PUCPR Internet Protocol Address Resolution and Routing Edgard Jamhour 2014 E N G L I S H S E M E S T E R
1. Address Resolution The IP address does not identify, indeed, a computer, but a network interface. A computer with multiple network interfaces (said multi-homed) has multiple IP addresses, one for each interface. For example, a computer with an Ethernet interface and a Wi-Fi interface will have two IP addresses, if both interfaces are active simultaneously. Frequently, a network interface is referred to as NIC (Network Interface Card). Currently, it is rare to see "NICs" because they are implemented "on-board", i.e., together with the computer's motherboard. A more up-to-date name is network adapter. Each network adapter of a computer has two addresses: the IP address and the physical address (MAC address, according to the nomenclature proposed by the IEEE 802 standard). The IEEE 802 proposes a subdivision of the data link layer of the OSI model into two sub layers: MAC (Medium Access Control) and LLC (Logic Link Control). The MAC layer is dependent of the transmission technology but the LLC is not. The LLC sub-layer provides high level addressing useful to forward protocol packets to specific processes (similar to the function provided by the transport protocols, but at a lower level). The physical address is considered part of the MAC sub layer, hence the name.
2. MAC Address The MAC address (6 bytes) defines an address space (i.e., all possible addresses) much bigger than the IPv4 addresses (4 bytes). Different than the IP addresses, MAC addresses are not related to the network topology. In fact, MAC addresses are related to the manufacturer of the NIC or the motherboard with embedded networking circuits. The network adapters present on the computer already comes with a pre-defined MAC address formed by the manufacturer code followed by a serial number. Usually, the driver of the network adapter allows you to change the MAC address. If you do not want to risk conflict with the MAC address of any other computer on your network, you must a specific range of MAC addressed called: locally administered. A situation where the use of locally administered addresses is necessary or advantageous is absolutely rare. No user level application uses the MAC address to address another computer. In the TCP/IP architecture, applications always address other computers using IP address. It is up to the operating system of the transmitter the responsibility to discover the MAC address of the recipient before encapsulating an IP packet within a frame.
3. NIC Address Filtering MAC and IP addresses are in different layers of the OSI model: data link and network layers. These layers are handled by separate processors. A network adaptor has its own processor, which permit to interpret the frames independently from the main CPU of the computer. This is necessary because the network adaptor is constantly receiving frames that should not be interpreted by the operating system of the computer. The network adaptor will only deliver a frame to the operating system of a computer in three specific situations. a) The destination MAC address of the frame matches the MAC address of the network adaptor. b) The destination MAC address of the frame is a broadcast, that is, FF.FF.FF.FF.FF.FF (all bits equal to 1). c) The destination MAC address is a multicast address that has been configured by the operating systems. The topic of multicast addressing will be discussed later in the course. In these situations, the network interface generates an interrupt to the main CPU of the computer, and sends the packet to the operating system, more precisely, to the process corresponding to the network layer protocol.
4. IP and MAC Addresses When hosts A and B are in the same physical network, the relationship between MAC and IP addresses is one to one. That is, a frame sent from host A to host B will contain the source addresses of A (MAC and IP) and the destination addresses of B (MAC and IP). As we shall see, if A and B are on different physical networks, i.e., separated by a router, the MAC address of the router will eventually be used in the place of MAC B, in a frame transmitted from A to B. In any case, the operating system of host A does not previously know the MAC address of B (or the router). As previously stated, the user level applications always indentify the destination of a packet in terms of an IP address. When the request for sending a packet to address IP B arrives at the network layer of host A, a protocol called ARP (Address Resolution Protocol) is used to discover the MAC address of B.
5. Address Resolution Protocol - ARP The ARP (Address Resolution Protocol) is used for MAC-to-IP address resolution. This protocol was originally designed to operate only with the Ethernet, but was later expanded to operate with other layer 2 technologies. This protocol is based on two messages. The transmitting station sends a message named ARP Request informing the recipient's IP address and requesting its MAC address. The ARP request is a broadcast message (i.e., uses the destination MAC address FF:FF:FF:FF:FF:FF). All stations in the LAN will receive the request, but only the station which has the IP address responds with an ARP Reply message informing its MAC address. The ARP protocol is encapsulated directly in the Data Link protocol. That is, the ARP messages have no IP header. It is important to note that this whole process occurs effectively before the first packet sent by the upper layers is effectively transmitted. That is, the request to send an IP packet gets frozen until the ARP completes the MAC address discovery procedure. This procedure is quite costly, because ARP is based on broadcast messages, and it is triggered each time a packet is sent to a new IP destination. As we shall see next, the cost of the ARP can be mitigated the use of a caching mechanism.
