Transcript LinkLayer_short

Chapter 5: The Data Link Layer




Application
Transport
Network
data link layer service








Moving data between nearby network elements
•
•
•
Move data between end-host and router
Move data between end-hosts
Move data between routers
•
There are many types of physical layer
error detection, correction
Encryption
sharing a broadcast channel: multiple access
link layer addressing and routing
reliable data transfer, flow control
Interact/act as a bridge between the network layer and the physical layer
Which services does the link layer provide that other layers also
provide?
Link Layer
 5.1 Introduction and




services
5.2 Error detection
and correction
5.3Multiple access
protocols
5.4 Link-layer
Addressing and
routing (ARP)
5.5 Ethernet
 5.6 Link-layer switches
 5.7 PPP
 5.8 Link virtualization:
ATM, MPLS
Link Layer: Introduction
Some terminology:
 hosts and routers are nodes
 communication channels that
connect adjacent nodes along
communication path are links



wired links
wireless links
LANs
 layer-2 packet is a frame,
encapsulates datagram
data-link layer has responsibility of
transferring datagram from one node
to adjacent node over one or more links
- Without visiting any layer 3 nodes
Link layer: context
 datagram transferred by
different link protocols
over different links:

e.g., Ethernet on first link,
frame relay on
intermediate links, 802.11
on last link
 each link protocol
provides different
services

e.g., may provide reliability
over link
transportation analogy
 trip from Newark to San Jose




limo: Newark to PHL
plane: PHL to SFO
BART: SFO to SF
train: SF to San Jose
 tourist = datagram
 transport segment =
communication link
 transportation mode = link
layer protocol

Note that a bus or plane trip
might contain many changes of
the bus or plane, but this
seems like a single hop
 travel agent = routing
algorithm
Link Layer Services
 framing, link access:
 encapsulate datagram into frame, adding header, trailer
 channel access if shared medium
 “MAC” addresses used in frame headers to identify
source, dest
• different from IP address!
Routing
 reliable delivery between adjacent nodes




we learned how to do this already (chapter 3)!
seldom used on low bit-error link (fiber, some twisted
pair)
wireless links: high error rates
• Q: why both link-level and end-end reliability?
Link Layer Services (more)
 flow control:

pacing between adjacent sending and receiving nodes
 Encryption

Some links can easily be tapped, so encryption is needed for privacy
 error detection:


errors caused by signal attenuation, noise.
receiver detects presence of errors:
• signals sender for retransmission or drops frame
 error correction:

receiver identifies and corrects bit error(s) without resorting to
retransmission
 half-duplex and full-duplex

with half duplex, nodes at both ends of link can transmit, but not at
same time
Where is the link layer implemented?
 in each and every host in the
network

Which other layers are
implemented in every host?
 link layer implemented in
“adaptor” (aka network interface
card NIC)


Ethernet card, PCMCI card,
802.11 card
implements link, physical layer
 attaches into host’s system
buses
 combination of hardware,
software, firmware
host schematic
application
transport
network
link
cpu
memory
controller
link
physical
host
bus
(e.g., PCI)
physical
transmission
network adapter
card
Adaptors Communicating
datagram
datagram
controller
controller
receiving host
sending host
datagram
frame
 sending side:
 encapsulates datagram in
frame
 adds error checking bits,
rdt, flow control, etc.
 receiving side
 looks for errors, rdt, flow
control, etc
 extracts datagram
• passes to upper layer at
receiving side
• Moves frame to another
link
Link Layer
 5.1 Introduction and




services
5.2 Error detection
and correction
5.3Multiple access
protocols
5.4 Link-layer
Addressing
5.5 Ethernet
 5.6 Link-layer switches
 5.7 PPP
 5.8 Link Virtualization:
ATM. MPLS
Error Detection
EDC= Error Detection and Correction bits (redundancy)
D = Data protected by error checking, may include header fields
• Error detection not 100% reliable!
• protocol may miss some errors, but rarely
• larger EDC field yields better detection and correction
otherwise
Parity Checking
Single Bit Parity:
Detect single bit errors
Two Dimensional Bit Parity:
Detect and correct single bit errors
0
0
Internet checksum (review)
Goal: detect “errors” (e.g., flipped bits) in transmitted
packet (note: used at transport layer only)
Sender:
 treat segment contents
as sequence of 16-bit
integers
 checksum: addition (1’s
complement sum) of
segment contents
 sender puts checksum
value into UDP checksum
field
Receiver:
 compute checksum of
received segment
 check if computed checksum
equals checksum field value:
 NO - error detected
 YES - no error detected.
But maybe errors
nonetheless?
Checksumming: Cyclic Redundancy Check
 view data bits, D, as a binary number
 choose r+1 bit pattern (generator), G
 goal: choose r CRC bits, R, such that



<D,R> exactly divisible by G (modulo 2)
receiver knows G, divides <D,R> by G. If non-zero remainder:
error detected!
can detect all burst errors less than r+1 bits
 widely used in practice (Ethernet, 802.11 WiFi, ATM)
CRC Example
Want:
D.2r XOR R = nG
equivalently:
D.2r = nG XOR R
equivalently:
if we divide D.2r by
G, want remainder R
R = remainder[
D.2r
G
]
Link Layer
 5.1 Introduction and




services
5.2 Error detection
and correction
5.3Multiple access
protocols
5.4 Link-layer
Addressing
5.5 Ethernet
 5.6 Link-layer switches
 5.7 PPP
 5.8 Link Virtualization:
ATM, MPLS
Multiple Access Links and Protocols
Two types of “links”:
 point-to-point
 PPP for dial-up access
 point-to-point link between Ethernet switch and host
 broadcast (shared wire or medium)
 old-fashioned Ethernet
 802.11 wireless LAN
shared wire (e.g.,
cabled Ethernet)
shared RF
(e.g., 802.11 WiFi)
shared RF
(satellite)
humans at a
cocktail party
(shared air, acoustical)
Multiple Access Control (MAC) protocols
 single shared broadcast channel
 two or more simultaneous transmissions by
nodes: interference

collision if node receives two or more signals at the
same time
multiple access protocol
 An algorithm that determines how nodes share
channel, i.e., determine when node can transmit
 communication about channel sharing must use
channel itself!

