Chapter 5: The Data Link Layer r Application r Transport r Network r data link layer service m Moving data between nearby network elements Move data between.

Chapter 5: The Data Link Layer r Application r Transport r Network r data link layer service m Moving data between nearby network elements Move data between end-host and router Move data between end-hosts Move data between routers m error detection, correction m Encryption m sharing a broadcast channel: multiple access m link layer addressing and routing m reliable data transfer, flow control m Interact/act as a bridge between the network layer and the physical layer There are many types of physical layer r Which services does the link layer provide that other layers also provide?

Link Layer r 5.1 Introduction and services r 5.2 Error detection and correction r 5.3Multiple access protocols r 5.4 Link-layer Addressing and routing (ARP) r 5.5 Ethernet r 5.6 Link-layer switches r 5.7 PPP r 5.8 Link virtualization: ATM, MPLS

Link Layer: Introduction Some terminology: r hosts and routers are nodes r communication channels that connect adjacent nodes along communication path are links m wired links m wireless links m LANs r layer-2 packet is a frame, encapsulates datagram data-link layer has responsibility of transferring datagram from one node to adjacent node over one or more links - Without visiting any layer 3 nodes

Link layer: context r datagram transferred by different link protocols over different links: m e.g., Ethernet on first link, frame relay on intermediate links, 802.11 on last link r each link protocol provides different services m e.g., may provide reliability over link transportation analogy r trip from Newark to San Jose m limo: Newark to PHL m plane: PHL to SFO m BART: SFO to SF m train: SF to San Jose r tourist = datagram r transport segment = communication link r transportation mode = link layer protocol m Note that a bus or plane trip might contain many changes of the bus or plane, but this seems like a single hop r travel agent = routing algorithm

Link Layer Services r framing, link access: m encapsulate datagram into frame, adding header, trailer m channel access if shared medium m “MAC” addresses used in frame headers to identify source, dest different from IP address! m Routing r reliable delivery between adjacent nodes m we learned how to do this already (chapter 3)! m seldom used on low bit-error link (fiber, some twisted pair) m wireless links: high error rates Q: why both link-level and end-end reliability?

Link Layer Services (more) r flow control: m pacing between adjacent sending and receiving nodes r Encryption m Some links can easily be tapped, so encryption is needed for privacy r error detection: m errors caused by signal attenuation, noise. m receiver detects presence of errors: signals sender for retransmission or drops frame r error correction: m receiver identifies and corrects bit error(s) without resorting to retransmission r half-duplex and full-duplex m with half duplex, nodes at both ends of link can transmit, but not at same time

Where is the link layer implemented? r in each and every host in the network m Which other layers are implemented in every host? r link layer implemented in “adaptor” (aka network interface card NIC) m Ethernet card, PCMCI card, 802.11 card m implements link, physical layer r attaches into host’s system buses r combination of hardware, software, firmware controller physical transmission cpu memory host bus (e.g., PCI) network adapter card host schematic application transport network link physical

Adaptors Communicating r sending side: m encapsulates datagram in frame m adds error checking bits, rdt, flow control, etc. r receiving side m looks for errors, rdt, flow control, etc m extracts datagram passes to upper layer at receiving side Moves frame to another link controller sending host receiving host datagram frame

Link Layer r 5.1 Introduction and services r 5.2 Error detection and correction r 5.3Multiple access protocols r 5.4 Link-layer Addressing r 5.5 Ethernet r 5.6 Link-layer switches r 5.7 PPP r 5.8 Link Virtualization: ATM. MPLS

Error Detection EDC= Error Detection and Correction bits (redundancy) D = Data protected by error checking, may include header fields Error detection not 100% reliable! protocol may miss some errors, but rarely larger EDC field yields better detection and correction otherwise

Parity Checking Single Bit Parity: Detect single bit errors Two Dimensional Bit Parity: Detect and correct single bit errors 0 0

Internet checksum (review) Sender: r treat segment contents as sequence of 16-bit integers r checksum: addition (1’s complement sum) of segment contents r sender puts checksum value into UDP checksum field Receiver: r compute checksum of received segment r check if computed checksum equals checksum field value: m NO - error detected m YES - no error detected. But maybe errors nonetheless? Goal: detect “errors” (e.g., flipped bits) in transmitted packet (note: used at transport layer only)

Checksumming: Cyclic Redundancy Check r view data bits, D, as a binary number r choose r+1 bit pattern (generator), G r goal: choose r CRC bits, R, such that m exactly divisible by G (modulo 2) m receiver knows G, divides by G. If non-zero remainder: error detected! m can detect all burst errors less than r+1 bits r widely used in practice (Ethernet, 802.11 WiFi, ATM)

CRC Example Want: D. 2 r XOR R = nG equivalently: D. 2 r = nG XOR R equivalently: if we divide D. 2 r by G, want remainder R R = remainder[ ] D.2rGD.2rG

