Transcript lectures5-6
Chapter 4: Network Layer Introduction IP: Internet Protocol IPv4 addressing NAT IPv6 Routing algorithms Link state Distance Vector Routing in the Internet RIP OSPF BGP Chapter 4, slide: 1 Sharing an IP address Home networks, other small LANs Expensive to have unique IP address for each host Want to share internet access through just one IP address Want to maintain security/privacy Install router … but how does it work? Chapter 4, slide: 2 Network Address Translation NAT is an extension of the original IP addressing scheme Motivated by exhaustion of IP address space Allows multiple computers at one site to share a single global IP address Requires a device to perform packet translation In-line configuration All traffic entering or leaving the network must go through the NAT device Should be transparent to all users • Virtual private connection Chapter 4, slide: 3 NAT: Network Address Translation local network uses just one IP address as far as outside world is concerned (external address) range of addresses not needed from ISP: just one IP address for all devices can change addresses of devices in local network without notifying outside world can change ISP / external address without changing addresses of devices in local network devices inside local net not explicitly addressable by outside world (a security plus). Chapter 4, slide: 4 NAT: Network Address Translation rest of Internet local network (e.g., home network) 10.0.0/24 10.0.0.4 10.0.0.1 10.0.0.2 138.76.29.7 10.0.0.3 All datagrams leaving local network have same single source NAT IP address: 138.76.29.7, different source port numbers Datagrams with source or destination in this network have 10.0.0/24 address for source, destination (as usual) Chapter 4, slide: 5 Implementation To send datagram out to the internet from a computer in the private network: Computer constructs datagram with source address and destination address, sends to NAT box NAT box translates the source address in the datagram to the site's IP address NAT keeps source and destination addresses in its translation table Note: checksum must be recalculated and datagram must be reconstructed Chapter 4, slide: 6 Implementation To forward an incoming datagram from the internet to a computer in the private network: Datagrams arrive addressed to the site's IP address NAT finds source and destination addresses in its translation table NAT changes the destination address in the datagram to the internal address for the target computer NAT reconstructs the datagram (with new checksum, etc.) and forwards it to the computer in the private network Chapter 4, slide: 7 Implementation Software solutions Standard PC with • NAT software, e.g.: – Linux masquerade – Windows RRAS (Routing and Remote Access Server) • extra NIC required OK for slower speed networks (e.g., 10 Mbps) NAT box must translate addresses in time for the usual network functions to work • detecting congestion, etc. Hardware solutions Special-purpose hardware for high-speed networks (e.g., gigabit Ethernet) Hybrid solutions Routers can incorporate software for NAT Used in medium-speed networks (e.g., 100 Mbps) Chapter 4, slide: 8 Virtual connection The effect of NAT is to form a virtual private connection between a computer in a private network and a remote host (internet site). Of course, the connection may be to a computer in a separate private network (through another NAT box) Internal communications do not use the NAT box Chapter 4, slide: 9 Problems with basic NAT If two computers inside the private network both want to communicate with the same external site, the basic translation table is not sufficient If one computer inside the private network is running applications with two remote hosts, the basic translation table is not sufficient If a remote site wants to make the first contact with a computer inside the private network, there will be no translation table entry. Chapter 4, slide: 10 NAPT Network Address and Port Translation Most popular implementation of NAT Usually just called NAT Keeps track of local addresses and IP addresses Also can keep track of (and change) TCP and UDP protocol port numbers Allows • multiple