Announcement r Takehome final r Final can be

Announcement r Take-home final r Final can be picked up in my office (Room 356) starting Monday, 3/14, 10 am-11: 59 am r Final should be returned by Thursday 3/17, 11: 59 am r Closed Book r One 8. 5” by 11” sheet of paper permitted (single side) r Cover network layer, data link layer and network security

Last class r CDMA and IEEE 802. 11 wireless LANs r Network security Today r Network security (cont. ) r Review for final

What is network security? Confidentiality: only sender, intended receiver should “understand” message contents m sender encrypts message m receiver decrypts message Authentication: sender, receiver want to confirm identity of each other Message Integrity: sender, receiver want to ensure message content not altered (in transit, or afterwards) without detection Access and Availability: services must be accessible and available to users

The language of cryptography Alice’s K encryption A key plaintext encryption algorithm Bob’s K decryption B key ciphertext decryption plaintext algorithm symmetric key crypto: sender, receiver keys identical public-key crypto: encryption key public, decryption key secret (private)

Public Key Cryptography symmetric key crypto r requires sender, receiver know shared secret key r Q: how to agree on key in first place (particularly if never “met”)? public key cryptography r radically different approach [Diffie. Hellman 76, RSA 78] r sender, receiver do not share secret key r public encryption key known to all r private decryption key known only to receiver

Public key cryptography + Bob’s public B key K K plaintext message, m encryption ciphertext algorithm + K (m) B - Bob’s private B key decryption plaintext algorithm message + m = K B(K (m)) B

Public key encryption algorithms Requirements: 1 2 . . + need K B( ) and K - ( ) such that B - + K (K (m)) = m B B + given public key KB , it should be impossible to compute private key K B + Also, given K (m) and B + B K (. ) it should be impossible to determine m

RSA: Choosing keys 1. Choose two large prime numbers p, q. (e. g. , 1024 bits each) 2. Compute n = pq, z = (p-1)(q-1) 3. Choose e (with e<n) that has no common factors with z. (e, z are “relatively prime”). 4. Choose d such that ed-1 is exactly divisible by z. (in other words: ed mod z = 1 ). 5. Public key is (n, e). Private key is (n, d). + KB - KB

RSA: Encryption, decryption 0. Given (n, e) and (n, d) as computed above 1. To encrypt bit pattern, m, compute e e c = m mod n (i. e. , remainder when m is divided by n) 2. To decrypt received bit pattern, c, compute d m = c d mod n (i. e. , remainder when c is divided by n) Magic d m = (m e mod n) mod n happens! c

RSA example: Bob chooses p=5, q=7. Then n=35, z=24. e=5 (so e, z relatively prime). d=29 (so ed-1 exactly divisible by z. encrypt: decrypt: letter m me l 12 1524832 c 17 d c 48196857210675091411825223071697 c = me mod n 17 m = cd mod n letter 12 l

RSA: m = (m e mod n) Why is that d mod n Useful number theory result: If p, q prime and n = pq, then: y y mod (p-1)(q-1) x mod n = x mod n e (m mod n) d mod n = med mod n = m ed mod (p-1)(q-1) mod n (using number theory result above) 1 = m mod n (since we chose ed to be divisible by (p-1)(q-1) with remainder 1 ) = m

RSA: another important property The following property will be very useful later: - + B B K (K (m)) + = m = K (K (m)) B B use public key first, followed by private key use private key first, followed by public key Result is the same!

Overview What is network security? Principles of cryptography Authentication Access control: firewalls Attacks and counter measures

Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap 1. 0: Alice says “I am Alice” Failure scenario? ?

Authentication Goal: Bob wants Alice to “prove” her identity to him Protocol ap 1. 0: Alice says “I am Alice” in a network, Bob can not “see” Alice, so Trudy simply declares herself to be Alice

Authentication: another try Protocol ap 2. 0: Alice says “I am Alice” in an IP packet containing her source IP address Alice’s “I am Alice” IP address Failure scenario? ?

