Examination 2D1392 Protocols and Principles of the Internet 2G1305 Internetworking 2G1507 Kommunikationssystem, fk Date: January 17 th 2006 at 14:00 18:00 SOLUTIONS
1. General (5p) a) Draw the layered models of OSI and TCP/IP respectively. Show how the layers of the two models relate to each other. (3p) OSI: Application (7), Presentation (6), Session (5), Transport (4), Network (3), Link (2), Physical (1) TCP/IP: Application (OSI layer 5-7) Transport (OSI layer 4) Network (OSI layer 3) Data link and physical (OSI layer 1-2) b) Place the following protocols/functions in the correct TCP/IP layer: SMTP, UDP, ICMP, Ethernet. (2p) SMTP Application layer UDP Transport layer ICMP Network layer Ethernet Data link and physical layer 2. IP Addressing (5p) a) Assume you need a subnet for 8 hosts. What would be the best-fit (i.e., resulting in as few hosts addresses as possible) netmask for this subnet? (1p) A /29 network has 8 IP addresses in total, but can only serve 6 hosts since 2 addresses are reserved (direct broadcast and network address respectively). Therefore, a /28 network with 16 IP addresses in total is needed. The netmask is thus 255.255.255.240 b) How many host addresses can be created from a /28 network? (1p) According to the previous question, there are 16 addresses in total within a /28 network. Two addresses are reserved. Thus, 14 hosts can be served by a /28 network. c) Show how the network 148.16.56.0/26 can be split into two equally sized /27 networks. (1p) 148.16.56.0/26 holds 64 addresses: 148.16.56.0 148.16.56.63 We split it in half: 148.16.56.0/27 and 148.16.56.32/27 d) What is the difference between a direct broadcast address and a limited broadcast address? (2p) A direct broadcast address is network specific and an IP packet destined to this address can be forwarded by routers. The limited broadcast address is 255.255.255.255 and is only used within a subnet. IP packets destined to this address are never forwarded by routers. 3. IPv4 forwarding (5p) Destination Next Hop Flags Interface 111.0.0.0/8 - U m0 192.16.7.0/28 193.14.5.193 UG m1 193.14.5.160/27 - U m2 193.14.5.192/27 - U m1 194.17.21.16/32 111.20.18.14 UGH m0 192.16.7.0/24 111.15.17.32 UG m0 194.17.21.0/24 111.20.18.14 UG m0
0/0 111.30.31.18 UG m0 A router has the routing table shown above. Determine the next-hop address and the outgoing interface for each packet that arrives to the router if the packet s destination address is as in alternative a-e below. a) 192.16.7.13 (1p) 193.14.5.193 on interface m1 (Address within 192.16.7.0/28, which is the most specific route for this address) b) 192.16.7.231 (1p) 111.15.17.32 on interface m0 (Address within the destination network for that next hop) c) 194.17.21.45 (1p) 111.20.18.14 on interface m0 (Address within the destination network for that next hop) d) 193.14.5.225 (1p) 11.30.31.18 on interface m0 (No fit within any of destination networks, use default gateway) e) 193.14.5.166 (1p) 193.14.5.166 on interface m2 (Address within 193.14.5.192/27, which is directly attached to interface m2) 4. UDP (5p) Which of the following statements about UDP are true and false respectively? a) UDP provides a connectionless service. (1p) b) UDP provides an optional end-to-end checksum covering both header and data. (1p) c) A UDP datagram can be sent to an IP multicast address. (1p) d) UDP gives feedback to the sender to throttle the sending rate if packet loss is detected. (1p) False e) UDP is generally more suitable for real-time applications than TCP. (1p) 5. TCP I (5p) a) Explain the use of delayed acknowledgements in TCP. What does it mean? What is the purpose? (2p) Upon reception of data, the receiver will wait roughly 200 ms (always less than 500 ms) before sending the ACK. The main purpose is to prevent the sender from sliding its window for a while and thereby prevent receiver-initiated silly window syndrome. b) A delayed acknowledgement must never be delayed more than 500 ms. Why? (1p) Because the retransmission timer might then go off and trigger an unnecessary retransmission. c) A TCP segment arrives with a sequence number that is expected by the receiver. The previous in-order segment has not been acknowledged. What does the receiver do? (1p) It immediately sends and ACK. This is what causes the ACK every other segment pattern in TCP bulk data transfers.
