ECE 461 Internetworking Fall 2013 Quiz 1 Instructions (read carefully): The time for this quiz is 50 minutes. This is a closed book and closed notes in-class exam. Non-programmable (Type 2) calculators are permitted The only other aid permitted are the aid sheets included in this quiz. Write your answers on the pages provided, using front and back if needed. Use extra sheets if needed. Do not give aid or receive aid from other students. Show all steps of your solutions. Make sure your answers are legible. Max Points 1 20 2 30 3 10 Total 30 STAPLE EXTRA SHEETS WITH YOUR SOLUTIONS TO THIS SHEET BEFORE TURNING IN! Name: Email: 1
Problem 1. (20 points) Address Resolution Protocol In the figure below, H1 and H2 are hosts and R is a router. The figure shows the IP addresses and MAC addresses of all interfaces (For simplicity, we assume that MAC addresses are 2 bytes long). Assume that ARP caches are empty on all systems at the start of each sub-problem. 128.100.0.1/16 4d:1d eth0 128.100.0.2/24 e4:44 eth0 128.100.1.1/24 33:c0 eth1 128.100.1.2/24 2a:d0 eth0 H1 Hub R Hub H2 The routing tables are: Network Prefix Interface Next hop At H1: 128.100.0.0/16 eth0 direct Network Prefix Interface Next hop At R: 128.100.0.0/24 eth0 direct 128.100.1.0/24 eth1 direct Network Prefix Interface Next hop At H2: 128.100.1.0/24 eth0 direct 0.0.0.0/0 eth0 128.100.1.1 Consider a scenario where H1 issues a ping to IP address 128.100.1.2 ( ping 128.100.1.2 ). The ping is successful, when H1 receives an ICMP Reply from H2. a. (5 points) Suppose that Proxy ARP is disabled on R. Describe the ARP packets that are exchanged when the ping is issued. Will the ping be successful? Explain your answer! b. (5 points) Suppose that Proxy ARP is enabled on R. Describe the ARP packets that are exchanged when the ping is issued. Will the ping be successful? Explain your answer! c. (5 points) Suppose again that Proxy ARP is disabled on R. H1 can ensure that the ping will be successful by adding an entry to its routing table. Provide such an entry. d. (5 points) Now suppose that the topology is changed as given in the figure below. H1, H2, and R all connect to a single hub. Also, the eth0 interface of R is not used, and Proxy ARP is disabled. Describe the ARP packets that are exchanged when the ping is issued at H1. Explain why the ping fails in this scenario. H1 128.100.0.1/16 4d:1d eth0 R 128.100.1.1/24 33:c0 eth1 128.100.1.2/24 2a:d0 eth0 Note: For describing ARP packets, include the MAC source and destination addresses and describe the content (for ARP Request: Who has IP address X? Tell IP address Y? ; for ARP Reply: IP address X is at MAC address Z. ). Hub H2 2
Solution: (a) Sender Source MAC address Destination MAC address ARP Content H1 4d:1d ff:ff Who has 128.100.1.2? Tell 128.100.0.1? Ping is not successful, since there is no reply to ARP Request from H1. (b) Sender Source MAC address Destination MAC address ARP Content H1 4d:1d ff:ff Who has 128.100.1.2? Tell 128.100.0.1? R e4:44 4d:1d 128.100.1.2 is at e4:44. H1 sends ICMP Request to R R 33:c0 ff:ff Who has 128.100.1.2? Tell 128.100.1.1? H2 2a:d0 33:c0 128.100.1.2 is at 2a:d0. R sends ICMP Request to H2 H2 2a:d0 ff:ff Who has 128.100.1.1? Tell 128.100.1.2? R 33:c0 2a:d0 128.100.1.1 is at 33:c0. H1 sends ICMP Reply to R R e4:44 ff:ff Who has 128.100.0.1? Tell 128.100.0.2? H1 4d:1d e4:44 128.100.0.1 is at 4d:1d. H1 sends ICMP Reply to R Ping is successful. (Explanation follows from table above). (c) Add a routing table for network 128.100.1.0/24 (or for a host route 128.100.1.2/32): Network Prefix Interface Next hop At H1: 128.100.0.0/16 eth0 direct 128.100.1.0/24 eth0 128.100.0.2 For destination address 128.100.1.2, both routing entries, however, the newly added entry has a better prefix. Therefore, the packet is sent to R (at IP address 128.100.0.2), and from there to H2. (d) Sender Source MAC address Destination MAC address ARP Content H1 4d:1d ff:ff Who has 128.100.1.2? Tell 128.100.0.1? 3
