Monday, June 23, 2014

Internetworking with TCP/IP Notes (Chapter 7)

Chapter 7 Internet Protocol: Connectionless Datagram Delivery (IPv4, IPv6)

7.1 Internet Architecture and Philosophy
Conceptually, a TCP/IP internet provides three sets of services. Figure below list the three categories and illustrates dependencies among them.

Internet protocols are designed around three conceptual levels of service. A connectionless service at the lowest level matches underlying hardware well, a reliable transport service provides service to applications, and a variety of applications provide the services users expect.

7.2 Connectionless Delivery System Characteristics

The service is defined as an unreliable, best-effort, connectionless packet delivery system. The basic service is classified as connectionless because each packet is treated independently from all others and it is unreliable as it mean that delivery is not guaranteed. It uses best-effort delivery because the Internet software makes an earnest attempt to deliver packets. 

7.3 The IP Datagram
The Internet calls its basic transfer unit an Internet datagram, usually abbreviated IP datagram. In fact, TCP/IP technology has become so successful that when someone uses the term datagram without any qualification, it is generally accepted to mean IP datagram.

7.4 IPv4 Datagram FormatIPv4 datagram is at least 20 bytes length, max 60 bytes length and the size is not fixed. It depends on the options filed.

The source address field in a datagram always refers to the original source and the destination address field refers to the ultimate destination.

Version
The first header field in an IP packet is the four-bit version field. For IPv4, this has a value of 4 (hence the name IPv4).

Internet Header Length (IHL) 
The second field (4 bits) is the Internet Header Length (IHL), which is the number of 32-bit words in the header. Since an IPv4 header may contain a variable number of options, this field specifies the size of the header. The minimum value for this field is 5, which is a length of 5×32 = 160 bits = 20 bytes. Being a 4-bit value, the maximum length is 15 words (15×32 bits) or 480 bits = 60 bytes.

Services Type
It is TOS (Type of Service). It is mostly refer to the DSCP and ECN.
More information on the ToS & DSCP, please see this post HERE

* Differentiated Services Code Point (DSCP)
Originally defined as the Type of service field, this field is now defined for Differentiated services (DiffServ). New technologies are emerging that require real-time data streaming and therefore make use of the DSCP field. An example is Voice over IP(VoIP)

* Explicit Congestion Notification (ECN)
It allows end-to-end notification of network congestion without dropping packets. ECN is an optional feature that is only used when both endpoints support it and are willing to use it. 

Total Length
This 16-bit field defines the entire packet (fragment) size, including header and data, in bytes. The minimum-length packet is 20 bytes (20-byte header + 0 bytes data) and the maximum is 65,535 bytes — the maximum value of a 16-bit word. 

Identification 
This field is an identification field and is primarily used for uniquely identifying the group of fragments of a single IP datagram.
Flags 
A three-bit field follows and is used to control or identify fragments. They are (in order, from high order to low order):
bit 0: Reserved; must be zero
bit 1: Don't Fragment (DF)
bit 2: More Fragments (MF)
If the DF flag is set, and fragmentation is required to route the packet, then the packet is dropped. This can be used when sending packets to a host that does not have sufficient resources to handle fragmentation. For unfragmented packets, the MF flag is cleared. For fragmented packets, all fragments except the last have the MF flag set. The last fragment has a non-zero Fragment Offset field, differentiating it from an unfragmented packet.

Fragment Offset 
The fragment offset field, measured in units of eight-byte blocks (64 bits), is 13 bits long and specifies the offset of a particular fragment relative to the beginning of the original unfragmented IP datagram. The first fragment has an offset of zero. This allows a maximum offset of (213 – 1) × 8 = 65,528 bytes, which would exceed the maximum IP packet length of 65,535 bytes with the header length included (65,528 + 20 = 65,548 bytes).

More explanation on the IP Fragmentation.--> HERE

TTL (Time to Live)
An eight-bit time to live field helps prevent datagrams from persisting (e.g. going in circles) on an internet. This field limits a datagram's lifetime. It is specified in seconds, but time intervals less than 1 second are rounded up to 1. In practice, the field has become a hop count—when the datagram arrives at a router, the router decrements the TTL field by one. When the TTL field hits zero, the router discards the packet and typically sends an ICMP Time Exceeded message to the sender.

Protocol
This field defines the protocol used in the data portion of the IP datagram. The Internet Assigned Numbers Authority maintains a list of IP protocol numbers
Header Checksum 
The 16-bit checksum field is used for error-checking of the header. When a packet arrives at a router, the router calculates the checksum of the header and compares it to the checksum field. If the values do not match, the router discards the packet. Errors in the data field must be handled by the encapsulated protocol. Both UDP and TCP have checksum fields.

Source address
This field is the IPv4 address of the sender of the packet. Note that this address may be changed in transit by a network address translation device.
Destination address
This field is the IPv4 address of the receiver of the packet. As with the source address, this may be changed in transit by a network address translation device.
Options
The options field is not often used. Note that the value in the IHL field must include enough extra 32-bit words to hold all the options (plus any padding needed to ensure that the header contains an integer number of 32-bit words). The list of options may be terminated with an EOL (End of Options List, 0x00) option; this is only necessary if the end of the options would not otherwise coincide with the end of the header.

More information about options please visit this post HERE

Padding
It depends on the options selected. It represents bits containing zero that may be needed to ensure the datagram header extends to an exact multiple of 32 bits (recall that the header length field is specified in units of 32-bit words).