computers in the private network to communicate with a single destination • multiple applications on a single computer in the private network to communicate with multiple destinations Chapter 4, slide: 11 Example NAPT table Entry in table records protocol port number as well as IP address Port numbers are re-assigned to avoid conflicts Note: this requires the NAT box (router) to have some transport-layer functionality Direction Initial value Translated Unchanged out IP SRC:TCP SRC 10.0.0.125:30000 IP SRC:TCP SRC 128.210.24.6:40001 IP DST:TCP DST 68.18.6.225:80 out IP SRC:TCP SRC 10.0.0.77:30000 IP SRC:TCP SRC 128.210.24.6:40002 IP DST:TCP DST 68.18.6.225:80 in IP DST:TCP DST 128.210.24.6:40001 IP DST:TCP DST 10.0.0.125:30000 IP SRC:TCP SRC 68.18.6.225:80 in IP DST:TCP DST 128.210.24.6:40002 IP DST:TCP DST 10.0.0.77:30000 IP SRC:TCP SRC 68.18.6.225:80 Chapter 4, slide: 12 NAT table For an out-going datagram: Source address is changed to the site address. Source port number is re-assigned and recorded Checksum is recalculated Datagram is reconstructed Destination address / port number are not changed Translation table records • Internal source address / original port number • Destination address / re-assigned source port number Chapter 4, slide: 13 NAT table For an in-coming datagram: Destination address is changed to the internal address recorded in the translation table. Destination port number is changed to the port number recorded in the translation table. Checksum is recalculated Datagram is reconstructed Source address / port number are not changed Chapter 4, slide: 14 NAT: Network Address Translation 2: NAT router changes datagram source addr from 10.0.0.1, 3345 to 138.76.29.7, 5001, updates table 2 NAT translation table WAN side addr LAN side addr 1: host 10.0.0.1 sends datagram to 128.119.40.186, 80 138.76.29.7, 5001 10.0.0.1, 3345 …… …… S: 10.0.0.1, 3345 D: 128.119.40.186, 80 S: 138.76.29.7, 5001 D: 128.119.40.186, 80 138.76.29.7 S: 128.119.40.186, 80 D: 138.76.29.7, 5001 3: Reply arrives dest. address: 138.76.29.7, 5001 3 1 10.0.0.4 S: 128.119.40.186, 80 D: 10.0.0.1, 3345 10.0.0.1 10.0.0.2 4 10.0.0.3 4: NAT router changes datagram dest addr from 138.76.29.7, 5001 to 10.0.0.1, 3345 Chapter 4, slide: 15 First contact When initial contact is attempted from outside the site, there is no translation table entry E.G., a private network might be running multiple servers through a NAT system Chapter 4, slide: 16 NAT traversal problem client wants to connect to server with address 10.0.0.1 server address 10.0.0.1 local to LAN (client can’t use it as destination addr) only one externally visible NAT’ed address: 138.76.29.7 Client 10.0.0.1 ? 10.0.0.4 138.76.29.7 NAT router Chapter 4, slide: 17 NAT traversal problem Solution 1: statically configure NAT to forward incoming connection requests at given port to server e.g., (123.76.29.7, port 2500) always forwarded to 10.0.0.1 port 25000 Client 10.0.0.1 ? 10.0.0.4 138.76.29.7 NAT router Chapter 4, slide: 18 NAT traversal problem Solution 2: Universal PnP Internet Gateway Device (IGD) Protocol. Allows NAT’ed host to: map (private IP, private port #) with (public IP, public port #) advertise (public IP, public port #) 10.0.0.1 So DNS can work IGD add/remove port mappings 10.0.0.4 138.76.29.7 NAT router Chapter 4, slide: 19 Summary: Network Address Translation 16-bit port-number field: ~65,000 simultaneous connections with a single LAN-side address! NAT is controversial. Objections include: • routers should only process up to layer 3 • address shortage should instead be solved by IPv6 Chapter 4, slide: 20 Chapter 4: Network Layer Introduction Virtual circuit and datagram networks IP: Internet Protocol IPv4 addressing NAT IPv6 Routing algorithms Link state Distance Vector Routing in the Internet RIP OSPF BGP Chapter 4, slide: 21 IPv6 Initial motivation: 32-bit address space soon to be completely allocated. Additional motivation: header changes to facilitate QoS Major changes from IPv4: Fragmentation: no longer allowed; drop packet if too big Checksum: removed to reduce processing time; already done at transport and link layers Options: allowed, but outside of header, indicated by “Next