1. More on TCP/IP
Module A
Copyright 2004 Prentice Hall Panko’s Business Data Networking and Telecommunications, 5th edition

2. Multiplexing

3. Multiplexing
IP packets can carry different things in their data fields
TCP segments
UDP datagrams
ICMP supervisory messages (later)
RIP messages (later)
IP Data Field
IP Header

4. Stream of Arriving or Outgoing IP Packets
Multiplexing
We say that IP can multiplex (mix) different types of traffic in a stream of IP packets
Single IP Packet
Carrying UDP Datagram
UDP
IP-H
TCP
IP-H
UDP
IP-H
ICMP
IP-H
Stream of Arriving or Outgoing IP Packets

5. Multiplexing
IP process must pass contents of arriving IP packets to the correct process for subsequent handling
TCP
UDP
UDP
IP-H IP
ICMP
Arriving
Packets
IP Process

6. Multiplexing
IP process must also accept messages from multiple processes and multiplex them on an outgoing stream
TCP
UDP
IP-H
UDP IP
ICMP
Outgoing
Packets
IP Process

7. Multiplexing
Need a Way for Receiving IP Process to Know What is in the Data Field
So it can pass the contents to the appropriate process
IP Data Field
IP Header

8. Multiplexing IP Header has an 8-bit Protocol field
Identifies the contents of the data field
1=ICMP (later), 8=TCP, 17=UDP, etc.
Version
(4)
Hdr Len
(4)
TOS (8)
Total Length in bytes (16)
Indication (16 bits)
Flags (3)
Fragment Offset (13)
Time to Live (8)
Protocol (8)
Header Checksum (16)
Source IP Address
Destination IP Address …

9. Multiplexing Other Messages have Analogous Fields TCP and UDP
Identify contents of data field
TCP and UDP
Have Port number fields
Identify the application process (80=HTTP)
Source Port # (16)
Destination Port # (16)
Sequence Number (32 bits)
Acknowledgement Number (32 bits)
Hdr Len
(4)
Reserved (6)
Flags (6)
Window Size (16)

10. Multiplexing Other Messages have Analogous Fields PPP
Identify contents of data field
PPP
Protocol field identifies contents of information field as IP, IPX, a supervisory message, etc.
Flag
Addr
Ctrl
Protocol
Info
CRC
Flag

11. TCP Sequence and Acknowledgement Numbers

12. TCP
TCP is Reliable
IP packets carrying TCP segments may arrive out of order
TCP must put the TCP segments in order 5 3 4 2 1

13. TCP
TCP is Reliable
Each correct TCP segment is acknowledged by the receiver
TCP Segment
Source
Transport
Process
Destination
Transport
Process
ACK

14. TCP Segment
Each TCP segment sent by a side must have a sequence number
Simplest: 1,2,3,4,5,6,7
To detect lost or out-of-sequence messages
TCP uses a more complex approach 3? 1 4 2 5

15. TCP Sequence Numbers TCP header has a 32-bit sequence number field
Source Port # (16)
Destination Port # (16)
Sequence Number (32 bits)
Acknowledgement Number (32 bits)
Hdr Len
(4)
Reserved (6)
Flags (6)
Window Size (16)
TCP Checksum (16)
Urgent Pointer (16)
Options (if any)
PAD
Data Field

16. with Initial Sequence Number (79)
TCP Sequence Numbers
Initial Sequence Number is randomly selected by the sender; Say, 79
Sent in the sequence number field of the first TCP segment
TCP Header 79
TCP Data Field
Sequence Number Field
with Initial Sequence Number (79)

17. TCP Sequence Numbers
Data octets in data fields of all segments in a connection are viewed as a long string
TCP Segment 1 79
TCP Segment
TCP Segment
ISN
3 Octets in Data Field
2 Octets in Data Field

18. TCP Sequence Numbers
Supervisory segments, which contain a header but no data, are treated as carrying a single octet of data
TCP seg
TCP seg 2 900
TCP seg …
Carries data
Supervisory segment
Carries data

19. TCP Sequence Numbers
Sequence number field gets the value of the first octet in the data field
TCP 1 79
TCP
TCP
79 is SeqNum Field Value
80 is SeqNum Field Value
83 is SeqNum Field Value