7.5 IPv6 Datagram Format
Each IPv6 datagram begins with a 40-octet base header. IPv6 datagram begins with a fixed-size base header followed by zero or mor eextension headers, followed by a payload. Each IPv6 header contains a NEXT HEADER field that specifies the type of the header that follows. The final header uses the NEXT HEADER field to specify the type of the payload.


(a) only a base header, (b) a base header and one extension, and

(c) a base header and two extension header

The IPv6 base header format; the size is fixed at 40 octets.


VERS field specifies the version of the protocol; 6 specifies an IPv6 datagram.
TRAFFIC CLASS field is interpreted exactly the same as IPv4’sTYPE OF SERVICE field. FLOW LABEL is intended to allow IPv6 to be used with technologies that support resource reservation. 
The FLOW LABEL holds an ID that allows a router to identify the flow, which is used instead of the destination address when forwarding a datagram. PAYLOAD LENGTH field refers only to the data being carried and does not include the size of the base header or extension header(s). NEXT HEADER field appears in all headers and specifies the type of the next extension header, and in the final header, gives the type of the payload.
HOP LIMIT field specifies the maximum number of networks the datagram

can traverse before being discarded.
SOURCE ADDRESS and DESTINATION ADDRESS fields specify the IPv6 addresses of the original sender and ultimate 
destination.

7.6 Datagram Type of Service and Differentiated Services
Informally called Type Of Service(TOS), the 8-bit SERVICE TYPE field in an IPv4 header and the TRAFFIC CLASS field in an IPv6 header specify how the datagram should be handled. In the late 1990s, the IETF redefined the meaning of the field to accommodate a set of differentiated services(DiffServ).
Under DiffServ, the first six bits of the field constitute a codepoint, which is sometimes abbreviated DSCP, and the last two bits are left unused. A codepoint value maps to an underlying service definition, typically through an array of pointers. Although it is possible to define 64 separate services, the designers suggest that a given router will only need a few services, and multiple codepoints will map to each service. Thus, the last bit are always 0.

To maintain backward compatibility with the original definition, the standard distinguishes between the first three bits of the codepoint (bits that were formerly used for precedence) and the last three bits. When the last three bits contain zero, the precedence bits define eight broad classes of service that adhere to the same guidelines as the original definition: datagrams with a higher number in their precedence field are given preferential treatment over datagrams with a lower number.

We regard the service type specification as a hint to the forwarding algorithm that helps it choose among various paths to a destination based on local policies and its knowledge of the hardware technologies available on those paths. An internet does not guarantee to provide any particular type of service.

7.7 Datagram Size, Network MTU and Fragmentation
The internet technology should accommodate the greatest possible variety of network hardware and network applications.
The first principle implies that we should not rule out a network technology merely because the technology has a small MTU. The second principle suggests that application programmers should be allowed to choose whatever datagram size they find appropriate.

The standards allow each application to choose a datagram size that is best suited to the application. Then when transferring a datagram, check the size to see if the datagram is less than the MTU. If the datagram does not fit into a frame, divide the datagram into smaller pieces called fragments.

IPv4 allows any router along a path to fragment a datagram. In fact, if a later router along the path finds that a fragment is too large, the router can divide the fragment into fragments that are even smaller. IPv6 requires the original source to learn the path MTU and perform fragmentation; routers are forbidden from performing fragmentation.

7.8 IPv4 Datagram Fragmentation
IPv4 fragmentation occurs automatically at any point along the path when a datagram is too large for a network over which it must pass; the source only needs to insure that datagrams can travel over the first hop.

More information about the IP Fragmentation --> HERE


7.9 IPv6 Fragmentation and Path MTU Discovery (PMTUD)
The original source host is required to find the minimum MTU along the path to the destination and fragment each datagram according to the path it will take. IP routers along the path are not permitted to fragment IPv6 datagrams; if a datagram does not fit into the MTU of a network, the router sends an error message to the original source and drops the datagram.

Because networking technologies used in the Internet do not inform a host about 
the path MTU, a host must engage in a trial-and-error mechanism to determine the path MTU. Known asPath MTU Discovery(PMTUD), the mechanism consists of sending an IPv6 datagram that fits in the MTU of the directly-connected network.

Therefore, PMTUD specifies that a host should probe periodically by sending a larger datagram. Because we do not expect routes to change frequently and because the path MTU changes less frequently than routes, most implementations of IPv6 choose a long time period before probing again


Recall that the IPv6 base header does not include fields to specify fragmentation. 
Therefore, when it fragments an IPv6 datagram, a source inserts a Fragment Extension Header into each fragment. 
As the figure shows, the extension header includes the required NEXT HEADER field. It also includes two fields that are reserved for future use. The remaining three fields have the same meaning as IPv4 fragmentation control fields. A 13-bit FRAGMENT OFFSET field specifies where in the original datagram this fragment belongs, the Mbits is a more fragments bit that specifies whether a fragment is the final (rightmost) fragment of the original datagram, and the IDENTIFICATION field contains a unique datagram ID that is shared by all the fragments of a datagram.

