1. 2017 session 1 TELE3118: Network Technologies Week 5: Network Layer Data Plane: Forwarding, Features
Some slides have been adapted from:
Computer Networking: A Top Down Approach, 7th (global) edition. Jim Kurose, Keith Ross. Pearson, April All material copyright J.F Kurose and K.W. Ross, All Rights Reserved.
Computer Networks, 5th edition. Andrew S. Tanenbaum, David J. Wetherall, Pearson, 2010.
Network Layer

2. IP Forwarding IP datagram: Case I: hosts in same LAN (A B)
misc
fields
source
IP addr
dest
data A
Case I: hosts in same LAN (A B)
Case II: hosts in different LANs (A  E)
A note on terminology:
Switch (bridge) vs. Router
Hardware vs. software?
layer-2 vs. layer-3? B E
Network Layer

3. Case I: hosts in same LAN
misc
fields
data
routing table at A
Dest
Mask
Next-hop 24 L:
Starting at A, dest. B:
look up dest-IP in routing table
dest is in LAN on interface
send datagram directly to B in Ethernet frame
how to determine B’s Ethernet MAC address? A B E
B’s MAC
addr
A’s MAC
A’s IP
B’s IP
IP payload
datagram
frame
frame source,
dest address
datagram source,
Network Layer

4. ARP: address resolution protocol
Question: how to determine
interface’s MAC address, knowing its IP address?
ARP table: each IP node (host, router) on LAN has table
IP/MAC address mappings for some LAN nodes:
< IP address; MAC address; TTL>
TTL (Time To Live): time after which address mapping will be forgotten (typically 20 min)
1A-2F-BB AD
LAN
71-65-F7-2B-08-53
58-23-D7-FA-20-B0
0C-C4-11-6F-E3-98
Link Layer and LANs

5. ARP protocol: same LAN A wants to send datagram to B
B’s MAC address not in A’s ARP table.
A broadcasts ARP query packet, containing B's IP address
destination MAC address = FF-FF-FF-FF-FF-FF
all nodes on LAN receive ARP query
B receives ARP packet, replies to A with its (B's) MAC address
frame sent to A’s MAC address (unicast)
A caches (saves) IP-to-MAC address pair in its ARP table until information becomes old (times out)
soft state: information that times out (goes away) unless refreshed
ARP is “plug-and-play”:
nodes create their ARP tables without intervention from net administrator
Link Layer and LANs

6. Case II: hosts in different LANs
routing table at A
misc
fields
data
Dest
Mask
Next-hop 24 L:
Starting at A, dest. E:
look up network address of E in routing table
E on different network
A, E not directly attached
routing table: next hop router to E is
link layer sends datagram to router in Ethernet frame (ARP)
datagram arrives at
continued….. A B E
Network Layer

7. Case II (contd.) routing table in router
misc
fields
data
Dest
Mask
Next-hop 24 L: L: L:
Arriving at , destined for
look up network address of E in router’s routing table
E on same network as router’s interface
router, E directly attached
link layer sends datagram to in Ethernet frame via interface (ARP)
datagram arrives at !!! (hooray!) A B E
Network Layer

8. Routing to another LAN walkthrough: send datagram from A to B via R
focus on addressing – at IP (datagram) and MAC layer (frame)
assume A knows B’s IP address
assume A knows IP address of first hop router, R (how?)
assume A knows R’s MAC address (how?) R
1A-23-F9-CD-06-9B
E6-E BB-4B
CC-49-DE-D0-AB-7D
C-E8-FF-55 A
49-BD-D2-C7-56-2A
88-B2-2F-54-1A-0F B
Link Layer and LANs

9. Routing to another LAN B A R
A creates IP datagram with IP source A, destination B
A creates link-layer frame with R's MAC address as destination address, frame contains A-to-B IP datagram
MAC src: C-E8-FF-55
MAC dest: E6-E BB-4B IP
Eth
Phy
IP src:
IP dest: R
1A-23-F9-CD-06-9B
E6-E BB-4B
CC-49-DE-D0-AB-7D
C-E8-FF-55 A
49-BD-D2-C7-56-2A
88-B2-2F-54-1A-0F B
Link Layer and LANs

10. Routing to another LAN B A R frame sent from A to R
frame received at R, datagram removed, passed up to IP
MAC src: C-E8-FF-55
MAC dest: E6-E BB-4B
IP src:
IP dest:
IP src:
IP dest: IP
Eth
Phy IP
Eth
Phy R
1A-23-F9-CD-06-9B
E6-E BB-4B
CC-49-DE-D0-AB-7D
C-E8-FF-55 A
49-BD-D2-C7-56-2A
88-B2-2F-54-1A-0F B
Link Layer and LANs