Authentication: another try Protocol ap 2. 0: Alice says “I am Alice” in an IP packet containing her source IP address Alice’s IP address Trudy can create a packet “spoofing” “I am Alice” Alice’s address

Authentication: another try Protocol ap 3. 0: Alice says “I am Alice” and sends her secret password to “prove” it. Alice’s “I’m Alice” IP addr password Alice’s IP addr OK Failure scenario? ?

Authentication: another try Protocol ap 3. 0: Alice says “I am Alice” and sends her secret password to “prove” it. Alice’s “I’m Alice” IP addr password Alice’s IP addr OK playback attack: Trudy records Alice’s packet and later plays it back to Bob Alice’s “I’m Alice” IP addr password

Authentication: yet another try Protocol ap 3. 1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it. Alice’s encrypted “I’m Alice” IP addr password Alice’s IP addr OK Failure scenario? ?

Authentication: another try Protocol ap 3. 1: Alice says “I am Alice” and sends her encrypted secret password to “prove” it. Alice’s encrypted “I’m Alice” IP addr password Alice’s IP addr OK Alice’s encrypted “I’m Alice” IP addr password record and playback still works!

Authentication: yet another try Goal: avoid playback attack Nonce: number (R) used only once –in-a-lifetime ap 4. 0: to prove Alice “live”, Bob sends Alice nonce, R. Alice must return R, encrypted with shared secret key “I am Alice” R KA-B(R) Failures, drawbacks? Alice is live, and only Alice knows key to encrypt nonce, so it must be Alice!

Authentication: ap 5. 0 ap 4. 0 requires shared symmetric key r can we authenticate using public key techniques? ap 5. 0: use nonce, public key cryptography “I am Alice” R Bob computes + - - K A (R) “send me your public key” + KA KA(KA (R)) = R and knows only Alice could have the private key, that encrypted R such that + K (K (R)) = R A A

ap 5. 0: security hole Man (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice) I am Alice R K (R) T K (R) A Send me your public key + K T Send me your public key + K A - + m = K (K (m)) A A + K (m) A Trudy gets - + m = K (K (m)) T Alice sends T m to encrypted with Alice’s public key + K (m) T

ap 5. 0: security hole Man (woman) in the middle attack: Trudy poses as Alice (to Bob) and as Bob (to Alice) Difficult to detect: q Bob receives everything that Alice sends, and vice versa. (e. g. , so Bob, Alice can meet one week later and recall conversation) q problem is that Trudy receives all messages as well!

Overview What is network security? Principles of cryptography Authentication Access control: firewalls Attacks and counter measures

Firewalls firewall isolates organization’s internal net from larger Internet, allowing some packets to pass, blocking others. public Internet administered network firewall

Firewalls: Why prevent denial of service attacks: m SYN flooding: attacker establishes many bogus TCP connections, no resources left for “real” connections. prevent illegal modification/access of internal data. m e. g. , attacker replaces CIA’s homepage with something else allow only authorized access to inside network (set of authenticated users/hosts) two types of firewalls: m application-level m packet-filtering

Packet Filtering Should arriving packet be allowed in? Departing packet let out? r internal network connected to Internet via router firewall r router filters packet-by-packet, decision to forward/drop packet based on: m m source IP address, destination IP address TCP/UDP source and destination port numbers ICMP message type TCP SYN and ACK bits

Packet Filtering r Example 1: block incoming and outgoing datagrams with IP protocol field = 17 and with either source or dest port = 23. m All incoming and outgoing UDP flows and telnet connections are blocked. r Example 2: Block inbound TCP SYN packets. m Prevents external clients from making TCP connections with internal clients, but allows internal clients to connect to outside.

Application gateways r Filters packets on application data as well as on IP/TCP/UDP fields. r Example: allow select internal users to telnet outside. host-to-gateway telnet session application gateway-to-remote host telnet session router and filter 1. Require all telnet users to telnet through gateway. 2. For authorized users, gateway sets up telnet connection to dest host. Gateway relays data between 2 connections 3. Router filter blocks all telnet connections not originating from gateway.

Limitations of firewalls and gateways r IP spoofing: router can’t know if data “really” comes from claimed source r if multiple app’s. need special treatment, each has own app. gateway. r client software must know how to contact gateway. m e. g. , must set IP address of proxy in Web browser r filters often use all or nothing policy for UDP. r tradeoff: degree of communication with outside world, level of security r many highly protected sites still suffer from attacks.