Link Layer r 5.1 Introduction and services r 5.2 Error detection and correction r 5.3Multiple access protocols r 5.4 Link-layer Addressing r 5.5 Ethernet r 5.6 Link-layer switches r 5.7 PPP r 5.8 Link Virtualization: ATM, MPLS

Multiple Access Links and Protocols Two types of “links”: r point-to-point m PPP for dial-up access m point-to-point link between Ethernet switch and host r broadcast (shared wire or medium) m old-fashioned Ethernet m 802.11 wireless LAN shared wire (e.g., cabled Ethernet) shared RF (e.g., 802.11 WiFi) shared RF (satellite) humans at a cocktail party (shared air, acoustical)

Multiple Access Control (MAC) protocols r single shared broadcast channel r two or more simultaneous transmissions by nodes: interference m collision if node receives two or more signals at the same time multiple access protocol r An algorithm that determines how nodes share channel, i.e., determine when node can transmit r communication about channel sharing must use channel itself! m out-of-band channel for coordination is difficult

Ideal Multiple Access Protocol Broadcast channel of rate R bps 1. when one node wants to transmit, it can send at rate R. 2. when M nodes want to transmit, each can send at average rate R/M 3. fully decentralized: m no special node to coordinate transmissions m no synchronization of clocks, slots m Generally, centralized MAC are much more efficient 4. simple

MAC Protocols: a taxonomy Three broad classes: r Channel Partitioning m divide channel into smaller “pieces” (time slots, frequency, code) m allocate piece to node for exclusive use m this approach is difficult since we know that statistical multiplexing can support more users r Random Access m channel not divided, allow collisions m Detect and recover from collisions m Detection and recovery (e.g., retransmission) can be inefficient m Predictable/guaranteed performance is difficult to achieve r Centralized/taking turns

Channel Partitioning MAC protocols: TDMA TDMA: time division multiple access r access to channel in "rounds" r each station gets fixed length slot (length = pkt trans time) in each round r unused slots go idle r GSM (some cell phones) uses TDMA m Why? m So service is predictable and calls can be rejected if there is not enough bandwidth r example: 6-station LAN, 1,3,4 have pkt, slots 2,5,6 idle 1 3 4 1 3 4 6-slot frame

Channel Partitioning MAC protocols: FDMA FDMA: frequency division multiple access r channel spectrum divided into frequency bands r each station assigned fixed frequency band r unused transmission time in frequency bands go idle r GSM also uses FDMA r example: 6-station LAN, 1,3,4 have pkt, frequency bands 2,5,6 idle frequency bands time FDM cable

Random Access Protocols r When node has packet to send m transmit at full channel data rate R. m no a priori coordination among nodes Some approaches use limited coordination  two or more transmitting nodes ➜ “collision”, r random access MAC protocol specifies: m how to detect collisions m how to recover from collisions (e.g., via delayed retransmissions) r Examples of random access MAC protocols: m slotted ALOHA m ALOHA m CSMA, CSMA/CD, CSMA/CA

The ALOHA Protocol r Developed @ U of Hawaii in early 70’s. r Packet radio networks. r “Free for all”: whenever station has a frame to send, it does so. r Aloha is the simplest of MAC protocols r Aloha is old but still widely used m As will be seen, many protocols have a period of time where nodes transmits when they want. m During such periods of time, the MAC essentially Aloha

Collisions r Invalid frames may be caused by channel noise or r Because other station(s) transmitted at the same time: collision. r Collisions and other link layer losses must be detected and corrected m Question 1. Where are all the places that losses can occur? m Question 2: where can errors be detected and corrected r Roughly speaking, a collision happens even when the last bit of a frame overlaps with the first bit of the next frame.

ALOHA’s Performance 1 Time t0t0 t 0 +t t 0 +2t t 0 +3t If another node transmits here, then there is a collision vulnerable If another node starts to transmit during this vulnerable period, then a collision will occur

ALOHA’s Performance r Assume that users try to send frames at random times (Poisson events). r Let G be the average rate that users try to send frames per frame time m G is the utilization r The probability of trying to send k frames during the vulnerable period (which is TWO frame times long) is The probability zero other frames are sent is P(0)=e -2G. The throughput is the rate that frames are sent multiplied by the probability that the transmission is successful G e -2G

Poisson process events Events are distributed according to a Poisson process with parameter if P(k events in period of length T) = exp(- T)( T) k / k! is the rate that events occur = number of events in period T/T (when T is large)

Aloha performance vulnerability period P(k events in period of length T) = exp(- T)( T) k / k! The probability of no collision is probability of no event in the vulnerability period = 2T Let T = 1 (i.e., our time is measured in packet transmission times, not seconds) Then what is ? = average number of transmission attempts per transmission time. So = utilization. I.e., = G. And the probability of no collision is exp(-2G)(2G) 0 /0!=exp(-2G)

ALOHA’s Performance The best throughput occurs for what value of G? What is this best throughput?

