sday, Tue May 20
Midte #2 rm S core areposte s d C eto m officeif you want to go ove thee om y r xam Program#1 Grading is in progre ss Lab #5 is poste d DueFriday, May 30 Lab sche duleis change d!! Hom work #4 is poste e d Re -assigne proble s (7 & 8) fromHom work #3 d m e DueThursday, May 22 (BOC ) Program#2 is poste d DueThursday, June5
1
Today's Topics
Ne twork Addre Translation (NAT) ss I nte t C rne ontrol Me ssageProtocol (I C MP) Routecom putation
2
S haring an I P addre ss
Hom ne e tworks, othe sm LANs r all Expe nsiveto haveuniqueI P addre for e host ss ach Want to shareinte t acce through just oneI P addre rne ss ss Want to m aintain se curity/privacy I nstall route ... but how doe it work? r s
3
Ne twork Addre Translation ss
NAT is an e nsion of theoriginal I P addre xte ssing sche e m Motivate by e d xhaustion of I P addre space ss Allows m ultiplecom rs at onesiteto share a singleglobal I P pute
addre ss Re quire a de to pe s vice rformpacke translation t I n-lineconfiguration
All traffic e ring or le nte aving thene twork m go through theNAT de ust vice S hould betranspare to all use nt rs
ction Virtual privateconne
4
NAT: Ne twork Addre Translation ss
local ne twork use just oneI P addre as far as outsideworld is s ss
conce d (e rnal addre rne xte ss) rangeof addre s not ne de fromI S just oneI P addre for sse e d P: ss all de s vice can changeaddre s of de s in local ne sse vice twork without notifying outsideworld can changeI S / e rnal addre without changing addre s P xte ss sse of de s in local ne vice twork de s insidelocal ne not e vice t xplicitly addre ssableby outside world (a se curity plus).
5
NAT: Ne twork Addre Translation ss
re of st I nte t rne local ne twork (e hom ne .g., e twork) 10.0.0/24
10.0.0.4 138.76.29.7 10.0.0.3
10.0.0.1
10.0.0.2
All datagram le s aving local ne twork havesam singlesourceNAT IP e addre 138.76.29.7, ss: diffe nt sourceport num rs re be
Datagram with sourceor s de stination in this ne twork have10.0.0/24 addre for ss source de , stination (as usual)
6
I m m ntation ple e
To se datagramout to theinte t froma com nd rne pute in the r
privatene twork:
C pute constructs datagramwith sourceaddre and de om r ss stination addre se to NAT box ss, nds NAT box translate thesourceaddre in thedatagramto thesite s ss 's I P addre ss NAT ke ps sourceand de e stination addre s in itstranslation table sse Note che : cksumm bere ust calculate and datagramm be d ust re constructe d
7
I m m ntation ple e
To forward an incom datagramfromtheinte t to a ing rne
com r in theprivatene pute twork:
Datagram arriveaddre d to thesite I P addre s sse 's ss NAT finds sourceand de stination addre s in itstranslation table sse NAT change thede s stination addre in thedatagramto the ss inte addre for thetarge com r rnal ss t pute NAT re constructs thedatagram(with ne che w cksum e and , tc.) forwards it to thecom r in theprivatene pute twork
8
I m m ntation ple e
S oftwaresolutions S tandard PCwith
, .g.: NAT software e Linux masquerade Windows RRAS (Routing and Remote Access Server) xtra e NI C
OK for slowe spe d ne r e tworks (e 10 Mbps) .g., NAT box m translateaddre s in tim for theusual ne ust sse e twork functions to work
te stion, e tc. calculating RTD, de cting conge
Hardwaresolutions S cial-purposehardwarefor high-spe d ne pe e tworks (e gigabit Ethe t) .g., rne Hybrid solutions Route can incorporatesoftwarefor NAT rs Use in m dium d e -spe d ne e tworks (e 100 Mbps) .g.,
9
Virtual conne ction
Thee ct of NAT is to forma virtual privateconne ffe ction
be e a com r in a privatene twe n pute twork and a re otehost m (inte t site rne ). Of course theconne , ction m beto a com r in a se ay pute parate privatene twork (through anothe NAT box) r I nte rnal com unications do not usetheNAT box m
10
Proble s with basic NAT m
I f two com pute insidetheprivatene rs twork both want to com unicate m
with thesam e rnal site thebasic translation tableis not sufficie e xte , nt I f onecom pute insidetheprivatene r twork is running applications with two re otehosts, thebasic translation tableis not sufficie m nt I f a re otesitewants to m thefirst contact with a com m ake pute inside r theprivatene twork, the will beno translation tablee re ntry.
