Integrated Ethernet Internetworking Protocol Mart Molle UCR Department

Integrated Ethernet Internetworking Protocol Mart Molle UCR Department of Computer Science & Engineering

Network Operation Primer • “Edge” is dominated by IEEE 802 LANs – Primarily 802. 3 Ethernet wired connections – Last hop might be 802. 11 Wi. Fi or similar – Every network card has a unique 48 -bit MAC addr. • “Core” is dominated by IP routing – A loose federation of Autonomous Systems – Everything works with 32 -bit, location-dependent IPv 4 addresses, given by each Service Provider. • I skipped many key details – we’ll be back! 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 2

Internet Core is Evolving towards Ethernet Links • Ethernet has long dominated edge networks • Now core is adopting Ethernet framing too! – Avoids conversion/encapsulation overhead – Used for ATM LANE, Packet-over-SONET – High speed Ethernet PHYs and carrier-class features (nested VLAN tags) make it attractive • Result: IP datagram encapsulated in Ethernet MAC frame will be a universal packet format. 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 3

So What? • The world is running out of IPv 4 addresses… – Source: Wikipedia, IPv 6 (one “/8” = 224 addresses) 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 4

IPv 6 “solves everything” by jumping from 32 to 128 bits • Indeed, IPv 6 assumes: – Fixed-size 64 -bit network numbers – 64 -bit host addresses (derived from MAC address) • No need for manual configuration or DHCP • 48 -bit addresses are now common in 802 networks – Ethernet, Token Ring, 802. 11, Bluetooth • 64 -bit addressing will be used for future systems – Firewire, 802. 15 • Why duplicate host address in every packet? 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 5

What If All Internet Traffic became “IP over Ethernet”? • All packets throughout the Internet will have a predictable format: – an IP datagram on the inside, where: • Source = Alice’s IP address • Destination = Bob’s IP address • Other options… – an Ethernet frame on the outside, where • Source = MAC address of first device on this VLAN • Destination = MAC address of last device on this VLAN • Ether. Type = IP 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 6

“IP over Ethernet” Primer • Initially, Alice knows her MAC address. – IP settings are done manually, or via DHCP: • The IP addresses for herself, the name server, and default gateway (router), plus subnet mask – Uses ARP to convert from IP to MAC addresses • Alice wants to send a packet to Bob: – Alice gets Bob’s IP address from a name server – Alice tests Bob’s IP address with her subnet mask • If they match, Alice sends to Bob’s MAC address • Otherwise, Alice sends to the MAC address of her default gateway (IP router) 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 7

Only MAC Addresses Affect Local Communications • Alice and Bob are on the same IP Subnet/VLAN – Alice’s stack creates both IP and MAC headers – Alice’s network card sends the MAC frame – 802 Bridges use (only) MAC addresses for packet forwarding and/or filtering; IP header is just payload. – Bob’s network card accepts frames to its MAC addr. – Bob’s stack strips both IP and MAC headers • IP headers did nothing except occupy space! 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 8

Only IP Addresses Affect Inter -Domain Communications • Inter-domain paths are managed by IP routers – “Next-hop” forwarding decisions use longest prefix matching between destination IP address and routing table entries – Layer-2 headers are not consulted in IP forwarding • If Packets from Alice to Bob cross the “Internet Core” – MAC header generated by Alice is stripped by the first IP router (Alice’s default gateway) – MAC header received by Bob is generated by the last IP router (Bob’s default gateway) – Only the IP datagram generated by Alice is sent to Bob 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 9

If Routers X and Y Connect through an Ethernet Link • Every IP datagram forwarded from X to Y must be encapsulated in an Ethernet frame generated by X: – MAC source = X’s network port on this link – MAC destination = Y’s network port on this link, and – Ether. Type = IP • Y discards the Ethernet header without looking at it – Only action is Y’s network interface discarding frames without its MAC address in destination field • Ethernet headers did nothing except occupy space! 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 10

