Routing, reminder Forward IP packets between networks according to - - PDF document

▶
routing reminder
SMART_READER_LITE
LIVE PREVIEW

Routing, reminder Forward IP packets between networks according to - - PDF document

Apr 06, 2023 274 likes •338 views

Routing, reminder Forward IP packets between networks according to destination Practical Networking 2 Part of the IP implementation Can be done statically or dynamically Based on Elisheva Alexander (eli7@cs.huji.ac.il) tirgul

slide-1
SLIDE 1

1

Practical Networking 2

Based on Elisheva Alexander (eli7@cs.huji.ac.il) tirgul from sysp2001

Routing, reminder

  • Forward IP packets between networks

according to destination

  • Part of the IP implementation
  • Can be done statically or dynamically

Routing, reminder

  • Special kind of routing

– Choose better route for high priority packets – Queue packets according to priority – This provide limited QoS! – According to source

  • Hosts, network with higher priority

– According to type

  • Usually telnet needs high latency, low bandwidth
  • Usually ftp needs high bandwidth high latency

Routing, reminder

  • Routing can be complex!

– Which is the best path – Avoids loops – Routing table is smaller then the internet

Routing

  • The routing we will be doing is very simple, static

routing according to routing table

  • Routing is done by the kernel
  • User interface

– Configured by ioctl(2) to a routing socket (PF_ROUTE) – route(8)

  • Enabling IP forwarding:

– FreeBSD IP forwarding is not enabled by default – This is a kernel parameter – sysctl(8) modifies kernel parameters at runtime

Static Routing, reminder

  • Looks at packet destination & go through the routing

table:

  • If an entry exists for destination in the routing table …

– If gw is defined in entry route to gw (recursively) – Otherwise send out proper interface

  • Otherwise if an entry exists for a network that includes

destination …

– If gw is defined in entry, route to gw (recursively) – Otherwise send out proper interface

  • Otherwise if a default entry exists (destination 0.0.0.0) …

– Send to the default gw

  • Finaly:

– Drop packet & perhaps send an ICMP back

slide-2
SLIDE 2

2

Routing table example

INET

modem hub carl

zelda pizi

DSL eth0 eth1 10.0.0.138/16 10.0.0.1/16 DMZ 10.0/16 10.1.0.1/16 10.1.0.3/16 10.1.0.2/16 Internal network 10.1/16

  • Machines

– Modem DSL interface and Ethernet interface – Carl, the big evil pentume with two Ethernet interfaces – Pizi and Zelda, hosts on the internal network

  • Networks

– DSL 132. – DMZ 10.0/16 – Internal 10.1/16

netstat(8) to view routing table

  • Carl does static routing.

– packet forwarding must be enabled

  • Note: netstat on FreeBSD prints the actual

routing table. Pretty messy.

Doing the routing (not finished)

  • An IP packet from pitzi is sent to

www.cs.huji.ac.il

  • Source – 10.0.1.2
  • Destination 132.65.80.39
  • Carl looks for the destination in the routing

table:

Packets coming back to pitzi from www.cs.huji.ac.il

  • An IP packet from www.cs.huji.ac.il returns

to pizi

  • Source – 132.65.80.39 destination –

10.0.1.2

  • Carl looks for the destination in the routing

table: is there a 10.0.1.2 entry? no is there a 10.0.1.0/255.255.255 entry? yes! we can reach that network via eth1!

route(8) not finished

  • Manipulate the routing table

– Route [delete|get|add] [-net | -host] destination gateway [netmask]

  • Needs root privileges (in order to open a

routing socket)

  • Examples
slide-3
SLIDE 3

3

Routers can handle some errors

  • Zelda sends an IP packet to pitzi via carl
  • Perhaps zelda’s aRP cache maps pitzi’s IP number to carl by

mistake!