out-of-band channel for coordination is difficult
Ideal Multiple Access Protocol
Broadcast channel of rate R bps
1. when one node wants to transmit, it can send at
rate R.
2. when M nodes want to transmit, each can send at
average rate R/M
3. fully decentralized:



no special node to coordinate transmissions
no synchronization of clocks, slots
Generally, centralized MAC are much more efficient
4. simple
MAC Protocols: a taxonomy
Three broad classes:
 Channel Partitioning



divide channel into smaller “pieces” (time slots, frequency, code)
allocate piece to node for exclusive use
this approach is difficult since we know that statistical
multiplexing can support more users
 Random Access




channel not divided, allow collisions
Detect and recover from collisions
Detection and recovery (e.g., retransmission) can be inefficient
Predictable/guaranteed performance is difficult to achieve
 Centralized/taking turns
Channel Partitioning MAC protocols: TDMA
TDMA: time division multiple access
 access to channel in "rounds"
 each station gets fixed length slot (length = pkt
trans time) in each round
 unused slots go idle
 GSM (some cell phones) uses TDMA


Why?
So service is predictable and calls can be rejected if
there is not enough bandwidth
 example: 6-station LAN, 1,3,4 have pkt, slots 2,5,6
idle
6-slot
frame
1
3
4
1
3
4
Channel Partitioning MAC protocols: FDMA
FDMA: frequency division multiple access
 channel spectrum divided into frequency bands
 each station assigned fixed frequency band
 unused transmission time in frequency bands go idle
 GSM also uses FDMA
 example: 6-station LAN, 1,3,4 have pkt, frequency bands 2,5,6
FDM cable
frequency bands
idle
Random Access Protocols
 When node has packet to send
 transmit at full channel data rate R.
 no a priori coordination among nodes
• Some approaches use limited coordination
 two or more transmitting nodes ➜ “collision”,
 random access MAC protocol specifies:
 how to detect collisions
 how to recover from collisions (e.g., via delayed
retransmissions)
 Examples of random access MAC protocols:
 slotted ALOHA
 ALOHA
 CSMA, CSMA/CD, CSMA/CA
The ALOHA Protocol
 Developed @ U of Hawaii in early 70’s.
 Packet radio networks.
 “Free for all”: whenever station has a frame to send,
it does so.
 Aloha is the simplest of MAC protocols
 Aloha is old but still widely used


As will be seen, many protocols have a period of time where
nodes transmits when they want.
During such periods of time, the MAC essentially Aloha
Collisions
 Invalid frames may be caused by channel noise or
 Because other station(s) transmitted at the same
time: collision.
 Collisions and other link layer losses must be
detected and corrected


Question 1. Where are all the places that losses can
occur?
Question 2: where can errors be detected and corrected
 Roughly speaking, a collision happens even when
the last bit of a frame overlaps with the first bit
of the next frame.
ALOHA’s Performance 1
If another node transmits here,
then there is a collision
t0
t0+t
t0+2t
t0+3t
Time
vulnerable
If another node starts to transmit
during this vulnerable period, then a
collision will occur
ALOHA’s Performance
 Assume that users try to send frames at random times
(Poisson events).
 Let G be the average rate that users try to send frames per
frame time

G is the utilization
 The probability of trying to send k frames during the
vulnerable period (which is TWO frame times long) is
k

2G  e 2G
P k  
k!
The probability zero other frames are sent is P(0)=e-2G.
The throughput is the rate that frames are sent multiplied
by the probability that the transmission is successful
G e-2G
Poisson process
events
Events are distributed according to a Poisson process with parameter if
P(k events in period of length T) = exp(-T)(T)k / k!
 is the rate that events occur = number of events in period T/T (when T is large)
Aloha performance
P(k events in period of length T) = exp(-T)(T)k / k!
vulnerability
period
The probability of no collision is probability of no event in the vulnerability period = 2T
Let T = 1 (i.e., our time is measured in packet transmission times, not seconds)
Then what is ?
= average number of transmission attempts per transmission time.
So  = utilization. I.e.,  = G.
And the probability of no collision is exp(-2G)(2G)0/0!=exp(-2G)
ALOHA’s Performance
0.184
G e
0.2
 2 G 0.1
0
0
0
0
1
2
G
3
3
The best throughput occurs for what value of G?
What is this best throughput?
Slotted Aloha – frames are only transmitted during
slots, they cannot cross slot boundaries
But this will only happen if a
packet arrives at the MAC
layer during this period
t0
t0+t
If a frame is transmitted
here, then a collision occurs
t0+2t
t0+3t
vulnerable
If another node selects to transmit during this
vulnerable period, then a collision will occur
The vulnerable period is half
the size of unslotted aloha
Time
Slotted Aloha
 Vulnerable period is halved.
 Doubles performance of ALOHA.
 Throughput=S = G e-G.
 S = Smax = 1/e = 0.368 for G = 1.
G=1 means typically a node tries to transmit
each slot
 However, the throughput is well below 1; there
any many collisions

Slotted Aloha Performance
0.368
G e
0.4
 G 0.2
0
0
0
2
4
0
G
4
ALOHA and Slotted ALOHA
Pros
 single active node can
continuously transmit at full
rate of channel
 decentralized
 simple
Cons
 Collisions


wasting slots
Inefficient
 idle slots
 nodes may be able to detect
collision in less than time to
transmit packet
 Slotted aloha requires clock
synchronization