Slotted Aloha – frames are only transmitted during slots, they cannot cross slot boundaries Time t0t0 t 0 +t t 0 +2t t 0 +3t If a frame is transmitted here, then a collision occurs But this will only happen if a packet arrives at the MAC layer during this period vulnerable If another node selects to transmit during this vulnerable period, then a collision will occur The vulnerable period is half the size of unslotted aloha

Slotted Aloha r Vulnerable period is halved. r Doubles performance of ALOHA. r Throughput=S = G e -G. r S = S max = 1/e = 0.368 for G = 1. m G=1 means typically a node tries to transmit each slot m However, the throughput is well below 1; there any many collisions

Slotted Aloha Performance

How long does it take to send a frame?

Slotted Aloha Performance How long does it take to send a frame?

Slotted Aloha Performance How long does it take to send a frame? one success k-1 failures Expected number of transmissions

Slotted Aloha Performance How long does it take to send a frame? one success k-1 failures This analysis is funny because it does not account for the fact that if packets are not successfully transmitted, then the rate at which transmissions are attempted increases. Expected number of transmissions

ALOHA and Slotted ALOHA Pros r single active node can continuously transmit at full rate of channel r decentralized r simple Cons r Collisions m wasting slots m Inefficient r idle slots r nodes may be able to detect collision in less than time to transmit packet r Slotted aloha requires clock synchronization m Lose synchronization requires guard times, which reduces efficiency

CSMA (Carrier Sense Multiple Access) CSMA: listen before transmit: If channel sensed idle: transmit entire frame r If channel sensed busy, defer transmission r human analogy: don’t interrupt others!

Question r For 10 Mbps ethernet, the maximum cable length is 2000m r For 100Mbps ethernet, the maximum cable length is 200m r Why is the maximum length for 100Mbps 10 times shorter than 10Mbps?

CSMA collisions collisions can still occur: propagation delay means two nodes may not hear each other’s transmission collision: entire packet transmission time wasted spatial layout of nodes note: role of distance & propagation delay in determining collision probability

CSMA/CD collision detection Transmitter 1 Transmission time time Transmitter 2 Propagation delay Collision detected by transmitter 2 Collision detected by transmitter 1. When is it detected? Receiver 1 receives garbled signal Position on wire Receiver 1

CSMA/CD collision detection Position on wire Transmitter 1 Transmission time Collision NOT detected by transmitter 1 Transmitter 2 Propagation delay Collision detected by transmitter 2 Receiver 1 Receiver 1 receives garbled signal What are the requirements to ensure that collisions are detected? The transmitter must transmit for 2×T propagation + epsilon The transmit time is frame length / bit rate Therefore 2×CableLength/speed of propagation + epsilon < FrameLength/bit-rate time

CSMA/CD What are the requirements to ensure that collisions are detected? The transmitter must transmit for 2*T propagation + epsilon The transmit time is frame length / bit rate Therefore 2×CableLength/speed of propagation + epsilon < FrameLength/bit-rate If frame length can be arbitrarily small, then the cable length must be very short Thus, frames cannot be arbitrarily small. Minimum frame length in Ethernet is 64B. Why is the maximum cable length of a 10Mbps ethernet cable 10 times longer than the maximum cable length of a 100Mbps ethernet? The minimum frame length in Ethernet is independent of bit-rate.

CSMA/CD (Collision Detection) CSMA/CD: carrier sensing with collision detection m collisions detected within short time m colliding transmissions aborted, reducing channel wastage r collision detection: m easy in wired LANs: measure signal strengths, compare transmitted, received signals m Difficult/impossible in wireless LANs: received signal strength overwhelmed by local transmission strength r human analogy: the polite conversationalist

persistent r 1-persistent m If medium is idle, then transmit. m If medium is not idle, then wait until it is and then transmit. In this case, all nodes that desire to transmit during the period when a node is transmitting will collide! r p-persistent m If medium is idle, then transmit. m If medium is not idle, then wait until it is idle m Once idle then transmit with probability p. And wait for the next slot with probability 1-p and repeat. Here slot does not have to be the time to send a full frame, but just enough time to let other hosts start sending. r Exponential Backoff m Next slide What to do when the link is found to be busy?

1. Upon desiring to transmit a frame, set BackOff = BO (some starting value, 4 and 8 are common) 2. If medium is idle, then transmit. 3. If medium is not idle, then wait until it is idle 4. Once idle, a. pick an integer, r, between 0 and BO-1 b. Wait r time slots 1.A time slot is long enough so that if a node begins to trasnmit at the beginning of the time slot, then all nodes will hear the transmission before the time slot end 2.Give an equation for the length of a time slot c. If no other transmission begins before the r time slots, then transmit 5. If a collision is detected, a. Continue to transmit so that all nodes will know that a collision occurred, then stop b. Set BO = min( 2 * BO, BO_Max ) a.In ethernet BO_max = 1024 c. Go to step 4 Exponential Backoff Question: discuss the different ways in which backoff is used in network protocols