End-to-End Delivery of MAC Source/Destination Addresses • Why not let Ethernet headers carry the MAC addresses for each endpoint, end-to-end? – No change, if both endpoints are on same subnet. – IP Routers need an Ethernet header-update rule: • • Source MAC = original sender (not previous router) Destination MAC = final destination (not next router) Routers forward MAC addresses (act like Bridges) No change to IP route selection (which ignores contents of MAC header anyway) – Result: 48 -bit MAC address becomes de facto IP host number, leaving 32 bits for IP network numbers 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 11

Let’s Define MAC Address to Be the IP Host Number • Integrated 32 -bit IPv 4 + 48 -bit MAC addresses – Each host now identified by an 80 -bit IPo. E address: • IPv 4 header addresses = 32 -bit network numbers • Ethernet MAC header addresses = 48 -bit host numbers – Huge increase in Internet address space – No change in packet size or format! • Total overhead (including MAC header) is 80 bits for each host address, 160 bits per packet • Address “footprint” is identical to current system, but a single MAC host number does double-duty for two protocol layers 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 12

Provision for Networks with 64 -bit MAC Addresses • 48 -bit and 64 -bit MAC addresses are designed to interoperate – “Well-known” 16 -bit extension 0 x. FF-FE maps each 48 -bit MAC address to a unique, reversible 64 -bit MAC address • Define a new Ether. Type that “tags” the next two 16 -bit values as extensions of the previous 48 -bit SRC and DST fields 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 13

Comparison to IPv 6 with MAC -based Host Numbers • IPv 6 addresses are 128 -bit values partitioned into: – 64 -bit network number – 64 -bit host number derived from host MAC address • Same host number is repeated in MAC header • Total overhead (including MAC header) is 176 bits for each host address, 352 bits per packet – 120% more overhead than Integrated IPv 4+MAC solution – 40% more address space available (all network numbers) 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 14

Is it Really that Easy? • Let’s review in detail, the effects on: – End host packet processing – Packet processing at 802. 1 bridges – Packet processing at a single IP router – Forwarding through the Internet “core” • What operational changes are needed? • What about scalability? 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 15

“IP over Ethernet” Revisited: Initial Configuration • Initially, Alice knows only her MAC address. • Introduce “well-known MAC addresses” for accessing “my provider” of basic services: – Local provider of name resolution service – “Subnet manager” (aka default gateway / router) • You can get IP network number without needing DHCP • Subnet mask disappears (always “ 0 x. FFFF”) • Name resolution eliminates ARP broadcasts – Name server returns (IP + MAC) address pair 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 16

IPv 6 has Stateless Address Auto. Configuration (SLAAC) • Host sends an ICMPv 6 router discovery message – Destination address is reserved IPv 6 link-local multicast address – Meaningless to layer 2 bridges; requires broadcast MAC destination address • Router returns a router advertisement packet with network-layer parameters 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 17

Alice wants to talk with Bob • Alice contacts “her” name server through its well-known MAC address – Query is Bob’s domain name – Response is Bob’s (IP + MAC) address • IP subnet mask test still works, but irrelevant! – If Alice’s IP = Bob’s IP, Bob is on “my” network • Packet carries both Bob’s IP and Bob’s MAC addresses – Otherwise, Bob is beyond “my” default gateway • Packet still carries Bob’s IP and Bob’s MAC addresses 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 18

Packets Traveling Through Alice’s “Edge” Subnet/VLAN • Each packet has Bob’s (IP + MAC) for destination, Alice’s (IP + MAC) for source • Alice and Bob are on the same Subnet/VLAN: – 802. 1 Bridges see no change, act normally • MAC address learning/filtering operates normally • (doesn’t care if source/destination IP addresses match) – Bob’s protocol stack sees no change either • NIC accepts packet with destination = Bob’s MAC • Protocol stack finds destination = Bob’s IP as expected 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 19

What Happens when Bob is not on this Subnet/VLAN? • Bridges broadcast packets with an unknown destination MAC address – Alice-to-Bob packet must reach the default gateway (router) • When Bob replies, all bridges learn his location is behind the default gateway – All further traffic to Bob is sent directly to the default gateway. 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 20

Implications for Router Design • IP routers must set their network interface to use promiscuous receive – Otherwise, packets addressed to external hosts would be discarded at the router port • Same MAC-level addresses repeated for next hop – Same MAC-level interface behavior as an 802. 1 Bridge – we know how to do it! 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 21