7.10 Datagram Reassembly
The mechanism used to handle fragment loss consists of a reassembly timer. The ultimate destination starts a timer when a fragment arrives for a given datagram. If the timer expires before all fragments arrive, the receiving machine discards the surviving fragments. The source must retransmit the entire datagram; there is no way for the receiver to request individual fragments. In the Internet, the ultimate destination reassembles fragments. The design means that routers do not need to store fragments or keep other information about packets.
7.11 Header Fields used for Datagram Reassembly
Field IDENTIFICATION contains a unique integer that identifies the datagram. That is, each datagram sent by a given source has a unique ID. A typical implementation uses a sequence number — a computer sends a datagram with identification S, the next datagram will have identification S+1.

A destination uses the IDENTIFICATION field in fragments along with the datagram source address to group all the fragments of a given datagram. The value in the FRAGMENT OFFSET field specifies the offset in the original datagram of the payload being carried in the fragment, measured in units of 8 octets, starting at offset zero.

The more fragmentsbit solves the problem that the datagrams may arrive out of order. Once a fragment arrives with the more fragmentsbit turned off, the destination knows the fragment carries data from the tail of the original datagram. From the FRAGMENT OFFSET field and the size of the fragment, the destination can compute the length of the original datagram.

7.12 Time To Live (IPv4) and Hop Limit (IPv6)
The TTL field is used to specify how many hops a datagram may traverse before being discarded. IPv6 includes the exact same concept. To clarify the meaning, IPv6 uses the name HOP LIMIT in place of TIME-TO-LIVE.

IP software in each machine along a path from source to destination decrements the field known as TIME-TO-LIVE (IPv4) or HOP LIMIT (IPv6). When the field reaches zero the datagram is discarded. A router does more than merely discard a datagram when the TTL reaches zero — the router sends an error message back to the source.
7.13 Optional IP Items
IP OPTIONS field that follows the destination address is used to send optional items. In IPv6, each of the extension headers is optional, and a given datagram may include multiple extensions. Many of the options in the standards are intended for special control or for network testing and debugging.

7.13.1 IPv4 Options
The options area of the header is treated as an array of octets, and options are placed in the array one after another. For more information, please see this post HERE

Some famous options explanation as below.

Record Route Option. The record route option allows the source to create an empty list of IPv4 addresses and request that each router along the path add its IPv4 address to the list. The list begins with a header that specifies the type of the option, a length field, and a pointer. The length field specifies the number of octets in the list, and the pointer specifies the offset of the next free item.

Source Route Options. Two options, Strict Source Route and Loose Source Route, provide a way for a sender to control forwarding along a path through an internet.

Strict Source Route. Strict source routing specifies a complete path through an internet (i.e., the path the datagram must follow to reach its destination). The path consists of IPv4 addresses that each correspond to a router (or to the ultimate destination).
The wordstrictmeans that each pair of routers along the path must be directly connected by a network; an error results if a router cannot reach the next router specified in the
list.

Loose Source Route. Loose source routing specifies a path through an internet, and the option includes a sequence of IP addresses. Unlike strict source routing, a loose source route specifies that the datagram must visit the sequence of IP addresses, but allows multiple network hops between successive addresses on the list

Internet Timestamp Option. The timestamp option works like the record route option: the option field starts with an initially empty list, and each router along the path from source to destination fills in one entry. Unlike the record route option, each entry in a timestamp list contains two 32-bit values that are set to the IPv4 address of the router that filled the entry and a 32-bit integer timestamp.  Timestamps give the time and date at which a router handles the datagram.

7.13.2 IPv6 OptionsIPv6 uses the mechanism of extension headers in place of IPv4 options. Many of the IPv6 extension headers are variable size; the size depends on the contents.



As the figure indicates, only the first two octets are specified: a NEXT HEADER
field and a Header Extension Length field (HDR EXT LEN). The length field specifies the length of the extension header in octets. The body of the extension header follows a Type-Length-Value(TLV) approach. The body consists of options that each begin with a 2-octet header. The first octet specifies the type of the option, the second octet specifies the length, and the next octets contain the value.

IPv6 requires datagram headers to be aligned to a multiple of eight octets. Variable-size options mean that the Hop-By-Hop header may not align correctly. In such cases, IPv6 defines two padding options that a sender can use to align the headers. One of the two consists of a single octet of padding; the other uses two octets to specify a padding length. 

More explanation --> HERE
7.14 Options Processing during Fragmentation
If an option must be processed by intermediate routers, the option is copied into each fragment. However, if the option is only used at the ultimate destination, the option is copied into the header of the first fragment but not the rest. Although they use the same concept, IPv4 and IPv6 differ in most details.

7.14.1 IPv4 Processing Options during fragmentation 
Each code octet contains a copy bit that specifies whether the option should be replicated in all fragments or in only one fragment. Source route options provide an example of options that must be copied into each fragment. When a sender specifies a source route, the sender intends for the datagram to follow the specified path through an internet.

7.14.2 IPv6 Processing Options during fragmentation 
IPv6 divides a datagram into two conceptual pieces: an initial piece that is classified as unfragmentable and the remainder, which is classified as fragmentable. The base header lies in the unfragmentable piece and the payload lies in the fragmentable piece.
The IPv6 standards specify whether a header is fragmentable. In particular, the Hop-By-Hop Header and Route Header are not fragmentable; other extension headers are fragmentable. Therefore, the fragmentable part of the datagram begins after the non- fragmentable extension headers.


IPv6 fragmentation with (a) an IPv6 datagram with extension headers divided into fragmentable and unfragmentable pieces, and (b) a set of fragments.

