OSI Layer 3 – Network DOD: "Internet Layer"

OSI Layer 3 – NetworkDOD: "Internet Layer" David Turton Conestoga College Institute of Technology & Advanced Learning http://www.conestogac.on.ca/~dturton Doon 1B43 x3610

Chapters/sections covered • Chapter 6 – Internet Layer Protocols • aka: OSI's Network Layer • IP, ARP, ICMP • Chapter 7 – all • Chapter 8 – IP Subnetting, NAT

OSI Layer 3 • Protocols: • IP • Concerned with routing to final destination • Layer 2 delivers to “next hop” • Layer 3 delivers to other side of world • Devices: • Routers, layer-3 switches, gateways (servers with routing service)

IP Address • Software or logical address • Used by routers to locate the destination network • Added to the transport layer's segment • Creating a layer-3 packet • IP address designates: • Network & device the packet is for • Network & device the packet is from

Network Layer Packet20-24 bytes of overhead 20-24 bytes

IPv4 addressing • IP version 4 is composed of 32 bits • Expressed as 4 octets: • 142.156.52.95 • Each octet is 8 bits • Range: 0 to 255 • Every networked device should have: • IP address to identify this host • Subnet mask to identify hosts local to it • Default gateway to access remote hosts • DNS address to resolve URLs to IP

Class A – 1st bit is 0 (zero) 0000 0001 to 0111 1111 1 to 127 first octet defines network: 65.0.0.0 (Bell South) 124 networks 3 octets for hosts: 16.7M nodes per network Class B – 1st 2 bits are 10 1000 0000 to 1011 1111 128 to 191 (128+63) first 2 octets for network: 142.156.x.x (Conestoga) 16,000 networks (about) 2 octets for hosts: 65,534 nodes per network 2562 - 2 Class C – 1st 3 bits are 110 1100 0000 to 1101 1111 192 to 223 (192+31) first 3 octets for network: 197.254.11.x 2M networks (about) 1 octet for hosts: 254 nodes per network IP Classeslook at the first octet Network Network Network (Fee: $9,000/yr) Network Network Network

Need for classes • 32-bit addressing (4 octets) • Over 4B addresses • In a flat structure • Routing tables would be huge, unmanageable • Classes denote location of networks • Location of "owner" of each class • Let Microsoft worry about the 16M hosts in 65.0.0.0 • Routing tables relate networks to paths • 128.4.0.0: 2 hops via Windsor, 3 hops via Toronto • 1 or 2 entries for 65,000 possible hosts

Private/Predefined networks • Some network ranges are private • Intended for intranet use • Secure: cannot be routed over Internet • 10.x.x.x • 192.168.x.x • 172.16.x.x through 172.31.x.x • Some, like 127.x.x.x are pre-defined • 127.0.0.1 means “this host” • Wasted: over 16 million addresses

Need for Subnets • Whole class A or B too large for a single network segment • Class C is pushing it, with 256 hosts • Subnets define a segment of local addresses • If destination is local to source PC • Just blast message onto LAN • Else • Give message to default gateway to deliver

Subnet Mask • Every IP device has an address and a subnet mask • 1’s in subnet mask denote the subnet address • Rest is node or host address • If source & destination subnets match • They’re local to same LAN segment • You use masks all the time • Focus on surname, city, etc. Fred Penner Marg Penner Sam Penner Gord Smith not local host subnet

IP Addressing • Each IP device has: • An IP address: 142.16.204.12 • A subnet mask: 255.255.255.0 • IP address of its default gateway • Subnet mask identifies the network portion of the IP address: 142 . 16 . 204 . 12 1000 1110 0001 0000 1100 1100 0000 1100 1111 1111 1111 1111 1111 1111 0000 0000 255 . 255 . 255 . 0 Also expressed as: 142.16.204.12/24 24  24-bit subnet mask Node part cannot be either all 0’s nor all 1’s All 0's: routers use to refer to subnet All 1's: used for broadcasts Host or node subnet

Logical "AND" to strip off host Local subnet 142 . 16 . 204 . 12 1 0 0 0 110 0001 0000 1100 1100 1 0000 0000 Source IP 1000 1110 0001 0000 1100 1100 0000 1100 Subnet Mask 1111 1111 1111 1111 1111 1111 0000 0000 255 . 255 . 255 . 0 1 AND 1 = 1 Network bits replicated Host bits zeroed 0 AND 1 = 0 0 AND 0 = 0 1 AND 0 = 0

Logical "AND" to strip off host Local subnet 1000 1110 0001 0000 1100 1100 0000 0000 Source IP 1000 1110 0001 0000 1100 1100 0000 1100 Subnet Mask 1111 1111 1111 1111 1111 1111 0000 0000 Destn IP 1000 1110 0001 0010 1100 1111 0010 1111 Destn IP 1000 1110 0001 0000 1100 1100 0010 1111 Destn subnet 1000 1110 0001 0010 1100 1111 0000 0000 Destn subnet 1000 1110 0001 0000 1100 1100 0000 0000 Destination on same subnet Destination on remote subnet