11. Routing to another LAN B A R
R forwards datagram with IP source A, destination B
R creates link-layer frame with B's MAC address as destination address, frame contains A-to-B IP datagram
MAC src: 1A-23-F9-CD-06-9B
MAC dest: 49-BD-D2-C7-56-2A IP
Eth
Phy
IP src:
IP dest: IP
Eth
Phy R
1A-23-F9-CD-06-9B
E6-E BB-4B
CC-49-DE-D0-AB-7D
C-E8-FF-55 A
49-BD-D2-C7-56-2A
88-B2-2F-54-1A-0F B
Link Layer and LANs

12. Routing to another LAN B A R
R forwards datagram with IP source A, destination B
R creates link-layer frame with B's MAC address as destination address, frame contains A-to-B IP datagram
IP src:
IP dest:
MAC src: 1A-23-F9-CD-06-9B
MAC dest: 49-BD-D2-C7-56-2A IP
Eth
Phy IP
Eth
Phy R
1A-23-F9-CD-06-9B
E6-E BB-4B
CC-49-DE-D0-AB-7D
C-E8-FF-55 A
49-BD-D2-C7-56-2A
88-B2-2F-54-1A-0F B
Link Layer and LANs

13. Routing to another LAN B A R
R forwards datagram with IP source A, destination B
R creates link-layer frame with B's MAC address as dest, frame contains A-to-B IP datagram
MAC src: 1A-23-F9-CD-06-9B
MAC dest: 49-BD-D2-C7-56-2A
IP src:
IP dest: IP
Eth
Phy B A R
49-BD-D2-C7-56-2A
C-E8-FF-55
1A-23-F9-CD-06-9B
E6-E BB-4B
CC-49-DE-D0-AB-7D
88-B2-2F-54-1A-0F
* Check out the online interactive exercises for more examples:
Link Layer and LANs

14. To switch or route? Assume unicast traffic Lookup dMAC in MAC-table1 3 ??
sMAC dMAC sIP dIP ----Data----
vlan 100
vlan 200 2 4
Assume unicast traffic
Lookup dMAC in MAC-table
If (dMAC ≠ interface MAC)  switch
switch (bridge) the frame as is onto learnt port
Else frame is for upper layer (IP)  route
Lookup dest-IP in routing table (discard if no match)
Determine next hop MAC addr (ARP table)
Send datagram with new Ethernet header
Network Layer

15. Switch-Router MAC table
VLAN
MAC address
port 3 10 6
00-4E-3A-02-08
Self 4 76 A3 7 8 B
2018
00-4E-3A-02-10
router IP interfaces
on VLANs 3 and 2018
No router IP interface
on VLAN 76
Network Layer

16. Switch-Router routing table
local
destination
mask
next-hop
default route 8 20 23 24 L
/24
/24
LAN interfaces
/24
Network Layer

17. Unicast forwarding algorithm
Host receive:
dest-MAC
address
mine?
Send:
yes
extract IP
datagram
Determine
most specific
match in routing
table no
dest-IP
address
mine? no
found
one? no
yes
discard
yes
local
intf?
drop
packet
yes no
pass datagram
data to upper layer
dest on
same LAN.
nh-IP = dest-IP
next-hop
is router.
nh-IP = gway-IP
Switch/router
receive:
dest-MAC
address
mine?
yes
extract IP
datagram
nh-IP in
ARP table?
send ARP
request and
wait for response no no
switch
Ethernet
frame
yes
dest-IP
address
mine?
get ARP
response and
fill in ARP table no
Route IP
datagram
yes
construct
Ethernet
header and
send frame
pass datagram
data to
upper layer
Network Layer

18. IP/Ethernet configuration
Dest
Mask
Gateway 24 L:
IP interface: /24
Interface route
/24
/24
/24
/24
/24
/24 B A
what’s going on ?? C
/16
Network Layer

19. IP/Ethernet configuration
Dest
Mask
Gateway 24 L:
/24
default route:
/24
default route:
/24
/24
Internet
Network Layer

20. IP/Ethernet configuration
/16
default route: A
/24
/24 B D
switch
/24
default route:
/24
default route:
router C
/24
default route:
IP reachability: to
A B C D
from A B C D
---
Network Layer