Lose synchronization requires
guard times, which reduces
efficiency
CSMA (Carrier Sense Multiple Access)
CSMA: listen before transmit:
If channel sensed idle: transmit entire frame
 If channel sensed busy, defer transmission
 human analogy: don’t interrupt others!
Question
 For 10 Mbps ethernet, the maximum cable
length is 2000m
 For 100Mbps ethernet, the maximum cable
length is 200m
 Why is the maximum length for 100Mbps
10 times shorter than 10Mbps?
CSMA collisions
collisions can still occur:
propagation delay means
two nodes may not hear
each other’s transmission
collision:
entire packet transmission
time wasted
note:
role of distance & propagation
delay in determining collision
probability
spatial layout of nodes
CSMA/CD collision detection
Transmitter 1
Transmitter 2
Receiver 1
Propagation delay
Transmission time
time
Collision detected
by transmitter 1.
When is it detected?
Collision detected
by transmitter 2
Position on wire
Receiver 1 receives
garbled signal
CSMA/CD collision detection
Transmitter 1
Transmission time
time
Collision NOT
detected
by transmitter 1
Transmitter 2
Receiver 1
Propagation delay
Position on wire
Receiver 1 receives
garbled signal
Collision detected
by transmitter 2
What are the requirements to ensure that collisions are detected?
The transmitter must transmit for 2×Tpropagation + epsilon
The transmit time is frame length / bit rate
Therefore
2×CableLength/speed of propagation + epsilon < FrameLength/bit-rate
CSMA/CD
What are the requirements to ensure that collisions are detected?
The transmitter must transmit for 2*Tpropagation + epsilon
The transmit time is frame length / bit rate
Therefore
2×CableLength/speed of propagation + epsilon < FrameLength/bit-rate
If frame length can be arbitrarily small, then the cable length must be very short
Thus, frames cannot be arbitrarily small. Minimum frame length in Ethernet is 64B.
The minimum frame length in Ethernet is independent of bit-rate.
Why is the maximum cable length of a 10Mbps ethernet cable 10 times
longer than the maximum cable length of a 100Mbps ethernet?
CSMA/CD (Collision Detection)
CSMA/CD: carrier sensing with collision
detection


collisions detected within short time
colliding transmissions aborted, reducing channel
wastage
 collision detection:
 easy in wired LANs: measure signal strengths,
compare transmitted, received signals
 Difficult/impossible in wireless LANs: received
signal strength overwhelmed by local transmission
strength
 human analogy: the polite conversationalist
persistent
What to do when the link is found to be busy?
 1-persistent


If medium is idle, then transmit.
If medium is not idle, then wait until it is and then transmit.
• In this case, all nodes that desire to transmit during the period
when a node is transmitting will collide!
 p-persistent



If medium is idle, then transmit.
If medium is not idle, then wait until it is idle
Once idle then transmit with probability p. And wait for the
next slot with probability 1-p and repeat.
• Here slot does not have to be the time to send a full frame, but
just enough time to let other hosts start sending.
 Exponential Backoff

Next slide
Exponential Backoff
1.
2.
3.
4.
Upon desiring to transmit a frame, set BackOff = BO (some
starting value, 4 and 8 are common)
If medium is idle, then transmit.
If medium is not idle, then wait until it is idle
Once idle,
a.
b.
pick an integer, r, between 0 and BO-1
Wait r time slots
1.
2.
5.
A time slot is long enough so that if a node begins to trasnmit at the
beginning of the time slot, then all nodes will hear the transmission before
the time slot end
Give an equation for the length of a time slot
c.
If no other transmission begins before the r time slots, then transmit
a.
b.
Continue to transmit so that all nodes will know that a collision
occurred, then stop
Set BO = min( 2 * BO , BO_Max )
c.
Go to step 4
If a collision is detected,
a.
In ethernet BO_max = 1024
Question: discuss the different ways in which backoff is used in network protocols
“Taking Turns” MAC protocols
channel partitioning MAC protocols:
 share channel efficiently and fairly at high load
 inefficient at low load: delay in channel access, 1/N
bandwidth allocated even if only 1 active node!
Random access MAC protocols
 efficient at low load: single node can fully utilize channel
 high load: collision overhead
• Be careful. Here we say that high load is when the number
of users increases. If the number of users is fixed (and
small), then the efficiency under high load is not as bad
 “taking turns” protocols




look for best of both worlds!
Use in mobile phones data access
802.16 aka WiMax partly uses this approach
802.11 specifies this capability, but it is not widely
deployed YET
“Taking Turns” MAC protocols
Polling:
 master node “invites” slave nodes
to transmit in turn
data
data
data
data
slaves
poll
poll
poll
master
“Taking Turns” MAC protocols
Polling:
 master node “invites” slave nodes
to transmit in turn


After each node is given a chance, the
pattern repeats
If a slave has no data to send, then it
does nothing, and the master quickly polls
the next node
data
poll
poll
master
data
data
slaves
“Taking Turns” MAC protocols
Polling:
 master node “invites” slave nodes
to transmit in turn



After each node is given a chance, the
pattern repeats
If a slave has no data to send, then it
does nothing, and the master quickly polls
the next node
concerns:



polling overhead
latency
single point of failure (master)
master
slaves
“Taking Turns” MAC protocols
Polling:
 master node “invites” slave nodes
to transmit in turn



concerns:




After each node is given a chance, the
pattern repeats
If a slave has no data to send, then it
does nothing, and the master quickly polls
the next node
polling overhead
latency
single point of failure (master)
master
QoS guarantees can be made

If a VoIP call requires 12bps.
The master can determine if
the call will receive the desire
quality and ensure that it
does.
•
•

When congested, new calls
are rejected, but existing call
continue to receive good
performance
Consider the difference
between the demands by
VoIP and services provided
by TCP
Guarantees are worth much
more money than nonguarantees
slaves
“Taking Turns” MAC protocols
Token passing:
 control token passed
from one node to next
sequentially.
 token message
 concerns:



token overhead
Latency
single point of failure
(token)
T
(nothing
to send)
T
data
Summary of MAC protocols
 channel partitioning, by time, frequency or code
 Time Division, Frequency Division
 random access (dynamic),
 ALOHA, S-ALOHA, CSMA, CSMA/CD
 carrier sensing: easy in some technologies (wire), hard in
others (wireless)
 CSMA/CD used in Ethernet
 CSMA/CA used in 802.11 (We’ll study it when we talk
about wireless)
 taking turns
 polling from central site, token passing
 Bluetooth, FDDI, IBM Token Ring
Link Layer
 5.1 Introduction and




services
5.2 Error detection
and correction
5.3Multiple access
protocols
5.4 Link-Layer
Addressing
5.5 Ethernet
 5.6 Link-layer switches
 5.7 PPP
 5.8 Link Virtualization:
ATM, MPLS
MAC Addresses and ARP
 32-bit IP address:
network-layer address
 used to get datagram to destination IP subnet