Subnetting a class C range • Normal subnet mask: 255.255.255.0 • Last octet available for host addresses • 256 addresses, less broadcast, less network • 256-2 = 254 possible hosts – a large network • Subnet mask 255.255.255.128 • Last octet is 1000 0000 • 1 bit is now part of network address • 7 bits left for host portion: 128 addresses • 128-2 = 126 hosts in each subnet, 252 total

Subnetting Algorithmconsider 255.255.255.192  1100 0000… a 26-bit subnet mask • 2x (x is number of bits in mask) • Number of subnets: 22 = 4 • 2y – 2 (y is number of zeros in mask) • Number of hosts per subnet: 26 -2 = 64 -2 = 62 • 256 – subnet mask • Increments between subnets: 256 - 192 = 64 • Subnet identifiers: 0, 64, 128, etc. • Broadcast address • 1 less than next subnet: 63, 127, etc. • Available host address range • Addresses between subnet identifier & broadcast • 1-62, 65-126, etc.

Subnet Example Source node: 10.123.123.17 mask 255.255.255.0 Local nodes: 10.123.123.1 through 10.123.123.254 Reserved: 10.123.123.0 and 10.123.123.255 • If host portion of address is all zeros • This is used to refer to the subnet • If host portion of address is all ones • This is the broadcast address to subnet

Source IP: 10.123.123.204 mask 255.255.255.128 255 = 1111 1111 – first 3 octets must match on all bits 128 = 1000 0000 – 1st bit on last octet is part of subnet 204 = 1100 1100 – host part of address Local nodes: same 1st3 octets and 4th one starts with 1 Local: 10.123.123.129 to 10.123.123.254 1000 0001 1111 1110 Remote: 10.123.123.1 to 10.123.123.126 0000 0001 0111 1110 Nodes lost (host all 1's or all 0's): 0000 0000 & 0111 1111 - 0 & 127 1000 0000 & 1111 1111 - 128 & 255 Subnet Example128: 2 subnets, 126 hosts per subnet 1 subnet  2 nodes lost 2 subnets  4 nodes lost 4 subnets  8 nodes lost

Assigning IP addresses • Manually assigned • Code IP, subnet mask, default g/w, DNS • Into each host • Assigned by a DHCP server • Hosts request an address on boot • Automatic Private IP Addressing (APIPA) • Windows assigns from 169.154.0.0 range • When neither above used

Manually Assigned IP Even a few hosts would be difficult to manage Potential to assign duplicates Difficult to change, especially if mobile Need to physically visit each machine

DHCP ServerDynamic Host Configuration Protocol • Server has a range of IP addresses (scope) • Hosts broadcast a DHCP request on boot: • To MAC FF:FF:FF:FF:FF:FF, IP 255.255.255.255 • Server leases: • An IP address • A subnet mask • Default gateway's IP address • DNS server addresses • 50% into lease period: Host requests renewal • No response: retry 90% into lease • No response: drop IP, broadcast DHCP request

DNS – Domain Name Service • People can’t remember IP addresses • DNS converts URL to IP address • Register domain name with a registry service • Are now commercial services • Address resolved through DNS iteration: • www.conestogac.on.ca. • Locate “.” DNS server – hard coded: see InterNIC.net • Locate “.ca” DNS server – InterNIC: see InterNIC.ca • Locate “.on.ca” DNS server – Ottawa: see CIRA • Locate “conestogac.on.ca” – Ontario: see gateway.conestogac.on.ca* • Locate host “www” – from Conestoga's DNS server * Conestoga has name servers hosted by a couple of other Internet Providers

Problem: DHCP & DNS don’t talk • DHCP-assigned IP address are dynamic • Could change if lease expires after inactivity • Servers accessed by URL need static IP addresses • Dynamic DNS (DDNS) • Common on internal corporate DNS servers • Not common on external DNS servers • Services available such as www.dynamIP.com • They host your DNS name • Server registers IP address each time it boots

Destination network = source network Broadcast an ARP (address Resolution protocol) Obtain destination MAC address Send message to MAC address Message contains IP addresses Destination network <> source network Have routing tables? Yes: know route No: Broadcast an ARP Get MAC address of default gateway Send message to default gateway's MAC IP address still to ultimate destination Determining Route to Destination

Default GatewayIP address must be local to host • Each Windows PC can only have one default gateway • 1st one defined is used • If not local, give to default gateway • Your ISP provides a default gateway on ISP’s network • Other PC’s on your network default to router connected to ISP .75 .73 Local subnet: 10.123.123.0 Subnet mask: 255.255.255.0 Default g/w: 10.123.123.1 .2 .1 WAN subnet: 220.13.156.72 Subnet mask: 255.255.255.248 Default g/w: 220.13.156.73 248: 1111 1000 – 6 hosts: 0100 1001 0100 1010 0100 1011 0100 1100 0100 1101 0100 1110 .3 .5 .4 …but 10.0.0.0 can't be routed over the Internet… ?