Overview What is network security? Principles of cryptography Authentication Access control: firewalls Attacks and counter measures

Internet security threats Mapping: m before attacking: “case the joint” – find out what services are implemented on network m Use ping to determine what hosts have addresses on network m Port-scanning: try to establish TCP connection to each port in sequence Countermeasures?

Internet security threats Mapping: countermeasures m record traffic entering network m look for suspicious activity (IP addresses, pots being scanned sequentially)

Internet security threats Packet sniffing: m broadcast media m promiscuous NIC reads all packets passing by m can read all unencrypted data (e. g. passwords) m e. g. : C sniffs B’s packets C A src: B dest: A Countermeasures? payload B

Internet security threats Packet sniffing: countermeasures m all hosts in organization run software that checks periodically if host interface in promiscuous mode. m one host per segment of broadcast media (switched Ethernet at hub) C A src: B dest: A payload B

Internet security threats IP Spoofing: m can generate “raw” IP packets directly from application, putting any value into IP source address field m receiver can’t tell if source is spoofed m e. g. : C pretends to be B C A src: B dest: A Countermeasures? payload B

Internet security threats IP Spoofing: ingress filtering m routers should not forward outgoing packets with invalid source addresses (e. g. , datagram source address not in router’s network) m great, but ingress filtering can not be mandated for all networks C A src: B dest: A payload B

Internet security threats Denial of service (DOS): m flood of maliciously generated packets “swamp” receiver m Distributed DOS (DDOS): multiple coordinated sources swamp receiver m e. g. , C and remote host SYN-attack A C A SYN SYN SYN B Countermeasures? SYN

Internet security threats Denial of service (DOS): countermeasures m filter out flooded packets (e. g. , SYN) before reaching host: throw out good with bad m traceback to source of floods (most likely an innocent, compromised machine) C A SYN SYN SYN B SYN

Review (1) r Network Layer m Virtual Circuits and Datagram Networks m Routing Principles • Link State Algorithm • Distance Vector Algorithm m The • • • Internet (IP) Protocol IPv 4 addressing Datagram format IP fragmentation ICMP: Internet Control Message Protocol IPv 6 NAT: Network Address Translation

Review (2) m Routing in the Internet • • Hierarchical routing RIP OSPF BGP r Data link layer m Introduction and services m Error detection and correction m Multiple access protocols • TDMA/FDMA • Random Access Protocols • “Taking Turns” Protocols m m m Link-Layer Addressing Ethernet Hubs and switches Mobile and wireless networks, CDMA IEEE 802. 11 wireless LANs

Review (3) r What is network security? r Principles of cryptography m Symmetric Key m Public Key r Authentication m Protocol evolution r Access control: firewalls r Attacks and counter measures m Packet sniffing m IP spoofing m Do. S attacks

Routing Algorithm classification Global or decentralized information? Global: r all routers have complete topology, link cost info r “link state” algorithms Decentralized: r router knows physicallyconnected neighbors, link costs to neighbors r iterative process of computation, exchange of info with neighbors r “distance vector” algorithms Static or dynamic? Static: r routes change slowly over time Dynamic: r routes change more quickly m periodic update m in response to link cost changes

Dijsktra’s Algorithm 1 Initialization: 2 N' = {u} 3 for all nodes v 4 if v adjacent to u 5 then D(v) = c(u, v) 6 else D(v) = ∞ 7 8 Loop 9 find w not in N' such that D(w) is a minimum 10 add w to N' 11 update D(v) for all v adjacent to w and not in N' : 12 D(v) = min( D(v), D(w) + c(w, v) ) 13 /* new cost to v is either old cost to v or known 14 shortest path cost to w plus cost from w to v */ 15 until all nodes in N'

Dijkstra’s algorithm: example Step 0 1 2 3 4 5 N' u ux uxyvwz D(v), p(v) D(w), p(w) 2, u 5, u 2, u 4, x 2, u 3, y D(x), p(x) 1, u 5 2 u v 2 1 x 3 w 3 1 5 z 1 y 2 D(y), p(y) ∞ 2, x D(z), p(z) ∞ ∞ 4, y