11
NAPT
Ne twork Addre and Port Translation ss Most popular im m ntation of NAT ple e Usually just calle NAT d Ke ps track of local addre s and I P addre s e sse sse Also can ke p track of (and change TC and UDP protocol e ) P port num rs be Allows
ultiplecom rs in theprivatene pute twork to com unicatewith a single m m de stination ultipleapplications on a singlecom r in theprivatene pute twork to m com unicatewith m m ultiplede stinations
12
Exam NAPT table ple
Entry in tablere cords protocol port num r as we as IP addre be ll ss Port num rs arere be -assigne to avoid conflicts d
Dire ction
out
I nitial value
IPS RC:TCP S RC 10.0.0.125:30000 IPS RC:TCP S RC 10.0.0.77:30000 I P DS T:TCP DS T 128.210.24.6:40001 I P DS T:TCP DS T 128.210.24.6:40002
Translate d
IPS RC:TCP S RC 128.210.24.6:40001 IPS RC:TCP S RC 128.210.24.6:40002 I P DS T:TCP DS T 10.0.0.125:30000 I P DS T:TCP DS T 10.0.0.77:30000
Unchange d
I P DS T:TCP DS T 68.18.6.225:80 I P DS T:TCP DS T 68.18.6.225:80 I P S :TC S RC P RC 68.18.6.225:80 I P S :TC S RC P RC 68.18.6.225:80 13
out
in
in
NAT table
For an out-going datagram : S ourceaddre is change to thesiteaddre ss d ss. S ourceport num r is re be -assigne and re d corde d C cksumis re he calculate d Datagramis re constructe d De stination addre / port num r arenot change ss be d
Translation tablere cords
rnal ss be I nte sourceaddre / original port num r stination addre / re ss -assigne sourceport num r d be De
14
NAT table
For an in-com datagram ing : De stination addre is change to theinte addre re ss d rnal ss corde in thetranslation d table . De stination port num r is change to theport num r re be d be corde in thetranslation d table . C cksumis re he calculate d Datagramis re constructe d S ourceaddre / port num r arenot change ss be d
15
TC splicing P
I nte rconne two inde nde TC conne cts pe nt P ctions Form two conne s ctions (inte and e rnal) rnal xte "splice theconne s" ctions to sim ulatedire conne ct ction Transpare to both hosts nt Ve e ry fficie nt Use e nde NAT translation table s xte d
16
NAT: Ne twork Addre Translation ss
2: NAT route r change datagram s sourceaddr from 10.0.0.1, 3345 to 138.76.29.7, 5001, update table s 2 NAT translation table WAN sideaddr LAN sideaddr 138.76.29.7, 5001 10.0.0.1, 3345 ...... ......
S 10.0.0.1, 3345 : D: 128.119.40.186, 80
1: host 10.0.0.1 se datagramto nds 128.119.40.186, 80
10.0.0.1
1
S 138.76.29.7, 5001 : D: 128.119.40.186, 80
10.0.0.4
S 128.119.40.186, 80 : D: 10.0.0.1, 3345
10.0.0.2
138.76.29.7
S 128.119.40.186, 80 : D: 138.76.29.7, 5001
4
3
3: Re arrive ply s de addre st. ss: 138.76.29.7, 5001
10.0.0.3 4: NAT route r change datagram s de addr from st 138.76.29.7, 5001 to 10.0.0.1, 3345
17
First contact
Whe contact is initiate fromoutsidethesite the is no n d , re
translation tablee ntry E.G., a privatene twork m berunning m ight ultiplese rs rve through a NAT syste m
18
NAT trave proble rsal m
clie wants to conne to se r with addre 10.0.0.1 nt ct rve ss se r addre 10.0.0.1 local to LAN (clie can't useit as de rve ss nt stination addr) only onee rnally visibleNAT'e addre 138.76.29.7 xte d ss:
10.0.0.1
C nt lie
?
