ÉCOLE POLYTECHNIQUE FÉDÉRALE DE LAUSANNE The Netwok Layer IPv4 and IPv6 Part 2 Jean Yves Le Boudec 2014 1 Contents 6. ARP 7. Host configuration 8. IP packet format Textbook Chapter 5: The Network Layer 2
ed2 in has a packet to destination address: 128.178.15.7; packet is sent directly to 128.178.15.7 128.178.156.24; packet is sent to 128.178.182.5 6. MAC Address Resolution Q: What does «send packet directly» mean? A: send in an Ethernet frame, with destination MAC address = MAC address of 128.178.15.7 Pb: what is the MAC address of 128.178.15.7? Solution: ed2 in learns MAC address of 128.178.15.7 using an address resolution procedure 3 Address Resolution with IPv4 : ARP Protocol 1: ed2-in has a packet to send to 128.178.15.7(stisun1) 1 No dest IP address Dest MAC addr = ff:ff:ff:ff:ff:ff ed2-in stisun1 lrcpc2 ed0-ext 128.178.15.221 08:00:20:71:0d:d4 128.178.15.7 00:00:c0:b3:d2:8d 128.178.15.13 00:00:0c:02:78:36 this address is on the same subnet lrcsuns sends an ARP request to all systems on the subnet (Ethernet broadcast Ethernet type = ARP) target IP address = 128.178.156.7 ARP request is received by all IP hosts on the local network is not forwarded by routers 4
Address Resolution with IPv4 : ARP Protocol 1 2 No dest IP address Dest MAC addr = 08:00:20:71:0d:d4 ed2-in stisun1 lrcpc2 ed0-ext 128.178.15.221 08:00:20:71:0d:d4 128.178.15.7 00:00:c0:b3:d2:8d 128.178.15.13 00:00:0c:02:78:36 2: stisun1 has recognized its IPv4 address sends an ARP reply packet to the requesting host with its IPv4 and MAC addresses 5 Address Resolution with IPv4 : ARP Protocol 1 2 3 Dest IP addr = 128.178.15.7 Dest MAC Addr = 00:00:c0:b3:d2:8d ed2-in stisun1 lrcpc2 ed0-ext 128.178.15.221 08:00:20:71:0d:d4 128.178.15.7 00:00:c0:b3:d2:8d 128.178.15.13 00:00:0c:02:78:36 3: ed2-in reads ARP reply, stores in a cache and sends IPv4 packet to stisun1 1 and 2 are ARP packets; Ethertype = ARP (0806) 3 is an IPv4 packet; Ethertype = IPv4 (0800) ed2 in keeps mapping in cache; expires if there is no traffic from stisun2 for some period of time > cache timeout 6
Address Resolution with IPv6 is part of the Neighbor Discovery Protocol (NDP) 1: ed2-in has a packet to send to 2001:620:618:1a6:1:80b2:f66:1(stisun1) 1 Dest IP address = ff02::1:ff66:1 Dest MAC address = 33:33:ff:66:00:01 ed2-in stisun1 lrcpc2 ed0-ext 128.178.15.221 128.178.15.7 2001:620:618:1a6:1: 2001:620:618:1a6:1: 80b2:f01:1 08:00:20:71:0d:d4 80b2:f66:1 00:00:d0:b3:d2:8d this address is on the same subnet lrcsuns sends a Neighbor Solicitation (NS) packet to the solicited node multicast address ff02::1:ff66:1 NS is received by all IPv6 hosts on the local network that have the same solicited node multicast address (here: only stisun1) 7 The Solicited Node Multicast Address Add last 24 bits of target IP address to ff02::1:ff00:0/104 A packet with such a destination address is forwarded by layer 2 to all nodes that listen to this multicast address Using MAC multicast address 33:33:<last 32 bits of IP address> This is better than broadcast Target address Solicited Node multicast address Compressed Uncompressed Uncompressed Compressed 2001:620:618:1a6:001:80b2:f66:1 2001:0620:0618:01a6:0001:80b2:0f66:0001 ff02:0000:0000:0000:0000:0001:ff66:0001 ff02::1:ff66:1 8