20. TCP Acknowledgements
Acknowledgement must indicate which TCP segment is being acknowledged
TCP Segment
Source
TCP
Process
Destination
TCP
Process
ACK

21. TCP Acknowledgements
TCP header contains a 32-bit Acknowledgement Number field to designate the TCP segment being acknowledged
Source Port # (16)
Destination Port # (16)
Sequence Number (32 bits)
Acknowledgement Number (32 bits)
Hdr Len
(4)
Reserved (6)
Flags (6)
Window Size (16)
TCP Checksum (16)
Urgent Pointer (16)
Options (if any)
PAD
Data Field

22. TCP Acknowledgment Numbers
Acknowledgement Number field contains the next byte expected--the last byte of the segment being acknowledged, plus one
TCP 1 79
TCP
TCP
80 is AckNum Field Value
83 is AckNum Field Value
85 is AckNum Field Value

23. TCP Acknowledgement Number
Quiz: A TCP segment contains the following data octets
567, 568, 569, 570, 571, 572, 573, 574
What will be in the sequence number field of the TCP segment delivering the data?
What will be in the acknowledgement number field of the TCP segment acknowledging the TCP segment that delivers these octets?

24. TCP Flow Control

25. TCP Flow Control Flow Control One TCP process transmits too fast
Other TCP process is overwhelmed
Receiver must control transmission rate
This is flow control
Too Much
Data
TCP Process
TCP Process
Flow Control Message

26. TCP Flow Control A TCP segment has a Window Size field
Used in acknowledgements
Source Port # (16)
Destination Port # (16)
Sequence Number (32 bits)
Acknowledgement Number (32 bits)
Hdr Len
(4)
Reserved (6)
Flags (6)
Window Size (16)
TCP Checksum (16)
Urgent Pointer (16)
Options (if any)
PAD
Data Field

27. Acknowledgement with Window Size Field
TCP Flow Control
A TCP segment has a Window Size field
Tell how many more octets the sender can send beyond the segment being acknowledged
Data
TCP Process
TCP Process
Acknowledgement with Window Size Field

28. TCP Flow Control Example TCP segment contained octets 45-89
Acknowledgement number for TCP segment acknowledging the segment is 90
If Window Size field value is 50, then
Sender may send through octet 140
Must then stop unless the window has been extended in another acknowledgement

29. TCP Flow Control
Each Acknowledgement extends the window of octets that may be sent
Called a sliding window protocol
1-44
45-79
80-419
May send through 480
400
1-44
45-79
80-419
May send through 920
500

30. TCP Fragmentation

31. Application Layer Message
TCP Fragmentation
TCP Segments have maximum data field sizes
(Size limit details are discussed later)
What if an application layer message is too large?
Application Layer Message
TCP Data Field Max
TCP Header

32. TCP Fragmentation Application layer message must be fragmented
Broken into several pieces
Delivered in separate TCP segments
App Frag 1
App Frag 2
App Frag 3
TCP Data Field Max
TCP Header

33. TCP Fragmentation
Note that, in TCP fragmentation, the TCP segment is NOT fragmented
The application layer message is fragmented
App Frag 1
App Frag 2
App Frag 3
TCP Data Field Max
TCP Header

34. TCP Fragmentation
Transport layer process on the source host does the fragmentation
Application layer on the source host is not involved
Transparent to the application layer
Application
Application Message
Transport
TCP Segment
TCP Segment
Internet

35. TCP Fragmentation
Transport layer process on the destination host does the reassembly
Application layer on the destination host is not involved; Gets original application layer message
Application
Application Message
TCP Segment
TCP Segment
Transport
Internet

36. TCP Fragmentation What is the maximum TCP data field size?
Complex
Maximum Segment Size (MSS)
Maximum size of a TCP segment’s data field
NOT maximum size of the segment as its name would suggest!!!

