IP Forwarding Relates to Lab 3. Covers the principles of end-to-end

IP Forwarding Relates to Lab 3. Covers the principles of end-to-end datagram delivery in IP networks. 1

Delivery of an IP datagram View at the data link layer layer: – Internetwork is a collection of LANs or point-to-point links or switched networks that are connected by routers R1 R2 Point-to-point link Point-to-point link Network of Ethernet switches H2 Ethernet IP R3 H1 Ethernet R4 Token Ring LAN 2

Delivery of an IP datagram View at the IP layer: – An IP network is a logical entity with a network number – The IP delivery service thinks of IP networks as “clouds”, ignoring the data link layer view R2 R1 10.2.1.0/24 20.2.1.0/28 H2 10.1.2.0/24 IP 10.1.0.0/24 H1 20.1.0.0/16 10.3.0.0/16 R3 R4 3

Tenets of end-to-end delivery of datagrams The following conditions must hold so that an IP datagram can be successfully delivered 1. The Thenetwork networkprefix prefixof ofan anIP IPdestination destinationaddress addressmust must 1. correspondto toaaunique uniquedata datalink linklayer layer network network ( LAN ( LANor or correspond point-to-point link linkor orswitched switchednetwork). network). point-to-point (Thereverse reverseneed neednot not be betrue!) true!) (The 2. Routers Routersand andhosts hoststhat thathave have aacommon common network network prefix prefix 2. mustbe beable ableto toexchange exchangeIP IPdagrams dagramsusing usingaadata datalink link must protocol(e.g., (e.g.,Ethernet, Ethernet, PPP) PPP) protocol 3. AAsequence sequenceof of alternating alternatingdata data link link layers layersand androuters routersmust must 3. existfrom from the thesource sourceto tothe thedestination. destination. exist 4

Routing tables Each router and each host keeps a routing table which tells the router how to process an outgoing packet, i.e., take it closer to destination Main columns: 1. 2. 3. Destination address: where is the IP datagram going to? Next hop: how to send the IP datagram? Interface: what is the output port? Destination Routing table of a host or router IP datagrams can be directly delivered ( “direct”) or is sent to a router (“R4”) 10.1.0.0/24 10.1.2.0/24 10.2.1.0/24 10.3.1.0/24 20.1.0.0/16 20.2.1.0/28 Next interface Hop direct direct R4 direct R4 R4 eth0 eth0 serial0 eth1 eth0 eth0 5

Delivery with routing tables D e s tin a tio n 1 0 .1 .0 .0 /2 4 1 0 .1 .2 .0 /2 4 1 0 .2 .1 .0 /2 4 1 0 .3 .1 .0 /2 4 2 0 .2 .0 .0 /1 6 3 0 .1 .1 .0 /2 8 N ext H op R3 d ire c t d ire c t R3 R2 R2 D e s tin a tio n 1 0 .1 .0 .0 /2 4 1 0 .1 .2 .0 /2 4 1 0 .2 .1 .0 /2 4 1 0 .3 .1 .0 /2 4 2 0 .1 .0 .0 /1 6 2 0 .2 .1 .0 /2 8 N ext H op R1 R1 d ire c t R4 d ire c t d ire c t D e s tin a tio n 1 0 .1 .0 .0 /2 4 1 0 .1 .2 .0 /2 4 1 0 .2 .1 .0 /2 4 1 0 .3 .1 .0 /2 4 2 0 .1 .0 .0 /1 6 2 0 .2 .1 .0 /2 8 N ext H op R2 R2 R2 R2 R2 d ire c t R2 R1 1 0 .2 .1 .0 /2 4 2 0 .2 .1 .0 /2 8 H2 1 0 .1 .2 .0 /2 4 to: 20.2.1.2 1 0 .1 .0 .0 /2 4 H1 D e s tin a tio n 1 0 .1 .0 .0 /2 4 1 0 .1 .2 .0 /2 4 1 0 .2 .1 .0 /2 4 1 0 .3 .1 .0 /2 4 2 0 .1 .0 .0 /1 6 2 0 .2 .1 .0 /2 8 N ext H op d ire c t R3 R3 R3 R3 R3 2 0 .2 .1 .2 /2 8 2 0 .1 .0 .0 /1 6 1 0 .3 .0 .0 /1 6 R3 D e s tin a tio n 1 0 .1 .0 .0 /2 4 1 0 .1 .2 .0 /2 4 1 0 .2 .1 .0 /2 4 1 0 .3 .1 .0 /2 4 2 0 .1 .0 .0 /1 6 2 0 .2 .1 .0 /2 8 R4 N ext H op d ire c t d ire c t R4 d ire c t R4 R4 D e s tin a tio n 1 0 .1 .0 .0 /2 4 1 0 .1 .2 .0 /2 4 1 0 .2 .1 .0 /2 4 1 0 .3 .1 .0 /2 4 2 0 .1 .0 .0 /1 6 2 0 .2 .1 .0 /2 8 N ext H op R3 R3 R2 d ire c t d ire c t R2 6

Delivery of IP datagrams There are two distinct processes to delivering IP datagrams: 1. Forwarding: How to pass a packet from an input interface to the output interface? 2. Routing: How to find and setup the routing tables? Forwarding must be done as fast as possible: – on routers, is often done with support of hardware – on PCs, is done in kernel of the operating system Routing is less time-critical – On a PC, routing is done as a background process 7

Processing of an IP datagram in IP Routing Protocol Static routing UDP TCP Demultiplex Yes routing table Lookup next hop Yes IP forwarding enabled? No Destination address local? No IP module Send datagram Discard Input queue Data Link Layer IP router: IP forwarding enabled Host: IP forwarding disabled 8