 MAC (or LAN or physical or Ethernet)
address:

function: get frame from one interface to another
physically-connected interface (same network)
• The textbook is wrong about this. Today, hosts are almost
never physically connected

48 bit MAC address (for most LANs)
• burned in NIC ROM, also sometimes software settable
LAN Addresses and ARP
Each adapter on LAN has unique LAN address
1A-2F-BB-76-09-AD
71-65-F7-2B-08-53
LAN
(wired or
wireless)
Broadcast address =
FF-FF-FF-FF-FF-FF
= adapter
58-23-D7-FA-20-B0
0C-C4-11-6F-E3-98
LAN Address (more)
 MAC address allocation administered by IEEE
 manufacturer buys portion of MAC address space (to assure
uniqueness)

Check OUI lookup
• Google OUI lookup
• Enter MAC address
• See manufacture
 analogy:
(a) MAC address: like Social Security Number
(b) IP address: like postal address
 MAC flat address ➜ portability

can move LAN card from one LAN to another
 IP hierarchical address NOT portable


address depends on IP subnet to which node is attached
If a NIC is changed, then the MAC is changed
• Whereas, the IP address can stay the same
ARP: Address Resolution Protocol
Question: how to determine
MAC address of B
knowing B’s IP address?
 Each IP node (host,
router) on LAN has
ARP table

137.196.7.78
1A-2F-BB-76-09-AD
137.196.7.23
 ARP table: IP/MAC
137.196.7.14
137.196.7.88
address mappings for
some LAN nodes
< IP address; MAC address; TTL>
LAN
71-65-F7-2B-08-53
At prompt, >> arp -a

58-23-D7-FA-20-B0
0C-C4-11-6F-E3-98
TTL (Time To Live): time
after which address
mapping will be forgotten
(typically 20 min)
ARP protocol: Same LAN (network)

A wants to send datagram to C



Check if C’s IP address is in the
same subnet
Use subnet mask and compare this
nodes IP to C’s IP
E.g.,
•
•
•
•
•
•
my IP=128.4.35.67
B’s IP=128.5.19.12
Subnet mask is 255.255.0.0 => the
first 8 bytes define the subnet
So in this case, A and B are in
different subnets
Thus, the datagram is sent to the
gateway, which must be in the
same subnet.
Suppose that the B is the
gateway, but only the IP address
of B is known
ARP protocol: Same LAN (network)

A wants to send datagram to C




Check if C’s IP address is in the
same subnet
Use subnet mask and compare this
nodes IP to C’s IP
E.g.,
•
•
•
•
•
•
my IP=128.4.35.67
B’s IP=128.5.19.12
Subnet mask is 255.255.0.0 => the
first 8 bytes define the subnet
So in this case, A and B are in
different subnets
Thus, the datagram is sent to the
gateway, which must be in the
same subnet.
Suppose that the B is the
gateway, but only the IP address
of B is known


Suppose a host wants to send to B and only B’s IP
address is know and B is in the same subnet
and B’s MAC address not in A’s ARP table.
A broadcasts ARP query packet, containing B's IP
address
 dest MAC address = FF-FF-FF-FF-FF-FF
 Ethernet frame type = ARP query
•
all machines on LAN receive ARP query
B receives ARP packet, replies to A with its (B's)
MAC address




A
C
I have 1.1.1.4
B
D
soft state: information that times out (goes away)
unless refreshed
ARP is “plug-and-play”:

LAN
frame sent to A’s MAC address (unicast)
A caches (saves) IP-to-MAC address pair in its
ARP table until information becomes old (times
out)


Who has IP 1.1.1.4
Tell 1.1.1.2
Other types include datagram
nodes create their ARP tables without intervention
from net administrator
Addressing: routing to another LAN
walkthrough: send datagram from A to B via R
assume A knows B’s IP address
88-B2-2F-54-1A-0F
74-29-9C-E8-FF-55
A
111.111.111.111
E6-E9-00-17-BB-4B
1A-23-F9-CD-06-9B
222.222.222.220
111.111.111.110
111.111.111.112
R
222.222.222.221
222.222.222.222
B
49-BD-D2-C7-56-2A
CC-49-DE-D0-AB-7D
 two ARP tables in router R, one for each IP
network (LAN)
 A creates IP datagram with source A, destination B
 A uses ARP to get R’s MAC address for 111.111.111.110
 A creates link-layer frame with R's MAC address as dest,





frame contains A-to-B IP datagram
This is a really important
A’s NIC sends frame
example – make sure you
understand!
R’s NIC receives frame
R removes IP datagram from Ethernet frame, sees its
destined to B
R uses ARP to get B’s MAC address
R creates frame containing A-to-B IP datagram sends to B
88-B2-2F-54-1A-0F
74-29-9C-E8-FF-55
A
E6-E9-00-17-BB-4B
111.111.111.111
222.222.222.220
111.111.111.110
111.111.111.112
CC-49-DE-D0-AB-7D
222.222.222.221
1A-23-F9-CD-06-9B
R
222.222.222.222
B
49-BD-D2-C7-56-2A
ARP
 Watch wireshark without any connections
 What happens if I set an entry in the ARP table
with the IP address of my gateway, but my MAC
address?
 E.g., take two machines A and B on the same LAN
(what does this mean? How can you tell if two
machines are on the same LAN).






