1. The Network Layer Role Services Main Functions Standard Functions
Datagram
Virtual Circuit
Main Functions
Path Determination
Packet Switching
Standard Functions
17/11/10
11-Network

2. The Role of the Network Layer
The role of the network layer is to move data from the sending host to the destination host across one or more subnetworks
It hides the details of the type of subnetwork from the transport layer
17/11/10
11-Network

3. Network Layer - Services
There are two alternative network layer services
Datagram or Connectionless (E.g. The Internet)
All packets contain a full destination network address which is used for routing
Each packet is routed independently
Virtual Circuit or Connection-oriented (E.g. X.25 Packet Layer Protocol, Asynchronous Transfer Mode, Frame Relay)
A virtual circuit is established before data transfer which sets up a path that is released afterwards
Each packet is routed via the same path using virtual circuit numbers
17/11/10
11-Network

4. Connectionless Network Layer
Characteristics
No prior set-up required. Just adds a header and sends the packet
Packets are routed independently and may follow different paths
Best effort service. No guaranties about delivery, order or duplication
Simple and flexible. Can support many different types of application, as most of the complexity is all in the hosts.
17/11/10
11-Network

5. Connection-oriented Network Layer
Characteristics
Connection set-up and release involves all the nodes on the path
Once connection is established, virtual circuit number (only unique to each link) not addresses are used
Each node holds state information (virtual circuit mapping information and buffers)
Can provide guaranty that data will be delivered in order without loss and without duplication
Complexity is in the network nodes rather than the hosts
17/11/10
11-Network

6. Datagrams versus Virtual Circuits
© Tanenbaum, Prentice Hall International
17/11/10
11-Network

7. Network Layer – Main Functions
Two main functions:
Path Determination
Maintenance of routing tables for datagrams or for virtual circuit setup
Packet Switching
Forwarding packets to the next node using routing tables or virtual circuit mappings
17/11/10
11-Network

8. Network Layer - Standard Functions
Segmentation (Fragmentation)
Encapsulation
Addressing
Flow Control
Grade of Service (ATM)
Connection Control
Ordered Delivery
Security (IPSec)
17/11/10
11-Network

9. Network Layer - Segmentation
Segmentation is often called fragmentation in the network layer
Different subnetworks have different Maximum Transfer Unit (MTU) sizes (1500 for Ethernet, 48 bytes for ATM)
The network layer must fragment any data that it receives that is larger than the network’s MTU size. (Maximum packets size in IP is 65,535 bytes but maximum packet sizes of subnetworks are usually much lower)
Fragments can be reassembled at gateways between networks (ATM) or at the network layer in the destination host (IP)
17/11/10
11-Network

10. Network Layer - Encapsulation
At the sending end, the network layer receives a segment from the transport layer, adds network layer headers and passes a packet to the data link layer
At the receiving end, the network layer receives a packet from the data link layer, processes the packet header, strips off the header and passes the segment to the transport layer
17/11/10
11-Network

11. Network Layer - Addressing
Network Layer Addresses must be globally unique so that all hosts and other network components can be unambiguously identified
Allocation of network layer addresses has to be carefully managed to ensure uniqueness
Destination network addresses are used for routing packets and setting up virtual circuits
17/11/10
11-Network

12. Network Layer – Flow/Congestion Control
Virtual circuit networks can implement sliding window flow control on each virtual circuit
Virtual circuit networks can also prevent new virtual circuits being established (this is known as admission control) or ensure that new virtual circuits are routed away from the congested part of the network
Both virtual circuit and datagram networks can control congestion by issuing source quench or choke packets to cause the sender to back off
As a last resort routers can discard packets
17/11/10
11-Network

13. Network Layer – Congestion Control
One of the main cause of congestion is that traffic is bursty.
Traffic shaping smoothes out bursty traffic
When setting up a virtual circuit, the sender can predict its traffic pattern
The network contracts to support this traffic pattern when it sets up the virtual circuit
The sender can regulate its traffic rate using the techniques such as the leaky or token bucket algorithms
17/11/10
11-Network

14. Leaky Bucket Algorithm
© Tanenbaum, Prentice Hall International
17/11/10
11-Network

15. Token Bucket Algorithm
© Tanenbaum, Prentice Hall International
For a packet to be transmitted, a token must be captured and destroyed
This algorithm allows bursts up to a maximum length
17/11/10
11-Network