NATNetwork Address Translation • There aren't enough IP addresses • But you can share IP addresses • Your PC does it all the time: e-mail, browser • Internally, use a private address range • Lease public addresses from Internet provider • Assign these to gateway router • Host makes an Internet request • Router replaces internal IP with external (public) one • Response from Internet: • Replace destination with requester's IP address • Forward on internal network

NAT: Tracking Requests • Each external IP used for multiple requests • Need table converting external to internal • Look at transport layer: TCP ports • Used to identify which application traffic's for • Router uses this as key to translation table • Response comes in to router's external IP • Transport layer: which application is this for? • NAT application  look up port number • Replace destination IP w/ LAN host's IP • Send back down protocol stack: • Destination network is LAN segment • ARP for host's MAC (hardware) address • Forward to local host

Routers • Routers first confirm the existence of a path to the destination network • Routing tables shared with other routers • A router only examines those data packets specifically addressed to it. • A bridge/switch examines all packets on attached segments. • Router is forward-if-known • Bridge/switch is forward-if-unknown

Advantages of Routers • More efficient use of bandwidth • Especially on large networks • Do not forward broadcasts • Keep unnecessary traffic off other segments • Eliminate traffic on WAN links • Can have redundant paths • Alternate routes to other networks

Router Advantages cont’d • Routers are layer-3 devices • MAC layer is stripped off and regenerated • Multiple protocols supported: • IP, ATM, Frame Relay • can support: • firewall features, • virtual private networking (VPN), • Network Address Translation (NAT), • Virtual LANs (VLAN) • protocol encapsulation, etc.

Routing Protocols • Routers share their routing tables • so each can determine the correct path (next step, actually) • RIP - routing information protocol • distance vector: hops (routers) to destination • OSPF - open shortest path first • link state: decides based on delay, capacity, throughput and reliability • branch routers usually just forward to default gateway

RIP vs OSPFmessage from network A for network B 1.544Mb/s A C 1.544Mb/s 128Kb/s RIP: 128Kb/s A  B (1 hop) OSPF: 1.544Mb/s A  C  B Actually, OSPF could send one packet A  B and ten via C … 11 packets arrive in same time as 10 (1.556 Mb/s) B

IPv6 • IP version 4 is essentially exhausted • 4B addresses • Subnet loss: 2 per subnet • IP Class assignment: • Conestoga owns a class B range: 65K addresses • Bell South owns a class A range: 17M addresses • 6.5B people, only 10% on Internet now • PCs, laptops, servers, phones, printers, routers, game systems, fax machines, DSL/cable modems, BluRay players • IPv6 • 128-bit addressing  3.4 * 1038 addresses

IPv6 featureshosts can have multiple addresses • Broadcast • Has been eliminated • Unicast • One IP to one IP • Multiple interfaces could have same IP • Global unicast • Public IP addresses • Link-local unicast • Private IP addresses, non-routable • Unique local unicast • Routable private IP addresses • Multicast • One-to-many • Interfaces register to multicast • IP's start with FF • Anycast • Delivered to first host w/ this address • It sends to others with same address

IPv6 address • Expressed in colon-delimited hex • 8 groupings, each 16 bits • Rules to shorten it: • Leave out leading zeros in each group • If have contiguous groups of zeros • Can replace with double colons • 2nd block of zeros … leave one zero in each group • Can only extrapolate to one missing set • 2001:db8:3c4d:12::1234:56ab

Special addresses • 0:0:0:0:0:0:0:1 or ::1 • Loopback, like IPv4's 127.0.0.1 • 0:0:0:0:0:0:142.156.113.3 ::8e9c:7103 • IP4-over-IP6 network starts with 12 bytes of zeros • 2000::/3  starting with 001 • Global unicast • FC00::/7  starting with 1111 110 • Unique unicast • FE80::/10  starting with 1111 1110 10 • Link-local unicast • FF00::/8  starting with 1111 1111 • Multicast

ICMP • ICMP: Internet Control Message Protocol • Used to return messages about a destination • Unreachable: device is down or too far away • ping & tracert use ICMP • ping 142.156.113.3 • If target replies • Have a path to it & ping shows response-times • If not • Target is down or not reachable • ping www.conestogac.on.ca • Also used to determine if DNS server is accessible & responding • Resolves URL to IP address • Pings IP address • tracert – trace route • Pings 1 hop, then 2 hops, then 3 hops … • Tells you about each device on route to destination • ...if they're configured to respond

ARP • Address Resolution Protocol • Know IP address of destination • Need to know MAC address • To get through Data Link layer • MAC not necessarily the final destination • Also used to forward to default gateway • ARP sent to broadcast MAC address • "who's IP address is this?" • Response is unicast: • target MAC to requester MAC

RARP • Reverse ARP • Diskless devices • Requests an IP address from RARP server • Superseded by • DHCP • dynamic host configuration protocol • Which uses bootp – boot protocol

Proxy ARP • Router intercepts an ARP for a machine in another subnet • Needs proxy ARP function turned on • Router sends own ARP to destination subnet • Listing its MAC as requester • Routers responds to original requester • Listing its MAC as respondent • Original requester now sends traffic to router MAC • Router acts like "man in the middle" • Forwards traffic, impersonating requester • Used when require more than one default gateway

OSI Layer 3 – Network DOD: "Internet Layer"