Lecture 6. TCP/IP Network Layer (4)

Lecture 6 TCP/IP Network Layer (4)

Outline (Network Layer) Principles behind network layer services: Virtual circuit and datagram networks Routing algorithms Link State Distance Vector Hierarchical Routing Tables What s inside a router Internet Protocol Datagram format IPv4 addressing CIDR IPv6 Routing in the Internet RIP OSPF BGP Broadcast and multicast routing Miscellaneous protocols and programs ICMP, PING, TRACERT

Different Types of Routing Unicast: the destination address specifies a single host (interface). Broadcast: a host wants to send a frame to every other host at the same time on the network. Multicast: the frame should be delivered to a set of hosts that belong to a (multicast) group at the same time.

Broadcast Routing Algorithms Flooding: every incoming packet is sent out on every outgoing line except the one it arrived on. It generates too many (duplicate) packets. Consumes too much bandwidth. Special mechanism is used to stop flooding (e.g. hop count, or list of packet seen per source) Spanning tree (or Sink tree): each router needs to know which of its lines belong to a spanning tree. It copies an incoming packet onto all the spanning tree lines except the one it arrived on. Efficient use of bandwidth. Each router must have knowledge of some spanning tree.

Broadcast Routing Algorithms Reverse Path Forwarding: if the broadcast packet arrived to the router on the line that is normally used by the router for sending packets to the broadcast source, then the router forwards copies of the packet onto all lines except the one it arrived on. If the broadcast packet arrived to the router on a line other than the preferred one for reaching the source, the packet is discarded as a duplicate.

Reverse Path Forwarding: Example A Subnet Sink Tree Reverse Path Forwarding Preferred paths from I to all other nodes fall along the sink tree. On first hop I sends packets to F, H, J and N On second hop 8 packets, 5 along preferred line On third hop 6 packets, 3 along preferred lines After five hops none of the packets is along preferred line, so the algorithm terminates.

Broadcast Routing: IP Addresses Limited Broadcast : the limited broadcasting address is 255.255.255.255. This can be use as the destination address of an IP datagram during the host configuration process, when the host might not know its subnet mask or even its IP address. Net-directed Broadcast : the net-directed broadcast address has a host ID of all one bits. class A net-directed broadcasting is netid.255.255.255, where netid is the class A network ID. Subnet-directed Broadcast : the subnet-directed broadcast address has a host ID of all one bits but a specific subnet ID. A router receives a datagram destined for 128.1.2.255, this is a subnet-directed broadcast if the class B network 128.1 has a subnet mask of 255.255.255.0, but it is not a broadcast if the mask is 255.255.254.0. All-subnet-directed Broadcast : an all-subnets-directed broadcast address both the subnet ID and the host ID are all one bits. The destination s subnet mask is 255.255.255.0, the class B IP address 128.1.255.255 is an all-subnets-directed broadcast. But if the network is not subnetted, then it is net-directed broadcast

Multicast Routing the sending of a packet from one sender to multiple receivers with a single transmit operation. One possibility is for the sender to use a separate unicast transport connection to each of the receivers. An application level data unit is duplicated at the sender and transmitted over each of the individual connections. This approach implements a one-sender-to-many-receivers multicast abstraction using an underlying unicast network layer. Alternative is to provide explicit multicast support at the network layer. A single datagram is transmitted from the sending host. This datagram (or a copy of this datagram) is then replicated at a network router whenever it must be forwarded on multiple outgoing links in order to reach the receivers.

Multicast Routing Implementation of mutlicast-aware network layer faces two problems that are much more complicated than in the case of unicast (or broadcast) how to identify the receivers of a multicast datagram how to address a datagram sent to these receivers. in the TCP/IP, a multicast datagram is addressed using address indirection, i.e. a single "identifier" is used for the group of receivers, and a copy of the datagram is delivered to all of the multicast receivers associated with that group. the single "identifier" that represents a group of receivers is a Class D multicast address, and the group is referred to as a multicast group.

Multicast Group Address A multicast group address, is a class D IP address, i.e. the combination of the high-order 4 bits of 1110 and the multicast group ID. These are in the range of 224.0.0.0 through 239.255.255.255. four hosts (shown in red) are associated with the multicast group address of 226.17.30.197 and will receive all datagrams addressed to that multicast address Some well known multicast group addresses (called permanent host groups): 224.0.0.1 means all system on this subnet (group). 224.0.0.2 means all routers on this subnets (group). 224.0.1.1 is for NTP ( the Network Time Protocol ). 224.0.0.9 is for RIP-2.