37. TCP Fragmentation MSS Default is 536 octets
Maximum IP packet size any network must support is 576 octets
Larger IP packets MAY be fragmented
IP and TCP headers are 20 octets each if there are no options
This gives the default MSS of 536
Smaller if there are options in the IP or TCP header

38. TCP Fragmentation MSS Default is 536 octets
Suppose the application layer process is 1,000 octets long
Two TCP segments will be needed to send the data
The first can send the first 536 octets
The second can carry the remaining 464 octets of the application layer message

39. TCP Fragmentation Each side MAY announce a larger MSS
An option usually used in the initial SYN message it sends to the other
If announces MSS of 2,048, this many octets of data may be sent in each TCP segments
536 is only the default—the value to use if no other value is specified by the other side

40. More on IP

41. Mask Operations Masks were introduced in Chapter 3
IP addresses alone do not tell you the size of their network or subnet parts
Network Mask
Has 1s in the network part
Has 0s in the remaining bits
Subnet Mask
Has 1s in the network plus subnet parts

42. Mask Operations Based on Logical AND Example
Both must be true for the result to be true
Example
Data
Mask
Result

43. Mask Operations Based on Logical AND Example
If mask bit is 1, get back original data
If mask bit is 0, bet back zero
Example
Data
Mask
Result

44. Mask Operations IP packet arrives at a router
Router sees destination IP address
Compares to each router forwarding table row
Address Part in First Entry
Mask in First Entry

45. Mask Operations Mask the IP destination Address
(IP address)
(mask)
(result)
Compare Result with First Entry Address part
(address part)
The Entry is a Match!

46. Mask Operations
Recap
Read destination IP address of incoming IP packet
For each entry in the router forwarding table
Read the mask (prefix)
Mask the incoming IP address
Compare the result with the entry’s IP address part
Do they match or not?

47. Mask Operations Simple for Computers
Computers have circuitry to AND to numbers
Computers have circuitry to COMPARE two numbers to see if they are equal or not
Very computer-friendly, so used on routers
Difficult for people, unfortunately

48. IPv6 Current version of the Internet Protocol is Version 4 (v4)
Earlier versions were not implemented
The next version will be Version 6 (v6)
No v5 was implemented
Informally called IPng (Next Generation)
IPv6 is Already Defined
Continuing improvements in v4 may delay its adoption

49. IPv6
IPv6 will raise the size of the internet address from 32 bits to 128 bits
Now running out of IP addresses
Will solve the problem
But current work-arounds are delaying the need for IPv6 addresses

50. IPv6 Improved Security Improved Quality of Service (QoS)
But, through IPsec, v4 is being upgraded in security as well
Improved Quality of Service (QoS)
But under IETF Differentiated Services (diffserv) initiative, IPv4 is being upgraded in this area as well

51. IPv6 Extension Headers IPv4 Headers are complex
IPv6 basic header is simple
Extension headers for options
Basic Header
Extension Header 1
Extension Header 2

52. IPv6 Extension Headers Basic header has 8-bit Next Header field
Identifies first extension header or says that payload follows
Basic Header NH
Extension Header 1
Extension Header 2

53. IPv6
Extension Headers
Each extension header also has 8-bit Next Header field
Identifies next extension header or says that payload follows
Basic Header
Extension Header 1 NH
Extension Header 2

54. IPv6
Extension Headers
Next header field is an elegant way to allow options
Easy to add new extension headers for new needs
Basic Header
Extension Header 1 NH
Extension Header 2

55. IP Fragmentation

56. MTU Maximum Transmission Unit (MTU)
Largest IP packet a network will accept
Arriving IP packet may be larger
MTU
IP Packet

57. IP Fragmentation
If IP packet is longer than the MTU, the router breaks packet into smaller packets
Called IP fragments
Fragments are still IP packets
Earlier in Mod A, fragmentation in TCP
MTU
IP Packet 3 2 1
IP Packets
Fragmentation

58. IP Fragmentation What is Fragmented? Only the original data field
New headers are created
MTU
IP Packet 3 2 1
IP Packets
Fragmentation

59. IP Fragmentation What Does the Fragmentation? The router
Not the subnet
MTU
IP Packet 3 2 1
IP Packets
Fragmentation

60. Multiple Fragmentations
Original packet may be fragmented multiple times along its route
Source
Host
Internet
Process
Destination
Host
Internet
Process
Fragmentation