6. ARP Messages The ARP request message is a message sent in broadcast, i.e. your destination MAC address is FF.FF.FF.FF.FF. All computers on the same physical network receive all ARP Request messages sent. This occurs even if the computers are connected to a Switch. Computers that receive the ARP message but do not have the requested IP address ignore the message. Only the computer that holds the requested IP address sends an ARP Reply, which is an unicast message. The address resolution Protocol (ARP) has the following main fields: 1) Hardware type: Specifies the link layer technology. Currently several options are supported, such as Ethernet, ATM, HDLC and FrameRelay. 2) Protocol type: Specifies the network layer technology. In the TCP/IP architecture, it specifies the IPv4 protocol. 3) Hardware addresses size: 6 bytes in the case of MAC addresses used by the Ethernet Protocol. 4) Network address size: 4 bytes for IPv4 5) Message type: ARP Request and ARP Reply, among others. 6) Hardware address of the transmitter: i.e., the MAC of the computer that sent the message.
7. ARP Cache Sending messages in broadcast is highly detrimental to the performance of the network. In the presence of this type of message, switches behave identically to the Hubs, i.e., an ARP message received on a port is transmitted to all the others. A network with many computers may present a high level of broadcast messages. These messages can cause network congestion, and lead to a decrease in network performance. Another problem is that broadcast messages are not filtered by network adaptors of the computers, because its contents need to be interpreted by the network layer of the operating system. Thus, ARP messages steal CPU processing time from user level applications. To reduce the amount of ARP messages generated, a cache mechanism is used. All discovered MAC addresses are stored in an ARP cache, in the memory of the local computer. The ARP entries have a limited TTL (time to live), usually 5 minutes. Before sending an ARP message, the operating system queries the cache, and only sends the ARP message if it cannot find the IP address of the destination in the ARP table. The ARP cache of any computer, regardless the operating system, can be seen by the user using the standard console command arp a.
8. ARP works only in the LAN By default, packets sent in broadcast do not traverse routers. That is, routers can receive broadcast messages, such as an ARP request, but they not propagate the message received from one interface to the others. Although you can configure routers to forward broadcast messages, this is not done (certainly not by Internet routers). Thus, if ARP messages cannot pass through routers, a computer is unable to determine the MAC address of other computers that are located on a different physical network. Fortunately, in the TCP/IP architecture, this isn't necessary. A host only tries to locate the MAC addresses of destinations that are located in the same subnet (i.e., destinations with the same IP network prefix). If the destination has a different network prefix, the packet must be forwarded to a router which has an interface in the same subnet than the host. Thus, an ARP request message is still required, but not to locate the physical address of the target computer, but to find the MAC address of the router.
9. Duplicated IP Address Detection ARP is used to identify duplicated IP addresses. When the IP address of a computer is configured for the first time, or the network service is initiated (during the computer s boot, for example), the operation system of the computer performs a test to verify if the assigned IP address is already being used by another computer. For this, it sends an ARP request message asking the MAC corresponding to the IP that is being assigned. If any other computer responds, then it is certain that the address is already being used. The user of the computer that answered the ARP request message can also be notified that was an attempt to duplicate the IP address of his computer. The use of the ARP mechanism to detect duplicated IP addresses does not permit to determine if an IP address already exist in other physical networks, because the ARP Request messages cannot traverse routers. However, duplicating an IP address in other network is usually harmless for a user, because the routers will forward the packets are only to the true owner of the network prefix. Currently, the IP addresses are classified into public and private. The public IP addresses are required to be unique in the Internet, but the private addresses can be duplicated in different subnets. This form of addressing will be studied later in the course.
10. Intranet and Internet Communication The ARP operation indicates that the procedure for forwarding IP packets is different when the destination address belongs to another subnet. Because of this, the IP routing must be considered in two distinct situations: Intranet communication and Internet communication. Intranet communication refers to the scenario where the communication occurs between two computers with the same network prefix, located on the same LAN. This communication does not involve routers. Internet communications occurs when two computers are located in different subnets. This operation is always intermediated by routers. It is important to note that who decides that a packet will go through a router is the transmitter computer. It does this by comparing the network prefix of the destination address with its own prefix. If they are equal, the communication is Intranet, otherwise, it is Internet.
11. Frame Format The way a computer builds a frame depends if the communication is intranet or internet. If the communication is intranet, the computer determines the destination MAC address using the ARP protocol, and builds a frame where the destination physical address corresponds to the final destination. If the communication is internet, the computer determines the MAC address of the first router that the packet must go to get to the destination (i.e., the next hop), also using the ARP. The destination physical address of the frame sent by the computer corresponds to the interface of the router that is in the same subnet than the computer. In both cases, the destination IP address always indentifies the final destination. It is important to note that the router IP address never appears in the packet.