16. Flow Specification
An agreement between the sender, the receiver and the subnetwork to describe the characteristics of the input traffic and the quality of service expected
17/11/10
11-Network

17. Flow Specification © Tanenbaum, Prentice Hall International 17/11/10
11-Network

18. Network Layer – Grade of Service
Virtual circuit network layers such as ATM can support grade of service
ATM supports the following services
Constant Bit Rate (CBR)
Variable Bit Rate (VBR)
Real Time (RT-VBR)
Non-Real Time (NRT-VBR)
Available Bit Rate (ABR)
Unspecified Bit Rate (UBR)
17/11/10
11-Network

19. Network Layer - Grade of Service
Virtual circuit network layers such as ATM will allow number of quality of service parameters to be specified in a contract between the customer and the network operator
The customer is responsible to shape the traffic to match the contract
The network operator is responsible for delivering the quality of service specified and for policing the traffic to ensure that it meets the contract
17/11/10
11-Network

20. Asynchronous Transfer Mode (ATM)
ATM (sometimes also called Cell Relay) is a suite of protocol designed to carry multiple services such as voice, video and data
It was designed to meet the requirements of Broadband ISDN to be provided by telecommunications companies and is very complex
The ATM network layer protocol is connection-oriented
All data is segmented into 48 byte cells which are transmitted with a 5 byte header
Most carriers currently run their IP networks on top of ATM, as unlike IP it can guaranty quality of service
17/11/10
11-Network

21. ATM Service Categories
© Tanenbaum, Prentice Hall International
17/11/10
11-Network

22. Network Layer – Connection Control
Only relevant to virtual circuit networks which must provide the facility to establish and release virtual circuits
Virtual circuits can be:
Permanent (PVCs), set up by the network administrator
Switched (SVCs) set up and released by network users
17/11/10
11-Network

23. Network Layer –SVC Establishment
Switched Virtual Circuits are established in response to a user request which specifies the destination address
A path across the network is found, resources at each router/switch are allocated and each router/switch stores a mapping between an incoming virtual circuit number and an outgoing port and virtual circuit number
The distant host accepts the virtual circuit and this is confirmed to all the routers and to the connecting host
17/11/10
11-Network

24. Virtual Circuit Mapping
Router
Host
VC # 12
VC # 23
When a virtual circuit is established a virtual circuit number is allocated for each link. All the routers/switches in the path must maintain a table that maps the incoming virtual circuit number with an output port and an outgoing virtual circuit number.
Routing with virtual circuits is simply a matter of looking up the incoming VC number in the table to obtain the output port and VC number
This is an example of state information. If a router crashes the mapping is lost and the whole virtual circuit has to be re-established
17/11/10
11-Network

25. Network Layer – Ordered Delivery
Only relevant to virtual circuit networks
All packets follow the same route, are given sequence numbers and are acknowledged
The remote network layer is therefore able to ensure that all data is delivered in the correct order
17/11/10
11-Network

26. Network Layer - Security
Security can be implemented in the network layer by encrypting all the data inside network layer packets
It must also be possible to provide source authentication so that destinations can be sure that data originated from an authentic source
IPSec is a secure network layer protocol suite that makes IP datagrams secure
17/11/10
11-Network

27. IPSec Protocol IPSec is based on two principle alternative protocols
Authentication Header (AH) Protocol
Provides authentication, and data integrity but not confidentiality
Encapsulation Security Payload (ESP) Protocol
Provide authentication, data integrity and confidentiality
Both protocols work by establishing a network layer logical connection between the source and destination called a Security Association
17/11/10
11-Network

28. AH Protocol
The AH protocol header sits between the IP header and the TCP or UDP header
It contains a digital signature that authenticate the sender and allows the IP data fields and some IP header fields such as the source address to be checked for data integrity
17/11/10
11-Network

29. ESP Protocol
The ESP protocol header sits between the IP header and the TCP or UDP header
There is also an ESP trailer that is inserted after the TCP/UDP segment
Following this trailer is an ESP authentication data field
The TCP/UDP segment and the ESP Trailer are both encrypted before transmission
17/11/10
11-Network

30. ESP Tunnel Mode
To further enhance security the encryption can be extended to the whole IP datagram (including its headers) and the whole datagram encapsulated inside another IP packet with an ESP header and trailer
This is usually done between two firewall routers and the original IP datagrams appear to pass through a tunnel between the two firewall routers. The header and contents of the original datagrams are completely invisible when they are in the tunnel
17/11/10
11-Network