Multicast Group Abstractly, the concept of multicast group is very simple, nevertheless several issues to be considered: How does a group get started and how does it terminate? How is the group address chosen? How are new hosts added to the group (either as senders or receivers)? Can anyone join a group (and send to, or receive from, that group) or is group membership restricted? Do group members know the identities of the other group members? How do the network routers interoperate with each other to deliver a multicast datagram to all group members? To answer all these questions a protocol has been defined, which is known as Internet Group Management Protocol (IGMP)

Internet Group Management Protocol (IGMP) The Internet Group Management Protocol (IGMP) is used between IP hosts and their immediate neighbor multicast agents (routers) to support the creation of multicast groups, the addition and deletion of members of a group, and the periodic confirmation of group membership. IGMP messages are transmitted in IP datagrams, has a fixed-size (8 bytes) message, with no optional data. IGMP messages are specified in the IP datagram with a protocol value of 2 in the IP header. IP datagram IP Header IGMP Message 20 bytes 8 bytes

IGMP Message Format (v2) Type: specifies IGMP message type Type Sent by Purpose Membership query:general Router used to learn which groups have members on an attached network Membership query:specific Router used to learn if a particular group has any members on an attached NT Membership report Host report host wants to join or is joined to given multicast group Leave group host report leaving given multicast group Max Response Time: The Max Response Time field is used only in Membership Query messages. It specifies the maximum allowed time before sending a responding report in units of 1/10 second. In all other messages, it is set to zero by the sender and ignored by receivers. Checksum: computing the checksum. Group Address: In a Membership Query message, this field is set to zero when sending a General Query, and set to the group address being queried when sending a Group-Specific Query. In a Membership Report or Leave Group message, this field holds the IP multicast group address of the group being reported or left.

Multicast Routing Algorithm IGMP interaction is limited to a host and its attached router only Another protocol (algorithm) is needed to coordinate the multicast routers (including the attached routers) throughout the Internet. This is accomplished by the network layer multicast routing algorithms how the packets should be routed amongst routers in order to insure that each router receives the multicast group traffic that it needs. E A C F D B Multicast hosts, their attached routers, and other routers

Multicast Routing: Problem Statement Goal: find a tree (or trees) connecting routers having local multicast group members tree: not all paths between routers used source-based: different tree from each sender to receivers shortest path trees reverse path forwarding shared-tree: same tree used by all group members minimal cost tree (Steiner) center-based trees Source-based trees we first look at basic approaches, then specific protocols adopting these approaches, e.g. PIM, DVMRP Shared tree

Shortest Path Tree multicast forwarding tree: tree of shortest path routes from a source to all receivers Dijkstra s algorithm S: source R1 1 R2 3 4 2 R4 5 R5 LEGEND router with attached group member router with no attached group member R3 R6 6 R7 i link used for forwarding, i indicates order link added by algorithm

Reverse Path Forwarding Already discussed Improvement forwarding tree contains subtrees with no multicast group members no need to forward datagrams down subtree prune messages sent upstream by router with no downstream group members S: source R1 R2 R3 R6 R5 R4 R7 LEGEND router with attached group member P router with no attached group member datagram will be forwarded datagram will not be forwarded prune message links with multicast forwarding R3 S: source R2 R1 R4 P R5 P R6 R7

Shared-Tree: Steiner Tree Steiner Tree: minimum cost tree connecting all routers with attached group members problem is NP-complete excellent heuristics exists not used in practice: computational complexity information about entire network needed monolithic: rerun whenever a router needs to join/leave

Center-based trees single delivery tree shared by all one router identified as center of tree to join: edge router sends unicast join-message addressed to center router join-message processed by intermediate routers and forwarded towards center join-message either hits existing tree branch for this center, or arrives at center path taken by join-message becomes new branch of tree for this router

Center-based trees: an example Suppose R6 chosen as center: LEGEND R1 3 R4 router with attached group member R3 R2 1 R6 2 R7 R5 1 router with no attached group member path order in which join messages generated

Tunneling only a small fraction of the Internet routers are multicast capable. Q: How to connect islands of multicast routers in a sea of unicast routers? physical topology logical topology multicast datagram encapsulated inside normal (nonmulticast-addressed) datagram normal IP datagram sent thru tunnel via regular IP unicast to receiving multicast router receiving multicast router unencapsulates to get multicast datagram