Distance vector algorithm (1) Basic idea: r Each node periodically sends its own distance vector estimate to neighbors r When a node x receives new DV estimate from neighbor, it updates its own DV using B-F equation: Dx(y) ← minv{c(x, v) + Dv(y)} for each node y ∊ N r Under minor, natural conditions, the estimate Dx(y) converge the actual least cost dx(y)

Distance Vector Algorithm (2) Iterative, asynchronous: each local iteration caused by: r local link cost change r DV update message from neighbor Distributed: r each node notifies neighbors only when its DV changes m m neighbors then notify their neighbors if necessary The algorithm doesn’t know the entire path – only knows the next hop Each node: wait for (change in local link cost of msg from neighbor) recompute estimates if DV to any dest has changed, notify neighbors

Dx(y) = min{c(x, y) + Dy(y), c(x, z) + Dz(y)} = min{2+0 , 7+1} = 2 node x table cost to x y z x ∞∞ ∞ y ∞∞ ∞ z 71 0 from x 0 2 7 y 2 0 1 z 7 1 0 cost to x y z x 0 2 7 y 2 0 1 z 3 1 0 x 0 2 3 y 2 0 1 z 3 1 0 cost to x y z from x ∞ ∞ ∞ y 2 0 1 z ∞∞ ∞ node z table cost to x y z x 0 2 3 y 2 0 1 z 7 1 0 cost to x y z from x 0 2 7 y ∞∞ ∞ z ∞∞ ∞ node y table cost to x y z Dx(z) = min{c(x, y) + Dy(z), c(x, z) + Dz(z)} = min{2+1 , 7+0} = 3 x 0 2 3 y 2 0 1 z 3 1 0 time x 2 y 7 1 z

The Internet Network layer Host, router network layer functions: Transport layer: TCP, UDP Network layer IP protocol • addressing conventions • datagram format • packet handling conventions Routing protocols • path selection • RIP, OSPF, BGP forwarding table ICMP protocol • error reporting • router “signaling” Link layer physical layer

IP datagram format IP protocol version number header length (bytes) “type” of data max number remaining hops (decremented at each router) upper layer protocol to deliver payload to how much overhead with TCP? r 20 bytes of TCP r 20 bytes of IP r = 40 bytes + app layer overhead 32 bits ver head. type of len service length fragment 16 -bit identifier flgs offset upper time to Internet layer live checksum total datagram length (bytes) for fragmentation/ reassembly 32 bit source IP address 32 bit destination IP address Options (if any) data (variable length, typically a TCP or UDP segment) E. g. timestamp, record route taken, specify list of routers to visit.

IP Addressing: introduction r IP address: 32 -bit identifier for host, router interface: connection between host/router and physical link m m m router’s typically have multiple interfaces host may have multiple interfaces IP addresses associated with each interface 223. 1. 1. 1 223. 1. 1. 2 223. 1. 1. 4 223. 1. 1. 3 223. 1. 2. 1 223. 1. 2. 9 223. 1. 3. 27 223. 1. 2. 2 223. 1. 1. 1 = 11011111 00000001 223 1 1 1

Subnets r IP address: m subnet part (high order bits) m host part (low order bits) r What’s a subnet ? m device interfaces with same subnet part of IP address m can physically reach other without intervening router 223. 1. 1. 1 223. 1. 1. 2 223. 1. 1. 4 223. 1. 1. 3 223. 1. 2. 1 223. 1. 2. 9 223. 1. 3. 27 223. 1. 2. 2 LAN 223. 1. 3. 2 network consisting of 3 subnets

IP addressing: CIDR Before CIDR: only 8 -, 16 -, and 24 - bit masks were available (A, B, and C class networks) CIDR: Classless Inter. Domain Routing m subnet portion of address of arbitrary length m address format: a. b. c. d/x, where x is # bits in subnet portion of address subnet part host part 11001000 00010111 00010000 200. 23. 16. 0/23