Address Resolution with IPv6 : NDP Protocol 1 2 Dest IP address = 2001:620:618:1a6:1:80b2:f01:1 Dest MAC address = 08:00:20:71:0d:d4 ed2-in stisun1 lrcpc2 ed0-ext 128.178.15.221 128.178.15.7 2001:620:618:1a6:1: 2001:620:618:1a6:1: 80b2:f01:1 08:00:20:71:0d:d4 80b2:f66:1 00:00:c0:b3:d2:8d 2: stisun1 has received the NS packet and recognized its IPv6 address as the target sends a Neighbor Advertisement in reply with its IPv6 and MAC addresses 9 Address Resolution with IPv6 : NDP Protocol 1 2 3 Dest IP address = 2001:620:618:1a6:1:80b2:f66:1 Dest MAC address = 00:00:c0:b3:d2:8d ed2-in stisun1 lrcpc2 ed0-ext 128.178.15.221 128.178.15.7 2001:620:618:1a6:1: 2001:620:618:1a6:1: 80b2:f01:1 08:00:20:71:0d:d4 80b2:f66:1 00:00:c0:b3:d2:8d 3: ed2-in reads NA, stores in a cache and sends IPv6 packet to stisun1 1,2 and 3 are IPv6 packets; Ethertype = ARP (86DD) ed2 in keeps mapping in cache; expires if there is no traffic from stisun2 for some period of time > cache timeout 10
Look inside an ARP packet Ethernet II Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff) Source: 00:03:93:a3:83:3a (Apple_a3:83:3a) Type: ARP (0x0806) Trailer: 00000000000000000000000000000000... Address Resolution Protocol (request) Hardware type: Ethernet (0x0001) Protocol type: IP (0x0800) Hardware size: 6 Protocol size: 4 Opcode: request (0x0001) Sender MAC address: 00:03:93:a3:83:3a (Apple_a3:83:3a) Sender IP address: 129.88.38.135 (129.88.38.135) Target MAC address: 00:00:00:00:00:00 (00:00:00_00:00:00) Target IP address: 129.88.38.254 (129.88.38.254) 11 Look Inside an ICMPv6 NDP Neighbour Solicitation Packet Solicited Node Multicast Address corresponding to this IPv6 target address Neighbor Solicitation (=ARP Request) 12
ed2 in has a packet to destination address 128.178.156.24; packet is sent to 128.178.182.5; the packet is sent by «ed2 in» 1.... inside an Ethernet frame with destination MAC address = 08:00:20:71:0d:d4 2.... inside an Ethernet frame with destination MAC address = 00:00.0d:0d:9a:75 3. None of the above 4. I don t know 00:00.0d:0d:9a:75 0% 0% 0% 0% 1. 2. 3. 4. 13 Security Issues with ARP/ NDP ARP requests / replies may be falsified (ARP spoofing) 1 2 No dest IP address Dest MAC addr = 08:00:20:71:0d:d4 ed2-in stisun1 lrcpc2 ed0-ext 128.178.15.221 08:00:20:71:0d:d4 128.178.15.7 00:00:c0:b3:d2:8d 128.178.15.13 00:00:0c:02:78:36 Can we prevent ARP spoofing? 14
DHCP Snooping and Dynamic ARP Inspection can prevent ARP spoofing in LANs DHCP snooping = switch/ethernet concentrator/wifi base station observes all DHCP traffic and remembers mappings IP addr MAC addresses (DHCP is used to automatically configure the IP address at system boot) Dynamic ARP inspection: switch filters all ARP (or NDP) traffic and allows only valid answers This solution is deployed in enterprise networks, rarely in homes or WiFi access points 15 p.h1 sends a packet to q.h1 for the first time since last reboot. 1. p.h1 sends an ARP (or NDP NS) packet for q.h1 2. p.h1 sends an ARP (or NDP NS) packet for p.1 3. None of the above 4. I don t know 0% 0% 0% 0% 1. 2. 3. 4. 16
7. Host Configuration An IP host needs to be configured on each interface with IP address of this interface Mask of this interface IP address of default router IP address of DNS server Can be done manually or automatically IPv4: with DHCPv4 IPv6: DHCPv6 stateful Stateless Address Autoconfiguration (SLAAC) DHCPv6 stateless 17 Dynamic Host Configuration Protocol = DHCP Why invented: avoid manual configuration How does it work : put config info in DHCP servers; host contacts DHCP server when boots Two phase commit to avoid inconsistent reservations Limited lifetime renewals Works for both IPv6 and IPv4, one logical server for each DHCPv4 client (host) Discover DHCPv4 relay (router) DHCPv4 server Offer Request Ack DISCOVER <MAC addr of client> UDP, dest port = 67,srce port = 68 IPv4 dest addr = 255.255.255.255 IPv4 srce addr = 0.0.0.0 18