Processing of an IP datagram in IP Processing IP datagrams very similar on IP router and host – Main difference: “IP forwarding” is enabled on router and disabled on host by default IP forwarding enabled if a datagram is received, but it is not for the local system, the datagram will be sent to a different system IP forwarding disabled if a datagram is received, but it is not for the local system, the datagram will be dropped 9

Processing of an IP datagram at a router Receive an IP datagram 1. 2. 3. 4. 5. 6. 7. 8. 9. IP header validation Process options in IP header Parsing the destination IP address Routing table lookup Decrement TTL Perform fragmentation (if necessary) Calculate checksum Transmit to next hop Send ICMP packet (if necessary) 10

Routing table lookup Routing table lookup: Use the IP destination address as a key to search the routing table. Destination address Next hop/ interface network prefix or host IP address or loopback address or default route IP address of next hop router or Name of a network interface 11

Type of routing table entries Network route – Destination addresses is a network address (e.g., 10.0.2.0/24) – Most entries are network routes Host route – Destination address is an interface address (e.g., 10.0.1.2/32) – Used to specify a separate route for certain hosts Default route – Used when no network or host route matches – The router that is listed as the next hop of the default route is the default gateway (for Cisco: “gateway of last resort) Loopback address – Routing table for the loopback address (127.0.0.1) – The next hop lists the loopback (lo0) interface as outgoing interface 12

Routing table lookup: Longest Prefix Match Longest Prefix Match: Search for the routing table entry that has the longest match with the prefix of the destination IP address 1. Search for a match on all 32 bits 2. Search for a match for 31 bits . 32. Search for a mach on 0 bits Host route, loopback entry 32-bit prefix match Default route is represented as 0.0.0.0/0 0-bit prefix match 128.143.71.21 Destination address Next hop 10.0.0.0/8 128.143.0.0/16 128.143.64.0/20 128.143.192.0/20 128.143.71.0/24 128.143.71.55/32 default R1 R2 R3 R3 R4 R3 R5 The longest prefix match for 128.143.71.21 is for 24 bits with entry 128.143.71.0/24 Datagram will be sent to R4 13

Route Aggregation Longest prefix match algorithm permits to aggregate prefixes with identical next hop address to a single entry This contributes significantly to reducing the size of routing tables of Internet routers Destination Next Hop Destination Next Hop 10.1.0.0/24 10.1.2.0/24 10.2.1.0/24 10.3.1.0/24 20.2.0.0/16 30.1.1.0/28 R3 direct direct R3 R2 R2 10.1.0.0/24 10.1.2.0/24 10.2.1.0/24 10.3.1.0/24 20.0.0.0/8 R3 direct direct R3 R2 14

How do routing tables get updated? Adding an interface: – Configuring an interface eth2 with 10.0.2.3/24 adds a routing table entry: Adding a default gateway: – Configuring 10.0.2.1 as the default gateway adds the entry: Destination Next Hop/ interface 10.0.2.0/24 eth2 Destination Next Hop/ interface 0.0.0.0/0 10.0.2.1 Static configuration of network routes or host routes Update of routing tables through routing protocols ICMP messages 15

Routing table manipulations with ICMP When a router detects that an IP datagram should have gone to a different router, the router (here R2) forwards the IP datagram to the correct router sends an ICMP redirect message to the host Host uses ICMP message to update its routing table R2 R1 Destination Next Hop 10.1.0.0/24 R1 (2) IP datagram (3) ICMP redirect (1) IP datagram Ethernet H1 Destination Next Hop 10.1.0.0/24 R2 R1 16

ICMP Router Solicitation ICMP Router Advertisement After bootstrapping, a host broadcasts an ICMP router R1 solicitation. In response, routers send an ICMP router advertisement message Routers also periodically broadcast ICMP router advertisement R2 ICMP router advertisement ICMP router advertisement ICMP router solicitation Ethernet Also called the Router Discovery Protocol H1 17

Proxy ARP Proxy ARP: Host or router responds to ARP Request that arrives from one of its connected networks for a host that is on another of its connected networks. Argon Neon Router137 128.143.137.144/16 128.143.137.1/16 00:e0:f9:23:a8:20 128.143.71.1/24 128.143.0.0/16 Subnet 128.143.171.21/24 00:20:af:03:98:28 128.143.71.0/24 Subnet ARP Request: What is the MAC address of 128.143.71.21? ARP Reply: The MAC address of 128.143.71.21 is 00:e0:f9:23:a8:20 18

Things to know about ARP What happens if an ARP Request is made for a non-existing host? Several ARP requests are made with increasing time intervals between requests. Eventually, ARP gives up. On some systems (including Linux) a host periodically sends ARP Requests for all addresses listed in the ARP cache. This refreshes the ARP cache content, but also introduces traffic. Gratuitous ARP Requests: A host sends an ARP request for its own IP address: – Useful for detecting if an IP address has already been assigned. 19

Vulnerabilities of ARP 1. No authentication: Since ARP does not authenticate requests or replies, ARP Requests and Replies can be forged 2. Stateless: ARP Replies can be sent without a corresponding ARP Request – According to the ARP protocol specification, a node receiving an ARP packet (Request or Reply) must update its local ARP cache with the information in the source fields, if the receiving node already has an entry for the IP address of the source in its ARP cache. (This applies for ARP Request packets and for ARP Reply packets) Example exploitation of these vulnerabilities: A forged ARP Request or Reply can be used to update the ARP cache of a remote system with a forged entry (ARP Poisoning) This can be used to redirect IP traffic to other hosts 20