NAT: Network Address Translation rest of Internet local network (e. g. , home network) 10. 0. 0/24 10. 0. 0. 1 10. 0. 0. 2 138. 76. 29. 7 10. 0. 0. 3 All datagrams leaving local network have same single source NAT IP address: 138. 76. 29. 7, different source port numbers Datagrams with source or destination in this network have 10. 0. 0/24 address for source, destination (as usual)

NAT: Network Address Translation 2: NAT router changes datagram source addr from 10. 0. 0. 1, 3345 to 138. 76. 29. 7, 5001, updates table 2 NAT translation table WAN side addr LAN side addr 1: host 10. 0. 0. 1 sends datagram to 128. 119. 40, 80 138. 76. 29. 7, 5001 10. 0. 0. 1, 3345 …… …… S: 10. 0. 0. 1, 3345 D: 128. 119. 40. 186, 80 S: 138. 76. 29. 7, 5001 D: 128. 119. 40. 186, 80 138. 76. 29. 7 S: 128. 119. 40. 186, 80 D: 138. 76. 29. 7, 5001 3: Reply arrives dest. address: 138. 76. 29. 7, 5001 3 1 10. 0. 0. 4 S: 128. 119. 40. 186, 80 D: 10. 0. 0. 1, 3345 10. 0. 0. 1 10. 0. 0. 2 4 10. 0. 0. 3 4: NAT router changes datagram dest addr from 138. 76. 29. 7, 5001 to 10. 0. 0. 1, 3345

Hierarchical Routing Our routing study thus far - idealization r all routers identical r network “flat” … not true in practice scale: with 200 million destinations: r can’t store all dest’s in routing tables! r routing table exchange would swamp links! administrative autonomy r internet = network of networks r each network admin may want to control routing in its own network

Hierarchical Routing r aggregate routers into regions, “autonomous systems” (AS) r routers in same AS run same routing protocol m m “intra-AS” routing protocol routers in different AS can run different intra. AS routing protocol Gateway router r Direct link to router in another AS

Interconnected ASes 3 c 3 a 3 b AS 3 1 a 2 a 1 c 1 d 1 b Intra-AS Routing algorithm 2 c AS 2 AS 1 Inter-AS Routing algorithm Forwarding table 2 b r Forwarding table is configured by both intra- and inter-AS routing algorithm m m Intra-AS sets entries for internal dests Inter-AS & Intra-As sets entries for external dests

Routing in the Internet r Routing in the Internet m m Intra-AS routing: RIP and OSPF Inter-AS routing: BGP

RIP ( Routing Information Protocol) r Distance vector algorithm r Included in BSD-UNIX Distribution in 1982 r Distance metric: # of hops (max = 15 hops) m # of hops: # of subnets traversed along the shortest path from src. router to dst. subnet (e. g. , src. = A) u v A z C B D w x y destination hops u 1 v 2 w 2 x 3 y 3 z 2

RIP advertisements r Distance vectors: exchanged among neighbors every 30 sec via Response Message (also called advertisement) r Each advertisement: list of up to 25 destination nets within AS

OSPF (Open Shortest Path First) r “open”: publicly available r Uses Link State algorithm m LS packet dissemination m Topology map at each node m Route computation using Dijkstra’s algorithm m Link costs configured by the network administrator r OSPF advertisement carries one entry per neighbor router r Advertisements disseminated to entire AS (via flooding) m Carried in OSPF messages directly over IP (rather than TCP or UDP

OSPF “advanced” features (not in RIP) r Security: all OSPF messages authenticated (to r r prevent malicious intrusion) Multiple same-cost paths allowed (only one path in RIP) For each link, multiple cost metrics for different TOS (e. g. , satellite link cost set “low” for best effort; high for real time) Integrated uni- and multicast support: m Multicast OSPF (MOSPF) uses same topology data base as OSPF Hierarchical OSPF in large domains.

Hierarchical OSPF

Hierarchical OSPF r Two-level hierarchy: local area, backbone. m Link-state advertisements only in area m each node has detailed area topology; r Area border routers: “summarize” distances to nets in own area, advertise to other Area Border routers. r Backbone routers: run OSPF routing limited to backbone. r Boundary routers: connect to other AS’s.