12. Internet Communication In multi-hop communication, during the process of forwarding a packet between successive routers, the source and destination MAC addresses are changed by the transmitting router to reflect the link where the frame is being forwarded. Ethernet technology is not always used in point-to-point links between routers, but in this example, let's assume that all the links are Ethernet. Consider the following steps corresponding to the transmission indicated in the figure. 1) The source computer sends the frame to the MAC address of Router 1 (MAC2). 2) When the Router 1 forwards the frame to Router 2, the source and destination physical addresses are changed to MAC3 and MAC4, respectively. 3) When the Router 2 sends the frame to the destination computer, the source and destination physical addresses are, respectively, MAC5 and MAC6. Note that the source does not need to know the MAC address of the destination, and the destination, upon receiving the frame, doesn't know the MAC address of the source. In an internet communication, the IP addresses are responsible for the end-to-end addressing. The physical addresses are responsible for the addressing between successive hops.
13. ARP in Internet Communication The figure shows how a packet is encapsulated when it traverses a router. Before sending the packet, if the MAC address is not already in the ARP cache, the computer sends an ARP Request to determine the MAC address of the router. After discovering the MAC address, the computer build a frame where the destination is the MAC address of the router`s interface that is directly connected to the computer. When the router receives the frame, it extracts the packet and prepares to build a new frame. By analyzing the destination address of the packet, the router determines that it is necessary discover the MAC address of the computer IP D. To do this, it sends an ARP request message in broadcast through its C interface. After discovering the MAC address corresponding to IP D, the router creates a new frame, where the sources address it the MAC address of its C interface, and the destination is the MAC address of computer IP D. It is important to observe that a router never modifies the IP addresses. The exception is when the router is performing NAT (network address translation), something only necessary when private IP addresses are used. This topic will be discussed ahead in this course.
14. Example The figure illustrates the frame and packet formats when a message is sent from computer A IP 10.0.0.2 to computer F with IP 30.0.0.2. To help to understand this scenario, remember that the MAC addresses do not have global significance. Also, remember that no frame can be MAC addresses belonging to different subnets, i.e., the source and destination MAC addresses must belong always to the same subnet. Remember that the Ethernet protocol belongs to the data link layer. The term data link refers to a part of the network that is not intermediated by routers. It can be a simple cable, as the peer-to-peer connection between two adjacent routers in the figure. Or a LAN formed by switches and hubs, such as the location of the source and destination computers. The frame sent by the source computer is used to transport the packet until the first router. When the packet is transferred from one interface of the router to another, a new frame is created. This new frame is used to transport the packet just to the next router. This process of rebuilding the frame continues until the packet is delivered to the destination.
15. Routing Table When transmitting IP packets through a WAN, computers and routers needs to decide if a packet can be delivered directly to the destination, or whether it must be forwarded to a router. It is also necessary to know the IP address of the routers in this process. The process of forwarding IP packets is called routing. All information needed for a computer or router to forward IP packets is contained in a memory structure called "routing table". A routing table contains multiple entries. Each entry corresponds to a destination network to which a computer or router can send packets. Each of these entries consists of four fields: 1) Destination network: identifies a block of IP addresses 2) Gateway: identifies to which router interface a packet must be forwarded to reach the destination network. 3) Interface: indicates the interface from which the packet must be delivered. The interface can be identified by an IP address or a logical name, depending on the operating system of the device. Observe that interface refers always to the local equipment and gateway refers to equipment. Also, gateway and interface must always belong to the same subnet. In some situations, the interface field may be omitted, as it can be logically deduced as being the interface that is in the same network than the gateway. 4) Cost: it is useful to select a specific route when there are two or more paths to a destination.
16. Destination Network A destination network can have multiple sizes. It can be as large as the Internet (0.0.0.0/0) or as small as a single computer (200.134.51.6/32). A destination network is described by a base address (the first address of subnet) and a subnet mask, which determine the number of addresses. For example, the network 200.134.51.0/24 (i.e., with mask 255.255.255.0) defines a block of addresses ranging from 200.134.51.0 to 200.134.51.255. When a computer or router needs to forward a packet, it looks for an entry in the routing table whose destination network field represents a block that contains the destination address of the packet. The test the routing table entries, one performs a logical AND (bit-to-bit) between the destination address of the packet and the subnet mask of the destination network. If the result is the base address, then the corresponding entry is used to forward the packet. If not, a new entry in the table is selected, and the test is repeated. For example, suppose a packet must be sent to the address 200.134.51.34 and we want to test if the packet matches the first entry of the routing table shown in the figure. If we perform a logical and between 200.134.51.34 and 255.255.255.0 (i.e., the bits corresponding to the host ID are set to 0 ), the result is 200.134.51.0. Therefore, the entry is selected. It is easy to observe that the result of this operation depends on the order that the routing table entries are tested. The destination address 200.134.51.34 matches the first, third and fourth routing entry shown in the figure. The question is, which one is selected?