61. Defragmentation
Internet layer process on destination host defragments, restoring the original packet
IP Defragmentation only occurs once
Source
Host
Internet
Process
Destination
Host
Internet
Process
Defragmentation

62. Fragmentation and IP Fields
More Fragments field (1 bit)
1 if more fragments
0 if not
Source host internet process sets to 0
If router fragments, sets More Fragments field in last fragment to 0
In all other fragments, sets to 1 1 1
Original IP Packet
Fragments

63. Identification Field IP packet has a 16-bit Identification field
Version
(4)
Hdr Len
(4)
TOS (8)
Total Length in bytes (16)
Indication (16 bits)
Flags (3)
Fragment Offset (13)
Time to Live (8)
Protocol (8)
Header Checksum (16)
Source IP Address
Destination IP Address
Options (if any)
PAD
Data Field

64. Total Length in bytes (16)
Identification Field
IP packet has a 16-bit Identification field
Source host internet process places a number in the Identification field
Different for each IP packet
Version
(4)
Hdr Len
(4)
TOS (8)
Total Length in bytes (16)
Indication (16 bits)
Flags (3)
Fragment Offset (13)
Time to Live (8)
Protocol (8)
Header Checksum (16)

65. Identification Field IP packet has a 16-bit Identification field
If router fragments, places the original Identification field value in the Identification field of each fragment 47 47 47 47
Original IP Packet
Fragments

66. Identification Field Purpose
Allows receiving host’s internet layer process know what fragments belong to each original packet
Works even if an IP packet is fragmented several times 47 47 47 47
Original IP Packet
Fragments

67. Total Length in bytes (16)
Fragment Offset Field
Fragment offset field (13 bits) is used to reorder fragments with the same Identification field
Contains the data field’s starting point (in octets) from the start of the data field in the original IP packet
Version
(4)
Hdr Len
(4)
TOS (8)
Total Length in bytes (16)
Indication (16 bits)
Flags (3)
Fragment Offset (13)

68. Fragment Offset Field
Receiving host’s internet layer process assembles fragments in order of increasing fragment offset field value
This works even if fragments arrive out of order!
Works even if fragmentation occurs multiple times
Fragment Offset Field
730
212

69. Fragmentation: Recap IP Fragmentation
Data field of a large IP packet is fragmented
The fragments are sent into a series of smaller IP packets fitting a network’s MTU
Fragmentation is done by routers

70. Defragmentation: Recap
IP Defragmentation
Fragmentation may be done multiple times along the route
Defragmentation (reassembly) is done once, by destination host’s internet layer process

71. Defragmentation: Recap
All IP packets resulting from the fragmentation of the same original IP packet have the same Identification field value
Destination host internet process orders all IP packets from the same original on the basis of their Fragment Offset field values
More Fragments field tells whether there are no more fragments coming

72. Defragmentation: Perspective
New: Not in Book
Perspective
Outside of voice over IP, fragmentation actually is fairly rare for legitimate uses
Attackers use it in attacks, however
Consequently, it pays to examine fragmented packets and even to drop all fragmented packets

73. Routing Protocols

74. Dynamic Routing Protocols
Why Dynamic Routing Protocols?
Each router acts independently, based on information in its router forwarding table
Dynamic routing protocols allow routers to share information in their router forwarding tables
Router
Forwarding
Table Data

75. Routing Information Protocol (RIP)
Routing Information protocol (RIP) is the simplest dynamic routing protocol
Each router broadcasts its entire routing table frequently
Broadcasting makes RIP unsuitable for large networks
Routing
Table

76. Routing Information Protocol (RIP)
RIP is the simplest dynamic routing protocol
Broadcasts go to hosts as well as to routers
RIP interrupts hosts frequently, slowing them down; Unsuitable for large networks
Routing
Table

77. Routing Information Protocol (RIP)
RIP is Limited
RIP routing table has a field to indicate the number of router hops to a distant host
The RIP maximum is 15 hops
Farther networks are ignored
Unsuitable for very large networks
Hop
Hop

78. Routing Information Protocol
Is a Distance Vector Protocol
“New York” starts, announces itself with a RIP broadcast
“Chicago” learns that New York is one hop away
Passes this on in its broadcasts
New York
Chicago
NY is 1
Dallas
1 hop