Internet Multicasting Routing DVMRP PIM

DVMRP DVMRP: distance vector multicast routing protocol source-based tree, applies reverse path forwarding, pruning and grafting, RPF tree based on DVMRP s own routing tables constructed by communicating DVMRP routers (distance vector algorithm) no assumptions about underlying unicast initial datagram to multicast group flooded everywhere via RPF routers not wanting group: send upstream prune messages

DVMRP soft state: DVMRP router periodically (1 min.) forgets the branches pruned: multicast data again flows down unpruned branch downstream router: reprune or else continue to receive data routers can quickly regraft to tree following IGMP join at leaf odds and ends commonly implemented in commercial routers Mbone routing done using DVMRP

PIM: Protocol Independent Multicast not dependent on any specific underlying unicast routing algorithm (works with all) two different multicast distribution scenarios : Dense: Multicast group members are densely located, i.e. many or most of the routers in the area need to be involved in routing multicast datagrams. bandwidth more plentiful Sparse: the number of routers with attached group members is small with respect to the total number of routers; group members widely dispersed bandwidth not plentiful

PIM- Dense Mode flood-and-prune RPF, similar to DVMRP group membership by routers assumed until routers explicitly prune data-driven construction on multicast tree (e.g., RPF) underlying unicast protocol provides RPF info for incoming datagram less complicated (less efficient) downstream flood than DVMRP reduces reliance on underlying routing algorithm has protocol mechanism for router to detect it is a leafnode router

PIM - Sparse Mode center-based approach router sends join message to rendezvous point (RP) i.e. center intermediate routers update state and forward join after joining via RP, router can switch to source-specific tree increased performance: less concentration, shorter paths sender(s): unicast data to RP, which distributes down RP-rooted tree RP can send stop message if no attached receivers no one is listening! R3 R2 R1 join join all data multicast from rendezvous point R6 join R4 R5 R7 rendezvous point

ICMP: Internet Control Message Protocol used by hosts, routers, gateways to communicate network-level information ICMP messages carried in IP datagrams Two categories: Error reporting: unreachable host, network, port, protocol, fragment needed by DF bit set Time exceeded (TTL) etc. Query/response Echo request/reply Timestamp request/reply Address mask request/reply

ICMP Message Format Type: There are different values for the type field, which identify the particular ICMP message. Code: Qualifies the ICMP message. Some types of ICMP messages then use different values of the code field to further specify the condition. Checksum: checksum that covers the ICMP message. Data: variable length. Contains the data specific to the message type indicated by the type and code fields.

ICMP Message Types

ICMP Error Message To prevent broadcast storm, an ICMP error message is never generated in response to An ICMP error message. A datagram destined to an IP broadcast address or an IP multicast address (a class D address). A datagram sent as a link-layer broadcast. A fragment other than the first. A datagram whose source address does not define a single host.

ICMP Address Mask Request and Reply The ICMP address mask request is intended for a diskless system to obtain its subnet mask at bootstrap time. The requesting system broadcasts its ICMP request. Format: The identifier and sequence number fields in the ICMP message can be set to anything the sender chooses, and these values are returned in the reply. Subnet mask: the subnet mask of the requesting host (set to 0 in request). ICMP ECHO Request and ECHO Reply messages have same format as the above one. Only difference is the name and size of the last field, which is Data, that carries implementation specific data.

ICMP Timestamp Request and Reply The ICMP timestamp request allows a system to query another for the current time. The recommended value to be returned is the number of milliseconds since midnight, Coordinated Universal Time (UTC). The drawback is that only the time since midnight is returned the caller must know the date form some other means. Format: The requestor fills in the originate timestamp and sends the request. The replying system fills in the receive timestamp when it receives the request, and the transmit timestamp when it sends the reply.