“Taking Turns” MAC protocols channel partitioning MAC protocols: m share channel efficiently and fairly at high load m inefficient at low load: delay in channel access, 1/N bandwidth allocated even if only 1 active node! Random access MAC protocols m efficient at low load: single node can fully utilize channel m high load: collision overhead Be careful. Here we say that high load is when the number of users increases. If the number of users is fixed (and small), then the efficiency under high load is not as bad r “taking turns” protocols m look for best of both worlds! m Use in mobile phones data access m 802.16 aka WiMax partly uses this approach m 802.11 specifies this capability, but it is not widely deployed YET

“Taking Turns” MAC protocols Polling: r master node “invites” slave nodes to transmit in turn master slaves data poll data poll

“Taking Turns” MAC protocols Polling: r master node “invites” slave nodes to transmit in turn m After each node is given a chance, the pattern repeats m If a slave has no data to send, then it does nothing, and the master quickly polls the next node master slaves data poll data poll

“Taking Turns” MAC protocols Polling: r master node “invites” slave nodes to transmit in turn m After each node is given a chance, the pattern repeats m If a slave has no data to send, then it does nothing, and the master quickly polls the next node r concerns: m polling overhead m latency m single point of failure (master) master slaves

“Taking Turns” MAC protocols Polling: r master node “invites” slave nodes to transmit in turn m After each node is given a chance, the pattern repeats m If a slave has no data to send, then it does nothing, and the master quickly polls the next node r concerns: m polling overhead m latency m single point of failure (master) r QoS guarantees can be made m If a VoIP call requires 12bps. The master can determine if the call will receive the desire quality and ensure that it does. When congested, new calls are rejected, but existing call continue to receive good performance Consider the difference between the demands by VoIP and services provided by TCP m Guarantees are worth much more money than non- guarantees master slaves

“Taking Turns” MAC protocols Token passing: r control token passed from one node to next sequentially. r token message r concerns: m token overhead m Latency m single point of failure (token) T data (nothing to send) T

Summary of MAC protocols r channel partitioning, by time, frequency or code m Time Division, Frequency Division r random access (dynamic), m ALOHA, S-ALOHA, CSMA, CSMA/CD m carrier sensing: easy in some technologies (wire), hard in others (wireless) m CSMA/CD used in Ethernet m CSMA/CA used in 802.11 (We’ll study it when we talk about wireless) r taking turns m polling from central site, token passing m Bluetooth, FDDI, IBM Token Ring

Link Layer r 5.1 Introduction and services r 5.2 Error detection and correction r 5.3Multiple access protocols r 5.4 Link-Layer Addressing r 5.5 Ethernet r 5.6 Link-layer switches r 5.7 PPP r 5.8 Link Virtualization: ATM, MPLS

MAC Addresses and ARP r 32-bit IP address: m network-layer address m used to get datagram to destination IP subnet r MAC (or LAN or physical or Ethernet) address: m function: get frame from one interface to another physically-connected interface (same network) The textbook is wrong about this. Today, hosts are almost never physically connected m 48 bit MAC address (for most LANs) burned in NIC ROM, also sometimes software settable

LAN Addresses and ARP Each adapter on LAN has unique LAN address Broadcast address = FF-FF-FF-FF-FF-FF = adapter 1A-2F-BB-76-09-AD 58-23-D7-FA-20-B0 0C-C4-11-6F-E3-98 71-65-F7-2B-08-53 LAN (wired or wireless)

LAN Address (more) r MAC address allocation administered by IEEE r manufacturer buys portion of MAC address space (to assure uniqueness) m Check OUI lookup Google OUI lookup Enter MAC address See manufacture r analogy: (a) MAC address: like Social Security Number (b) IP address: like postal address  MAC flat address ➜ portability m can move LAN card from one LAN to another r IP hierarchical address NOT portable m address depends on IP subnet to which node is attached m If a NIC is changed, then the MAC is changed Whereas, the IP address can stay the same

ARP: Address Resolution Protocol r Each IP node (host, router) on LAN has ARP table m At prompt, >> arp -a r ARP table: IP/MAC address mappings for some LAN nodes m TTL (Time To Live): time after which address mapping will be forgotten (typically 20 min) Question: how to determine MAC address of B knowing B’s IP address? 1A-2F-BB-76-09-AD 58-23-D7-FA-20-B0 0C-C4-11-6F-E3-98 71-65-F7-2B-08-53 LAN 137.196.7.23 137.196.7.78 137.196.7.14 137.196.7.88

ARP protocol: Same LAN (network) r A wants to send datagram to C m Check if C’s IP address is in the same subnet m Use subnet mask and compare this nodes IP to C’s IP m E.g., my IP=128.4.35.67 B’s IP=128.5.19.12 Subnet mask is 255.255.0.0 => the first 8 bytes define the subnet So in this case, A and B are in different subnets Thus, the datagram is sent to the gateway, which must be in the same subnet. Suppose that the B is the gateway, but only the IP address of B is known