  • Perhaps zelda’s routing table sends packets to pitzi via carl

source 192.168.0.3 destination 192.168.0.2 carl looks for the destination … is there a 192.168.0.2 entry? No is there a 192.168.0.0/255.255.255.0 entry? No is there a 192.168.0.0/255.255.0.0 entry ? Yes! we can reach that host via eth1!

  • But the packet came on that wire:

– Carl may send an ICMP redirect bark – Carl may forward the packet anyway – Carl can do whatever it wants

MTU problems in routing

  • Modem has two interfaces

– eth0 with MTU 1500 connected to carl – ppp1 with MTU 1400 connected to DSL

  • Lets say carl sends a packet of size > 1400.

Modem should:

– Either fragment the IP packet so it fits on the link layer – Or at least tell carl to lower the MTU

  • Modem is not smart, and decide just to drop the

packets

  • Problem!!!

Solving the MTU problem

  • In order to get around this we would want

to:

carl > ifconfig mtu 1400 eth0

  • Carl is smar enough!

– Doesn’t drop the packets > 1400 it gets from eth1 – Takes care of them properly

Routing Diagnostic tools

  • traceroute(8) – print the route packets take

to network host

  • Uses UDP packets and utilizes IP’s ttl field
  • Elicits an ICMP TIME_EXCEEDED

response from each gateway along a path

What Traceroute

  • Send a UDP packet with ttl 1
  • Our host’s gateway will send and ICMP

TIME_EXCEEDED back to us

  • Send a UDP packet with ttl 2
  • Our packet will pass our gateway lowering it’s ttl
  • Have an ICMP TIME_EXCEEDED sent from the

following hop or time out (and print a *)

  • This till we (hopefully)

– reach our destination and get an ICMP “port unreachable” – Or till we reach the maximum ttl

Traceroute output

mos24:~> traceroute www.tau.ac.il traceroute to mondrian.tau.ac.il (132.66.16.6), 30 hops max, 38 byte packets 1 router-160 (132.65.160.1) 0.597 ms 0.405 ms 0.378 ms 2 cc-cs.huji.ac.il (132.64.252.25) 0.318 ms 0.258 ms 0.217 ms 3 cisco101-103-2.huji.ac.il (132.64.252.41) 0.348 ms 0.319 ms 0.280 ms 4 gw-huji.huji.ac.il (128.139.226.1) 1.945 ms 1.220 ms 1.643 ms 5 gp1-huji-cel.ilan.net.il (128.139.193.1) 6.645 ms 5.797 ms 6.228 ms 6 tau-gp1-fe.ilan.net.il (128.139.191.69) 6.818 ms 7.162 ms 5.880 ms 7 * * * 8 * * * 9 * * * 10 * * * 11 * * * 12 * * * 13 * * *

slide-4
SLIDE 4

4

mtr(8)

  • Ping can also be used to find problems on

the way to a host

  • Mtr(8) combines the capabilities of ping

and traceroute

  • E.g. you can see exactly where the packet

loss occurs

Routers are hard workers!

  • Where is it done?
  • User space

– Dynamic routing (routed, gated, zebra) – Routing algorithms – Changes in the routing table – Load balancing queuing – Special routing decisions – according to source content

  • The Kernel

– Static routing – pretty simple – Just check the routing table, perhaps do link layer stuff (ARP)

  • Hardware

– Once an initial connection is established – trivial – The need for speed, MBONE

  • Different routers do different things – many times done in all three!

Routers don’t do all the work

  • There are many other machines that help

get your data from here to there!