ICMP Unreachable Message The ICMP unreachable error message is sent by a router when it receives an IP datagram that it cannot deliver or forward: Format: Unused (or last 16 bits, Next Hops MTU): Last 16 bits are used when the code is set to 4 (The datagram is too big. Packet fragmentation is required but the DF bit in the IP header is set). MTU of that next-hop network is specified in the low-order 16 bits. IP header + the first 8 bytes of the original datagram's data: This data is used by the host to match the message to the appropriate process. If a higher level protocol uses port numbers, they are assumed to be in the first 64 data bits of the original datagram's data. (ICMP time exceeded message has same format)

ICMPv6 Internet Control Message Protocol Version 6 (ICMPv6) or ICMP for IPv6 is a new version of ICMP. ICMPv6 packet format is similar to ICMP packet format. ICMPv6 combines functions previously subdivided among different protocols, such as ICMP, IGMP and ARP. It introduces some simplifications by eliminating obsolete types of messages no longer in use. Type Meaning Type Meaning 1 Destination Unreachable 130 Group Membership Query 2 Packet Too Big 131 Group Membership Report 3 Time Exceeded 132 Group Membership Reduction 4 Parameter Problem 133 Router Solicitation 128 Echo Request 134 Router Advertisement 129 Echo Reply 135 Neighbor Solicitation

Ping Program Ping program is used to test whether another host is reachable. The program sends an ICMP echo request message to a host, expecting an ICMP echo reply to be return. Ping also measures the round-trip time to the host, giving us some indication of how far away that host is. Most TCP/IP implementations contains ping program. identifier field in the ICMP massage is set to the process ID of the sending process. The sequence number starts at 0 and is increased every time a new echo request is sent.

Ping Program - Example C:\Documents and Settings\Administrator>ping 172.16.10.25 Pinging 172.16.10.25 with 32 bytes of data: Reply from 172.16.10.25: bytes=32 time=1ms TTL=128 Reply from 172.16.10.25: bytes=32 time<1ms TTL=128 Reply from 172.16.10.25: bytes=32 time<1ms TTL=128 Reply from 172.16.10.25: bytes=32 time<1ms TTL=128 Ping statistics for 172.16.10.25: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 1ms, Average = 0ms

Ping Program with IP Record Route Option Most versions of ping provide the -r option that enables the record route (RR) feature, i.e. every router that handles the datagram adds its IP address to a list in the options field. When the datagram reaches the final destination, the list of IP addresses is copied into the outgoing ICMP echo reply, and all the routers on the return path also add their IP addresses to the list. The big problem is the limited room in the IP header for the list of IP addresses. General format of the option field: Code: a 1-byte field specifying the type of IP option. For RR its value is 7. Len: the total number of bytes of the RR option (i.e. 39 bytes). Prt: the pointer field. It points into the 39-byte option of where to store the next IP address. Its minimum value is 4, which is the pointer to the first IP address. It becomes 8,12..

Ping Program with -r Option - Example C:\>ping -r 9 www.yahoo.sg.com Pinging premium9.geo.yahoo7.akadns.net [216.39.58.169] with 32 bytes of data: Reply from 216.39.58.169: bytes=32 time=2176ms TTL=51 Route: 123.49.40.153 -> 123.49.0.30 -> 123.49.13.3 -> 123.49.0.249 -> 117.18.33.78 -> 117.18.32.1 -> 202.160.242.86 -> 202.160.242.87 -> 202.160.242.92 Reply from 216.39.58.169: bytes=32 time=2250ms TTL=50 Route: 123.49.40.153 -> 123.49.0.30 -> 123.49.13.3 -> 123.49.0.249 -> 117.18.33.78 -> 117.18.32.1 -> 202.160.242.86 -> 202.160.242.87 -> 202.160.242.92 Request timed out................ Ping statistics for 216.39.58.169: Packets: Sent = 4, Received = 3, Lost = 1 (25% loss), Approximate round trip times in milli-seconds: Minimum = 2139ms, Maximum = 2250ms, Average = 2188ms

Ping Program with IP Time Stamp Option The IP timestamp option is similar to the record route option, i.e. each router records its current time also. General Format: Code: a 1-byte field specifying the type of IP option. For timestamp its value is 0x44. Len: the total number of bytes of the timestamp 36-40. Prt: the pointer field. Normal values 5, 9, 13 OF (4 bits): overflow field is incremented by a router if there is no room to add time stamp. FL (4 bits): flag field drives the time stamp option.