Difficulties for 802. 1 Bridges • Number of entries in MAC address filtering database (CAM) is much bigger! – Includes all peers across the Internet, not just local hosts – High capacity CAMs are too expensive to accept such a design • However, every “alien” MAC address is colocated with the default gateway… 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 22

Solution via Meta-Data • Bridges already understand forwarding policies not based on MAC addresses – 802. 3 x PAUSE frames are addressed to a reserved group address (= my neighbor) – Spanning Tree Protocol control packets are addressed to another reserved group address – Link Aggregation control packets do also 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 23

“Alien” MAC as Special Case • Let’s just map “alien” MAC addresses to something easy to process – “well-known MAC” of default gateway – No need for Bridges to learn individual “alien” MAC addresses • Task is simply to recognize “aliens” • Then the packet is processed as if it carried the well-known MAC instead 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 24

Encoding via Ether. Type Field • We can’t continue using Ether. Type for IPv 4 – Meaning of IP header has been changed • What if new Ether. Type had 4 values, encoding: – “alien” source MAC address (yes/no) – “alien” destination MAC address (yes/no) • Bridge equates every “alien” MAC address to “wellknown MAC” of default gateway – “Alien” destination = send it to gateway – Size of CAM = number of hosts in VLAN 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 25

Aside Comment about Optimizing Local Connections • Host IP stack needs to follow the new multivalued Ether. Type encoding • We can easily compress the IP header by dropping each local IP address – Provides room for local options between host and default gateway (eg, flow control) – Less overhead for high performance clusters and large data centers 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 26

“Null-IP” Layer can be created with a new Ether. Type • Presence of “Tag” means the rest of the packet is the payload of an IP datagram without the IP header • Only data field associated with the “Tag” is the IP header field identifying the next Protocol number (e. g. , TCP) • We’ll come back to this concept later! 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 27

Application to Internet Core Routers • Trivial to deploy on a direct Ethernet link between two core routers, X and Y – All packets sent by X carry (MAC + IP) addresses for the two endpoint hosts – Y uses promiscuous receive for all packets • He saves (MAC + IP) addresses for next hop • He uses destination IP address for route selection decision as usual • No changes beyond the MAC headers 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 28

Aside Comment about Wasting IP Subnet Numbers • Today, every Ethernet (VLAN) occupies one IP Subnet number (e. g. , “a. b. c. 0”) • A point-to-point Ethernet link also occupies two host numbers on that IP Subnet, i. e. , – “a. b. c. 1” represents the interface on router X – “a. b. c. 2” represents the interface on router Y • Routers need separate host numbers on different IP Subnets for each interface 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 29

Now, a Router-Router Link Isn’t a Separate IP Subnet • A border router for an Autonomous System needs only one “public” IP address for the “box”: – (default gateway MAC + IP Network Number) – “box” can also have private MAC addresses for each interface (only used for management) • Route-updates use “public” IP for each box • Normal traffic has only end-to-end (MAC+IP) headers – Layer-2 service carries everything from router to router 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 30

Support for Dumb/Fast Switches in the Core • Several generations of Internet “core” architecture have used dumb switches surrounded by IP routers: – ATM LAN Emulation, Packet-over-SONET – Multi-Protocol Label Switching (MPLS) – IP over Lambda (wavelength couplers) • Integration of Ethernet and IP offers something similar 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 31

VLAN-Specific Default Gateways • VLAN Tag has a 12 -bit VLAN Identifier (plus 8 -level priorities) • Let “default IP gateway” be per-VLAN – One “core network” of 802. 1 Bridges can connect 4, 096 distinct IP routers • Bridges can use small address CAM – Which port points “downstream” towards the default gateway on each VLAN? 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 32

A Word about NAT Gateways • This whole idea started as a rebuttal to a Network World article slamming NAT • (IP + MAC) addressing “promotes” all NAT’d hosts to fully IP routable status – Replace all “private” 32 -bit IPv 4 host addresses by individual 80 -bit (IP+MAC) addresses • 32 -bit IP comes from your gateway • 48 -bit MAC comes from your NIC – No need for port mapping at the gateway 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 33