DHCP with IPv6 Broadcasts are avoided thanks to Link local unicast address of requesting host DHCP server broadcast address DUID = DHCP Unique Identifier = derived from one MAC address Uses ICMP (internet control protocol) instead of UDP DHCPv6 client (host) Solicit DHCPv6 relay (router) DHCPv6 server Advertize Request Reply SOLICIT <DUID> UDP, dest port = 547,srce port = 5466 IPv6 dest addr = ff05::1:3 IPv6 srce addr = fe80:0.0.0.0 19 Example: An EPFL Assigned IPv6 Addresses (except in lnternet Engineering Workshop) = EPFL Network prefix Host part In the lnternet Engineering Workshop we use special addresses that are not part of the EPFL numbering plan Do you recognize something special in the host part? 20
The EPFL numbering plan for IPv6 is such that the host part of this interface is derived from. 1. The MAC adress of this interface 2. The IPv4 address of this interface 3. Nothing special 4. I don t know 25% 25% 25% 25% 1. 2. 3. 4. 21 The Point to Point Protocol (PPP) Why? allocate address automatically over telecom lines (modem, ADSL) link is point to point, no MAC address, DHCP not suitable How? Similar to (simpler than) DHCP PPPv4 for IPv4 PPPv6 for IPv6 23
Stateless Address Autoconfiguration (SLAAC) = Plug and Play Why invented: avoid configuring DHCP servers Fully automatic How it works : First host auto configures a link local address Second, host tries to add globally valid addresses by obtaining network prefix from routers if any present; Only for IPv6, in principle 24 Autoconfiguration of Link Local Address: Part 1: Duplicate Test ff02::1:ff78:30f9 Host part is determined using one of these possible methods Manually assigned, e.g. ::1 Derived from MAC address Randomly assigned Cryptographically generated address (CGA) not seen here 25
Host Part derived from MAC Address MAC address is 48 bit, it is translated to a 64 bit host part called «modified EUI» Pad with «fffe» in the middle Invert 7th bit, so that; 7th bit of modified EUI ==0 address is locally assigned 64 bit host part (Modified End MAC User Identifier = modified EUI) Hexa 08:00:20:78:30:f9 0a00:20ff:fe78:30f9 Binary 0000 1000 0000 1010 Globally assigned EUI ( = MAC address assigned by manufacturer) 26 From MAC address to Modified EUI Bit 7 of EUI is 1 for EUI derived from globally assigned MAC addresses Bit 7 of EUI is 0 for locally assigned address Ex: 2001:620:618:100::1 27
Randomly Assigned Host Part Privacy concern: MAC address allows tracking a mobile node Randomly assigned Host Part can be used as alternative 7th bit of address must be 0 Host randomly computes one tentative host part Duplicate test is used to avoid (unlikely) collisions Has a limited lifetime Limited lifetime, renewed before expiration Preferred Successful timer Duplicate test expires Valid timer expires tentative preferred deprecated invalid - Address cannot be used to start new TCP connections - Host should obtain a new address 28 The 7th bit of the host part of this interface is. 1. 0 2. 1 3. It is impossible to determine it 4. I don t know 25% 25% 25% 25% 1. 2. 3. 4. 29