79. Routing Information Protocol
Learning Routing Information
“Dallas” receives broadcast from Chicago
Already knows “Chicago” is one hop from Dallas
So New York must be two hops from Dallas
Places this information in its routing table
New York
Chicago
NY is 1
Dallas
1 hop
1 hop
NY is 2

80. Routing Information Protocol
Slow Convergence
Convergence is getting correct routing tables after a failure in a router or link
RIP converges very slowly
May take minutes
During that time, many packets may be lost

81. Routing Information Protocol
Encapsulation
Carried in data field of UDP datagram
Port number is 520
UDP is unreliable, so RIP messages do not always get through
A single lost RIP message does little or no harm
UDP Data Field
RIP Message
UDP
Header

82. OSPF Routing Protocol Link State Protocol
Link is connection between two routers
OSPF routing table stores more information about each link than just its hop count: cost, reliability, etc.
Allows OSPF routers to optimize routing based on these variables
Link

83. OSPF Routers Network is Divided into Areas
Each area has a designated router
Area
Designated
Router

84. OSPF Routers When a router senses a link state change
Sends this information to the designated router
Area
Designated
Router
Notice of
Link State Change

85. OSPF Routers Designed Router Notifies all Routers Within its area Area
Designated
Router
Notice of
Link State Change

86. OSPF Routers Efficient Only routers are informed (not hosts)
Usually only updates are transmitted, not whole tables
Designated
Router
Area
Notice of
Link State Change

87. OSPF
Fast Convergence
When a failure occurs, a router transmits the notice to the designated router
Designated router send the information back out to other routers immediately

88. OSPF Encapsulation Carried in data field of IP packet
Protocol value is 89
IP is unreliable, so OSPF messages do not always get through
A single lost OSPF message does little or no harm
IP Data Field
OSPF Message IP
Header

89. Selecting RIP or OSPF Within a network you control, it is your choice
Your network is an autonomous system
Select RIP or OSPF based on your needs
Interior routing protocol

90. Selecting RIP or OSPF RIP is fine for small networks
Easy to implementing
15 hops is not a problem
Broadcasting, interrupting hosts are not too important

91. Selecting RIP or OSPF OSPF is Scalable Works with networks of any size
Management complexities are worth the cost in large networks

92. Border Gateway Protocol (BGP)
To connect different autonomous systems
Must standardized cross-system routing information exchanges
BGP is most popular today
Gateway is the old name for router
Exterior routing protocol
Autonomous
System
Autonomous
System
BGP

93. Border Gateway Protocol (BGP)
Distance vector approach
Number of hops to a distant system is stored in the router forwarding table
Normally only sends updates
Autonomous
System
Autonomous
System
BGP

94. Border Gateway Protocol (BGP)
Encapsulation
BGP uses TCP for delivery
Reliable
TCP is only for one-to-one connections
If have several external routers, must establish a TCP and BGP connection to each
Autonomous
System
Autonomous
System
BGP

95. Routing Protocols: Recap
RIP
OSPF
BGP
Interior/Exterior
Interior
Exterior
Type of Information
Distance Vector
Link State
Router Transmission
To all hosts and routers on all subnets attached to the router
Between designated router and other routers in area
To one other router

96. Routing Protocols: Recap
RIP
OSPF
BGP
Transmission Frequency
Whole Table, Every 30 Seconds
Updates Only
Scalability
Poor
Very Good
Convergence
Slow
Fast
Complex
Encapsulation in
UDP Datagram
IP Packet
TCP Segment

97. Address Resolution Protocol

98. Internet and Data Link Layer Addresses
Each host and router on a subnet needs a data link layer address to specify its address on the subnet
This address appears in the data link layer frame sent on a subnet
For instance, 48-bit MAC layer frame addresses for LANs
Subnet DA
DL Frame for Subnet

99. Addresses
Each host and router also needs an IP address at the internet layer to designate its position in the overall Internet
Subnet
Subnet
Subnet

100. Internet and Data Link Addresses Serve Different Purposes
IP address
To guide delivery to destination host across the Internet (across multiple networks)
Subnet Address
To guide delivery between two hosts, two routers, and a host and router within a single subnet
Same LAN, Frame Relay network, etc.