17. Routing Table Example To illustrate the concept of routing tables, consider the scenario shown in the figure. All computers and routers in the figure have routing tables. As good initial guess is to consider that the number of entries in a routing table is equal to the number of subnets in the WAN. In this scenario, the subnets are 200.17.98.0/24, 200.134.51.0/24 and 0.0.0.0/0. The link between routers 1 and 2 is also a network, but usually it's not worth including it in the routing table, since it is possible to manage the routers from the other interfaces. The mask/30 is ideal for assigning addresses to point-to-point links, because it sets a block with only 4 addresses, being only two unicast addresses. Therefore, the routing table of all elements in the figure should include three entries. This rule is not always valid, because there are some situations where the number of entries in the routing table does not match the number of subnets. In some cases, it is possible eliminate some entries in the routing table using the concept of super-nets, discussed earlier in this course. Also, in case of multiple paths to the same network, it is possible to a route to appear more than one time in the routing table.
18. Routing Table of Host B The figure shows the routing table of computer B. The table has three entries, one for each network accessible by the computer. The first route indicates how the computer should forward packets to their own network. In this case, the gateway field is not necessary. Operating systems represent routes to local networks in different ways. Windows, for example, indicates "On-link" in this field. Linux uses 0.0.0.0 to indicate that the gateway is not required. The interface field is identical for all entries in the table once the computer has only one network interface. Again, the form of representation of this field is quite variable. The logical name "eth0" is commonly used by Linux to designate the first (or the only) Ethernet network interface of the computer. Windows, on the other hand, uses the IP address of the interface on that field. The cost in this case was arbitrarily chosen as 1 because there are no alternative paths to the networks listed in the table. In this case, any value of cost would be valid.
19. How Route Tables are Tested At first sight, the routing table of computer B could indicates a sort of conflict because the Internet encompasses the other two networks. That is, any destination address tested by the computer is contained in the route to the Internet, including the local addresses. Fortunately, this problem does not occur because there is a convention about the order in which the routing table entries are tested. This convention is based on two important rules. The first rule says that a more-specific route should always be tested before a less specific route. The more specific term refers to the size of the corresponding block address represented by the route. Routes corresponding to smaller blocks of addresses are tested first. According to the first rules, the route to the Internet is always the last one to be tested. For example, the route to 200.134.51.0/24 should be tested before the route 0.0.0.0/0 because it represents a smaller address block. The second rule says that if there is a tie in relation to the size of the block of addresses represented by the route, cost field must be used. In this case, a lower cost route should always be tested first.
20. Routing Table of Router 1 The figure shows the routing table of Router 1. The first two table entries are said local routes, because the router has one of its interfaces directly connected to the destination network. Local routes are created automatically once an address is assigned to an interface of the router. The subnet is indentified by performing a logical AND between the IP address of the interface and the subnet mask. Again, for local routes, no gateway is needed. In many systems, local routes automatically receive 0 in the cost field of the routing table. This indicates that it is not possible to find an alternative route with lower cost. Router 1 must sent the packets addressed to the Internet to Router 2. This is indicated by the third rule in the table. The cost 1 indicated for this rule has no effect, once there is no alternate route. The cost field will be discussed in details next in this booklet.
21. Routing Table of Router 2 The figure shows the routing table of Router 2. Note how the IP addresses of the links that connect Routers 1 and 2 and Router 2 and the ISP (Internet Service Provider) were defined. The IP addresses of routers connected to the same link must necessarily belong to the same subnet. The link between Routers 1 and 2 belongs to the subnet 10.0.0.0/30. The mask/30 has only 2 bits to identify hosts and therefore corresponds to a block of only 2 2 = 4 addresses, from 10.0.0.0 to 10.0.0.3. As the first and last addresses of the block cannot be used, the addresses 10.0.0.1 and 10.0.0.2 were assigned to the routers. The mask /30 corresponds to 255.255.255.252 in decimal dotted notation. Similarly, the link between the Router 2 and the ISP belongs to the subnet 10.0.0.4/30, which comprises the addresses 10.0.0.4 to 10.0.0.7.