As the figure indicates, each fragment starts with a copy of the unfragmentable piece of the original datagram. In the figure, the unfragmentable piece includes a Base Header,aHop-By-Hop Header, and a Route Header. Following the unfragmentable piece, a fragment has aFragment Headerlabeled Fin the figure.

7.15 Network Byte Order
Protocols must specify enough detail to insure that both sides interpret data the same way. Standardizing byte-order for integers is especially important for protocol headers because a header usually contains binary values that specify information such as the packet length or a type field that specifies the type of data in the payload area. The TCP/IP protocols solve the byte-order problem by defining a network standard byte order that all machines must use for binary fields in headers.

The Internet protocols define network byte order to be big endian. A sender must convert all integer fields in packet headers to network byte order before sending a packet, and a receiver must convert all integer fields in packet headers to local byte order before processing a packet.

What is the difference between cos , ip precedence and dscp

* A simple explanation about the COS, TOS, DSCP, IP Precedence. It is from HERE
Thanks to the author.

  • cos is used at layer 2
  • ip precedence is the old way for type of service(ToS)
  • DSCP is the new way for type of service(ToS)
  • DSCP is backward compatible with ip precedence
Below is a the IPV4 datagram packet
As you notice ToS is 8 bits

ip precedence use the first 3 bits , DSP use the first 6 bits (in fact the 6th bit is never used)
Ip Precedence (Major class)It use a scale of 0 to 7 and will be typically used as below
  • 0:Best Effort (000)
  • 1:Medium priority(001)
  • 2:Hight priority(010)
  • 3:Call signals(011)
  • 4:Video conference(100)
  • 5:Voice(101)
  • 6:Reserved (110)
  • 7:Reserved(111)
again this is the old way to be used with ToS
Configuration Example:

Router(config)#class-map match-all IP-PRECEDENCE
Router(config-cmap)#match protocol rtp
Router(config-cmap)#exist
Router(config)#policy-map IP-PRECEDENCE-POLICY
Router(config-pmap)#class IP-PRECEDENCE
Router(config-pmap-c)#set ip precedence ?
<0-7>           Precedence value
critical        Set packets with critical precedence (5)
flash           Set packets with flash precedence (3)
flash-override  Set packets with flash override precedence (4)
immediate       Set packets with immediate precedence (2)
internet        Set packets with internetwork control precedence (6)
network         Set packets with network control precedence (7)
priority        Set packets with priority precedence (1)
routine         Set packets with routine precedence (0)


Router(config-pmap-c)#set ip precedence critical
Router(config-pmap-c)#exit
Router(config)#interface gigabitEthernet 0/1
Router(config-if)#service-policy input IP-PRECEDENCE-POLICY

DSCPThe advantages of DSCP is that you may have more levels to define than “ip precedence”. For each level in “ip precedence” , there are 3 sub levels.at the same time it is backward compatible.
default  Match packets with default dscp (000000) (no sub level for level 0 or best effort)
af11     Match packets with AF11 dscp (001010)
af12     Match packets with AF12 dscp (001100)
af13     Match packets with AF13 dscp (001110)
Notice in the above level for af11 = 001|010 , as the 6th bit is not used this will become in reality   001|01 which is equal to 1|1 in decimal and the final result is af11
an old router which does not support DSCP will look at the first 3 bits , so the major classification will be understood by the old router .
The second part or the second 3 bits is called Drop Preference ,the higher it is , the more chance it has to be dropped . To resume af11 is better than af13 because af13 has more chance to be dropped than af11
Below are the rest of levels
af21     Match packets with AF21 dscp (010010)
af22     Match packets with AF22 dscp (010100)
af23     Match packets with AF23 dscp (010110)
af31     Match packets with AF31 dscp (011010)
af32     Match packets with AF32 dscp (011100)
af33     Match packets with AF33 dscp (011110)
af41     Match packets with AF41 dscp (100010)
af42     Match packets with AF42 dscp (100100)
af43     Match packets with AF43 dscp (100110)
ef       Match packets with EF dscp (101110) (no sub levels for level 5 or critical level)
Configuring DSCP on a cisco router is the same as ip precedence the only difference will be in the following line
Router(config-pmap-c)#set ip dscp ef

Friday, June 20, 2014

ARP (Address Resolution Protocol)

* This is copied from Daniel Networking Blog.
ARP is one of the most used protocols and every netwoork engineer should have a good understanding of it. The purpose of ARP is to find out the hardware address for a host for which we know the IP. ARP is in no way bound to Ethernet, it will function for other layer 2 protocols also. The topology I have used is very simple, it’s my own wireless network at home. See the picture below:
In Windows, to see what is in the ARP cache type “arp -a”. In windows Vista/7 the entry is valid for about 30 seconds.
Since I already have an entry for 192.168.1.254 (my router) I need to delete it to force an ARP request to be sent. I will capture the traffic with Wireshark. The command to do this is “arp -d”.
Lets look at an ARP header:
The numbers above the image are the octet boundaries, one octet is 8 bits. This can also be expressed as one byte. The first field which is 2 octets in size is hardware type. This field indicates what layer 2 protocol is being used, in this case Ethernet. This number will be one for Ethernet(0×0001). Protocol type is the layer 3 protocol in use which in our case is IP. IP has the number 0×0800. Hardware address length is one octet long and indicates the length of the hardware address. For Ethernet this is 6 bytes(48 bits). Protocol address length is the length of IP which is 4 octets. Opcode tells us what kind of ARP message this is, this will be a one for a request or a two for a reply. It can also be a three or four in the case of RARP (Reverse ARP).
Source hardware address and destination hardware address is in our case the MAC(Media Access Control) address. The protocol address is the source and destination IP address.
My computer now sends an ARP request (Opcode 0×0001). This is what it looks like:
192.168.1.254 is the router and .65 is my computer. Notice that the frame is a broadcast since we don’t know the MAC-address of the router. This is what the frame looks like in detail:
The router then sends a reply which is unicast, the router knows the computers MAC-address since it was in the frame that it received. The frame looks like this:
This is the more detailed version:
The router will save the MAC for the computer in it’s own cache. If we are asking for the hardware address of the router that means we are interested in communicating with it so it is more efficient to save the information then to send a new request from the router to the computer.