H2 2a:d0 4d:1d 128.100.1.2 is at 2a:d0. H1 sends ICMP Request to H2 H2 2a:d0 ff:ff Who has 128.100.1.1? Tell 128.100.1.2? R 33:c0 2a:d0 128.100.1.1 is at 33:c0. H1 sends ICMP Reply to R At this time R wants to forward the datagram to 128.100.0.1. However, R does not have a routing table entry for network 128.100.0.1 (since the eth0 interface is no longer there). Therefore, R will now send an ICMP destination unreachable to H2. Ping is not successful. (Explanation is given in the table). 4
Problem 2. (30 marks) Below is the traffic capture of three packets in hexadecimal notation. The packets consist of an Ethernet II header, followed by an IP header, possibly followed by a UDP header, followed by UDP payload. The traffic capture shows the Ethernet II header, the IP header, and 14 bytes following the IP header. The remaining bytes from the packets are not shown. Packet #1: c8 2a 14 04 0a 81 00 1f f3 56 8a 9f 08 00 45 00 02 54 42 d8 20 48 40 11 fe af 0a 00 01 02 0a 00 01 c8 38 39 30 31 32 33 34 35 36 37 38 39 30 31 Packet #2: c8 2a 14 04 0a 81 00 1f f3 56 8a 9f 08 00 45 00 01 5a 42 d8 00 90 40 11 1f 62 0a 00 01 02 0a 00 01 c8 34 35 36 37 38 39 30 31 32 33 34 35 36 37 Packet #3: c8 2a 14 04 0a 81 00 1f f3 56 8a 9f 08 00 45 00 02 54 42 d8 20 00 40 11 fe f7 0a 00 01 02 0a 00 01 c8 c5 b7 13 89 05 c6 93 75 00 00 00 00 50 be a. (3 marks) Provide the values of the Source IP Address and the Destination IP addresses of the packets. (Use dotted decimal notation!) b. (4 marks) Determine the length in bytes of each of the packets, including the Ethernet headers, IP headers, and all data following the IP headers. Describe how you determined the length. c. (20 marks) The above packets have been undergoing IP fragmentation. (Note: The fragments are not in the correct order.) a. (4 marks) How can you tell that the above packets have been fragmented? Explain your answer, and support your answer with names and values of relevant IP header fields. b. (4 marks) How can you tell that the fragments belong to the same ( original ) IP datagram? Explain your answer, and support your answer with names and values of relevant IP header fields. c. (4 marks) Give the names and values of the IP header fields needed to determine that no fragments are missing, that is, the three packets can be reassembled to reconstitute the original IP datagram before fragmentation. Identify which of the captured packets contains the first, second, and third fragment of the payload. d. (4 marks) Determine the size of the IP payload of the original IP datagram, i.e., before fragmentation. The IP payload refers to the data following the IP header. e. (4 marks) Provide the MTU value at the network interface that required performing IP fragmentation of the above fragments. Justify your answer. d. (3 marks) Which information in the packet headers determines that the data following the IP headers belongs to UDP. Provide the UDP source and destination ports. 5