22. Default Gateway and Default Route When configuring a computer manually (without the help of DHCP, studied ahead in this course), besides the IP address and the subnet mask, the user is asked to provide an IP address called default gateway or default router. In general, the term default gateway is used to designate the router that gives the computer access to all other subnets in the same organization and the Internet. Normally, this is the only router that is required to be known by the computer. The computer's routing table is automatically generated using the following three parameters: the computer's IP, the subnet mask and the default gateway. In the figure, the first routing table entry of computer B is the route to the local network. It is defined by a logical "and" between the IP 200.134.51.25 and the subnet mask /24 (255.255.255.0). The result is the subnet 200.134.51.0/24. The third routing table entry is created from the information about the default gateway. This route is usually referred to as default route. The second entry in the routing table is unnecessary because the network 200.17.98.0/24 can be considered part of the Internet, since it is accessed by the same router. This route entry can be eliminated. As a general rule, all table entries with the same gateway as the Internet route can be eliminated.
23. Multiple Routes and Cost Routing tables permit to represent more than one route to the same destination. The network software of the operating system always tests the entries of the routing table in a specific order, using the longest prefix match as first sorting criteria and the cost of the route as the second. The first route that includes the destination address of the packet being forwarded is selected. This route is known as the best or main route. Routes other than the best route are only considered in the event of a failure of the main route, which occurs, for example, due to a link failure or a failure in the hardware or software of a router. There are basically two strategies to define costs. The first is based on counting the number of hops (i.e., the number of routers) that a packet must traverse to reach the destination network. This strategy is suitable only in situations where the transmission rate of the links is very similar. The second strategy consists of assigning costs to the links in a manner inversely proportional to its transmission rate. Generally, the link cost is calculated by dividing the highest transmission rate among all links of the network by the transmission rate of the link. For example, in the figure, the highest transmission rate is 100Mbit/s. Therefore, the 100Mbit/s links would have cost 1 and the 10Mbit/s link would have cost 10. The table shown in figure corresponds to the Router 1. The costs without parentheses were calculated in hops and those within parentheses using the rate of the links.
24. Route Aggregation In the previous examples we have considered only networks with default masks, i.e. masks corresponding to the classes A, B and C. Let us now consider the construction of routing tables with variable-sized masks. In this case, suppose a router connects two subnets formed by the partition of the class C subnet 200.1.2.0/24. If we replace the subnet mask /24 by a /25, we define two subnets of identical size (128 addresses): 200.1.2.0/25 (with addresses between 200.1.2.0 and 200.1.2.255) and 200.1.2.128/25 (with addresses between 200.1.2.128 and 200.1.2.255) Observe that the router 2 does not need to take into account the division of the class C subnet into two smaller subnets. From the viewpoint of router 2, the path to achieve both subnets is identical, and must pass through router 1 using the 10.0.0.1 interface. Therefore, a single /24 route can be still be used in router 2 to represent both subnets. The routing tables corresponding to this scenario are illustrated in sequence of this chapter.
25. Routing Tables with Route Aggregation The table corresponding to the computer uses the concept of default route. As most computers, the computer has only two routes: a route to its local network and other to the Internet. The Router 1 has three routes, two local routes and one for the Internet. Router 2 has only two routes, a route to subnet 200.1.2.0/24 and another for the Internet. Note that the router 2 does not need use two routes to address the /25 subnets. All it needs to know is that any destination address between 200.1.2.1 and 200.1.2.254 can be reached by sending the packet to the interface 10.0.0.1 of Router 1. In this case, it is up to the Router 1 to decide what subnet (200.1.2.0/25 or 200.1.2.128/25) the packet must be sent. The process of representing two or more subnets with a single route is known as route aggregation. It is very important for the performance of the Internet. It permits hiding from the Internet routers the numerous subdivisions made internally by companies and Internet Service Providers.
26. Conclusion The integration between Internet Protocol (IP) and the data link layer is made with the aid of the Address Resolution Protocol (ARP). The ARP is responsible for finding the MAC address corresponding to an IP address. ARP is based on two main messages: ARP request and ARP reply. The ARP request is sent in broadcast, and it is considered one of the greatest villains of the network performance. The ARP is one of the main motivations for introducing the concept of VLANs (Virtual LANs) in the Ethernet technology. VLANs will be studied later in the course. Finally, we saw that all the elements involved in IP communication (computers and routers) have routing tables. We also saw that the concept of VLSM allows to aggregate routes to decrease the number of entries in the tables of the routers of the Internet. Presently, the internet routers have about 500 thousand entries in the routing tables. Without the concept of route aggregation, this number would be much higher.