C SC 481.20 Lecture 10: Internet Protocol (IP)
major resource: Computer Networking (4th Edition), Kurose and Ross, Addison Wesley, 2008

[ previous | schedule | next ]

IP : Internet Protocol

Overview

• The network layer protocol for the Internet
• Offers "best effort" non-guaranteed delivery of datagrams
• Designed for "internetworking", interoperability between dissimilar networks
• major issues detailed below, such as router addressing, routing protocols, control protocols (ICMP)

IPv4 Datagram Format

• Field	Length in Bits	Description
  Version	4	IP version number (4)
  Header Length	4	length in 32-bit words
  Service Type	8	tell router to optimize delay, throughput, reliability
  Total Length	16	total datagram length (header+data) in bytes
  Identification	16	datagram I.D. (for reassembling fragments)
  unused	1
  Don't Fragment	1	whether or not datagram can be split up
  More Fragments	1	0 if this is last fragment of datagram, else 1
  Fragment Offset	13	fragment I.D. within datagram (0-8191)
  Time To Live	8	init to 255, decrement each hop, discard upon 0
  Protocol	8	transport layer protocol (e.g. TCP, UDP)
  Header Checksum	16	sum 16-bit chunks of header using 1's complement
  Source IP Address	32
  Destination IP Address	32
  IP Options (optional)	0-240	specify options for security, routing, timestamp,...
  Padding (optional)	0-31	Enough to bring header length to 32-bit boundary
  Data	1-64K bytes	maximum actually is (64K - header length) bytes.

• IP header length with no options is 20 bytes.
• If the datagram is carrying a TCP segment, the TCP header (also normally 20 bytes) is at the start of the payload and thus immediately follows the IP header.
• Note that destination and source IP addresses are hosts, and are not changed by routers
• Note that TTL field is decremented by each router.
• The Protocol field is very important; it identifies which Transport layer service the payload should be given to, once extracted. Its value is normally 6 (TCP) or 17 (UDP).
• Note that checksum is based on datagram header, and thus must be recalculated by each router because TTL field decremented!
• Although the payload is normally a TCP or UDP segment, it may also be a network layer ICMP (control) message -- details below.

Fragmentation

• Datagrams are payload of link layer frame (e.g. ethernet)
• Each link layer technology has maximum payload size (called MTU)
• What to do if datagram is bigger than MTU? Fragment.
• Even if sender knows MTU for its own link layer, datagram may encounter smaller MTU as it is routed to destination.
• Who does the fragmenting? Any router.
• Datagram must be reassembled at destination before being given to transport layer.
• Who does the reassembly? Destination host!
• Why the host? Because reassembly is more complex than fragmentation (any tinkerer can tell you that)!
• Leaves host open to DoS attack. Since each fragment is a full-blown datagram, a malicious sender can send fake datagrams with inconsistent fragmenting info and the receiving host will go nuts trying to process them!
• Fragments are IP datagrams themselves and thus may be dropped or arrive out-of-order or with errors.
• Thus network layer at destination has to run a reassembly protocol to account for at least out-of-order and delay.
• Reassembly protocol relatively simple since dropped or erroneous fragment results in entire datagram being dropped (even if only one fragment doesn’t arrive).
• IP has header bits to support this: “don’t fragment” bit, “more fragments” bit, fragment offset (multiple of 8-byte chunk).
• Fragmentation can be avoided by keeping datagram to no more than 576 total bytes (standard minimum MTU). Subtracting 20 bytes for IP header and 20 bytes for TCP header, yields 536 byte TCP payload.
• Using ICMP, it is possible to determine minimum MTU for a given path. How? Answer below.

Internet Control Message Protocol (ICMP)

• Used to communicate IP-level error and control information.
• Interesting twist: the control message itself is payload in IP datagram. IP header’s Protocol field set to 1.
• Some error messages are:
  • Source Quench: router buffers are full so it tells sender to back off
  • Time Exceeded: datagram's TTL or fragment reassembly timer has expired -- notify sender.
  • Destination Unreachable: when router learns this, transmits message to sender
  • Redirect: tell sender to use a different route
  • Fragmentation Required: datagram too big but can't be fragmented -- drop it and notify sender.
• Useful for more than error messages.
• ping is implemented using this. ICMP “echo request” from sender and “echo reply” from receiver
• traceroute is implemented using this. How?
• Answer to question at end of previous section: Minimum MTU for a path can be found using ICMP protocol. Send very large datagram (max size?) with “don’t fragment” bit set, and see if response is ICMP message with type=3 and code=4 (see RFC 792) “fragmentation needed and DF bit set”. If so, try smaller datagram and repeat until it gets through.

