TCP flows follow the same physical link by hashing of the L2 header (or other similar mechanism). But if packets are randomly sent on the different links, the links may have different properties causing a re-order of packets. For example, one link may have a queue (at the sender or receiver) causing one packet to be delayed. It is also possible that one link has a longer latency for some other reason (eg longer fiber connection). TCP packets that are reordered at the receiver may make the TCP implementation at the receiver side to signal congestion. For example, if the receiver receives segments in the following order: X, X+2, X+1, the receiver will issue ACKs in the following manner: X+1, X+1, X+3. This means that the sender may receive duplicate ACKs in a session even if there are no packet losses. But duplicate acks (actually three consequtive) is a trigger for fastretransmit/fast recovery which means that the congestion threshold is set to half the current congestion window and the congestion window starts at the threshold and linearly increases from there. If this happens repeatedly, TCP will not be able to reach its full capacity but will decrease its congestion window unnecessary. If SACK is enabled, the behaviour may be different.