Partial Deployment of (IP+MAC) Addressing • Two “worlds” are separated by a “gateway” – Maps connections between incompatible addressing schemes, like a NAT Gateway – Nameserver must also be aware of both worlds – Local connections (obviously!) work as planned • This is a hard problem in general! – IPv 6 gave up trying to make a translating gateway – Only encapsulation of one version of IP inside another is supported (Hosts run both stacks) 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 34

32 -bit IPv 4 Addresses in an 80 -bit (IP+MAC) “World” – MAC address of an IPv 4 packet can’t be trusted • Not the host unless (IP+MAC) gateway is on same VLAN – IP addresses in 80 -bit world are not individual hosts – Use subnet mask to split the IPv 4 address • Only network number goes into 32 -bit IP field – Frees up many network numbers for 80 -bit world – Suppose IPv 4 network number is a. b. c. 0/24 • a. b. c. 0 represents the “legacy” IPv 4 network • 255 new network numbers are available for the 80 -bit world from a. b. c. 1 to a. b. c. 255 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 35

Representation of IPv 4 Host Number in MAC Address Field • IPv 4 host numbers are at most 24 bits long (maximum size is for Class A networks) • For MAC addresses, a single OUI gives you 24 assignable bits – Let’s reserve one OUI for encoding IPv 4 host numbers in an (IP+MAC) network • Uniqueness can’t a problem with valid IPv 4 addresses – Since the OUI is public, the split IPv 4 address can easily be reconstructed later 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 36

IPv 4 Proxy Server for 80 -bit (IP+MAC) Networks • IPv 4 systems don’t understand (IP+MAC) addresses – Since MAC address is irrelevant, all hosts with a common 32 -bit IP network number appear merged (like NAT system) • Let’s reserve a well-known MAC address for the role of IPv 4 Proxy Server within each (IP+MAC) network – Maps “well known” services (web, mail, etc) to internal provider(s) – Maintains state about open connections, like a NAT gateway – Scalable because burden is distributed across all IP networks, not concentrated at one border crossing between “worlds” – Routing via alternate border crossings is supported • “state” is kept at the endpoint, not the boundary 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 37

Assume “Alice” = IPv 4 host, “Bob” = (IP+MAC) host • Addresses in IPv 4 “World”: – Bob’s IPv 4 address = Bob’s 32 -bit IP network number – Everyone’s MAC addresses are unimportant • Alice’s address in (IP+MAC) “World” : – 32 -bit IP network = network_mask && (Alice’s IPv 4) – MAC address = IPv 4_Host_OUI + host_mask && (Alice’s IPv 4) • Bob’s address in (IP+MAC) “World” (not for native traffic) – 32 -bit IP network = Bob’s IP – MAC address outside Bob’s network = Reserved_Proxy_MAC – MAC address inside Bob’s network = Bob’s MAC • Proxy may do port remapping if multiple hosts talk to Alice 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 38

Simple Translating Gateway From IPv 4 to (IP+MAC) • Suppose Alice wants to connect with Bob – IPv 4 Name server returns (only) Bob’s 32 -bit IP network number – Alice uses her subnet mask to determine he is not local • Alice sends packet with separate IPv 4, MAC addresses: – SRC: (Alice’s IPv 4 address, Alice’s MAC) – DEST: (Bob’s IP network number, Alice’s router MAC) • Gateway rewrites header(s) into (IP+MAC) format: – SRC: (Alice’s IPv 4 Network, Reserved OUI + Alice’s IPv 4 Host) – DEST: (Bob’s IP network number, Reserved Proxy MAC) • Reserved MAC values tell Proxy sender is an IPv 4 Host 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 39