Internet inter-AS routing: BGP r BGP (Border Gateway Protocol): the de facto standard r BGP provides each AS a means to: 1. 2. 3. Obtain subnet reachability information from neighboring ASs. Propagate the reachability information to all routers internal to the AS. Determine “good” routes to subnets based on reachability information and policy. r Allows a subnet to advertise its existence to rest of the Internet: “I am here”

BGP basics r Pairs of routers (BGP peers) exchange routing info over TCP conections: BGP sessions r Note that BGP sessions do not correspond to physical links. r When AS 2 advertises a prefix to AS 1, AS 2 is promising it will forward any datagrams destined to that prefix towards the prefix. m AS 2 can aggregate prefixes in its advertisement 3 c 3 a 3 b AS 3 1 a AS 1 2 a 1 c 1 d 1 b 2 c AS 2 2 b e. BGP session i. BGP session

Path attributes & BGP routes r When advertising a prefix, advert includes BGP attributes. m prefix + attributes = “route” r Two important attributes: m AS-PATH: contains the ASs through which the advert for the prefix passed: AS 67 AS 17 m NEXT-HOP: Indicates the specific internal-AS router to next-hop AS. (There may be multiple links from current AS to next-hop-AS. ) r When gateway router receives route advert, uses import policy to accept/decline.

Why different Intra- and Inter-AS routing ? Policy: r Inter-AS: admin wants control over how its traffic routed, who routes through its net. r Intra-AS: single admin, so no policy decisions needed Scale: r hierarchical routing saves table size, reduced update traffic Performance: r Intra-AS: can focus on performance r Inter-AS: policy may dominate over performance

Data Link Layer Some terminology: r hosts and routers are nodes r communication channels that connect adjacent nodes along communication path are links m m m wired links wireless links LANs r layer-2 packet is a frame, encapsulates datagram data-link layer has responsibility of transferring datagram from one node to adjacent node over a link “link”

Link Layer Services r Framing, link access: m encapsulate datagram into frame, adding header, trailer m channel access if shared medium m “MAC” addresses used in frame headers to identify source, dest • different from IP address! r Reliable delivery between adjacent nodes m we learned how to do this already (chapter 3)! m seldom used on low bit error link (fiber, some twisted pair) m wireless links: high error rates • Q: why both link-level and end-end reliability?

MAC Protocols: a taxonomy Three broad classes: r Channel Partitioning m m divide channel into smaller “pieces” (time slots, frequency, code) allocate piece to node for exclusive use r Random Access m channel not divided, allow collisions m “recover” from collisions r “Taking turns” m Nodes take turns, but nodes with more to send can take longer turns

Channel Partitioning MAC protocols: TDMA: time division multiple access r access to channel in "rounds" r each station gets fixed length slot (length = pkt trans time) in each round r unused slots go idle r example: 6 -station LAN, 1, 3, 4 have pkt, slots 2, 5, 6 idle

Slotted ALOHA Pros r single active node can continuously transmit at full rate of channel r highly decentralized: only slots in nodes need to be in sync r simple Cons r collisions, wasting slots r idle slots r clock synchronization

Slotted Aloha efficiency Efficiency is the long-run fraction of successful slots when there are many nodes, each with many frames to send r Suppose N nodes with many frames to send, each transmits in slot with probability p r prob that node 1 has success in a slot = p(1 -p)N-1 r prob that there is a success = Np(1 -p)N-1 r For max efficiency with N nodes, find p* that maximizes Np(1 -p)N-1 r For many nodes, take limit of Np*(1 -p*)N-1 as N goes to infinity, gives 1/e =. 37 At best: channel used for useful transmissions 37% of time!

CSMA (Carrier Sense Multiple Access) CSMA: listen before transmit: r If channel sensed idle: transmit entire frame r If channel sensed busy, defer transmission r Human analogy: don’t interrupt others!