  • We will see that later

Reminder, Transport Layer

  • TCP, Transmission Control Protocol

– Reliable, flow-controlled, two-way transmission – Simulates a connection: client server module

  • UDP Unreliable Datagram Protocol

– Unreliable, connectionless, lightweight – Speed is more important then correctness or reliability

  • Real time communication VoIP, talk

Multiplexing

  • Many applications want to communicate on one

machine

  • A connection is defined by a unique quadruple
  • <source IP, source Port, dest IP, dest Port>
  • A returning connection may just swap the source and

destination

  • Ports

– UDP and TCP do not share ports – Privileged ports (<1024) can only be opened by root – Well known ports can be found in /etc/services

telnet

  • telnet – user interface to the TELNET protocol
  • telnet <host> <port name or number>
  • Usful for debugging TCP Protocols

– telnet www.microsoft.com http

  • Talk RAW http with a web server

– telnet pop.cs.huji.ac.il 110

  • Check your mail anywhere
  • Of course you can use the default telent port (23)

– telnet gw.cs.huji.ac.il

  • Lets you log into the university

– telnet towel.blinkenlights.nl

  • Shows you a nice movie
slide-5
SLIDE 5

5

Sending email with telnet

telnet cse 25 220 cs.huji.ac.il welcomes you to the wonderful world of ESMTP (but NO UCE please) mail from: lior 250 OK rcpt to: lior 250 Accepted data 500 unrecognized command data 354 Enter message, ending with "." on a line by itself Hi, This is a test message . 250 OK id=1BWuPY-000BVg-Qb quit 221 cs.huji.ac.il closing connection Connection to host lost. C:\Documents and Settings\lior>

The Net Cat, a swiss army knife of the transport layer

  • nc(1) – arbitrary TCP and UDP connections and

listens

  • Used for just about anything under the sun

involving TCP or UDP

  • Can open TCP connections, send UDP packets
  • Listen on arbitrary TCP and UDP ports
  • Port scanning
  • Source routing
  • Scripts nicely

Netcat examples

  • Copy file/dir

– nc -l -p 1234 | uncompress -c | tar xvfp - – and then on the other side – tar cfp - /some/dir | compress -c | nc -w 3 othermachine 1234

  • Port scanning

– echo QUIT | nc -v -w 5 target 20-250 500-600 5990-7000

  • Performance testing

– yes AAAAAAAAAAAAAAAAAAAAAA | nc -v -v -l -p 2222 > /dev/null – yes BBBBBBBBBBBBBBBBBBBBBB | nc othermachine 2222 > /dev/null

nc is great and wonderful!

  • Simple TCP proxies
  • Shell-scripts based HTTP client and

servers

  • Network daemon testing
  • Source routing based connectivity testing
  • More!

Packet sniffers

  • Applications that listen to the network and

capture the trafic

– For real time analysis – Save to file and analyze later

  • There is no problem listening to packets sent

to/from our own machine

  • In a broadcast network like ethernet we can also

listen to other traffic, assuming no switch, we will hear packets that have nothing to do with us

Promiscuous mode

  • Promiscuous mode

– Network card sends all packets heard to the OS

  • Non promiscuous mode

– Network card only sends packets destined it’s MAC – Network card only sends broadcasts packtes

  • We must ask the device driver to change the

card’s mode in order to sniff other people’s packets

slide-6
SLIDE 6

6

Different sniffers

  • tcpdump – exists for all UNIX, usually

already installed

  • snoop – another good sniffer, comes with

Solaris (not free)

  • ethereal – friendly GUI, understands

many protocols

tcpdump dump traffic on a network

  • tcpdump –i ppp0 dump

– Dump traffic on a ppp link

  • tcpdump dst port 80 and len >= 1400 and udp

– Dump UDP traffic to or from http port bigger then 1400 bytes

  • tcpdump ether host 11:22:33:44:55 and not host

10.0.0.1

– Assuming 11:22:33:44:55 is the mack of 10.0.0.1 – Dumps all traffic using 10.0.0.1 as a gateway

  • tcpdump ether[0] & 1 != 0

– Catches all multicast traffic

Some more tools

  • hping2 – great for testing bandwidth and

latency of the network

  • echoping
  • nmap – port scanner

– Guesses what services are running on what port – Guesses the OS running on a machine according to it’s TCP/IP stack behavior