Internetworking with TCP/IP Notes (Chapter 6)

Chapter 6 Mapping Internet Addresses to Physical Addresses (ARP)

Daniel Networking Blog
There is a great example by Daniel to explain on how ARP works in actual environment.
The link is HERE.

6.1 Two Types of Hardware Addresses
The purpose of ARP is to find out the hardware address for a host for which we know the IP. There are two basic types of hardware addresses: those that are larger than the host
portion of an IP address and those that are smaller. IPv6 accommodates all types of hardware addresses. Thus, the distinction is only important for IPv4

6.2 Resolution Through Direct Mapping
IPv6 uses a technique known as direct mapping. The basic idea is straightforward: 
use a computer’s hardware address as the host portion of the computer’s Internet address.

Direct mapping has the advantage that new computers can be added to a networkwithout changing existing assignments and without propagating new information to existing computers.

6.3 IPv4 Address Resolution Through Dynamic Binding
Although it is efficient, direct mapping cannot be used with IPv4 if a hardware addresses is larger than an IPv4 address. The designers chose to use a low-level protocol that resolves addresses dynamically. Named the Address Resolution Protocol(ARP), the protocol provides a mechanism that is reasonably efficient and does not require an administrator to configure tables manually.

The Address Resolution Protocol, ARP, allows a host to find the physical address of a target host on the same physical network, given only the target’s IP address.

6.4 The ARP Cache
The standard specifies that ARP software must maintain acacheof recently acquired IP-to-hardware address bindings.

6.5 ARP Cache Timeout
A timer is set when information is added to the cache; when the timer expires, the information is deleted.

6.6 ARP Refinements
Several refinements of ARP have been included in the protocol that reduce the amount of network traffic and automate recovery after a hardware address changes:

* ARP requires A to include its IP-to-hardware address binding when sending B a request. B extracts A’s binding from the request and saves the binding in its ARP cache. Thus, when sending an Internet packet to A, B will find the binding is already in its cache.

* The protocol specifies that each 
machine extract the sender’s IP-to-hardware address binding from the request, and use the information to update the binding in their cache. Notice that a machines that do not already have an entry for sender in their cache do not add this sender’s information; the standard only specifies updating the hardware address on existing entries.

* The computer can notify others of a new address (eg. changing of new hardware due to failure) 
by broadcasting a gratuitous ARP request.

The sender’s IP-to-hardware address binding is included in every ARP broadcast; receivers use the information to update their address binding information. The intended recipient uses the information to create a new cache entry in anticipation of a reply.

6.7 Relationship of ARP to other protocols
ARP is a low-level protocol that hides the underlying addressing used by network hardware, permitting us to assign an arbitrary IP address to every machine. We think of ARP as associated with the physical network system rather than as part of the Internet protocols.

6.8 ARP Implementation
The first part provides address resolution for outgoing packets: given the IP address of a computer on the network, it finds the hardware address of the computer. If an address is not in the cache, it sends a request.

The second part handles incoming ARP 
packets. It updates the cache, answers requests from other computers on the network, and checks whether a reply matches an outstanding request.

The timestamp on an entry is reset each time the entry is used. When space must be reclaimed, the entry with the oldest time stamp is removed from the cache. The timestamp refresh every time when received the update.

6.9 ARP Encapsulation and Identification


On an Ethernet, frames carrying ARP messages have a type field of 0x0806, where the prefix0xindicates a hexadecimal value. The frame type for ARP has been standardized by IEEE (which owns the Ethernet standards). Thus, when ARP travels over any Ethernet, the type is always 0x0806. Other hardware technologies may use other values.

6.10 ARP Message Format

The designers did not restrict ARP to IPv4 addresses. Instead, the size of protocol address fields in an ARP message depends on the type of high-level protocol address being used. The design allows ARP to map an arbitrary high-level protocol address to an arbitrary network hardware address. In practice, ARP is only used to map 32-bit IPv4 addresses to 48-bit Ethernet addresses.

The protocol address is 32 bits (4 octets) long, and the hardware address is 48-bits (6 octets) long.

HARDWARE TYPE specifies a hardware interface type for which the sender seeks an answer; it contains the value 1 to specify that the hardware address is an Ethernet MAC address.

PROTOCOL TYPE specifies  the type of high-level 
protocol address the sender has supplied; it contains 0x0800 (hexadecimal) to specify that the protocol address is IPv4. 
HLEN and PLEN specify the length 
of a hardware address and the length of a protocol address.

OPERATION specifies an ARP request (1), ARP response (2), RARP request (3), or RARP response (4).