IP Addresses

• 32 bits for IPv4
• each "interface" must have unique IP address
  • A host has one interface to the Internet and thus one IP address
  • A router has multiple interfaces to the Internet, and thus has a different IP address for each input/output link
• ICANN has authority over the distribution of IP addresses (just like they do domain names, the "NN" stands for Names and Numbers).
• Sys admin can configure address to host (static)
• DHCP is Dynamic Host Configuration Protocol, a client-server protocol for assigning available IP address dynamically
• dotted decimal notation: a.b.c.d
• partitioned into network part and host part.
• “network” means all hosts addressable without further routers
• IPv4 allows over 4 billion addresses, so why the shortage?
• Originally, length of host part had specific length -- "classful" addressing
• Class A address: 24 bit host, B: 16 bit host, C: 8 bit host.
• Organization could buy only a class A network, class B network or class C network (exclusive rights to all host addresses within).
• Led to serious “three bears problem”
• Several solutions: CIDR, subnetting, DHCP, NAT, IPv6.

CIDR

• Classless InterDomain Routing
• Allows network part of IP address to be first x bits, denoted by "/ x".
• For reference, this is appended to dotted decimal : a.b.c.d / x
• E.g. "/ 20" gives organization 12 bit host address and thus 4096 hosts (between class B and C).
• ISP can buy a large block of IP address space, and allocate in smaller blocks to clients
• "/ x" forms mask that router applies to datagram destination address before matching
• E.g. / 20 defines mask 11111111 11111111 11110000 00000000
• "applying a mask" means performing bitwise AND operation of the mask with the destination IP address. The IP bit values for the mask positions with "1" will come through unchanged, but the bit values for the mask positions with "0" will all go to 0.
• Problem: after mask applied, destination address may match more than one router table entry.
  • E.g. router table has separate entries for 64.48.16.0 / 20 and 64.48.24.0 / 21
  • destination address 64.48.24.3 will match both!
  • Ambiguity resolved using longest prefix matching rule. Select 64.28.24.0 / 21; it has a longer mask (e.g. longer matching prefix) and is thus addresses a smaller block.

Subnetting

• Conceptually similar to CIDR, except is within organization (invisible to external routers)
• Some of the IP address host bits can be used to identify internal subnet
• Each internal subnet has a 32 bit mask
• Gateway (or internal) router has subnet routing table
• Destination gateway router applies mask to incoming datagram
• Routes to matching subnet
• Adds another level to routing hierarchy
• Allows organization to better organize its internal networks

Dynamic Host Configuration Protocol (DHCP)

• Protocol to dynamically allocate IP addresses within an organization
• Host requiring Internet access requests IP address
  • Admin can configure to assign same address every time
  • Admin can configure to assign any available address
• Required in mobile settings, where wireless host moves from router to router
• Allows ISP to purchase pnly enough addresses to simultaneously support x active users, where x is smaller than its total customer base (some will not be online at a given time).
• DHCP is client-server protocol, with one or more DHCP servers in organization network/subnet.
  • Newly-joining client host does not know who DHCP server is, so issues discover message with source IP address 0.0.0.0 and destination 255.255.255.255 (broadcast).
  • Everyone on the subnet receives it, all but DHCP servers ignore it. DHCP servers respond with offer message with its address as source and, since the client does not have an IP address yet(!), 255.255.255.255 as destination.
  • Client host selects from offers, responds with request message.
  • DHCP server confirms with ACK message.

Network Address Translation (NAT)