CSMA collisions can still occur: propagation delay means two nodes may not hear each other’s transmission collision: entire packet transmission time wasted note: role of distance & propagation delay in determining collision probability spatial layout of nodes

CSMA/CD (Collision Detection) CSMA/CD: carrier sensing, deferral as in CSMA m collisions detected within short time m colliding transmissions aborted, reducing channel wastage r collision detection: m easy in wired LANs: measure signal strengths, compare transmitted, received signals m difficult in wireless LANs: receiver shut off while transmitting

CSMA/CD collision detection

“Taking Turns” MAC protocols Token passing: Polling: r control token passed from r master node one node to next “invites” slave nodes sequentially. to transmit in turn r token message r concerns: m polling overhead m m latency single point of failure (master) m m m token overhead latency single point of failure (token)

ARP: Address Resolution Protocol Question: how to determine MAC address of B knowing B’s IP address? 237. 196. 7. 78 1 A-2 F-BB-76 -09 -AD 237. 196. 7. 23 r Each IP node (Host, Router) on LAN has ARP table r ARP Table: IP/MAC address mappings for some LAN nodes 237. 196. 7. 14 m LAN 71 -65 -F 7 -2 B-08 -53 237. 196. 7. 88 < IP address; MAC address; TTL> 58 -23 -D 7 -FA-20 -B 0 0 C-C 4 -11 -6 F-E 3 -98 TTL (Time To Live): time after which address mapping will be forgotten (typically 20 min)

ARP protocol: Same LAN (network) r A wants to send datagram to B, and B’s MAC address not in A’s ARP table. r A broadcasts ARP query packet, containing B's IP address m Dest MAC address = FFFF-FF-FF m all machines on LAN receive ARP query r B receives ARP packet, replies to A with its (B's) MAC address m frame sent to A’s MAC address (unicast) r A caches (saves) IP-to- MAC address pair in its ARP table until information becomes old (times out) m soft state: information that times out (goes away) unless refreshed r ARP is “plug-and-play”: m nodes create their ARP tables without intervention from net administrator

Routing to another LAN walkthrough: send datagram from A to B via R assume A knows B’s IP address A R r Two ARP tables in router R, one for each IP network (LAN) B

r A creates datagram with source A, destination B r A uses ARP to get R’s MAC address for 111. 110 r A creates link-layer frame with R's MAC address as dest, r r r frame contains A-to-B IP datagram A’s adapter sends frame R’s adapter receives frame R removes IP datagram from Ethernet frame, sees its destined to B R uses ARP to get B’s MAC address R creates frame containing A-to-B IP datagram sends to B A R B

Ethernet uses CSMA/CD r No slots r adapter doesn’t transmit if it senses that some other adapter is transmitting, that is, carrier sense r transmitting adapter aborts when it senses that another adapter is transmitting, that is, collision detection r Before attempting a retransmission, adapter waits a random time, that is, random access

Ethernet CSMA/CD algorithm 1. Adaptor receives datagram 4. If adapter detects from net layer & creates another transmission while frame transmitting, aborts and sends jam signal (48 bits) 2. If adapter senses channel idle, it starts to transmit 5. After aborting, adapter frame. If it senses enters exponential channel busy, waits until backoff: after the mth channel idle and then collision, adapter chooses transmits a K at random from {0, 1, 2, …, 2 m-1}. 3. If adapter transmits entire frame without Adapter waits K·512 bit detecting another times and returns to Step transmission, the adapter 2 is done with frame !

Ethernet’s CSMA/CD (more) Jam Signal: make sure all other transmitters are aware of collision; 48 bits Bit time: . 1 microsec for 10 Mbps Ethernet ; for K=1023, wait time is about 50 msec Exponential Backoff: r Goal: adapt retransmission attempts to estimated current load m heavy load: random wait will be longer r first collision: choose K from {0, 1}; delay is K· 512 bit transmission times r after second collision: choose K from {0, 1, 2, 3}… r after ten collisions, choose K from {0, 1, 2, 3, 4, …, 1023}

CSMA/CD efficiency r Tprop = max prop between 2 nodes in LAN r ttrans = time to transmit max-size frame r Efficiency goes to 1 as tprop goes to 0 r Goes to 1 as ttrans goes to infinity r Much better than ALOHA, but still decentralized, simple, and cheap

Hubs are essentially physical-layer repeaters: m bits coming from one link go out all other links m at the same rate m no frame buffering m no CSMA/CD at hub: adapters detect collisions m provides net management functionality • can disconnect a malfunctioning adapter twisted pair hub