SENDER HARD specified the sender hardware address and its IPv4 address, if known, in SENDER IPv4.

TARGET HARD and TARGET IPv4 give the hardware address and protocol address of the target machine, if known. For a response message (i.e., a reply), the target information can be extracted from the request message. When sending an ARP request, a sender knows the target’s IPv4 address, but does not know the target’s hardware address. Therefore, in a request, the target hardware address field contains zeroes. 

An ARP reply carries the IPv4 address and hardware address of the original requester as well as the IPv4 address and hardware address of the sender. In a request, the target hardware address is set to zero because it is unknown.

6.11 Automatic ARP Cache Revalidation
To avoiding jitter arises from early re-validation, designer implements  two counters with each entry in the ARP cache: the traditional timer and a revalidation timer. The revalidation timer is set to a slightly smaller value than the traditional timer. When the revalidation timer expires, the software examines the entry. If datagrams have recently used the entry, the software sends an ARP request and continues to use the entry. When it receives a reply, both timers are reset. Of course, if no reply arrives, the traditional timer will expire, and ARP will again try to obtain a response. 

6.12 Reverse Address Resolution (RARP)
RARP was once an essential protocol used to bootstrap systems that did not have stable storage (i.e., diskless devices). Eg: at startup, a system broadcasts a RARP request to obtain an IP address. The request contains the sender’s Ethernet address. A server on the network receives the request, looks up the Ethernet address in a database, extracts the corresponding IPv4 address from the database, and sends a RARP reply with the information. Once the reply arrives, the diskless system continues to boot, and uses the IPv4 address for all communication. RARP uses Ethernet type 0x8035.

6.13 ARP Caches in Layer 3 Switches
First, a switch can watch ARP traffic and keep a record of bindings between IP addresses and Ethernet addresses. Second, if it has the necessary information, a switch can respond to an ARP request without broadcasting the request. Third, an Ethernet address can only change if a computer is powered down, and a switch can tell whether a computer has been powered down. Therefore, a switch can create its own cache of ARP information and can answer requests.

6.14 Proxy ARP
Proxy ARP relies on a computer that has two network connections and runs special-purpose ARP software. Proxy ARP can be used for a firewall or on a VPN connection. The idea is that because a proxy ARP machine impersonates machines on the second network, all packets must travel though the proxy ARP machine where they can be checked.

6.15 IPv6 Neighbor Discover
IPv6’s Neighbor Discovery Protocol(NDP) replaces ARP and allows a host to map between an IPv6 address and a hardware address. 

ICMPv6 includes messages that a computer uses to find its neighbors at startup and to check the status of a neighbor periodically.

ARP uses a late-binding approach with soft state. ARP waits until a datagram must be sent to a neighbor before taking any action. After it performs an exchange, ARP stores the binding in its cache, and then sends IP packets to the neighbor without checking the neighbor’s status until the ARP cache timer expires.

NDP uses early binding and takes a proactive approach to state maintenance. Instead of waiting until a datagram must be sent, an IPv6 
node uses NDP to discover neighbors at startup. Furthermore, an IPv6 node continually checks the status of neighbors. Thus, transmission of an IPv6 datagram to a neighbor can proceed without delay and does not involve broadcast.

Wednesday, June 18, 2014

Internetworking with TCP/IP Notes (Chapter 5)

Chapter 5 Internet Addressing

5.1 Universal Host Identifiers
Each host on an IPv4 internet is assigned a unique Internet address that is used in all communication with the host. To make forwarding efficient, a prefix of the address identifies a network and a suffix identifies a host on the network. The designers also decided to make IP addresses fixed size (32 bits was chosen for IPv4 and 128 bits for IPv6).

5.2 The Original IPv4 Classful Addressing Scheme

Unfortunately, the ISO model predates work on the Internet, and does not describe the Internet protocols well. It contains layers not used by TCP/IP protocols. Because it was designed to describe protocols in a single network, the model does not describe the organization of TCP/IP protocols well.

5.3 IPv4 Subnet Addressing

When using subnet addressing, we think of a 32-bit IPv4 address as having an internet portion and a local portion, where the internet portion identifies a site, possibly with multiple physical networks, and the local portion identifies a physical network and host at that site.

5.3.1 Fixed Length Subnet Mask
This terminology is used to CLASSFUL Addressing.  Let us take a ClassFul Address whic belongs to CLASS A.
It is defaultly assumed to have a Mask as 8. Only 8 bits for Network &&& remaing 24 bits for Host.

5.3.2 Variable Length Subnet Mask
To allow maximum flexibility in choosing how to partition subnet addresses, the TCP/IP subnet standard permits variable-length subnetting in which a partition can be chosen independently for each physical network. Once a subnet partition has been selected, all machines on that network must honor it.

5.3.3 Classless Inter-Domain Routing
CIDR specifies that a manager should use slash notation to specify the mask. Syntactically, the format, which is sometimes called CIDR notation, consists of a starting address in dotted decimal followed by a mask size in slash notation. The format will be: x.x.x.x/y
5.4 IPv4 CIDR Blocks reserved for Private Networks
When using subnet addressing, we think of a 32-bit IPv4 address as having an internet portion and a local portion, where the internet portion identifies a site, possibly with multiple physical networks, and the local portion identifies a physical network and host at that site. 