101. Analogy
In company, each person has a company-wide ID number (like IP address)
In company, person also has a local office number in a building
Paychecks are made out to ID numbers
For delivery, also need to know office number

102. Address Resolution Problem
Router knows that destination host is on its subnet based on the IP address of an arriving packet
Does not know the destination host’s subnet address, so cannot deliver the packet across the subnet
Destination Host
Subnet
subnet address?

103. Address Resolution Protocol (ARP)
Router creates an ARP Request message to be sent to all hosts on the subnet.
Address resolution protocol message asks “Who has IP address ?”
Passes ARP request to data link layer process for delivery
Subnet
ARP Request

104. Address Resolution Protocol (ARP)
Data link process of router broadcasts the ARP Request message to all hosts on the subnet.
On a LAN, MAC address of 48 ones tells all stations to pay attention to the frame
Subnet
ARP Request

105. Address Resolution Protocol (ARP)
Host with IP address responds
Internet process creates an ARP response message
Contains the destination host’s subnet address (48-bit MAC address on a LAN)
ARP Response
Subnet

106. Address Resolution Protocol (ARP)
Router delivers the IP packet to the destination host
Places the IP packet in the subnet frame
Puts the destination host’s subnet address in the destination address field of the frame
Deliver IP Packet
within a subnet frame
Subnet

107. Address Resolution Protocol
ARP Requests and Responses are sent between the internet layer processes on the router and the destination host
ARP
Request
Router
Destination Host
Internet
Process
Internet
Process
ARP Response

108. Address Resolution Protocol
However, the data link processes deliver these ARP packets
Router broadcasts the ARP Request
Destination host sends ARP response to the subnet source address found in the broadcast frame
Router
Destination Host
Internet
Process
Internet
Process
Broadcast ARP Request
Data Link
Process
Data Link
Process
Direct ARP Response

109. IP Address Classes

110. IP Address Classes How large is the network part in an IP address?
Today we use network masks to tell
Originally, IP had address classes with fixed numbers of bits in the network part
Class A: 8 bits (24 bits in local part)
Class B: 16 bits (16 bits in local part)
Class C: 24 bits (8 bits in local part)

111. Class A IP Address IP address begins with 0
7 remaining bits in network part
Only 128 possible Class A networks
24 bits in local part
Over 16 million hosts per Class A network!
All Class A network parts are assigned or reserved

112. Class B IP Address
IP address begins with 10 (1st zero in 2nd position)
14 remaining bits in network part
Over 16,000 possible Class B networks
16 bits in local part
Over 65,000 possible hosts
A good trade-off between number of networks and hosts per network
Most have been assigned

113. Class C IP Address
IP address begins with 110 (1st zero in 3d position)
21 more bits in network part
Over 2 million possible Class C networks!
8 bits in local part
Only 256 possible hosts per Class C network!
Unpopular, because large firms must have several

114. Class D IP Address IP address begins with 1110
Used for multicasting, not defining networks
Sending message to group of hosts
Not just to one (unicasting)
Not ALL hosts (broadcasting)
Say to send a videoconference stream to a group of receivers

115. Class D IP Address
All hosts in a multicast group listen for this multicast address as well as for their specific own host IP address
In Group
Accept
Packets to
Multicast Address
Not in Group
Reject
In Group
Accept

116. Multicasting

117. Multicasting Traditionally, unicasting and broadcasting Multicasting
Unicasting: send to one host
Broadcasting: send to ALL hosts
Multicasting
Send to SOME hosts
500 stations viewing a video course
50 computers getting software upgrades
Standards exist and are improving
Not widely implemented yet

118. Why Multicasting Do not need to send an IP packet to each host
Routers split when needed
Reduces traffic
Multiple
Packets
Single
Packet

119. Mobile IP

120. Mobile IP IP addresses are associated with fixed physical locations
Mobile IP is needed for notebooks, other portable equipment
Computer still gets a permanent IP address
When travels, also gets a temporary IP address at its location
This is linked dynamically to its permanent IP address