d) What does a TCP sender do with a segment for which it receives three duplicate ACKs in a row? (1p) It immediately retransmits the segment. 6. TCP II (5p) In TCP, several timers are used to make the protocol operate properly. One important timer is the retransmission timer, which have an adaptable timeout value (RTO). The RTO is normally based on the RTT (Round Trip Time), which may vary during the lifetime of a TCP connection. a) What happens with the RTO when a retransmission occurs? (1p) The RTO is doubled, referred to as exponential back-off. b) Explain Karn s algorithm affects the RTO. What problem is addressed and how is the problem solved with Karn s algorithm? (4p) Problem: The TCP retransmission timeout (RTO) is based on the RTT (Round Trip Time). A TCP sender is continuously measuring the RTT based on the ACKs it receives. Suppose that a sender sends a segment, and the RTO goes off before the segment is ACKed. The segment is then retransmitted. When the ACK for this segment is received, there is no way for the sender to know if it is the original segment or the retransmitted segment that is ACKed. Therefore, it cannot measure the current RTT for that particular segment. Karn s solution: Don t consider the RTT of a retransmitted segment. Instead, the previous value of the RTO (the one that was doubled due to exponential back-off) is reused. The RTT is not updated until an ACK is received without the need for retransmission. 7. Application layer (5p) There are several different ways to represent data in application-layer protocols. Fixed binary format is one such format which has some properties separating it from other data representations (such as BNF, ASN.1, XML, etc) a) Give one example of an application-layer protocol that uses fixed binary format. (1p) DNS, DHCP b) Briefly describe the fixed binary format with respect to flexibility (can it be extended with new types and fields?); compatibility (can different computer architectures understand the same format?); performance (how efficient is the parsing and general handling?); readability (how difficult it is for a human or computer to read and write?) (4p) Fixed binary format is a format which is pre-defined and static the interpretation of the data resides in the end-node implementations, there is no way to extend the data with new fields or types. It is also binary, in the sense that it uses machine-readable representation for integers and other data, and is therefore not human-readable. Since integers are binary, they must be encoded with a specific alignment and byte-order: Since different architectures use different byte-order and alignment, one must agree on a specific binary encoding scheme, such as network-byte-order with 64-bit alignment. The fixed binary format is easy to read and write for a computer, but difficult to understand for a human. It is also efficient in terms of CPU cycles since it can be
parsed quickly, and it uses low bandwidth since it has low overhead (compared with many other formats). 8. SMTP and DNS I (5p) a) What does FQDN stand for? (1p) Fully Qualified Doimain Name. b) Give an example of a FQDN. (1p) www.csc.kth.se c) What is the difference between FQDN and PQDN? (1p) PQDN describes only a part of the FQDN. Example: www.csc from the example above. d) MIME (Multipurpose Internet Mail Extensions) is used to encode data to one common format in e-mails when transferred through SMTP. Which common format is the only one allowed during a SMTP session? (1p) ASCII. e) An e-mail (SMTP message) can hold several chunks of data, each encoded with another type of MIME encoding. Describe what kind of information is found in the Beginning and at the end of each chunk of data. (1p) The chunk begins with a header. The header describes the Content-Type and optionally boundary, id, length, etc. When no length is specified there has to be some marker to mark the end of the chunk. 9. SMTP and DNS II (5p) a) Under the root in the hierarchical domain name space there are several top domains. One of them is called the arpa domain. Describe what kind of data is found under this domain. (2p) E164.arpa. is assigned to telephone numbers. IP6.arpa. to ipv6- addresses. In-addr.arpa. describes IPv4 addresses. The addresses are in reverse order i.e. the address 192.36.125.26 becomes 26.125.36.192.in-addr.arpa. b) Suppose you query a name server about an A record. What kind of data is needed to complete the query? (1p) A domain name is needed to complete the query. c) Suppose you query a name server about an A record. What kind of data is received as an answer? (1p) An IPv4 address is received as the answer. d) What kind of data does the AAAA record hold? (1p) An IPv6 address. 10.Dynamic Routing (5p) RIP, OSPF and BGP are three dynamic routing protocols used in the Internet today. a) OSPF and RIP use fundamentally different algorithms, but OSPF is said to converge faster than RIP. What does this mean, and why is this so? In your answer, you should compare the two protocols with respect to convergence. (3p)