21. 32 bit destination IP address
IP datagram format
IP protocol version
number
ver
length
32 bits
data
(variable length,
typically a TCP
or UDP segment)
16-bit identifier
header
checksum
time to
live
32 bit source IP address
head.
len
type of
service
flgs
fragment
offset
upper
layer
32 bit destination IP address
options (if any)
total datagram
length (bytes)
header length
(bytes)
“type” of data
for
fragmentation/
reassembly
max number
remaining hops
(decremented at
each router)
upper layer protocol
to deliver payload to
e.g. timestamp,
record route
taken, specify
list of routers
to visit.
how much overhead?
20 bytes of TCP
20 bytes of IP
= 40 bytes + app layer overhead
Network Layer: Data Plane

22. IP fragmentation, reassembly
network links have MTU (max.transfer size) - largest possible link-level frame
different link types, different MTUs
large IP datagram divided (“fragmented”) within net
one datagram becomes several datagrams
“reassembled” only at final destination
IP header bits used to identify, order related fragments …
fragmentation:
in: one large datagram
out: 3 smaller datagrams
reassembly …
Network Layer: Data Plane

23. IP fragmentation, reassemblyID =x
offset =0
fragflag
length
=4000
example:
4000 byte datagram
MTU = 1500 bytes ID =x
offset =0
fragflag =1
length
=1500
=185
=370
=1040
one large datagram becomes
several smaller datagrams
1480 bytes in data field
offset =
1480/8
Network Layer: Data Plane

24. ICMP: Internet Control Message Protocol
used by hosts & routers to communicate network-level information
error reporting: unreachable host, network, port, protocol
echo request/reply (used by ping)
network-layer “above” IP:
ICMP msgs carried in IP datagrams
ICMP message: type, code plus first 8 bytes of IP datagram causing error
Type Code description
echo reply (ping)
dest. network unreachable
dest host unreachable
dest protocol unreachable
dest port unreachable
dest network unknown
dest host unknown
source quench (congestion
control - not used)
echo request (ping)
route advertisement
router discovery
TTL expired
bad IP header
Network Layer

25. Traceroute and ICMP Source sends series of UDP segments to dest
First has TTL =1
Second has TTL=2, etc.
Unlikely port number
When nth datagram arrives to nth router:
Router discards datagram
And sends to source an ICMP message (type 11, code 0)
Message includes name of router& IP address
When ICMP message arrives, source calculates RTT
Traceroute does this 3 times
Stopping criterion
UDP segment eventually arrives at destination host
Destination returns ICMP “host unreachable” packet (type 3, code 3)
When source gets this ICMP, stops.
Network Layer

26. IPv6: motivation
initial motivation: 32-bit address space soon to be completely allocated.
additional motivation:
header format helps speed processing/forwarding
header changes to facilitate QoS
IPv6 datagram format:
fixed-length 40 byte header
no fragmentation allowed
Network Layer: Data Plane

27. IPv6 datagram format
priority: identify priority among datagrams in flow
flow Label: identify datagrams in same “flow.”
(concept of“flow” not well defined).
next header: identify upper layer protocol for data
ver
pri
flow label
payload len
next hdr
hop limit
source address
(128 bits)
destination address
(128 bits)
data
32 bits
Network Layer: Data Plane

28. Other changes from IPv4
checksum: removed entirely to reduce processing time at each hop
options: allowed, but outside of header, indicated by “Next Header” field
ICMPv6: new version of ICMP
additional message types, e.g. “Packet Too Big”
multicast group management functions
Network Layer: Data Plane

29. Transition from IPv4 to IPv6
not all routers can be upgraded simultaneously
no “flag days”
how will network operate with mixed IPv4 and IPv6 routers?
tunneling: IPv6 datagram carried as payload in IPv4 datagram among IPv4 routers
IPv4 header fields
UDP/TCP payload
IPv6 source dest addr
IPv6 header fields
IPv4 payload
IPv4 source, dest addr
IPv6 datagram
IPv4 datagram
Network Layer: Data Plane

30. connecting IPv6 routers
Tunneling
logical view:
IPv4 tunnel
connecting IPv6 routers E
IPv6 F A B A B
IPv6 C D E
IPv6 F
physical view:
IPv4
IPv4
Network Layer: Data Plane

31. connecting IPv6 routers
Tunneling
logical view:
IPv4 tunnel
connecting IPv6 routers E
IPv6 F A B A B
IPv6 C D E
IPv6 F
physical view:
IPv4
IPv4
flow: X
src: A
dest: F
data
A-to-B:
IPv6
Flow: X
Src: A
Dest: F
data
src:B
dest: E
B-to-C:
IPv6 inside
IPv4
B-to-C:
IPv6 inside
IPv4
Flow: X
Src: A
Dest: F
data
src:B
dest: E
E-to-F:
IPv6
flow: X
src: A
dest: F
data
Network Layer: Data Plane

