Computer Networks: Lab 3 Traceroute and IP Luca Bedogni

Computer Networks: Lab 3 Traceroute and IP Luca Bedogni Department of Computer Science and Engineering University of Bologna

A brief introduction We will leverage the traceroute utility It traces the route from your computer to the destination It does that by sending messages with increasingly big TTLs Can do this with live capture, or we need the ip-ethereal-trace-1 from the wireshark-traces.zip file A TTL=1 REPLY B

A brief introduction We will leverage the traceroute utility It traces the route from your computer to the destination It does that by sending messages with increasingly big TTLs Can do this with live capture, or we need the ip-ethereal-trace-1 from the wireshark-traces.zip file A TTL=2 TTL=1 REPLY B

A brief introduction We will leverage the traceroute utility It traces the route from your computer to the destination It does that by sending messages with increasingly big TTLs Can do this with live capture, or we need the ip-ethereal-trace-1 from the wireshark-traces.zip file A TTL=3 TTL=2 TTL=1 REPLY B

A brief introduction We will leverage the traceroute utility It traces the route from your computer to the destination It does that by sending messages with increasingly big TTLs Can do this with live capture, or we need the ip-ethereal-trace-1 from the wireshark-traces.zip file A TTL=4 TTL=3 TTL=2 TTL=1 REPLY B

A brief introduction We will leverage the traceroute utility It traces the route from your computer to the destination It does that by sending messages with increasingly big TTLs Can do this with live capture, or we need the ip-ethereal-trace-1 from the wireshark-traces.zip file A TTL=5 TTL=4 TTL=3 TTL=2 TTL=1 REPLY B

A brief introduction We will leverage the traceroute utility It traces the route from your computer to the destination It does that by sending messages with increasingly big TTLs Can do this with live capture, or we need the ip-ethereal-trace-1 from the wireshark-traces.zip file A TTL=6 TTL=5 TTL=4 TTL=3 TTL=2 TTL=1 REPLY B

Traceroute Traceroute purpose is to identify the problematic link in a network It may be very time consuming if abused General syntax is

Traceroute example What is the average round trip time? Why is it so different? Is this enough to understand how the network behaves?

How to (correctly) use traceroute Seems pretty easy Just type traceroute my.end.point It ll show my all intermediate lantecy values Where it stops or where it takes too much, that s where the problem is Unfortunately, it almost never is like this What could go wrong? Modern routers are pretty well run Congestion and routing loops are becoming less frequent So the other issues are far more complex How to correctly read traceroute outputs? They look very easy to be understood read

Traceroute output HOP # Router IP Measurements Traceroute sends typically 3 probe packets Most implementations use UDP But ICMP and TCP can be used Each probe is independent - Unique IDs Each packet may be sent in a completely different path This may be visible to the user in form of multiple Ips for each hop However, it may be invisible as well How is latency computed? Difference between: Timestamp at the beginning Timestamp for the return packet Routers in between do not do any time processing Hence the latency is the sum of the time it took to reach the router + router time to generate a reply + time to get back

Interpreting the output Understanding correctly the DNS information is key You can discover: Location IATA or ICAO Airport codes CLLI Codes City name or abbreviations of it Guessing Interface type Most routers put the interface info in the DNS But may not be updated Router type Sysadmins do not always follow conventions Core Routers CR, Core, GBR, BB, CCR, EBR Peering Routers BR, Border, Edge, IR, IGR, Peer Customer Routers AR, Aggr, Cust, CAR, HSA, GW Network boundaries and relationships Typically where problems occur

Location interpretation Name Airport Code CLLI Other codes Atlanta, GA ATL ATLNGA Chicago, IL ORD, MDW CHCGIL CHI New York, NY JFL, LGA NYCMNY NYC, NYM San Jose, CA SJC SNJSCA SJO, SV, SF Seattle, WA SEA STTLWA Amsterdam, NL AMS AMSTNL Montreal, CA YUL MTRLPQ MTL Paris, FR CDG PARSFR PAR

Interface interpretation Interface Type CISCO IOS CISCO IOS XR Juniper Fast Ethernet Fa#/# fe-#/#/# Gigabit Ethernet Gi#/# Gi#/#/#/# ge-#/#/# 10 Gigabit Ethernet Te#/# Te#/#/#/# te-#/#/# SONET Pos#/# POS#/#/#/# so-#/#/# Tunnel Tu# TT# ip-#/#/# ATM ATM#/# AT#/#/#/# at-#/ /# Example: xe-11-1-0.edge1.newyork1.level3.net Xe is a 10 Gigabit ethernet with at least 12 slots

More on network delay Typically network delays can occur due to 3 steps Serialization delay Caused by the encoding of the data to be transmitted in packets HELLO -> Header, Data Queuing delay Caused by routers buffering the packet and waiting to retransmit it Propagation delay Caused by the signal which propagates on the medium from source to destination

Serialization Delay Serialization is the process of encoding data packets into the PHY The faster the interface, the faster the process Really easy to compute - SIZE/SPEED Example: what is the serialization delay of a 1500B packet on a 1Mbps link? 1Mbps -> 1000 Kb/s -> 125 KB/s -> 125000 bps 1500/125000 = 0.012 seconds Packets move inside the communication link as an atomic unit You can t transmit half a packet and transmit the other one later You can t retransmit a packet until you have received it all Every time a router acquires a packet a serialization delay occurs With modern modems and routers it is a less of an issue

Queuing delay Queuing happens when routers hold packets in their buffer waiting for an opportunity to transmit Each moment the router keeps the packet in memory, the overall latency increases Can t I eliminate queuing? Scenario 1 Imagine packets enter the router through a 1Gbps link, and have to be sent over a 100 Mbps link The router buffers the packet and send them whenever the 100 Mbps link is ready Scenario 2 A lot of senders and few receivers 40 sender on 10 Gbps slots, sending to 1 receiver on a 10 Gbps slot Hence, some sort of queuing is necessary Better: it increases throughput! At every moment, an interface could either transmit or receive Queuing packets at the router enables the output interface to always send

Queuing bad or good? GOOD BAD

Propagation Delay The propagation delay is the time spent on the medium For short distances, negligible For long distances it may cause considerable latency Propagation delay on a straight fiber route at the equator takes approximately 400ms

How can I put this to good use We have learned the different types of delay How can we use those ideas to troubleshoot networking problems? Do you notice anything strange? Here?

Summing up Delay is caused by Time needed to reach the router from the source Time needed by the router to generate the reply Time needed for the packet to get back The second source of delay does not involve real packets Routers may actually slow down ICMP traffic Different paths: fast for normal packets, slow for handling special packets Router CPUs are typically slow ICMP generation is not the router priority Latency spikes in the middle may not be harmful if they do not propagate over Asymmetric paths Artificial rate limit

Asymmetric paths Traceroute measures two paths But only one is visible Unless you have traceroute in both directions Still, very hard to get all the possible asymmetric paths Asymmetric paths typically start at network boundaries Where policy change

How many paths?

Asymmetric paths Try to send 1 probe (-q 1) Still, you don t have the guarantee that each probe goes through the same path

Lab3 Open the ip-ethereal-trace-1 file What is the IP address of your computer? What is the size of the IP header and the size of the IP payload? Has the data been fragmented? What are the fields that always change in the traceroute request? Send a bigger traceroute (i.e. traceroute host 32768). Is it possible to tell which are the first, intermediate and last packets of a frame? How? Experiment with different sizes. How many packets are sent with 3500 bytes?