Ping Program with IP Time Stamp Option - Example C:\Documents and Settings\Administrator>ping -s 4 www.buet.ac.bd Pinging www.buet.ac.bd [203.208.166.72] with 32 bytes of data: Reply from 203.208.166.72: bytes=32 time<1ms TTL=63 Timestamp: 172.16.20.1 : 36867880 -> 203.208.166.72 : 35633023 -> 203.208.166.72 : 35633023 -> 203.208.166.68 : 36867880 Reply from 203.208.166.72: bytes=32 time<1ms TTL=63 Timestamp: 172.16.20.1 : 36868881 -> 203.208.166.72 : 35634025 -> 203.208.166.72 : 35634025 -> 203.208.166.68 : 36868881 Reply from 203.208.166.72: bytes=32 time<1ms TTL=63 Timestamp: 172.16.20.1 : 36869882 -> 203.208.166.72 : 35635025 -> 203.208.166.72 : 35635025 -> 203.208.166.68 : 36869882 Reply from 203.208.166.72: bytes=32 time<1ms TTL=63 Timestamp: 172.16.20.1 : 36870883 -> 203.208.166.72 : 35636026 -> 203.208.166.72 : 35636026 -> 203.208.166.68 : 36870883 Ping statistics for 203.208.166.72: Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds: Minimum = 0ms, Maximum = 0ms, Average = 0ms

Traceroute Program Traceroute program enables to see the route that IP datagrams follow from one host to another host (source to destination). Why don t use Ping program with IP record route option: not all router support the record route option the room (9 IP addresses in the IP header) allocated for options in the IP header isn t large enough today to handle most routes

Traceroute Program Operation Traceroute principles: use TTL field: a router gets a IP datagram whose TTL is either 0 or 1 => not forward it and throws away AND send back to the originating host an ICMP time exceeded use UDP: assign an unlikely value (>30000) to the port number AND even if the datagram REALLY reached the destination, it also caused a ICMP port unreachable operations: Set TTL=1, send the IP datagram and then gets a ICMP from the FIRST router Set TTL=2, and then gets the address of the second router And so on for TTL=N, but if the error is port unreachable then we know reached the destination

Traceroute Program - Example C:\>tracert www.city.ac.uk Tracing route to www.city.ac.uk [138.40.3.21] over a maximum of 30 hops: TTL 1 <1 ms <1 ms <1 ms 192.168.0.1 2 104 ms 3 ms 3 ms 123.49.40.129 3 * 54 ms 5 ms 123.49.0.29 4 41 ms 4 ms 50 ms 123.49.13.11 5 * 1875 ms * 203.208.191.177 6 1790 ms 1809 ms 1868 ms ge-4-0-2-0.sngtp-cr1.ix.singtel.com [203.208.149.62] 7 1822 ms 1816 ms 1829 ms ge-0-0-0-0.sngtp-ar6.ix.singtel.com [203.208.182.110] 8 1997 ms 1988 ms * so-0-2-0-0.lonlx-cr2.ix.singtel.com [203.208.151.134] 9 2019 ms 2060 ms * 195.66.224.15 10 2035 ms 2138 ms 2078 ms 146.97.35.129 11 2175 ms * 2125 ms so-1-1-0.lond-sbr1.ja.net [146.97.33.137] 12 2114 ms * 2135 ms LMN-LMN1.site.ja.net [146.97.42.62] 13 * * * Request timed out. 14 2172 ms 2190 ms 2172 ms 138.40.183.2 15 2099 ms 2113 ms 2104 ms 138.40.76.3 16 * * * Request timed out. 17 2140 ms 2148 ms * 138.40.251.241 18 2138 ms 2136 ms 2135 ms www-vip.city.ac.uk [138.40.3.21] Trace complete. RTT Round Trip Time For each TTL value 3 Datagrams are sent No Response Received

Traceroute with IP Source Routing Option Source routing: the sender specifies the route: Strict: the sender specifies the exact path that the IP datagram must follow. If a router encounters a next hop in the source route that isn t on a directly connected network, an ICMP source route failed error is returned. Loose: the sender specifies a list of IP address that the datagram must traverse, but the datagram can also pass through other routers between any two addresses in the list Option format in the IP header The code is 0x83 for loose source routing and 0x89 for strict source routing. The len, ptr and other fields have same semantic as in RR option in ping program. Most implementation of Traceroute program supports only loose source routing.

Notice Mid term 1 exam marks are available at, http://teacher.buet.ac.bd/khaledmahbub/ant_exam_marks.html

Reading Material Chapter 4 text3 (Kurose) Chapter 5 text2 (Tanenbaum) Chapter 12, 13, 6, 7, 8, 9 text1 (Stevens) For ICMPv6 : RFC 4443, at http://tools.ietf.org/html/rfc4443