ARP protocol: Same LAN (network) r A wants to send datagram to C m Check if C’s IP address is in the same subnet m Use subnet mask and compare this nodes IP to C’s IP m E.g., my IP=128.4.35.67 B’s IP=128.5.19.12 Subnet mask is 255.255.0.0 => the first 8 bytes define the subnet So in this case, A and B are in different subnets Thus, the datagram is sent to the gateway, which must be in the same subnet. Suppose that the B is the gateway, but only the IP address of B is known r Suppose a host wants to send to B and only B’s IP address is know and B is in the same subnet r and B’s MAC address not in A’s ARP table. r A broadcasts ARP query packet, containing B's IP address m dest MAC address = FF-FF-FF-FF-FF-FF m Ethernet frame type = ARP query Other types include datagram m all machines on LAN receive ARP query r B receives ARP packet, replies to A with its (B's) MAC address m frame sent to A’s MAC address (unicast) r A caches (saves) IP-to-MAC address pair in its ARP table until information becomes old (times out) m soft state: information that times out (goes away) unless refreshed r ARP is “plug-and-play”: m nodes create their ARP tables without intervention from net administrator A C B D LAN Who has IP 1.1.1.4 Tell 1.1.1.2 Who has IP 1.1.1.4 Tell 1.1.1.2 Who has IP 1.1.1.4 Tell 1.1.1.2 I have 1.1.1.4

Addressing: routing to another LAN R 1A-23-F9-CD-06-9B 222.222.222.220 111.111.111.110 E6-E9-00-17-BB-4B CC-49-DE-D0-AB-7D 111.111.111.112 111.111.111.111 A 74-29-9C-E8-FF-55 222.222.222.221 88-B2-2F-54-1A-0F B 222.222.222.222 49-BD-D2-C7-56-2A walkthrough: send datagram from A to B via R assume A knows B’s IP address r two ARP tables in router R, one for each IP network (LAN)

r A creates IP datagram with source A, destination B r A uses ARP to get R’s MAC address for 111.111.111.110 r A creates link-layer frame with R's MAC address as dest, frame contains A-to-B IP datagram r A’s NIC sends frame r R’s NIC receives frame r R removes IP datagram from Ethernet frame, sees its destined to B r R uses ARP to get B’s MAC address r R creates frame containing A-to-B IP datagram sends to B R 1A-23-F9-CD-06-9B 222.222.222.220 111.111.111.110 E6-E9-00-17-BB-4B CC-49-DE-D0-AB-7D 111.111.111.112 111.111.111.111 A 74-29-9C-E8-FF-55 222.222.222.221 88-B2-2F-54-1A-0F B 222.222.222.222 49-BD-D2-C7-56-2A This is a really important example – make sure you understand!

ARP r Watch wireshark without any connections r What happens if I set an entry in the ARP table with the IP address of my gateway, but my MAC address? r E.g., take two machines A and B on the same LAN (what does this mean? How can you tell if two machines are on the same LAN). m Let P be a nonexistent IP address in the LAN. m On machine A ping P. Use wireshark on B to see no evidence of the ping. m On A, set an arp entry on A with IP = P and MAC = B’s MAC m Then ping P m Watch ping messages appear in wireshark on B m But still, no response.

ARP spoofing – man-in-the-middle attack r If the medium is shared, then a node can eavesdrop on transmissions m Wireless uses link layer encryption m These days, wired ethernet used a dedicate wires from the switch (link layer router) to each host But ARP attack still works r Goal: intercept messages between the victim and anyone else m I record the real MAC address of the victim m When an ARP query request is made for the victim, I respond with my MAC

Who has IP address 1.2.3.4 ARP spoofing – man-in-the-middle attack Victim: MAC=00:12:12:12:12:12 IP: 1.2.3.4 attacker: MAC=00:11:11:11:11:11 IP= 5.6.7.8 Some other host switch Who has IP address 1.2.3.4

ARP spoofing – man-in-the-middle attack Victim: MAC=00:12:12:12:12:12 IP: 1.2.3.4 attacker: MAC=00:11:11:11:11:11 IP= 5.6.7.8 Some other host switch MAC 00:12:12:12:12 has IP address 1.2.3.4 Save MAC/IP mapping in cache for 20 minutes Attacker knows the MAC of victim

Source MAC 00:11:11:11:11 Who has ip: bla.bla.bla.bla Tell IP address 1.2.3.4 ARP spoofing – man-in-the-middle attack Victim: MAC=00:12:12:12:12:12 IP: 1.2.3.4 attacker: MAC=00:11:11:11:11:11 IP= 5.6.7.8 Some other host switch Attacker knows the MAC of victim Later (when all caches have been cleared), the attacker floods ARP queries. The attacker continues to flood ARP queries. Source MAC 00:11:11:11:11 Who has ip: bla.bla.bla.bla Tell IP address 1.2.3.4 Source MAC 00:11:11:11:11 Who has ip: bla.bla.bla.bla Tell IP address 1.2.3.4 Save IP/ARP mapping in cache Confused… but ignores it