32. IPv6: adoption Google: 8% of clients access services via IPv6
NIST: 1/3 of all US government domains are IPv6 capable
Long (long!) time for deployment, use
20 years and counting!
think of application-level changes in last 20 years: WWW, Facebook, streaming media, Skype, …
Why?
Network Layer: Data Plane

33. Future of IPv6?
hourglass  wineglass?
Network Layer

34. Generalized Forwarding and SDN
Each router contains a flow table that is computed and distributed by a logically centralized routing controller
logically-centralized routing controller
control plane
data plane
local flow table
headers counters actions 1 2 3
values in arriving
packet’s header
Network Layer: Data Plane

35. OpenFlow data plane abstraction
flow: defined by header fields
generalized forwarding: simple packet-handling rules
Pattern: match values in packet header fields
Actions: for matched packet: drop, forward, modify, matched packet or send matched packet to controller
Priority: disambiguate overlapping patterns
Counters: #bytes and #packets
Flow table in a router (computed and distributed by controller) define router’s match+action rules
Network Layer: Data Plane

36. OpenFlow data plane abstraction
flow: defined by header fields
generalized forwarding: simple packet-handling rules
Pattern: match values in packet header fields
Actions: for matched packet: drop, forward, modify, matched packet or send matched packet to controller
Priority: disambiguate overlapping patterns
Counters: #bytes and #packets
* : wildcard
src=1.2.*.*, dest=3.4.5.*  drop
src = *.*.*.*, dest=3.4.*.*  forward(2)
3. src= , dest=*.*.*.*  send to controller

37. OpenFlow: Flow Table Entries
Rule
Action
Stats
Packet + byte counters
Forward packet to port(s)
Encapsulate and forward to controller
Drop packet
Send to normal processing pipeline
Modify Fields
Now I’ll describe the API that tries to meet these goals.
Switch
Port
VLAN ID
MAC
src
MAC
dst
Eth
type IP
Src IP
Dst IP
Prot
TCP
sport
TCP
dport
Link layer
Network layer
Transport layer 37

38. Examples Destination-based forwarding: Firewall:
Switch
Port
MAC
src
dst
Eth
type
VLAN ID IP
Src
Dst
Prot
TCP
sport
dport
Action * * * * * * * * *
port6
IP datagrams destined to IP address should be forwarded to router output port 6
Firewall:
Switch
Port
MAC
src
dst
Eth
type
VLAN ID IP
Src
Dst
Prot
TCP
sport
dport
Forward * * * * * * * * * 22
drop
do not forward (block) all datagrams destined to TCP port 22
Switch
Port
MAC
src
dst
Eth
type
VLAN ID IP
Src
Dst
Prot
TCP
sport
dport
Forward
drop * * * * * * * * *
do not forward (block) all datagrams sent by host

39. Examples Destination-based layer 2 (switch) forwarding:
Port
MAC
src
dst
Eth
type
VLAN ID IP
Src
Dst
Prot
TCP
sport
dport
Action *
22:A7:23:
11:E1:02 * * * * * * * *
port3
layer 2 frames from MAC address 22:A7:23:11:E1:02 should be forwarded to output port 6
Network Layer: Data Plane

40. OpenFlow abstraction match+action: unifies different kinds of devices
Router
match: longest destination IP prefix
action: forward out a link
Switch
match: destination MAC address
action: forward or flood
Firewall
match: IP addresses and TCP/UDP port numbers
action: permit or deny
NAT
match: IP address and port
action: rewrite address and port
Network Layer: Data Plane

41. OpenFlow example
Example: datagrams from hosts h5 and h6 should be sent to h3 or h4, via s1 and from there to s2
IP Src = 10.3.*.*
IP Dst = 10.2.*.*
forward(3)
match
action
Host h6
controller 1 s3 2 4 3
Host h5 s1 1 s2 1 2
Host h4 4 2 4
ingress port = 2
IP Dst =
IP Dst =
forward(3)
match
action
forward(4)
ingress port = 1
IP Src = 10.3.*.*
IP Dst = 10.2.*.*
forward(4)
match
action
Host h1 3 3
Host h2
Host h3

42. Network Layer Data Plane: done!
Overview of Network layer: data plane and control plane
IP addressing; DHCP/NAT
What’s inside a router
IP forwarding
Switching vs routing
Datagram format
Fragmentation
ICMP
IPv6
SDN
match plus action
OpenFlow example
Question: how do forwarding tables (destination-based forwarding) or flow tables (generalized forwarding) computed? Answer: by the control plane (next week)
Network Layer: Data Plane