• Used in small office and home networks; use home network as example
• My home network situation
  • My Linksys router connects to Internet via DSL, it obtains single IP address (probably via DHCP)
  • My PC has a wired connection and multiple laptops have wireless connections to the router
  • The PC and laptops are hosts and thus all require IP addresses for Internet communication
  • The router cannot get additional addresses and they cannot all use the one address allocated to the router
  • Solution? NAT!
• Suppose NAT-enabled router maintains private subnet 192.168.0.0/16 (e.g. first 16 bits of IP address are fixed at dotted decimal 192.168, the last 16 bits are available to any device within the subnet)
  • The PC and laptops get IP addresses 192.168.W.X w/i the internal subnet
  • But they cannot communicate outside the subnet with those addresses, not unique!
  • Router maintains NAT translation table to translate internal addresses to external.
  • But there is only one external IP address and they can't share it! How does this solve the problem?
  • Solution? Combine the IP address with port number (from transport layer)
• Basic NAT translation operation : a fresh client request from within to outside server
  1. Assume router's IP address to the world is P.Q.R.S.
  2. Client process on internal host generates request from 192.168.W.X (itself) port Y, to destination A.B.C.D, port E (where A, B, C, D, E comprise well-known destination server address).
  3. NAT intercepts the request, allocates port Z (not already in the translation table), creates table entry with (192.168.W.X, Y) and (P.Q.R.S, Z)
  4. NAT then changes source address in request from 192.168.W.X, port Y to P.Q.R.S, port Z and sends the request out onto the Internet
• Basic NAT translation operation : outside server responds to request
  1. Assume router's IP address to the world is P.Q.R.S.
  2. Server response arrives with destination address P.Q.R.S, port Z.
  3. NAT intercepts the response, searches for (P.Q.R.S, Z) entry in translation table
  4. If (P.Q.R.S, Z) found (and this is determined to be reponse from request), get associated (192.168.W.X, Y) -- else drop response
  5. NAT then changes the destination address in response from P.Q.R.S, port Z to 192.168.W.X, port Y, and sends the response to internal host.
• What if you want to use 192.168.W.X as a server, either in a client-server or P2P application?
  • A server must be prepared to receive unsolicited requests
  • But the NAT will drop such requests! See response scenario above for incoming datagrams, and imagine that received datagram is request not response
  • There are obviously solutions; otherwise P2P would not work (and we know it does)!
  • For a detailed explanation of such solutions, see the 2006 Linux Journal article "Developing P2P Protocols across NAT", http://www.linuxjournal.com/article/9004
  • A typical situation: Two hosts A and B want to establish a P2P connection but both are behind NATs.
    • Solution is complicated (see the paragraph in the above article that starts "Now the real fun begins.")
    • relies on a intermediary host C not behind a NAT having a pre-existing TCP connection with one of the peers.
    • Overly simplistic explanation:
      • Suppose A wants to connect to B and C already has a TCP connection established with B.
      • A tells C to let B know that A wants to connect.
      • B then contacts A by pretending to be a response from A's request to C. A's router will only accept solicited responses.
      • This last step succeeds initally or eventually and is called UDP hole punching.
      • A and B can then communicate.
• A healthy form of hacking...

IPv6

• This was a hot topic in the mid-90s, then cooled a bit as CIDR, DHCP and NAT relieved the IP address allocation crunch, and now is hot again.
• Biggest advance: Address expanded to 128 bits.
• Ipv6 allows 7 * 10²³ IP addresses per square meter of the earth surface (water plus land). -- Andrew Tanenbaum, Computer Networks 3rd Edition.
• IPv6 allows every grain of sand on earth to have its own IP address. -- Kurose and Ross 4th edition
• Still contains prefix and suffix, but not address classes.
• Addresses written in colon hexadecimal notation. This is 8 groups of 16-bit hex numbers, each group separated by colon. A sequence of multiple groups of 0's can be compressed to a double colon (::).
• Features streamlined 40 byte fixed length header
  • Version (value is 6),
  • traffic class,
  • flow ( kinda like a VC #),
  • payload length,
  • next header (same as IPv4 Protocol field),
  • hop limit,
  • source addr,
  • dest addr.
  • No fragmentation fields needed (if datagram too big, router drops it and sends ICMP message to sender, sender responds with smaller datagram).
  • No checksum, redundant because TCP can handle it plus it is seldom needed.
• ICMPv6 defined with additional message types/codes.
• IPv4 – IPv6 transition tricky! How can legacy IPv4-only routers handle IPv6 datagrams?
  • One transition approach is "dual stack" e.g. has both IPv4 and 6 network layer functions
    • Has to determine whether neighbor is IPv6-capable or not, and use IPv4 if not.
    • This affects DNS; returns IPv6 address only if both it and requester are IPv6-capable.
  • Another transition approach is "tunneling"
    • If neighbor determined to be IPv4-only, then put IPv6 datagram in payload of IPv4 datagram.
    • Receiver has to recognize this and pull it apart appropriately.
• Transition will be difficult at any rate.
• Check out this protocol for carrying IPv4/IPv6 traffic http://www.ietf.org/rfc/rfc4824.txt (note the date)