ARP spoofing – man-in-the-middle attack Victim: MAC=00:12:12:12:12:12 IP: 1.2.3.4 attacker: MAC=00:11:11:11:11:11 IP= 5.6.7.8 Some other host switch Attacker knows the secret plan MAC 00:11:11:11:11: IP:1.2.3.4: The secret plan is ….. MAC 00:12:12:12:12: IP:1.2.3.4 The secret plan is ….. Ahh, I got the secret plan I was expecting Changed MAC address to correct address Later (when all caches have been cleared), the attacker floods ARP queries. The attacker continues to flood ARP queries.

ARP spoofing – man-in-the-middle attack r Some new switches can protect against these attacks m How can these attacks be detected and stopped? m One way is to detect a attacker is to look at ARP tables and see is a single IP has two MACs Is real IP and the victims IP But if a machine has wired and wireless NICs and is running microsoft OS, the OS will sometimes send a frame with the wireless IP as source address over the wired LAN and hence with the wired MAC address Then tables will record the mapping between the MAC and IP, and there will be two IPs for a single MAC

Link Layer r 5.1 Introduction and services r 5.2 Error detection and correction r 5.3Multiple access protocols r 5.4 Link-Layer Addressing r 5.5 Ethernet r 5.6 Link-layer switches r 5.7 PPP r 5.8 Link Virtualization: ATM and MPLS

Ethernet “dominant” wired LAN technology: r cheap $20 for NIC r first widely used LAN technology r simpler, cheaper than token LANs and ATM r kept up with speed race: 10 Mbps – 10 Gbps Metcalfe’s Ethernet sketch

Star topology r bus topology popular through mid 90s m all nodes in same collision domain (can collide with each other) r star topology m active switch in center m each “spoke” runs a (separate) Ethernet protocol (nodes do not collide with each other) r LAN m Multiple stars connected (we’ll see later) switch bus: coaxial cable star

Ethernet Frame Structure Sending adapter encapsulates IP datagram (or other network layer protocol packet) in Ethernet frame Preamble: r 7 bytes with pattern 10101010 followed by one byte with pattern 10101011 r used to synchronize receiver, sender clock rates

Ethernet Frame Structure (more) r Addresses: 6 bytes m if adapter receives frame with matching destination address, or with broadcast address (eg ARP packet), it passes data in frame to network layer protocol m otherwise, adapter discards frame (unless in promiscuous modes) r Type: m ARP query/response m LAN routing m higher layer protocol (mostly IP but others possible, e.g., Novell IPX, AppleTalk) r CRC: checked at receiver, if error is detected, frame is dropped

Ethernet: Unreliable, connectionless r connectionless: No handshaking between sending and receiving NICs r unreliable: receiving NIC doesn’t send acks or nacks to sending NIC m stream of datagrams passed to network layer can have gaps (missing datagrams) m gaps will be filled if app is using TCP m otherwise, app will see gaps r Ethernet’s MAC protocol: unslotted CSMA/CD

Ethernet CSMA/CD algorithm 1. NIC receives datagram from network layer, creates frame 2. If NIC senses channel idle, starts frame transmission 3. If NIC senses channel busy, waits until channel idle, then transmits m 1-persistant! 4. If NIC transmits entire frame without detecting another transmission, NIC is done with frame ! 4. If NIC detects another transmission while transmitting, aborts and sends jam signal 5. After aborting, NIC enters exponential backoff: after mth collision, NIC chooses K at random from {0,1,2,…,2 m -1}. NIC waits K slots where one slot is 512 bit times, returns to Step 2

Ethernet’s CSMA/CD (more) Jam Signal: make sure all other transmitters are aware of collision; 48 bits Bit time:.1 microsec for 10 Mbps Ethernet ; for K=1023, wait time is about 50 msec Exponential Backoff: r Goal: adapt retransmission attempts to estimated current load m heavy load: random wait will be longer r first collision: choose K from {0,1}; delay is K· 512 bit transmission times r after second collision: choose K from {0,1,2,3}… r after ten or more collisions, choose K from {0,1,2,3,4,…,1023}

Exponential backoff collision Idle (channel recovery) Upon sensing the channel is idle, transmission begin again, and collide When a collision occurs, nodes cannot simply try again when the channel is idle waiting to transmit Busy channel waiting to transmit Transmission finished. Channel is idle collision When the channel is found to be busy, nodes cannot simply try when the channel is idle

Exponential backoff Collision (or channel is found to be busy) Idle (channel recovery) Pick r, a number between 0 and BO-1 (e.g., BO=4) r=1 r=2 If the channel is idle to a timeslot, decrement r r=0 r=1 If r=0, then transmit r=0 r=1 If channel is not idle, keep r fixed r=1 If channel is idle for a timeslot, decrement r r=0