Simple Translating Gateway From (IP+MAC) to IPv 4 • Proxy for Bob’s network sends (IP+MAC) packet: – SRC: (Bob’s IP network number, Reserved Proxy MAC) – DEST: (Alice’s IPv 4 Network, Reserved OUI + Alice’s IPv 4 Host) • Gateway rewrites with separate IPv 4, MAC addresses: – SRC: (Bob’s IP network number, Gateway port MAC) – DEST: (Alice’s IPv 4 Network || Alice’s IPv 4 Host, MAC for Alice or next IPv 4 Router) • Alice receives packet with expected IPv 4, MAC addresses: – SRC: (Bob’s IP network number, Alice’s router MAC) – DEST: (Alice’s IPv 4 address, Alice’s MAC) 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 40

Result: Simple Translating Gateway Works -- Mostly • An (IP+MAC) host can connect to anyone: – Any (IP+MAC) host – Any IPv 4 host, even if it doesn’t understand (IP+MAC) addressing • An IPv 4 host can connect to: – Any IPv 4 host – “Well-known” services offered by (IP+MAC) networks • “Cross-border” connections assume a stateful IPv 4 Proxy Server for each (IP+MAC) network 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 41

What if Host “Alice” on an IPv 4 Network Learns (IP+MAC)? • IPv 6 requires hosts connected to both “worlds” to: – Run both IPv 4 and IPv 6 protocol stacks – Include nested headers in every packet • Is (IP+MAC) Addressing more flexible than this? – Let’s assume that “Alice” is a host on an IPv 4 network who understands (IP+MAC) addresssing – Her network doesn’t understand (IP+MAC) addressing – Border crossing is handled by stateless gateways – (IP+MAC) networks have no stateful proxy servers 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 42

Adding (IP+MAC) Addressing to a Standard IPv 4 Datagram • Alice can get (IP+MAC) addresses from an 80 -bit name server – Bob’s 32 -bit IP number fits the IPv 4 address field • She needs a “safe” place for Bob’s MAC field • Must be invisible to Ethernet and IPv 4 layers – Cannot allow them to change its value – Can’t break Alice’s existing network connection • Must be placed after the MAC and IPv 4 headers 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 43

Recursively Embed a Second Ethernet Header after IPv 4 • IETF IP must assign a protocol / next header value to (embedded) Ethernet header – No need to add a second CRC error check at end! • Second Ethernet header has its own Ether. Type • Allows more Ethernet options before continuing – Optional MAC address extension Ether. Type lets us support 64 -bit host numbers • Lets us define a “short cut” for resuming IP 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 44

“Null IP” Header follows the Embedded Ethernet Header • Don’t repeat the IP network numbers in the IPv 4 header – “Null IP” skips addresses, preserves next protocol / header field • Total cost of embedding an (IP+MAC) header inside a standard IPv 4 datagram is less than 132 bits: – 2 * 48 -bits for MAC addresses – 16 bits for “Null IP” Ether. Type – 16 -32 bits should be enough for “Null IP” Header (Next header field is only 8 bits) • Extended host addresses increases the total by 64 bits 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 45

Smart IPv 4 Host Sending to (IP+MAC) “World” • Alice is IPv 4 host, understands (IP+MAC) – (IP+MAC) name server gives Bob’s full 80 -bit address • Alice’s packet starts with IPv 4, MAC addresses: – SRC: (Alice’s IPv 4 address, Alice’s MAC) – DEST: (Bob’s IP network number, Alice’s router MAC) • Embedded Ethernet header following IPv 4 adds: – SRC: Reserved OUI + Alice’s IPv 4 host – DEST: Bob’s MAC from his 80 -bit address 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 46

(IPv 4 + Embedded Ethernet) to (IP+MAC) Translation • Embedded Ethernet header means target in IPv 4 “world” must understand (IP+MAC) addressing – Use sender-supplied MAC values in (IP+MAC) “world” • If sender-supplied MAC address for itself is from Reserved OUI, IPv 4 target is on an IPv 4 network – Drop host part from IPv 4 address in (IP+MAC) world • Source’s subnet mask not required! • Host part = (MAC – Reserved OUI) • Otherwise, IPv 4 target is an (IP+MAC) host behind a tunnel – Its IPv 4 address is actually its network number in (IP+MAC) world 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 47