Let P be a nonexistent IP address in the LAN.
On machine A ping P.
• Use wireshark on B to see no evidence of the ping.
On A, set an arp entry on A with IP = P and MAC = B’s
MAC
Then ping P
Watch ping messages appear in wireshark on B
But still, no response.
ARP spoofing – man-in-the-middle attack
 If the medium is shared, then a node can
eavesdrop on transmissions
Wireless uses link layer encryption
 These days, wired ethernet used a dedicate
wires from the switch (link layer router) to
each host

• But ARP attack still works
 Goal: intercept messages between the
victim and anyone else
I record the real MAC address of the victim
 When an ARP query request is made for the
victim, I respond with my MAC

ARP spoofing – man-in-the-middle attack
Victim:
MAC=00:12:12:12:12:12
IP: 1.2.3.4
Who has IP address 1.2.3.4
switch
Who has IP address 1.2.3.4
attacker:
MAC=00:11:11:11:11:11
IP= 5.6.7.8
Some other host
ARP spoofing – man-in-the-middle attack
Victim:
MAC=00:12:12:12:12:12
IP: 1.2.3.4
MAC 00:12:12:12:12 has IP address 1.2.3.4
MAC 00:12:12:12:12 has IP address 1.2.3.4
switch
attacker:
MAC=00:11:11:11:11:11
IP= 5.6.7.8
Attacker knows the
MAC of victim
Some other host
Save MAC/IP
mapping in cache for
20 minutes
ARP spoofing – man-in-the-middle attack
Victim:
MAC=00:12:12:12:12:12
IP: 1.2.3.4
Later (when all caches have been
cleared), the attacker floods ARP
queries. The attacker continues to flood
ARP queries.
Confused… but
ignores it
Source MAC 00:11:11:11:11
Who has ip: bla.bla.bla.bla
Tell IP address 1.2.3.4
attacker:
MAC=00:11:11:11:11:11
IP= 5.6.7.8
Attacker knows the
MAC of victim
Source MAC 00:11:11:11:11
switch
Who has ip: bla.bla.bla.bla
Tell IP address 1.2.3.4
Some other host
Save IP/ARP
mapping in cache
ARP spoofing – man-in-the-middle attack
Victim:
MAC=00:12:12:12:12:12
IP: 1.2.3.4
Later (when all caches have been
cleared), the attacker floods ARP
queries. The attacker continues to flood
ARP queries.
Ahh, I got the
secret plan I was
expecting
switch
Some other host
MAC 00:11:11:11:11: IP:1.2.3.4: The secret plan is …..
attacker:
MAC=00:11:11:11:11:11
IP= 5.6.7.8
MAC 00:12:12:12:12: IP:1.2.3.4 The secret plan is …..
Attacker knows the
secret plan
Changed MAC address to correct address
ARP spoofing – man-in-the-middle attack
 Some new switches can protect against these
attacks


How can these attacks be detected and stopped?
One way is to detect a attacker is to look at ARP tables
and see is a single IP has two MACs
• Is real IP and the victims IP
• But if a machine has wired and wireless NICs and is running
microsoft OS, the OS will sometimes send a frame with the
wireless IP as source address over the wired LAN and
hence with the wired MAC address
• Then tables will record the mapping between the MAC and
IP, and there will be two IPs for a single MAC
Link Layer
 5.1 Introduction and




services
5.2 Error detection
and correction
5.3Multiple access
protocols
5.4 Link-Layer
Addressing
5.5 Ethernet
 5.6 Link-layer switches
 5.7 PPP
 5.8 Link Virtualization:
ATM and MPLS
Ethernet
“dominant” wired LAN technology:
 cheap $20 for NIC
 first widely used LAN technology
 simpler, cheaper than token LANs and ATM
 kept up with speed race: 10 Mbps – 10 Gbps
Metcalfe’s Ethernet
sketch
Star topology
 bus topology popular through mid 90s

all nodes in same collision domain (can collide with each other)
 star topology


active switch in center
each “spoke” runs a (separate) Ethernet protocol (nodes do not
collide with each other)
 LAN

Multiple stars connected (we’ll see later)
switch
bus: coaxial cable
star
Ethernet Frame Structure
Sending adapter encapsulates IP datagram (or other
network layer protocol packet) in Ethernet frame
Preamble:
 7 bytes with pattern 10101010 followed by one
byte with pattern 10101011
 used to synchronize receiver, sender clock rates
Ethernet Frame Structure (more)
 Addresses: 6 bytes


if adapter receives frame with matching destination address, or with
broadcast address (eg ARP packet), it passes data in frame to network
layer protocol
otherwise, adapter discards frame (unless in promiscuous modes)
 Type:



ARP query/response
LAN routing
higher layer protocol (mostly IP but others possible, e.g., Novell IPX,
AppleTalk)
 CRC: checked at receiver, if error is detected, frame is dropped
Ethernet: Unreliable, connectionless
 connectionless: No handshaking between sending and
receiving NICs
 unreliable: receiving NIC doesn’t send acks or nacks
to sending NIC



stream of datagrams passed to network layer can have gaps
(missing datagrams)
gaps will be filled if app is using TCP
otherwise, app will see gaps
 Ethernet’s MAC protocol: unslotted CSMA/CD
Ethernet CSMA/CD algorithm
NIC receives datagram
from network layer,
creates frame
2. If NIC senses channel
idle, starts frame
transmission
3. If NIC senses channel
busy, waits until channel
idle, then transmits
4. If NIC detects another
transmission while
transmitting, aborts and
sends jam signal
5. After aborting, NIC
enters exponential
backoff: after mth
collision, NIC chooses K at
random from
{0,1,2,…,2m-1}. NIC waits K
 1-persistant!
slots where one slot is 512
4. If NIC transmits entire
bit times, returns to Step
frame without detecting
2
another transmission, NIC
is done with frame !
1.
Ethernet’s CSMA/CD (more)
Jam Signal: make sure all
other transmitters are
aware of collision; 48 bits
Bit time: .1 microsec for 10
Mbps Ethernet ;
for K=1023, wait time is
about 50 msec
Exponential Backoff:
 Goal: adapt retransmission
attempts to estimated
current load
 heavy load: random wait
will be longer
 first collision: choose K from
{0,1}; delay is K· 512 bit
transmission times
 after second collision: choose
K from {0,1,2,3}…
 after ten or more collisions,
choose K from
{0,1,2,3,4,…,1023}
CSMA/CD efficiency
 Tprop = max prop delay between 2 nodes in LAN
 ttrans = time to transmit max-size frame
efficiency 
1
1  5t prop /ttrans
 efficiency goes to 1
 as tprop goes to 0
 as ttrans goes to infinity