Exponential backoff Collision (or channel is found to be busy) Idle (channel recovery) Pick r, a number between 0 and BO-1 (e.g., BO=2) r=1 If the channel is idle to a timeslot, decrement r r=0 If r=0, then transmit Collide again. BO was too small BO=2*BO r=0 If another collision is detcted r=0 If channel is idle for a timeslot, decrement r r=0

CSMA/CD efficiency r T prop = max prop delay between 2 nodes in LAN r t trans = time to transmit max-size frame r efficiency goes to 1 m as t prop goes to 0 m as t trans goes to infinity larger frame size is better, higher bit-rate is worst r better performance than ALOHA: and simple, cheap, decentralized ! r Most ethernet is used with switches. So collision never occur

802.3 Ethernet Standards: Link & Physical Layers r many different Ethernet standards m common MAC protocol and frame format m different speeds: 2 Mbps, 10 Mbps, 100 Mbps, 1Gbps, 10G bps m different physical layer media: fiber, cable m Very large ethernets are possible m QoS m MPLS runs over ethernet (so traffic engineering is possible) application transport network link physical MAC protocol and frame format 100BASE-TX 100BASE-T4 100BASE-FX 100BASE-T2 100BASE-SX 100BASE-BX fiber physical layer copper (twister pair) physical layer

Link Layer r 5.1 Introduction and services r 5.2 Error detection and correction r 5.3 Multiple access protocols r 5.4 Link-layer Addressing r 5.5 Ethernet r 5.6 Link-layer switches

Hubs … physical-layer (“dumb”) repeaters: m bits coming in one link go out all other links at same rate m all nodes connected to hub can collide with one another m no frame buffering m no CSMA/CD at hub: host NICs detect collisions twisted pair hub

Interconnecting with hubs r Backbone hub interconnects LAN segments r But individual segment collision domains become one large collision domain r Can’t interconnect 10BaseT & 100BaseT hub

Switch r link-layer device: smarter than hubs, take active role m Store and forward Ethernet frames Question: do switches in circuit switching networks store and forward? m examine incoming frame’s MAC address, selectively forward frame to one-or-more outgoing links when frame is to be forwarded on segment, uses CSMA/CD to access segment r transparent m hosts are unaware of presence of switches r plug-and-play, self-learning m switches do not need to be configured

Switch: allows multiple simultaneous transmissions r hosts have dedicated, direct connection to switch r switches buffer packets r Ethernet protocol used on each incoming link, but no collisions; full duplex m each link is its own collision domain r switching: A-to-A’ and B- to-B’ simultaneously, without collisions m not possible with dumb hub A A’ B B’ C C’ switch with six interfaces (1,2,3,4,5,6) 1 2 3 4 5 6

Switch Table r Q: how does switch know that A’ reachable via interface 4, B’ reachable via interface 5? r A: each switch has a switch table, each entry: m (MAC address of host, interface to reach host, time stamp) r looks like a routing table! r Q: how are entries created, maintained in switch table? m something like a routing protocol? A A’ B B’ C C’ switch with six interfaces (1,2,3,4,5,6) 1 2 3 4 5 6

Switch: self-learning r switch learns which hosts can be reached through which interfaces m Some interfaces are configured. But in other cases… m when frame received, switch “learns” location of sender: incoming LAN segment m records sender/location pair in switch table A A’ B B’ C C’ 1 2 3 4 5 6 A A’ Source: A Dest: A’ MAC addr interface TTL Switch table (initially empty) A 1 60

Switch: frame filtering/forwarding When frame received: 1. record link/interface associated with sending host. 3. if entry found for destination then { if dest on segment from which frame arrived then drop the frame else forward the frame on interface indicated } else flood 3. periodically, purge all old table entries forward on all but the interface on which the frame arrived

Self-Learning MACInterface 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface MACInterface MACInterface A B

Self-Learning MACInterface 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface MACInterface MACInterface A B Dest=B; Source=A

Self-Learning MACInterface A1 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface MACInterface MACInterface A B Dest=B; Source=A Make table entry for A No table entry for B, so flood Dest=B; Source=A Note: if the switch has ports that are manually configured, then the frame is not flooded to a host. But they are only flooded to other switches

Self-Learning MACInterface A1 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface A1 MACInterface MACInterface A B Make table entry for A No table entry for B, so flood Dest=B; Source=A

Self-Learning MACInterface A1 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface A1 MACInterface A1 MACInterface A2 A B Make table entry for A No table entry for B, so flood Dest=B; Source=A Make table entry for A No table entry for B, so flood

Self-Learning MACInterface A1 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface A1 MACInterface A1 MACInterface A2 A B Dest=A; Source=B

Self-Learning MACInterface A1 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface A1 MACInterface A1 B2 MACInterface A2 A B Dest=A; Source=B Make table entry for B Have a table entry for A, so forward