Solution: (e) Source address Destination address Packet #1 10.0.1.2 10.0.1.200 Packet #2 10.0.1.2 10.0.1.200 Packet #3 10.0.1.2 10.0.1.200 Location of addresses is marked in red in captured packets. Source address is in bold face. (f) Length of all Headers and Payload = Ethernet II header + Total length field in IP header = 14 + Total length field in IP header IP total length field (hex) IP total length field (dec) Length (decimal) Packet #1 0254 596 610 Packet #2 015a 346 360 Packet #3 0254 596 610 Location of IP total length field is marked in blue/boldface. (g) (c1) Let us identify the flags and the offset fields, which are the 7th and 8th byte in the IP header. The fields are marked in black/boldface. From these two bytes: The first 3 bits are the flags (Reserved, DF, MF) The remaining bits are the offset field (Note that the field has 13 bits. Fortunately, the first 5 bits of the offset field are zero in all packets, and can be ignored. Byte 7-8 of IP Header (hex) R DF MF Value of offset field (Hex) Value of offset field (Decimal) Offset in bytes (decimal) Packet #1 20 48 0 0 1 48 72 72*8=576 Packet #2 00 90 0 0 0 90 144 144*8=1152 Packet #3 20 00 0 0 1 00 0 0 6
The following information tells that the packets have been fragmented: Packet #1: MF bit is set (and offset value is nonzero) Packet #2: nonzero offset value Packet #3: MF bit is set. (c2) Fragments that belong to the same IP datagram have same source/destination address + same identification field. Packet #1 Packet #2 Packet #3 Identification field (hex) 42d8 42d8 42d8 Location of Identification field is marked in magenta. It follows that the fragments belong together. (c3) Note: Stating that two packets have the MF bit set is not sufficient, since fragments could be missing. The answer must verify that the there are no holes in the payload. To do this we need to compare the values of the offset and the number of bytes in the packets. To get the correct answer we need to put the packets in the correct order. We can sort the packets with the values of the offset field. Offset in bytes (decimal) Order of fragments total length (in IP header) IP Payload (=total length IP header length) Packet #1 72*8=576 Second 596 576 Packet #2 144*8=1152 Third 346 326 Packet #3 0 First 596 576 Packet #1 (2 nd fragment) has offset 576. Since Packet #3 (first fragment, offset 0) has 576 bytes of payload, nothing is missing between 1 st and 2 nd fragment. Packet #2 (3 rd fragment) has offset 1152. Since the sum of the payloads of Packet #1 (2 nd fragment) and #3 (first fragment) is 1152, nothing is missing between 2 nd and 3 rd fragment. 7
Since Packet #2 is last fragment (since MF=0), there are no holes. (c4) Two methods: We need to add the IP payload of the three packets. For this we need to add the total length in the IP headers and subtract the length of the IP headers (20 bytes *3). Take the offset of the third packet and add IP payload of third packet The result is 1478 bytes. (c5) The size of the payload in a fragment (not the last) is the largest number evenly divisible by 8 such that IP payload+ip header<= MTU. Select MTU such that floor((mtu-20) / 8)* 8 = 576. With the given IP payload (576 bytes) and IP header (20 bytes), the following MTU are feasible: 597,598,599,600,601,602,603. (d) The IP protocol field (decimal value 17) in the IP header means the payload is UDP. For the source and destination port, note that only the first IP fragment (Packet #3) contains a UDP header. The port numbers are in the first 4 bytes of the UDP header (The values are marked in green/bold) hexadecimal decimal Source port c5 b7 50615 Destination port 13 89 5001 8