1
 0.96
200m 1500  8
1 5
/
8
2  10 100  106
• larger frame size is better, higher bit-rate is worst
 better performance than ALOHA: and simple,
cheap, decentralized!
 Most ethernet is used with switches. So collision
never occur
802.3 Ethernet Standards: Link & Physical Layers
 many different Ethernet standards






common MAC protocol and frame format
different speeds: 2 Mbps, 10 Mbps, 100 Mbps, 1Gbps, 10G bps
different physical layer media: fiber, cable
Very large ethernets are possible
QoS
MPLS runs over ethernet (so traffic engineering is possible)
application
transport
network
link
physical
MAC protocol
and frame format
100BASE-TX
100BASE-T2
100BASE-FX
100BASE-T4
100BASE-SX
100BASE-BX
copper (twister
pair) physical layer
fiber physical layer
Link Layer
 5.1 Introduction and




services
5.2 Error detection
and correction
5.3 Multiple access
protocols
5.4 Link-layer
Addressing
5.5 Ethernet
 5.6 Link-layer switches
Hubs
… physical-layer (“dumb”) repeaters:
 bits coming in one link go out all other links at
same rate
 all nodes connected to hub can collide with one
another
 no frame buffering
 no CSMA/CD at hub: host NICs detect
collisions
twisted pair
hub
Interconnecting with hubs
 Backbone hub interconnects LAN segments
 But individual segment collision domains become one
large collision domain
 Can’t interconnect 10BaseT & 100BaseT
hub
hub
hub
hub
Switch
 link-layer device: smarter than hubs, take
active role

Store and forward Ethernet frames
• Question: do switches in circuit switching networks
store and forward?

examine incoming frame’s MAC address,
selectively forward frame to one-or-more
outgoing links when frame is to be forwarded on
segment, uses CSMA/CD to access segment
 transparent
 hosts are unaware of presence of switches
 plug-and-play, self-learning
 switches do not need to be configured
Switch: allows multiple simultaneous
transmissions
A
 hosts have dedicated,
direct connection to switch
 switches buffer packets
 Ethernet protocol used on
each incoming link, but no
collisions; full duplex

each link is its own collision
domain
 switching: A-to-A’ and B-
to-B’ simultaneously,
without collisions

not possible with dumb hub
C’
B
6
1
5
2
3
4
C
B’
A’
switch with six interfaces
(1,2,3,4,5,6)
Switch Table
 Q: how does switch know that
A’ reachable via interface 4,
B’ reachable via interface 5?
 A: each switch has a switch
table, each entry:

C’
B
6
 Q: how are entries created,
maintained in switch table?
something like a routing
protocol?
1
5
(MAC address of host, interface
to reach host, time stamp)
 looks like a routing table!

A
2
3
4
C
B’
A’
switch with six interfaces
(1,2,3,4,5,6)
Switch: self-learning
 switch learns which hosts can
be reached through which
interfaces



Source: A
Dest: A’
A A A’
C’
Some interfaces are
configured. But in other
cases…
when frame received, switch
“learns” location of sender:
incoming LAN segment
records sender/location pair
in switch table
B
1
6
5
2
3
4
C
B’
A’
MAC addr interface TTL
A
1
60
Switch table
(initially empty)
Switch: frame filtering/forwarding
When frame received:
1. record link/interface associated with sending host.
3. if entry found for destination
then {
if dest on segment from which frame arrived
then drop the frame
else forward the frame on interface indicated
}
forward on all but the interface
else flood
on which the frame arrived
3. periodically, purge all old table entries
Self-Learning
MAC
Interface
MAC
Interface
MAC
Interface
A
1
3
1
2
1
2
2
3
2
B
1
3
MAC
Interface
3
Self-Learning
MAC
Interface
MAC
Interface
MAC
Interface
A
Dest=B; Source=A
1
3
1
2
1
2
2
3
2
B
1
3
MAC
Interface
3
Self-Learning
MAC
Interface
A
1
MAC
Interface
MAC
Interface
A
Dest=B; Source=A
1
3
1
2
1
2
2
3
Make table entry for A
No table entry for B, so flood
2
Note: if the switch has ports that B
are manually configured, then the
frame is not flooded to a host.
But they are only flooded to
other switches
1
3
MAC
Interface
3
Self-Learning
MAC
Interface
A
1
Make table entry for A
No table entry for B, so flood
MAC
Interface
A
1
MAC
Interface
A
1
Dest=B; Source=A
3
1
2
1
2
2
3
2
B
1
3
MAC
Interface
3
Self-Learning
MAC
Interface
A
1
Make table entry for A
No table entry for B, so flood
MAC
Interface
MAC
Interface
A
1
A
2
A
1
3
2
Dest=B; Source=A
1
2
1
2
3
Dest=B; Source=A
1
2
3
MAC
Interface
A
1
3
B
Make table entry for A
No table entry for B, so flood
Self-Learning
MAC
Interface
A
1
MAC
Interface
MAC
Interface
A
1
A
2
A
1
3
1
2
1
2
2
3
2
Dest=A; Source=B
B
1
3
MAC
Interface
A
1
3
Self-Learning
MAC
Interface
A
1
MAC
Interface
MAC
Interface
A
1
A
2
A
1
3
2
1
2
1
2
3
1
Dest=A; Source=B
2
3
MAC
Interface
A
1
B
2
3
B
Make table entry for B
Have a table entry for A, so forward
Self-Learning
MAC
Interface
A
1
Make table entry for B
Have a table entry for A, so forward
A
1
2
MAC
Interface
MAC
Interface
A
1
A
2
B
3
3
1
2
1
2
3
Dest=A; Source=B
2
B
1
3
MAC
Interface
A
1
B
2
3
Self-Learning
A
MAC
Interface
A
1
B
3
MAC
Interface
MAC
Interface
A
1
A
2
B
Make table entry for B
Have a table entry for A, so forward
3
1
3
1
2
1
2
Dest=A;
Source=B
2
3
2
B
1
3
MAC
Interface
A
1
B
2
3
Self-Learning
MAC
20 minutes later, all table entries are deleted
Interface
MAC
Interface
MAC
Interface
A
1
3
1
2
1
2
2
3
2
B
1
3
MAC
Interface
3
Poorly Designed Institutional
network. Why?
to external
network
mail server
router
web server
LAN IP subnet
Institutional network without a
single point of failure
to external
network
mail server
router
web server
IP subnet
A
Explain self learning on this network
Suppose that A sends a frame to the mail server and all tables are empty?
Due to the loops, the frames will loop and overwhelm the network.
Loops provide robustness, but have to be eliminated.
Institutional network without a
single point of failure
to external
network
mail server
router
web server
IP subnet
A
Edge in spanning tree
“disconnected” interface, i.e., do not forward or flood frames
through this interface
Ethernet includes a loop resolution protocol that is based on spanning
tree algorithm
Layer 2 Routing
 L2 routing table is automatically maintained (set
up and updated as topology changes).
 3 mechanisms:




Loop resolution
Address learning
Frame forwarding
Typically ignore security such as ARP attacks, access
control, etc.
 Loop resolution must happen before address
learning.


On the EECIS network, the link to the campus network
would go down for ~50ms.
This would trigger loop resolution
• During which time no packets were forwarded
Switches vs. Routers
 both store-and-forward devices
 routers: network layer devices (examine network layer
headers)
 switches are link layer devices
 routers maintain routing tables, implement routing
algorithms
 switches maintain switch tables, implement
filtering, learning algorithms
Summary comparison
hubs
routers
switches
traffic
isolation
no
yes
yes
plug & play
yes
no
yes
optimal
routing
cut
through
no
yes
no
yes
no
yes
(vs. store and
forward)
Link Layer
 5.1 Introduction and




services
5.2 Error detection
and correction
5.3Multiple access
protocols
5.4 Link-Layer
Addressing
5.5 Ethernet
 5.6 Link-layer switches
 5.7 PPP
 5.8 Link Virtualization:
ATM and MPLS
Ethernet
“dominant” wired LAN technology:
 cheap $20 for NIC
 first widely used LAN technology
 simpler, cheaper than token LANs and ATM
 kept up with speed race: 10 Mbps – 10 Gbps
Metcalfe’s Ethernet
sketch
Star topology
 bus topology popular through mid 90s

all nodes in same collision domain (can collide with each other)
 star topology


active switch in center
each “spoke” runs a (separate) Ethernet protocol (nodes do not
collide with each other)
 LAN

Multiple stars connected (we’ll see later)
switch
bus: coaxial cable
star
Ethernet Frame Structure
Sending adapter encapsulates IP datagram (or other
network layer protocol packet) in Ethernet frame
Preamble:
 7 bytes with pattern 10101010 followed by one
byte with pattern 10101011
 used to synchronize receiver, sender clock rates
Ethernet Frame Structure (more)
 Addresses: 6 bytes


if adapter receives frame with matching destination address, or with
broadcast address (eg ARP packet), it passes data in frame to network
layer protocol
otherwise, adapter discards frame (unless in promiscuous modes)
 Type:



ARP query/response
LAN routing
higher layer protocol (mostly IP but others possible, e.g., Novell IPX,
AppleTalk)
 CRC: checked at receiver, if error is detected, frame is dropped
Ethernet: Unreliable, connectionless
 connectionless: No handshaking between sending and
receiving NICs
 unreliable: receiving NIC doesn’t send acks or nacks
to sending NIC



stream of datagrams passed to network layer can have gaps
(missing datagrams)
gaps will be filled if app is using TCP
otherwise, app will see gaps
 Ethernet’s MAC protocol: unslotted CSMA/CD
Ethernet CSMA/CD algorithm
NIC receives datagram
from network layer,
creates frame
2. If NIC senses channel
idle, starts frame
transmission
3. If NIC senses channel
busy, waits until channel
idle, then transmits
4. If NIC detects another
transmission while
transmitting, aborts and
sends jam signal
5. After aborting, NIC
enters exponential
backoff: after mth
collision, NIC chooses K at
random from
{0,1,2,…,2m-1}. NIC waits K
 1-persistant!
slots where one slot is 512
4. If NIC transmits entire
bit times, returns to Step
frame without detecting
2
another transmission, NIC
is done with frame !
1.
Ethernet’s CSMA/CD (more)
Jam Signal: make sure all
other transmitters are
aware of collision; 48 bits
Bit time: .1 microsec for 10
Mbps Ethernet ;
for K=1023, wait time is
about 50 msec
Exponential Backoff:
 Goal: adapt retransmission
attempts to estimated
current load
 heavy load: random wait
will be longer
 first collision: choose K from
{0,1}; delay is K· 512 bit
transmission times
 after second collision: choose
K from {0,1,2,3}…
 after ten or more collisions,
choose K from
{0,1,2,3,4,…,1023}
CSMA/CD efficiency
 Tprop = max prop delay between 2 nodes in LAN
 ttrans = time to transmit max-size frame
efficiency 
1
1  5t prop /ttrans
 efficiency goes to 1
 as tprop goes to 0
 as ttrans goes to infinity

1
 0.96
200m 1500  8
1 5
/
8
2  10 100  106
• larger frame size is better, higher bit-rate is worst
 better performance than ALOHA: and simple,
cheap, decentralized!
 Most ethernet is used with switches. So collision
never occur
802.3 Ethernet Standards: Link & Physical Layers
 many different Ethernet standards






common MAC protocol and frame format
different speeds: 2 Mbps, 10 Mbps, 100 Mbps, 1Gbps, 10G bps
different physical layer media: fiber, cable
Very large ethernets are possible
QoS
MPLS runs over ethernet (so traffic engineering is possible)
application
transport
network
link
physical
MAC protocol
and frame format
100BASE-TX
100BASE-T2
100BASE-FX
100BASE-T4
100BASE-SX
100BASE-BX
copper (twister
pair) physical layer
fiber physical layer
Link Layer
 5.1 Introduction and




services
5.2 Error detection
and correction
5.3Multiple access
protocols
5.4 Link-Layer
Addressing
5.5 Ethernet
 5.6 Hubs and switches
 VLAN
Typical LAN
 Grouped based on the hub (physically)
 Use routers as LAN segmentation (broadcast)
 A single enterprise LAN is too large