Interconnecting with hubs Pros: Cons: r Enables interdepartmental r Collision domains are communication r Extends max distance btw. nodes r If a hub malfunctions, the backbone hub can disconnect it hub transferred into one large, common domain r Cannot interconnect 10 Base. T and 100 Base. T hubs hub

Switch r Link layer device m stores and forwards Ethernet frames m examines frame header and selectively forwards frame based on MAC dest address m when frame is to be forwarded on segment, uses CSMA/CD to access segment r transparent m hosts are unaware of presence of switches r plug-and-play, self-learning m switches do not need to be configured

Forwarding switch 1 2 hub 3 hub • How to determine onto which LAN segment to forward frame? • Looks like a routing problem. . .

Self learning r A switch has a switch table r entry in switch table: m (MAC Address, Interface, Time Stamp) m stale entries in table dropped (TTL can be 60 min) r switch learns which hosts can be reached through which interfaces m when frame received, switch “learns” location of sender: incoming LAN segment m records sender/location pair in switch table

Switch: traffic isolation r switch installation breaks subnet into LAN segments r switch filters packets: m same-LAN-segment frames not usually forwarded onto other LAN segments m segments become separate collision domains switch collision domain hub

Switches vs. Routers r both store-and-forward devices m routers: network layer devices (examine network layer headers) m switches are link layer devices r routers maintain routing tables, implement routing algorithms r switches maintain switch tables, implement filtering, learning algorithms

Summary comparison

Wireless network characteristics Multiple wireless senders and receivers create additional problems (beyond multiple access): C A B Hidden terminal problem C C’s signal strength A’s signal strength space r B, A hear each other Signal fading: r A, C can not hear each other r B, C hear each other r B, A hear each other means A, C unaware of their interference at B r A, C can not hear each other interferring at B

IEEE 802. 11 Wireless LAN r 802. 11 b m 2. 4 -5 GHz unlicensed radio spectrum m up to 11 Mbps m direct sequence spread spectrum (DSSS) in physical layer • all hosts use same chipping code m widely deployed, using base stations r 802. 11 a m 5 -6 GHz range m up to 54 Mbps r 802. 11 g m 2. 4 -5 GHz range m up to 54 Mbps r All use CSMA/CA for multiple access r All have base-station and ad-hoc network versions

802. 11 LAN architecture r wireless host communicates Internet AP hub, switch or router BSS 1 AP BSS 2 with base station m base station = access point (AP) r Basic Service Set (BSS) (aka “cell”) in infrastructure mode contains: m wireless hosts m access point (AP): base station m ad hoc mode: hosts only

IEEE 802. 11 MAC Protocol: CSMA/CA 802. 11 sender 1 if sense channel idle for DIFS then transmit entire frame (no CD) 2 if sense channel busy then - start random backoff time - timer counts down while channel idle - transmit when timer expires - if no ACK, increase random backoff interval, repeat 2 sender receiver DIFS 802. 11 receiver - if frame received OK return ACK after SIFS (ACK needed due to hidden terminal problem) data SIFS ACK

Collision Avoidance: RTS-CTS exchange A B AP RTS(B) RTS(A) reservation collision RTS(A) CTS(A) DATA (A) time ACK(A) defer ACK(A)

802. 11 frame: addressing 2 2 6 6 6 frame address duration control 1 2 3 Address 1: MAC address of wireless host or AP to receive this frame Address 2: MAC address of wireless host or AP transmitting this frame 2 6 seq address 4 control 0 - 2312 4 payload CRC Address 4: used only in ad hoc mode Address 3: MAC address of router interface to which AP is attached

802. 11 frame: addressing R 1 router H 1 Internet AP R 1 MAC addr AP MAC addr dest. address source address 802. 3 frame AP MAC addr H 1 MAC addr R 1 MAC address 1 address 2 address 3 802. 11 frame

Network Security r What is network security? r Principles of cryptography m Symmetric Key m Public Key r Authentication m Protocol evolution r Access control: firewalls r Attacks and counter measures m Packet sniffing m IP spoofing m Do. S attacks