Self-Learning MACInterface A1 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface A1 B3 MACInterface A1 B2 MACInterface A2 A B Dest=A; Source=B Make table entry for B Have a table entry for A, so forward

Self-Learning MACInterface A1 B3 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface A1 B3 MACInterface A1 B2 MACInterface A2 A B Dest=A; Source=B Make table entry for B Have a table entry for A, so forward

Self-Learning MACInterface 1 2 3 1 2 3 2 1 3 2 3 1 MACInterface MACInterface MACInterface A B 20 minutes later, all table entries are deleted

Poorly Designed Institutional network. Why? to external network router LAN - IP subnet mail server web server

Institutional network without a single point of failure to external network router IP subnet mail server web server Explain self learning on this network Suppose that A sends a frame to the mail server and all tables are empty? Due to the loops, the frames will loop and overwhelm the network. Loops provide robustness, but have to be eliminated. A

Institutional network without a single point of failure to external network router IP subnet mail server web server A Edge in spanning tree “disconnected” interface, i.e., do not forward or flood frames through this interface Ethernet includes a loop resolution protocol that is based on spanning tree algorithm

Loop Resolution r Goal: remove “extra” paths by removing “extra” bridges. r Spanning tree: m Consider the network as a graph G(V,E), m LANs are represented by vertices and bridges/switches are represented by edges. This is backwards from what you might expect, i.e., switches as vertices and LANs as edges m On any graph there exists a tree that spans all nodes where there is only one path between any pair of nodes, i.e., NO loops. m If a LAN A’s next hop toward the root is LAN B, then the switch between LAN A and B uses the interfaces to A and B m This tree is formed by “disconnecting” switches from some LANs The switches are not physically disconnected. Instead, when “disconnected” from a LAN they simply never flood packets over to the LAN. Of course, the spanning tree is recomputed often and if something breaks, then the LAN might be “reconnected” to the switch B3 LAN A LAN B B2

Spanning Tree Algorithm (1) r LANs are represented by vertices and bridges/switches are represented by edges. m This is backwards from what you might expect, i.e., switches as vertices and LANs as edges r When manufactured, each bridge is given a unique ID. The root is the node with the smallest ID. r Approach: Compute paths to the node with smallest ID m Paths indicate which of a bridge’s/switch’s interface leads to the switch with smallest ID m If LAN A’s next hop toward the root is LAN B, then the switch between LAN A and B uses the interfaces to A and B m If LAN B’s next hop to the switch with lowest ID is LAN A, and LAN C’’s next hop to the switch with lowest ID is LAN D then switch B2 will disconnect from LAN B and C B3 LAN A LAN B B2 LAN C B1 LAN D B0

Spanning Tree Algorithm (2) Bridges exchange messages with the following information r 1. The ID of the bridge that is sending the message. r 2. The ID for what the sending bridge believes to be the root bridge. r 3. The distance (hops) from the sending bridge to the root bridge.

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors Note, we find these paths not for forwarding, but only to decide which interfaces to “turn off.’” Of course, if a frame is headed to the root, then it will follow the shortest path. Unfortunately, the root might not be the gateway A B C D E F G H I J

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 Each switch computes distance to root in terms of LAN hops.

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 Each of the roots interfaces is ON

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 LAN A’s next hop is LAN E.

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 LAN A’s next hop is LAN E. Turn on the two interfaces

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 LAN B’s next hop is LAN E or F. But B5 has a lower ID than B7, so LAN E is used as the next hop.

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 LAN B’s next hop is LAN E or F. But B5 has a lower ID than B7, so LAN E is used as the next hop. Turn on the interface

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 LAN D’s next hop is LAN G. Turn on the two interfaces Note that B3 will not have any interfaces “on”

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 LAN C’s next hop is LAN F. Turn on the interfaces

B3 B1 B7 B2 B5 B4 B6 Which interfaces to keep and which to ignore. Pretend that the objective is to find shortest paths from each LAN to root switch (the one with smallest ID) and use least cost with minimum ID to break ties. By shortest path, we mean paths from a LAN to the route switch that visits the smallest number of switches A switch will keep an interface active if 1.the interface is along a LAN’s shortest path to the root 2.If a LAN has more than one shortest path, then switch with the smallest ID is used. Take a distance vector approach, so we only consider neighbors A B C D E F G H I J 0 1 2 1 1 1 1 Which other interfaces are “on”

Layer 2 Routing r L2 routing table is automatically maintained (set up and updated as topology changes). r 3 mechanisms: m Loop resolution m Address learning m Frame forwarding m Typically ignore security such as ARP attacks, access control, etc. r Loop resolution must happen before address learning. m On the EECIS network, the link to the campus network would go down for ~50ms. m This would trigger loop resolution During which time no packets were forwarded

Switches vs. Routers r both store-and-forward devices m routers: network layer devices (examine network layer headers) m switches are link layer devices r routers maintain routing tables, implement routing algorithms r switches maintain switch tables, implement filtering, learning algorithms

Summary comparison