(IP+MAC) to (IPv 4 + Embedded Ethernet) Translation • If sender’s own MAC is not Reserved IPv 4 MAC, – IPv 4 target must understand (IP+MAC) addresses – Construct Embedded Ethernet header from MAC field in (IP+MAC) addresses • If destination MAC address is from Reserved OUI – IPv 4 target is on an IPv 4 network – Reconstruct the target’s IPv 4 address by combining network number in IP field and host number in MAC field • Otherwise, IPv 4 target is an (IP+MAC) host behind a tunnel – Its IPv 4 address is actually its network number in (IP+MAC) world – IPv 4 world will route the packet to another gateway using its IP field 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 48

Simple Translating Gateway Revisited • Any (IP+MAC) host can connect to anyone: – Any (IP+MAC) host – Those IPv 4 hosts that understand Embedded Ethernet headers – Any other IPv 4 host, but it requires a stateful IPv 4 Proxy! • IPv 4 hosts that supports Embedded Ethernet headers can connect to anyone without proxies • All other IPv 4 hosts can connect to: – Any IPv 4 host – “Well-known” services on (IP+MAC) networks with IPv 4 Proxies • Tunneling (IP+MAC) traffic over IPv 4 networks is easy 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 49

A Word about Denial of Service Attacks • In a distributed denial of service (DDS) attack, multiple hosts flood a “victim” with traffic • Such attacks are hard to stop because: – The attackers are spread over the Internet – They hide their location(s) by spoofing the source address • If such an attack packet can “escape” its home network it is difficult to see anything wrong with it – “Escape” is easy unless the home network uses outbound ACLs (which are not common) 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 50

Does (IP+MAC) Addressing affect DDS Attacks? • Under IPv 4, the attacker’s MAC address would be left behind at the first router – Only the (spoofed) IPv 4 address carries on • Under (IP+MAC) addressing, all 80 bits of the source address reach the victim – The attacker cannot use its true MAC address without revealing its identity – Substituting a false (but static) MAC still leaves a trail… 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 51

Randomized IP Addresses Brings You Trouble • Recall that the new Ether. Type would show whether the source or destination IP addresses are local or alien • No Host should ever send a packet with an alien source address – This policy violation could be caught at the first point of connection (bridge) if the Ether. Type is set – Placing an alien value in the IP-field is a violation that the gateway router should detect, no matter how the Ether. Type is set 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 52

Randomizing MAC Addresses Brings You Trouble • Recall that Bridges must learn all MAC addresses on their network, unless they belong to an alien (IP+MAC) address • If an attacker randomizes its MAC source address: – It cannot set the Ether. Type to say they are alien addresses, from the previous slide – Therefore, all bridges will try to learn them all, causing CAM overflows from the port pointing back to the attacker 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 53

Conclusion: (IP+MAC) Helps Catch DDS Attackers • Spoofed IP addresses are easy to detect at the source – Needs cooperation of the network operator • Spoofed MAC addresses require spoofed IP addresses, unless you change them rarely – Victim receives many copies with the same information 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 54

Conclusion • (IP+MAC) addressing is an easy, natural evolution of current networking practice • Uses new multi-valued Ether. Type • A few reserved MAC addresses are needed to identify local services – default gateway – Name server • One reserved OUI is needed for carrying legacy IPv 4 host numbers 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 55

3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 56

Example: Legacy IPv 4 to Global (IP + MAC) Network • Assume legacy network has routable IPv 4 addresses – Otherwise, it is a standard NAT gateway problem except for the change in format • 32 -bit to 80 -bit mapping: – Gateway splits host IPv 4 address – Network number matches gateway IP on 80 -bit side – Host number encoded into MAC address 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 57

80 -bit to 32 -bit Mapping • If incoming MAC address = encoded IPv 4 host – recreate IPv 4 address (end of an IPv 4 tunnel) • Else, 32 -bit IP field becomes the IPv 4 address – Same 32 -bit IP field covers all hosts in an (IP+MAC) network, so port conflicts may arise – Additional conflicts may arise if the 32 -bit IP field matches the exact address of a legacy IPv 4 host with whom you communicate • Its 32 -bit IP could match your own IPv 4 legacy address! 3 Nov 2010 Version 1. 0 (c) Copyright Mart Molle 2010 58