Autoconfiguration of Link Local Address Part 2: Obtaining Network Prefix host A other host on-link router on-link A attempts to acquire its link local unicast address: fe80::0a00:20ff:fe78:30f9 1. Neighbour Solicitation, multicast to ff02::1:ff78:30f9 (dupl test) A accepts its link local unicast address: fe80::0a00:20ff:fe78:30f9 2. Router Solicitation, multicast to ff02::2 All routers on link A accepts its global unicast address: 2001:620:618:1ad:0a00:20ff:fe78:30f9 router response with prefix 2001:620:618:1ad (if M flag set : use DHCP instead) 31 At the end of this process, an IPv6 host has 1. A link local address and, if a routers is present in the subnet, also a global unicast address 2. If a routers is present in the subnet a global unicast address and no link local address 3. None of the above 4. I don t knww 25% 25% 25% 25% 1. 2. 3. 4. 32
Stateless DHCPv6 Why invented: solve problem left by stateless autoconfiguration E.g. DNS server address is not provided to host by stateless autoconfiguration How: Stateless autoconfiguraiton is performed first Router response contains a flag = USE STATELESS DHCP Host sends a query to DHCP server to obtain missing info, such as DNS server address Why called stateless? A: DHCP servers does not keep state information 33 Multiple Addresses per Interface are the Rule with IPv6 A host interface typically has One or several link local addresses Plus one or several global unicast addresses The preference selection algorithm, configured by operating, says which address should be used as source address see RFC 3484 In contrast, there is usually only one IPv4 address per interface 34
IPv4 Link Local Addresses Some form of autoconfiguration also exists with IPv4 When host boots, if no DHCP and no configuration info available, it picks a link local address at random in the 169.254/16 block Address duplicate test is performed by broacast Allows to operate in routerless network («Dentist s Office») Not supported by the Linux version we use in the lab 35 Zone Index Identifies an interface inside one machine that has several interfaces typically visible in Windows machines Never inside an IP packet E.g. fe80::1%2 means: the destination IPv6 address fe80::1 on interface %2 36
Ipconfig example Wireless LAN adapter Wireless Network Connection: Physical Address......... : 10 0B A9 A3 91 08 DHCP Enabled........... : Yes Autoconfiguration Enabled.... : Yes Link local IPv6 Address..... : fe80::945c:d22c:b0e2:a885%16(preferred) IPv4 Address........... : 123.255.96.194(Preferred) Subnet Mask........... : 255.255.252.0 Lease Obtained.......... : mercredi 25 juillet 2012 09:05:03 Lease Expires.......... : mercredi 25 juillet 2012 09:35:02 Default Gateway......... : 123.255.99.254 DHCP Server........... : 10.3.1.12 IAID = logical number of this interface, assigned by client DHCPv6 IAID........... : 386927529 DHCPv6 Client DUID........ : 00 01 00 01 16 E8 19 59 F0 DE F1 BE ED EB DNS Servers........... : 202.45.188.37 137.189.192.3 137.189.196.3 NetBIOS over Tcpip........ : Enabled Ethernet MAC address Identifies this host in the DHCP database 37 When an IPv4 host uses DHCP, which of the following information does it acquire: A. its IP address; B. its subnet mask C. its default gateway address D. its DNS server address 1. A 2. A, B 3. A, B, C 4. A, B, C, D 5. None of the above 6. I don t know 0% 0% 0% 0% 0% 0% 1. 2. 3. 4. 5. 6. 38