Header” field Chapter 4, slide: 22 New features of IPv6 Support for audio and video “flow labels” and “quality of service” allow audio and video applications to establish appropriate connections Extensible new features can be added more easily Chapter 4, slide: 23 IPv6 datagram format Chapter 4, slide: 24 IPv6 base header format Chapter 4, slide: 25 IPv6 base header Contains less information than IPv4 header VERSION (4 bits) TRAFFIC CLASS (8 bits) • specifies the traffic class (used to choose a route) FLOW LABEL (20 bits) PAYLOAD LENGTH (16 bits) NEXT HEADER (8 bits) HOP LIMIT (8 bits) (old TTL) • used to associate datagrams belonging to a flow or communication between two applications • indicates the length of data (i.e. payload) excluding header • points to first extension header • specifies the maximum number of hops a packet can travel through before being discarded SOURCE ADDRESS (128 bits) DESTINATION ADDRESS (128 bits) Chapter 4, slide: 26 NEXT header Chapter 4, slide: 27 Parsing IPv6 headers Base header is fixed size - 40 octets NEXT HEADER field in base header defines type of next header Next header appears at end of fixed-size base header Some extensions headers are variable sized NEXT HEADER field in extension header defines type HEADER LEN field gives size of extension header Chapter 4, slide: 28 Multiple headers Efficiency header only as large as necessary Flexibility can add new headers for new features Incremental development can add processing for new features Chapter 4, slide: 29 Fragmentation and Path MTU Fragmentation information is in fragmentation extension header IPv6 source (not intermediate routers) is responsible for fragmentation Source must find path MTU Routers simply drop datagrams larger than path MTU No more fragmenting by routers ICMP message sent to source Must be dynamic - path may change during transmission of datagrams Source determines path MTU Uses path MTU discovery • Source sends probe message of various sizes • Gets ICMP messages until destination reached Constructs datagrams to fit within that MTU Chapter 4, slide: 30 IPv6 addressing 128-bit addresses Includes network prefix and host suffix No address classes prefix/suffix boundary can fall anywhere Longest matching prefix Chapter 4, slide: 31 Address notation in IPv6 128-bit addresses unwieldy in dotted decimal requires 16 numbers example: • 105.220.136.100.255.255.255.255.0.0.18.128.140.10.255.255 IPv6 uses groups of 16-bit numbers in hex separated by colons colon hexadecimal (colon hex) example: • 69DC:8864:FFFF:FFFF:0:1280:8C0A:FFFF Add /bits to specify netmask example: • 69DC:8864:FFFF:FFFF:0:1280:8C0A:FFFF/64 Chapter 4, slide: 32 Address shorthand in IPv6 Zero-compression series of zeroes indicated by two colons example: • FF0C:0:0:0:0:0:0:B1 becomes • FF0C::B1 An IPv6 address with 96 leading zeros is interpreted to hold an IPv4 address Chapter 4, slide: 33 Transition From IPv4 To IPv6 Can all routers be upgraded simultaneously ?? Answer: it can’t; no “flag days” Analogy: (IP for Internet) ~ (foundation for House) To change the foundation, you need to tear down the house!! Solution gradually incorporate IPv6 (may take few years) How will the network operate with mixed IPv4 and IPv6 routers? Tunneling?? Chapter 4, slide: 34 Tunneling Logical view: Physical view: Be aware that: • • IPv6 nodes have both IPv4 & IPv6 addresses Nodes know which nodes are IPv4 and which one are IPv6 (use for e.g. DNS) A B IPv6 IPv6 A B C IPv6 IPv6 IPv4 Flow: X Src: A Dest: F data A-to-B: IPv6 E F IPv6 IPv6 D E F IPv4 IPv6 IPv6 tunnel What is the problem here? Why can’t B just send an IPv4 packet to C ? Problem: D won’t be able to send an IPv6 packet to E? Why? Chapter 4, slide: 35 Tunneling Logical view: Physical view: Be aware that: • • IPv6 nodes have both IPv4 & IPv6 addresses Nodes know which nodes are IPv4 and which one are IPv6 (use for e.g. DNS) A B IPv6 IPv6 A B C IPv6 IPv6 IPv4 Flow: X Src: A Dest: F data A-to-B: IPv6 E F IPv6 IPv6 D E F IPv4 IPv6 IPv6 tunnel Src:B Dest: E Src:B Dest: E Flow: X Src: A Dest: F Flow: X Src: A Dest: F data data B-to-C: IPv6 inside IPv4 B-to-C: IPv6 inside IPv4 Flow: X Src: A Dest: F data E-to-F: IPv6 Chapter 4, slide: 36