1. 12 – NAT, ICMP, IPv6 Network Layer4-1

2. Network Layer4-2 Chapter 4 Network Layer Computer Networking: A Top Down Approach Featuring the Internet, 3 rd edition. Jim Kurose, Keith Ross Addison-Wesley, July 2004. A note on the use of these ppt slides: We’re making these slides freely available to all (faculty, students, readers). They’re in PowerPoint form so you can add, modify, and delete slides (including this one) and slide content to suit your needs. They obviously represent a lot of work on our part. In return for use, we only ask the following:  If you use these slides (e.g., in a class) in substantially unaltered form, that you mention their source (after all, we’d like people to use our book!)  If you post any slides in substantially unaltered form on a www site, that you note that they are adapted from (or perhaps identical to) our slides, and note our copyright of this material. Thanks and enjoy! JFK/KWR All material copyright 1996-2004 J.F Kurose and K.W. Ross, All Rights Reserved

3. Network Layer4-3 NAT: Network Address Translation 10.0.0.1 10.0.0.2 10.0.0.3 10.0.0.4 138.76.29.7 local network (e.g., home network) 10.0.0/24 rest of Internet Datagrams with source or destination in this network have 10.0.0/24 address for source, destination (as usual) All datagrams leaving local network have same single source NAT IP address: 138.76.29.7, different source port numbers

4. Network Layer4-4 NAT: Network Address Translation r Motivation: local network uses just one IP address as far as outside word is concerned: m no need to be allocated range of addresses from ISP: - just one IP address is used for all devices m can change addresses of devices in local network without notifying outside world m can change ISP without changing addresses of devices in local network m devices inside local net not explicitly addressable, visible by outside world (a security plus). r Support more IPv4 hosts by reusing addresses

5. Network Layer4-5 NAT: Network Address Translation 10.0.0.1 10.0.0.2 10.0.0.3 S: 10.0.0.1, 3345 D: 128.119.40.186, 80 1 10.0.0.4 138.76.29.7 1: host 10.0.0.1 sends datagram to 128.119.40, 80 NAT translation table WAN side addr LAN side addr 138.76.29.7, 5001 10.0.0.1, 3345 …… S: 128.119.40.186, 80 D: 10.0.0.1, 3345 4 S: 138.76.29.7, 5001 D: 128.119.40.186, 80 2 2: NAT router changes datagram source addr from 10.0.0.1, 3345 to 138.76.29.7, 5001, updates table S: 128.119.40.186, 80 D: 138.76.29.7, 5001 3 3: Reply arrives dest. address: 138.76.29.7, 5001 4: NAT router changes datagram dest addr from 138.76.29.7, 5001 to 10.0.0.1, 3345

6. Network Layer4-6 NAT: Network Address Translation Implementation: NAT router must: m outgoing datagrams: replace (source IP address, port #) of every outgoing datagram to (NAT IP address, new port #)... remote clients/servers will respond using (NAT IP address, new port #) as destination addr. m remember (in NAT translation table) every (source IP address, port #) to (NAT IP address, new port #) translation pair m incoming datagrams: replace (NAT IP address, new port #) in dest fields of every incoming datagram with corresponding (source IP address, port #) stored in NAT table

7. Private network addresses (RFC 3330) Network Layer4-7 Addresses cannot appear on the public Internet.

8. Network Layer4-8 Circumventing the NAT firewall (if you must) r You may want to run a server behind your NAT router. How do you let in some traffic? r NAT routers have a limited ability to “port forward”, sending all traffic to a given computer on the internal net and bypassing the flow table. r For example: m Send all Web traffic (port 80) to 192.168.1.3 m Send all mail traffic (port 25) to 192.168.1.5

9. Network Layer4-9 NAT: Network Address Translation r 16-bit port-number field: m 60,000 simultaneous connections with a single LAN-side address! r NAT is controversial: m routers should only process up to layer 3 m violates end-to-end argument NAT possibility must be taken into account by app designers, e.g. P2P applications m address shortage should instead be solved by IPv6

10. Network Layer4-10 ICMP: Internet Control Message Protocol (RFC 792) r used by hosts & routers to communicate network-level information m error reporting: unreachable host, network, port, protocol m echo request/reply (used by ping) r network-layer “above” IP: m ICMP msgs carried in IP datagrams r ICMP message: type, code plus first 8 bytes of IP datagram causing error Type Code description 0 0 echo reply (ping) 3 0 dest. network unreachable 3 1 dest host unreachable 3 2 dest protocol unreachable 3 3 dest port unreachable 3 6 dest network unknown 3 7 dest host unknown 4 0 source quench (congestion control - not used) 8 0 echo request (ping) 9 0 route advertisement 10 0 router discovery 11 0 TTL expired 12 0 bad IP header

11. Network Layer4-11 Traceroute and ICMP r Source sends series of UDP segments to dest m First has TTL =1 m Second has TTL=2, etc. m Unlikely port number r When nth datagram arrives to nth router: m Router discards datagram m And sends to source an ICMP message m Message includes name of router& IP address r When ICMP message arrives, source calculates RTT r Traceroute does this 3 times Stopping criterion r UDP segment eventually arrives at destination host r Destination returns ICMP “port unreachable” packet r When source gets this ICMP, stops.

12. Network Layer4-12 IPv6 r Initial motivation: 32-bit address space soon to be completely allocated. m 128-bit addresses r Additional motivation: m header format helps speed processing/forwarding m header changes to facilitate QoS IPv6 datagram format: m fixed-length 40 byte header

13. Network Layer4-13 IPv6 Header (Cont) Traffic class: identify priority among datagrams in flow Flow Label: identify datagrams in same “flow.” (concept of“flow” not well defined). Next header: identify upper layer protocol or if fragmented

14. Network Layer4-14 Other Changes from IPv4 r Fragmentation: using Next Hdr field, by source node, use Path MTU Discovery r Checksum: removed entirely to reduce processing time at each hop r Options: allowed, but outside of header, indicated by “Next Header” field r ICMPv6: new version of ICMP m additional message types, e.g. “Packet Too Big”

15. Network Layer4-15 Transition From IPv4 To IPv6 r Not all routers can be upgraded simultaneously m no “flag days” m How will the network operate with mixed IPv4 and IPv6 routers? r Tunneling: IPv6 carried as payload in IPv4 datagram among IPv4 routers

16. Network Layer4-16 Tunneling A B E F IPv6 tunnel Logical view: Physical view: A B E F IPv6 IPv4

17. Network Layer4-17 Tunneling A B E F IPv6 tunnel Logical view: Physical view: A B E F IPv6 C D IPv4 Flow: X Src: A Dest: F data Flow: X Src: A Dest: F data Flow: X Src: A Dest: F data Src:B Dest: E Flow: X Src: A Dest: F data Src:B Dest: E A-to-B: IPv6 E-to-F: IPv6 B-to-C: IPv6 inside IPv4 B-to-C: IPv6 inside IPv4

18. Deployment r The 2008 Summer Olympic Games were a notable event in terms of IPv6 deployment, http://ipv6.beijing2008.cn/en (IP addresses 2001:252:0:1::2008:6 and 2001:252:0:1::2008:8) r All network operations of the Games were conducted using IPv6. r It is believed that the Olympics provided the largest showcase of IPv6 technology since the inception of IPv6. Network Layer4-18