When an IPv6 host uses DHCP, which of the following information does it acquire: A. its IP address; B. its subnet mask C. its default gateway address D. its DNS server address 1. A 2. A, B 3. A, B, C 4. A, B, C, D 5. None of the above 6. I don t know 0% 0% 0% 0% 0% 0% 1. 2. 3. 4. 5. 6. 39 When an IPv6 host uses SLAAC, which of the following information does it acquire: A. its IP address; B. its subnet mask C. its default gateway address D. its DNS server address 1. A 2. A, B 3. A, B, C 4. A, B, C, D 5. None of the above 6. I don t know 0% 0% 0% 0% 0% 0% 1. 2. 3. 4. 5. 6. 40
When an IPv6 host uses SLAAC, the host part is 1. Mapped from MAC address 2. Randomly chosen 3. Both of the above are possible 4. None of the above are possible 5. I don t know 0% 0% 0% 0% 0% 1. 2. 3. 4. 5. 41 8. IPv6 Header Hop Limit: 0 255; router :, if 0, drop and send ICMP packet to source Used by traceroute Default is 64 at source 42
IPv4 Packet Format Hop Limit is called TTL (Time to live) 43 Other fields Type of service / Traffic Class Differentiated Services (6bits) sort of priority eg voice over IP Used only in corporate networks Explicit Congestion Notification (2bits) see congestion control Total length / Payload length in bytes including header 64 Kbytes; limited in practice by link level MTU (Maximum Transmission Unit) every subnet should forward packets of 576 = 512 + 64 bytes Protocol / Next Header = identifier of protocol 6 = TCP, 17 = UDP 1 = ICMP for IPv4, 58 = ICMP for IPv6 4 = IPv4; 41 = IPv6 (encapsulation = tunnels) 50 = ESP (encrypted payload) 51 = AH (authentication header) Checksum IPv4 only, protects header against bit errors Absent in IPv6 layer 2 and router hardware assumed to have efficient error detection ICMP is used to carry error messages 44
Look inside an IPv4 packet Ethernet II Destination: 00:03:93:a3:83:3a (Apple_a3:83:3a) Source: 00:10:83:35:34:04 (HEWLETT-_35:34:04) Type: IP (0x0800) Internet Protocol, Src Addr: 129.88.38.94 (129.88.38.94), Dst Addr: 129.88.38.241 (129.88.38.241) Version: 4 Header length: 20 bytes Differentiated Services Field: 0x00 (DSCP 0x00: Default; ECN: 0x00) Total Length: 1500 Identification: 0x624d Flags: 0x04 Fragment offset: 0 Time to live: 64 Protocol: TCP (0x06) Header checksum: 0x82cf (correct) Source: 129.88.38.94 (129.88.38.94) Destination: 129.88.38.241 (129.88.38.241) 45 Look inside an IPv6 packet IPv6 ICMP for IPv6 (this is an NDP packet used for address resolution) solicited node multicast address 46
1. 2. 3. 4. 5. 6. The destination MAC address is 1. A group address derived from the last 23 bits of the IPv6 target address 2. A group address derived from the last 24 bits of the IPv6 target address 3. A group address derived from the last 32 bits of the IPv6 target address 4. A broadcast address 5. The MAC address of an ARP server 6. I don t know 17% 17% 17% 17% 17% 17% 47 A host generates a packet with Hop Limit = 1 1. This packet is invalid 2. This packet will never be forwarded by a router but may be forwarded by a bridge 3. This packet will never be forwarded by a bridge but may be forwarded by a router 4. This packet will never be forwarded by a bridge nor by a router 5. None of the above is true 6. I don t know 17% 17% 17% 17% 17% 17% 1. 2. 3. 4. 5. 6. 48
Conclusion IP is built on two principles: one IP address per interface and longest prefix match; this allows to compress routing tables by aggregation inside subnet, don t use routers The goal of ARP/NDP is to find the MAC address corresponding to an IP address DHCP is used to allocate IP address, network mask and DNS server s IP address TTL/HC limits the number of hops of an IP packet 49