5.5 IPv6 Colon Hexadecimal Notation
First, colon hex notation allows zero compression in which a string of repeated zeros is replaced by a pair of colons. For example, the address: FF05:0:0:0:0:0:0:B3 can be written: FF05::B3
Second, colon hex notation incorporates dotted decimal suffixes; such combinations are intended to be used during the transition from IPv4 to IPv6. For example, the following string is a valid colon hex notation: 0:0:0:0:0:0:128.10.2.1

Finally, IPv6 extends CIDR-like notation by allowing an address to be followed by a slash and an integer that specifies a number of bits. For example, 12AB::CD30:0:0:0:0/60 specifies the first 60 bits of the address which is 12AB00000000CD3 in hexadecimal.

5.6 IPv6 Address Space Assignment
The first issue focuses on the practical problem of devising a hierarchy of authority. Unlike the current Internet, which uses a two-level hierarchy of network prefix (assigned by an ISP) and host suffix (assigned by an organization), the large address space in IPv6 permits amulti-level hierarchy or multiple hierarchies. Large ISPs can start with large blocks of addresses and assign subblocks to second-level ISPs, which can each assign subblocks from their allocation to third-level ISPs, and so on. The second issue focuses on router efficiency,

The above diagram mentioned about the prefixes used to divide the IPv6 address space into blocks and the purpose of each block.

5.7 Embedding IPv4 Addresses in IPv6 for transition
Embedding an IPv4 address in an IPv6 address will be used during the transition from IPv4 to IPv6 for two reasons. First, a computer may choose to upgrade from IPv4 to IPv6 software before it has been assigned a valid IPv6 address. Second, a computer running IPv6 software may need to communicate with a computer that runs only IPv4 software.

5.8 IPv6 Unicast Addresses and /64
IPv6 address is divided into three conceptual parts: a globally-unique prefix used to identify a site, a subnet ID used to distinguish among multiple physical networks at the destination site, and an interface ID used to identify a particular computer connected to the subnet.
5.9 IPv6 Interface Identifiers and MAC Addresses
IPv6 uses the term interface identifier (interface ID) rather than host identifier to emphasize that a host can have multiple interfaces and multiple IDs. Two examples will help clarify the concept. IEEE defines a standard 64-bit globally unique MAC address format known as EUI-64. As the figure shows, bits from the original MAC address are not contiguous in an IPv6 address. Instead, 16 bits with hexadecimal value FFFE are inserted in the middle. In addition, bit 6, which indicates whether the address has global scope, is changed from 0 to 1. Remaining bits of the address, including the group bit (labeled g), the ID of the company that manufactured the interface (labeled c), and the manufacturer’s extension are copied as shown.

5.8 Special Addresses


5.8.1  IPv4 Network Address
An IPv4 address with zero in the host portion is used to refer to the network itself.
5.8.2  IPv4 Directed Broadcast Address
Directed broadcast address that is sometimes called a network broadcast address. When used as a destination address, it refers to all computers on a network. The standard specifies that a host id of all 1s is reserved for directed broadcast

5.8.3  IPv4 Limited (Local Network) Broadcast Address
A limited broadcast means a packet is broadcast across the local network. The local broadcast address consists of thirty-two1s (hence, it is sometimes called the “all1s” broadcast address).

5.8.4  IPv4 Subnet Broadcast Address
A subnet broadcast address is used to broadcast on a single network within a site that uses subnetting. The address contains a network and subnet prefix and has all 1s in the host field.

5.8.5  IPv4 All-0s Source Address
An address that consists of thirty-two zero bits is reserved for cases where a host needs to communicate, but does not yet know its own IP address (i.e., at startup)

5.8.6  IPv4 Multicast Addresses

5.8.7  IPv4 Loopback Address
IPv4 reserves 127.0.0.0 / 8 for loopback testing; a packet destined to any host with prefix 127 stays within the computer and does not travel across a network.

5.8.8  Summary of IPv4 Special Addresses

5.8.9 IPv6 Multicast and Anycast Addresses
IPv6 designers decided to avoid broadcast and use only multicast. Therefore, IPv6 defines several reserved sets of multicast groups. Anycast addressing is designed to handle server replication. A provider can deploy a set of identical servers at arbitrary locations in the Internet. All servers in the set must offer exactly the same service, and all are assigned the same anycast address. Forwarding is set up so that a packet sent to the anycast address goes to the nearest server.

5.8.10  IPv6 Link-Local Addresses
IPv6 defines a set of prefixes for unicast addresses that are not globally valid. Instead, the prefixes are said to be locally scoped or to have link-local scope. That is, packets sent to the addresses are restricted to travel across a single network. The standard defines any IPv6 address that begins with the 10-bit binary prefix:
1111 1110 10 
Routers honor link-local scoping rules. A router can respond to a link-local packet sent across a local network, but a router never forwards a packet that contains a link local address outside the specified scope.

5.9 Weaknesses in Internet Addressing
If a host computer moves from one network to another, its internet address must change.

Internetworking with TCP/IP Notes (Chapter 4)

Chapter 4 Protocol Layering

4.1 The Need for Multiple Protocols
Program translation has been partitioned into four conceptual subproblems identified with the software that handles each subproblem: compiler, assembler, link editor, and loader.
Two final observations will help clarify the organization of protocols. 
First, it should be clear that pieces of translation software must agree on the exact format of data passed between them. The translation process involves multiple representations. Second, the four parts of the translator form a linear sequence in which output from the compiler becomes input to the assembler, and so on. Protocol software also uses a linear sequence.