OSPF is based on link-state routing, whereas RIP uses distance-vector. Link-state routing distributes original link information by flooding to every other node. Thus, every node has complete link information fast. The system can reach a correct routing state in a short time. In contrast, distance-vector uses periodic updates between neighbours to distribute information. In addition, distance-vector re-computes routes nodes do not have access to original data. Therefore, RIP takes longer time to reach a correct state. Thus, the system may be inconsistent causing routing loops during a relatively long time. b) The Border Gateway Protocol (BGP) uses path-vector routing. Describe how pathvector enhances distance-vector. What is the advantage with the enhancement? (1p) Path-vector adds the sequence of autonomous systems to pass (a path) in order to reach a destination network. With this information, loops that can occur in distance vector (e.g. count-to-infinity) can be avoided. c) Give an example of a situation when redistribution of routes between two routing protocols is useful. (1p) There are many such scenarios. Example (1) (IGP->BGP): if one wishes to advertise internal routes to the global Internet: then static or IGP routes are redistributed into BGP. Example (2) BGP->IGP; external routes can be redistributed into an IGP if one wishes the IGP to route transit traffic. Example (3): (IGP->IGP): one uses more than one IGP and they should co-exist in one internal network. 11.IP Multicast (5p) Assume a multicast router with four network interfaces: A, B, C and D. All interfaces are connected to other multicast routers, and they all run the PIM-SM multicast routing protocol. The unicast routing table and the multicast forwarding table are given below. Unicast routing table Prefix Interfac 207.46.199.0/24 A 204.13.161.0/24 D 192.0.0.0/16 B 198.76.195.0/24 C 213.189.140.0/24 B 0.0.0.0/0 A Multicast forwarding table Sender, Group Interface list 192.0.34.9, 224.4.5.6 A 204.13.161.2, 224.4.5.6 C 9.1.1.1, 224.4.5.6 B *, 224.4.5.6 A, B, C *, 231.1.1.1 B, D a) What is reverse-path-forwarding (RPF) and how does it work? (2p) In RPF, the source address of the incoming IP multicast packet is used to make a lookup in the unicast routing table. The result of the lookup provides an outgoing interface. If this interface is not the same as the incoming interface of the multicast packet, the packet is dropped. RPF implements a simple flooding algorithm to reach all nodes in a network without packet loops or broadcast storms.
How are the following IP packets forwarded by the router? b) A packet with src = 192.0.34.9 and dst = 224.4.5.6, arriving on interface A? (1p) Drop: failed RPF (Reverse Path Forwarding check) since it arrived on the wrong interface (it should have arrived on interface B). c) A packet with src = 1.2.3.4 and dst = 224.4.5.6, arriving on interface A? (1p) RPF OK, Forward on interfaces B, C (but not on the incoming interface A) d) A packet with src = 9.1.1.1 and dst = 231.1.1.1, arriving on interface A? (1p) RPF OK, Forward on interfaces B and D 12. VPNs and NAT (5p) a) Compared to private networks constructed with e.g., leased lines, Virtual Private Networks (VPNs) are increasingly popular among companies and organizations today. Give a motivation for this popularity. (1p) (1) VPN:s are generally cheaper than a private network solution; (2) VPN:s are more flexible in terms of connectivity. b) Two challenges that VPNs need to solve concern addressing and privacy. How are these two issues typically handled by VPN technology? (1p) Privacy is typically handled by encryption or by a trusted network. Addressing is typically handled by separating the addressing domains into a global and a private domain. The private domain is used within the company or organization and the global domain is the global Internet addressing domain. The packet containing the private addresses are encapsulated within a globally addressed packet. c) What is the difference between a symmetric NAT and a full-cone NAT? (2p) A full-cone NAT has no filtering of external address and ports. A binding between an internal end-point and an external end-point may be re-used by other external endpoints. In other words, a hole opened in the NAT by one session can be re-used by another session. A symmetric NAT has filtering of external addresses and ports. This means that a binding created by one session between an internal end-point and an external endpoint cannot be re-used by any other external end-point. d) Why do many applications have problems traversing NATs with respect to packetlevel data? That is, why do many applications require that application-specific modules be added to a NAT for the application to function properly? (1p) The NAT box rewrites addresses and ports in the packet headers. But the payload of a packet may contain information about addresses and ports, and these are not rewritten. This means that the information in the payload and the packet header is inconsistent, and the application may break. An application-specific NAT module can add functionality that re-writes the payload of the packet following the application semantics.