Each ARP request is broadcast over the entire LAN
When self-learning (e.g., every 20 minutes),
• too much traffic is flooded
• This traffic is viewable by anyone in the LAN (not easy to provide
firewalls between groups)
 Solution


Create smaller LANs each with subnet.
The subnet could represent a workgroup
• Shared drives, printers, etc
• LAN-based Firewall/access control
 However,

20% to 40% of work force moves every year
• Recabling / readdressing and reconfiguration

Work group members might be in different locations
• e.g., dedicated switch for each work group in each floor or each building. Can’t
we share switches with other work groups?
VLAN
 VLAN is a broadcast domain
 Grouped based on logical function,
department or application.
 Traffic can only be switched between
VLANS with a router

Like switching between regular LANs
VLAN
 VLANs can logically segment users into
different subnets (broadcast domains)
 Broadcast frames are only switched on the
same VLAN ID.
 Users can be logically group via software
based on:
Ethernet port/jack
 port number
 protocol being used
 application being used

LAN VS. VLAN
VLAN across backbone
 Backbone
Inter-Domain communication
 High-speed link (100 Mbps or more)
 Inter-connect to router
 VLAN traffic between switches (trunks) is tagged (802.1q)
or encapsulated (ISL) to identify VLAN membership

Router’s Role
 Provides connection between different
VLANs
 For example, you have VLAN1 and VLAN2.
Within the switch, users on separate VLANs
cannot talk to each other (benefit of a VLAN!)
 However, users on VLAN1 can access a web
server on VLAN2, but they need a router to do
it.

VLAN Techniques
 Two techniques
Frame Filtering--examines particular
information about each frame (MAC address or
layer 3 protocol type)
 Frame Tagging--places a unique identifier in the
header of each frame as it is forwarded
throughout the network backbone.

Frame Tagging
 IEEE 802.1q
 Assigns a VLAN ID to each frame
 Switch understands the tag
 Places a tag in the frame
 Tags are removed by the switch
VLAN implementation
 Created by software running on Layer 2
switches
 Three methods for implementing VLANs
Port-Centric
 Static
 Dynamic

Port-Centric VLAN
3 Port-Centric VLANs
 Same VLAN, same router interface
 Easy for management
Static VLAN
 Ports on a switch are administratively assigned to a VLAN
 Benefits



can be assigned by port, address, or protocol type
secure, easy to configure and monitor
works well in networks where moves are controlled
Dynamic VLAN
 Switch ports can automatically determine a user’s
VLAN assignment based on either/or:

MAC / logical address / protocol type
 When connected to an unassigned port, the switch
dynamically configures the port with the correct
VLAN
Virtualization of networks
Virtualization of resources: powerful abstraction in
systems engineering:
 computing examples: virtual memory, virtual
devices
 Virtual machines: e.g., java
 IBM VM os from 1960’s/70’s
 layering of abstractions: don’t sweat the details of
the lower layer, only deal with lower layers
abstractly
The Internet: virtualizing networks
1974: multiple unconnected
nets
 ARPAnet
 data-over-cable
networks
 packet satellite network (Aloha)
 packet radio network
ARPAnet
"A Protocol for Packet Network Intercommunication",
V. Cerf, R. Kahn, IEEE Transactions on Communications,
May, 1974, pp. 637-648.
… differing in:
 addressing
conventions
 packet formats
 error recovery
 routing
satellite net
The Internet: virtualizing networks
Internetwork layer (IP):
 addressing: internetwork
appears as single, uniform
entity, despite underlying local
network heterogeneity
 network of networks
Gateway:
 “embed internetwork packets in
local packet format or extract
them”
 route (at internetwork level) to
next gateway
gateway
ARPAnet
satellite net
Cerf & Kahn’s Internetwork Architecture
What is virtualized?
 two layers of addressing: internetwork and local
network
 new layer (IP) makes everything homogeneous at
internetwork layer
 underlying local network technology
 cable
 satellite
 56K telephone modem
 today: ATM, MPLS
… “invisible” at internetwork layer. Looks like a link
layer technology to IP!
Multiprotocol label switching (MPLS)
 initial goal: speed up IP forwarding by using fixed
length label (instead of IP address) to do
forwarding


borrowing ideas from Virtual Circuit (VC) approach
but IP datagram still keeps IP address!
PPP or Ethernet
header
MPLS header
label
20
IP header
Exp S TTL
3
1
5
remainder of link-layer frame
MPLS capable routers
 a.k.a. label-switched router
 forwards packets to outgoing interface based
only on label value (don’t inspect IP address)

MPLS forwarding table distinct from IP forwarding
tables
 signaling protocol needed to set up forwarding
 RSVP-TE
 forwarding possible along paths that IP alone would
not allow (e.g., source-specific routing) !!
 use MPLS for traffic engineering
 must co-exist with IP-only routers
MPLS forwarding tables
in
label
out
label dest
10
12
8
out
interface
A
D
A
0
0
1
in
label
out
label dest
out
interface
10
6
A
1
12
9
D
0
R6
0
0
D
1
1
R3
R4
R5
0
0
R2
in
label
8
out
label dest
6
A
out
interface
0
in
label
6
outR1
label dest
-
A
A
out
interface
0
Chapter 5: Summary
 principles behind data link layer services:
 error detection, correction
 sharing a broadcast channel: multiple access
 link layer addressing
 instantiation and implementation of various link
layer technologies
 Ethernet
 switched LANS
 PPP
 virtualized networks as a link layer: ATM, MPLS
Chapter 5: let’s take a breath
 journey down protocol stack complete
(except PHY)
 solid understanding of networking principles,
practice
 ….. could stop here …. but lots of interesting
topics!
wireless
 multimedia
 security
 network management