4.2 ISO 7-Layer Reference Model
Unfortunately, the ISO model predates work on the Internet, and does not describe the Internet protocols well. It contains layers not used by TCP/IP protocols. Because it was designed to describe protocols in a single network, the model does not describe the organization of TCP/IP protocols well.

4.3 The TCP/IP 5-Layer Reference Model


One of the major conceptual differences between the ISO and Internet layering

models arises from the way in which they were defined. The ISO model was prescriptive and  the Internet model is descriptive. 

Unlike the ISO model, which was defined by committees before protocols were implemented, the Internet 5-layer reference model was formalized after protocols had been designed and tested.
Application Layer.  An application interacts with one of the transport layer protocols to send or receive data. Each application program chooses the style of transport needed, which can be either a sequence of individual messages or a continuous stream of bytes.

Transport Layer. The primary duty of the transport layer is to provide communication from one application program to another. Such communication is called end-to-end, because it involves applications on two endpoints rather than intermediate routers. It can be either connection oriented or connectionless.  A The transport software divides the stream of data being transmitted into small pieces (sometimes called packets) and passes each packet along with a destination address to the next layer for transmission.

Internet Layer. The internet layer handles communication from one computer to another. It accepts a request to send a packet from the transport layer along with an identification of the computer to which the packet should be sent. Internet software encapsulates the transport packet in an IP packet, fills in the header, and either sends the IP packet directly to the destination (if the destination is on the local network) or sends it to a router to be forwarded across the internet (if the destination is remote). 

Network Interface Layer. The lowest-layer of TCP/IP software comprises a network interface layer, responsible for accepting IP packets and transmitting them over a specific network.

4.3.1 The Realistic View of TCP Layers
A comparison of (a) conceptual protocol layering and (b) a more realistic view of protocol software with multiple network interfaces and multiple protocols
Although multiple independent protocols can exist above IP and multiple networks can exist below IP, all outgoing or incoming traffic must pass through IP.

4.3.2 TCP models on different networks connected by routers
Figure below shows the layering used in an internet with three networks connected by two routers.
















In the figure, a sending application on computer A uses a transport protocol to send data to a receiving application on computer B. The message passes down the protocol stack on computer A, and is transmitted across network 1 to Router 1. When it reaches the first router, the packet passes up to the internet layer (Layer 3), which forwards the packet over network 2 to Router 2. On Router 2, the message passes up to Layer 3, and is forwarded over network 3 to the destination. When it reaches the final destination machine, the message passes up to the transport layer, which delivers the message to the receiving application.

4.3.3 Relationship between ISO Layer & TCP Layer

4.4 The Protocol Layering Principle

Layered protocols are designed so that layer n at the destination receives exactly the same object sent by layer n at the source.

Specifically, the layering principle offers:
* Protocol design independence
* Definition of the end-to-end property

Protocol Design Independence. By placing a guarantee on the items passing between each pair of layers, the layering principle allows protocol designers to work on one layer at a time. A protocol designer can focus on the message exchange for a given layer with the assurance that lower layers will not alter messages.

Definition Of The End-To-End Property. Informally, we classify a network technology as end-to-end if the technology provides communication from the original source to the ultimate destination.

4.5 High-Level Protocol Address Boundary


Application programs and all protocol software from the internet layer upward use only Internet addresses; addresses used by the network hardware are isolated at lower layers.

4.6 Cross-layer Optimizations

It allows upper layers of a protocol stack to obtain information such as the maximum packet size or the route being used. When allocating packet buffers, transport layer protocols can use the information to optimize processing by leaving sufficient space for headers that will be added by lower-layer protocols. Similarly, lower-layer protocols often retain all the headers on an incoming frame when passing the frame to higher-layer protocols.

4.7 Basic Idea behind Multiplexing and Demultiplexing

Multiplexing and demultiplexing occur at each layer. To understand demultiplexing at Layer 3, consider a frame that contains an IP packet. We have seen that frame demultiplexing will pass the packet to the IP module for processing. Once it has verified that the packet is valid , IP will demultiplex further by passing the packet to the appropriate transport protocol module. If a receiver does not understand the type in an arriving packet, the receiver discards the packet. To guarantee universal agreement on types, standards bodies specify values to be used (e.g., IEEE specifies the set of values for Ethernet types and the IETF specifies values for the Internet protocol).

Tuesday, June 17, 2014

Internetworking with TCP/IP Notes (Chapter 3)

Chapter 3 Internetworking Concept and Architectural Model

3.1 Network-Level Interconnection
Two fundamental observations about the design of communication systems:
* No single network hardware technology can satisfy all constraints.
* Users desire universal interconnection

3.2 Properties of the Internet
Encapsulation. We want to hide the underlying internet architecture from users, and permit communication without requiring knowledge of the internet’s structure.

Network and computer independence. That is, we want the set of operations used to establish communication or 
to transfer data to remain independent of the underlying network technologies and the destination computer.

3.3 Interconnection of Multiple Networks with IP routers

In a TCP/IP internet, special computer systems called IP routers provide interconnections among physical networks. Routers use the destination network, not the destination computer, when forwarding a packet.

3.4 All networks are equal
The TCP/IP internet protocols treat all networks equally. A Local Area Network such as an Ethernet, a Wide Area Network used as a backbone, a wireless network such as a Wi-Fi hotspot, and a pointto-point link between two computers each count as one network.