Problem 3. (10 marks) Routing Tables a. (5 marks) A router has the following routing table entries: Network Prefix Interface (1) 199.85.124.64/26 eth0 (2) 192.0.0.0/4 eth1 (3) 208.224.0.0/11 eth2 (4) 199.85.160.0/19 eth3 (5) 0.0.0.0/0 eth4 For each of the following IP addresses, indicate the entries with a prefix, and indicate the entry with the longest prefix. (You may use the row number or the interface name to indicate an entry): a1) 199.85.124.112 a2) 198.75.223.14 a3) 207.235.84.10 a4) 199.85.187.135 a5) 208.101.192.4 b. (5 marks) Aggregate the following network prefixes to the highest degree possible. 12.0.0.0/10 12.128.0.0/11 12.160.0.0/13 12.168.0.0/14 12.168.0.0/16 12.176.0.0/12 12.172.0.0/14 Solution: (h) (1) Address eth0 (a1) 199.85.124.112 best (a2) 198.75.223.14 (a3) 207.235.84.10 (2) eth1 (3) eth2 (4) eth3 (5) eth4 best best (a4) 199.85.187.135 (a5) 208.101.192.4 best best 9
(b): (1) 12.0.0.0/10 : 0000 1100.0000 0000.0000 0000.0000 0000 (2) 12.128.0.0/11: 0000 1100.1000 0000.0000 0000.0000 0000 (3) 12.160.0.0/13: 0000 1100.1010 0000.0000 0000.0000 0000 (4) 12.168.0.0/14: 0000 1100.1010 1000.0000 0000.0000 0000 (5) 12.168.0.0/16: 0000 1100.1010 1000.0000 0000.0000 0000 (6) 12.176.0.0/12: 0000 1100.1011 0000.0000 0000.0000 0000 (7) 12.172.0.0/14: 0000 1100.1010 1100.0000 0000.0000 0000 Summarize (4)+(7) to: (8) 12.168.0.0/13: 0000 1100.1010 1000.0000 0000.0000 0000 Summary (8)+(3) to: (9) 12.160.0.0/12: 0000 1100.1010 0000.0000 0000.0000 0000 Summary (9)+(6) to: (10)12.160.0.0/11: 0000 1100.1010 0000.0000 0000.0000 0000 Summary (10)+(2) to: (11)12.128.0.0/10: 0000 1100.1000 0000.0000 0000.0000 0000 Nothing else can be summarized. The result is (1),(5),(11), i.e., 12.0.0.0/10 12.168.0.0/16 12.128.0.0/10 10
Hexadecimal-to-Decimal Conversion Table Hex Dec Hex Dec Hex Dec Hex Dec 1 1 10 16 100 256 1000 4096 2 2 20 32 200 512 2000 8192 3 3 30 48 300 768 3000 12288 4 4 40 64 400 1024 4000 16384 5 5 50 80 500 1280 5000 20480 6 6 60 96 600 1536 6000 24576 7 7 70 112 700 1792 7000 28672 8 8 80 128 800 2048 8000 32768 9 9 90 144 900 2304 9000 36864 A 10 A0 160 A00 2560 A000 40960 B 11 B0 176 B00 2816 B000 45056 C 12 C0 192 C00 3072 C000 49152 D 13 D0 208 D00 3328 D000 53248 E 14 E0 224 E00 3584 E000 57344 F 15 F0 240 F00 3840 F000 61440 11
Packet Format of Ethernet, IP, and UDP header 4 bytes Ethernet header (14 bytes) destination address type source address IP Header version header length Identification DiffServ Field flags (3 bits) source IP address destination IP address total length fragment offset time-to-live protocol header checksum Flags in the IP header: Bit 1: Reserved Bit 2: DF Bit 3: MF Options (if applicable) UDP Header source port length destination port checksum 12
Binary-Decimal Conversion Last 4 bitsà 0000 0001 0010 0011 0100 0101 0110 0111 1000 1001 1010 1011 1100 1101 1110 1111 First 4 bitsâ 0000 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 0001 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 0010 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 0011 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 0100 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 0101 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 0110 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 0111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 1000 128 129 130 131 132 133 134 135 136 137 138 139 140 141 142 143 1001 144 145 146 147 148 149 150 151 152 153 154 155 156 157 158 159 1010 160 161 162 163 164 165 166 167 168 169 170 171 172 173 174 175 1011 176 177 178 179 180 181 182 183 184 185 186 187 188 189 190 191 1100 192 193 194 195 196 197 198 199 200 201 202 203 204 205 206 207 1101 208 209 210 211 212 213 214 215 216 217 218 219 220 221 222 223 1110 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238 239 1111 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 13