10.0.0.4
138.76.29.7
NAT route trave r
19
NAT proble rsal m
S olution 1:
statically configureNAT to forward incom conne ing ction re sts at give que n port to se r rve
e (123.76.29.7, port 2500) always forwarde to 10.0.0.1 port 25000 .g., d
10.0.0.1
C nt lie
?
10.0.0.4
138.76.29.7
NAT route r
20
NAT trave proble rsal m
S olution 2: Universal PnP I nternet Gateway Device(I GD) Protocol.
Allows NAT'e host to: d
m (privateI P, privateport #) with (public I P, public port #) ap adve rtise(public IP, public port #) add/re oveport m m appings
10.0.0.1
IGD
10.0.0.4 138.76.29.7
NAT route r
21
NAT trave proble rsal m
S olution 3: (TwiceNAT)
ProvideDNSse rvice Works in m case ost s Doe work if re otere st use I P addre inste of dom sn't m que s ss ad ain
nam e
22
I m m ntations of NAT ple e
linux: unix:
m asque rade slirp (Serial Lineinternet Routing Protocol) Windows: I C (I nternet Connection Sharing) S
23
NAT: Ne twork Addre Translation ss
16-bit port-num r fie be ld: 60,000 sim ultane conne ous ctions with a singleLAN-side addre ss! NAT is controve rsial. Obje ctions include :
rs ss r route should only proce up to laye 3 s nd-to-e argum nt nd e violate e NAT possibility must be taken into account by app designers, eg, P2P applications ss ad d addre shortageshould inste besolve by I Pv6
24
Que stions on NAT?
25
Mode a wide a ne ling -are twork (WAN)
Usea graph: "Node m l switche s" ode s "Edge m l dire conne s" ode ct ctions be e switche twe n s C apture e nceof WAN, ignoring attache com rs s sse d pute
26
C puting shorte path om st
Re se WAN as a graph pre nt C puteshorte path frome nodeto e ry othe node om st ach ve r Extract ne xt-hop inform ation fromre sulting path
inform ation I nse ne rt xt-hop inform ation into routing table s
27
We ights
Re se costs as we pre nt ights on e s in graph dge We ights arede rm d by spe d, distance additional te ine e ,
hardware bottle cks, e , ne tc. S horte path is thepath with lowe total we (sumof st st ight we ights of all e s in thepath) dge S horte path is not ne ssarily fe st e s or fe st hops st ce we dge we
28
Djikstra's Algorithm(sim plifie ve d rsion)
S e e calle "Link-S om tim s d tateAlgorithm " ... but Link-S tateuse Djikstra's s Data structure s: S= {all node e pt source s xce } D is array of we ights of e s dge
I nitially, D[v] = e we (if e fromsourceto v e dge ight dge xists) or
Use to re se the"cost" of a nodein these Sof node for which a path pre nt t s has not ye be n com d t e pute
(otherwise)
R is array of node s
dge xists) or ze (othe ro rwise ) I nitially, R[v] = v (if e fromsourceto v e
P is an array of node s
dge xists), or ze (othe ro rwise ) I nitializeP [v] to source(if an e fromsourceto v e
29
Djikstra's Algorithm(sim plifie ve d rsion)
Num r thenode be s De rm sourcenodeand de te ine stination node At e ite ach ration, find a nodein S com , putethepath to that
node and de tethenodefromS , le Tracebackwards (de stination to source in P to ge shorte ) t st path. Find total cost at D[de stination] Routing tableR give first-hop inform s ation
30
Djikstra's Algorithm(sim plifie ve d rsion)
initialize S, D, R, P; while (!empty(S)) { u = node in S with D[u] a "smallest element" ... if tied, take smallest u; if(D[u] == ) { error: "no path"; exit;} S = S {u}; for (each v such that edge (u,v) exists) { if(v in S) { c = D[u] + weight (u,v); if(c < D[v]) { R[v] = R[u]; P[v] = u; D[v] = c; } } } }
31
Exam com ple putation (S ourceis 4, De stination is 5)
32
initialize S, D, R, P; while (!empty(S)) { u = node in S with D[u] a "smallest element" ... if tied, take smallest u; if(D[u] == ) { error: "no path"; exit;} S = S {u}; for (each v such that edge (u,v) exists) { if(v in S) { c = D[u] + weight (u,v); if(c < D[v]) { R[v] = R[u]; P[v] = u; D[v] = c;
} } } }
33
Distribute routecom d putation
Pass inform ation about ne twork topology be e node twe n s Updateinform ation pe riodically Each nodere pute shorte paths and ne hops com s st xt Makechange in routing table s s
34
Othe routing algorithm r s
Distance ctor -ve Local inform ation is ne xt-hop routing tableand distancefrome ach switch S witche pe s riodically broadcast topology inform ation Othe switche updaterouting tablebase on re ive inform r s d ce d ation
35
Othe routing algorithm r s
Link-state S parate ne e s twork topology fromroutecom putation S witche se link-stateinform s nd ation about local conne ctions (e .g., "link 4 17, OK") Each switch builds its own routing table s
s ation to updateglobal topology Use link-stateinform Runs Djikstra's algorithm
36
C parison of algorithm om s
Djikstra's algorithm Re quire com tecost inform s ple ation Othe rwise e to im m nt , asy ple e Link-statealgorithm Much m com x ore ple S witche pe s rforminde nde com pe nt putations Use in OS d PF (Ope S n horte Path First) protocol st Distance ctor algorithm -ve Ve sim to im m nt ry ple ple e Use in RI P (Routing Inform d ation Protocol)
37
Que stions on routecom putation?
38
Error de ction te
I P provide be ffort de ry s st-e live I nte t laye can de ct a varie of e rne r te ty rrors: C cksum he TTL e xpire s No routeto de stination ne twork C an't de r to de live stination host (e no ARP re .g., ply) I nte t laye discards datagram with ce rne r s rtain type of proble s s m
39
IC MP
S etype of e om s rrors can bede cte and re te d porte d I nte t C rne ontrol Me ssageProtocol (I C MP) provide e s rror-
re porting m chanism e s Route se control m ssageback to source r nds e
Encapsulate in I P datagram d C ontains code inform d ation about thetypeof proble m
40
I C He r MP ade
0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1
Type
C ode unuse d Original I P He r ade + 64 bits of DatagramData
C cksum he
41
I C He r Exam MP ade ple
Type 3 C 0 = ne unre ode t achable 1 = host unre achable 2 = protocol unre achable 3 = port unre achable 4 = fragm ntation ne de and DF se e e d t 5 = sourceroutefaile d C cksum he the16-bit one com m nt of theone com m nt sumof theI C 's ple e 's ple e MP m ssage e starting with theI C Type MP . Original I P He r + 64 bits of Data Datagram ade I P he r is at le 20 byte ade ast s. Re ainde is use by host to m m r d atch m ssageto appropriateproce e ss.
42
ICMP messag e types
43
Type of m ssage s e s
I nte t C rne ontrol Me ssageProtocol (I C MP) de s 2 classe fine s
of m ssage e s
e m ssage rror e s inform ational m ssage e s
44
Error m ssagee ple e xam s
S ourceque nch
route se whe it has no m que r nds n ore uing spaceavailable . m ssageis se in two case e nt s
1. route se whe theTTL is re d to ze r nds n duce ro 2. de stination host se whe there m tim r e nds n asse bly e xpire be all s fore fragm nts arrive e .
Tim e e d e xce de
45
Error m ssagee ple e xam s
De stination unre achable route se r nds whe it de rm s that a datagramcannot be n te ine de re to its final de live d stination Re ct dire route se r nds whe it de rm s that a host has incorre se a n te ine ctly nt datagramthat should bese to a diffe nt route nt re r
46
Error m ssagee ple e xam s
Fragm ntation re e quire d Route se r nds whe it de rm s datagramis too largefor n te ine outbound ne twork Param te Proble e r m Oneof theparam te spe e rs cifie in a datagramis incorre d ct.
47
Que stions?
Ge m t oving on Program#2 Hom work #4 e Lab #5 Re K& R, C ad hapte 5, S ctions 1 - 6 r e
48