Page ‹#›1Lecture 14IP Wrap upDavid AndersenSchool of Computer ScienceCarnegie Mellon University15-441 Networking, Spring 20052Outline NAT. IPv6. Tunneling / Overlays Network Management» Autoconfiguration» SNMPPage ‹#›3B IPNetwork Address Translation NAT maps (private source IP, source port) onto(public source IP, unique source port)» reverse mapping on the way back» destination host does not know that this process is happening Very simple working solution.» NAT functionality fits well with firewallsPubl A IPB IPA Port’ B PortPriv A IPB IPA Port B PortPubl A IPB PortB IPPriv A IPB Port A PortA Port’AB4Types of NATs Bi-directional NAT: 1 to 1 mapping between internal andexternal addresses.» E.g., 128.237.0.0/16 -> 10.12.0.0/16» External hosts can directly contact internal hosts» Why use?– Flexibility. Change providers, don’t change internal addrs.– Need as many external addresses as you have hosts - can usesparse address space internally. “Traditional” NAT: Unidirectional» Basic NAT: Pool of external addresses– Translate source IP address (+checksum,etc) only» Network Address Port Translation (NAPT): What most of us use– Also translate ports. E.g., map (10.0.0.5 port 5555 -> 18.31.0.114 port 22) to (128.237.233.137 port 5931 ->18.31.0.114 port 22)– Lets you share a single IP address among multiple computersPage ‹#›5NAT Considerations NAT has to be consistent during a session.» Set up mapping at the beginning of a session and maintain itduring the session» Recycle the mapping that the end of the session– May be hard to detect NAT only works for certain applications.» Some applications (e.g. ftp) pass IP information in payload» Need application level gateways to do a matching translation NAT has to be consistent with other protocols.» ICMP, routing, … NAT is loved and hated» Breaks a lot of applications. Inhibits new applications like p2p.» Little NAT boxes make home networking simple.» Saves addresses. Makes allocation simple.6NAT Research Plug Want to play with your own NAT, and helpout some researchers who are looking attechniques to communicate from behindNATs? http://nutss.gforge.cis.cornell.edu/stunt-client.phpPage ‹#›7IP v6 “Next generation” IP. Most urgent issue: increasingaddress space.» 128 bit addresses Simplified header for fasterprocessing:» No checksum (why not?)» No fragmentation (?) Support for guaranteedservices: priority and flow id Options handled as “nextheader”» reduces overhead of handlingoptionsV/Pr Flow labelLengthNext Hop LSource IP addressDestination IP address8IPv6 Addressing Do we need more addresses? Probably, long term» Big panic in 90s: “We’re running out of addresses!”» Big reality in 2005: We’re about 50% used.– CIDR– Tighter allocation policies; voluntary IP reclamation– NAT» Big worry: Devices. Small devices. Cell phones, toasters, everything. 128 bit addresses provide space for structure (good!)» Hierarchical addressing is much easier» Assign an entire 48-bit sized chunk per LAN -- use Ethernet addresses» Different chunks for geographical addressing, the IPv4 address space,» Perhaps help clean up the routing tables - just use one huge chunk perISP and one huge chunk per customer.Registry010 Provider HostSubNetSubscriberPage ‹#›9IPv6 Cleanup - Router-friendly Recall router architecture:» Common case: Switched in silicon (“fast path”)» Weird cases: Handed to CPU (“slow path”, or “process switched”)» Typical division:– Fast path: Almost everything– Slow path: Fragmentation TTL expiration (traceroute) IP option handling» Slow path is evil in today’s environment– “Christmas Tree” attack sets weird IP options, bits, and overloadsrouter.– Developers can’t (really) use things on the slow path for data flow. If it became popular, they’d be in the soup!» Other speed issue: Touching data is expensive. Designers would like tominimize accesses to packet during forwarding.10IPv6 Header Cleanup No checksum» Why checksum just the IP header?– Efficiency: If packet corrupted at hop 1, don’t waste b/wtransmitting on hops 2..N.– Useful when corruption frequent, b/w expensive– Today: Corruption rare, b/w cheap Different options handling» IPv4 options: Variable length header field. 32 different options.– Rarely used– No development / many hosts/routers do not support– Processed in “slow path”.» IPv6 options: “Next header” pointer– Combines “protocol” and “options” handling Next header: “TCP”, “UDP”, etc.– Extensions header: Chained together– Makes it easy to implement host-based options– One value “hop-by-hop” examined by intermediate routers Things like “source route” implemented only at intermediate hopsPage ‹#›11IPv6 Fragmentation Cleanup IPv4: IPv6:» Discard packets, send ICMP “Packet Too Big”– Similar to IPv4 “Don’t Fragment” bit handling» Sender must support Path MTU discovery– Receive “Packet too Big” messages and send smaller packets» Increased minimum packet size– Link must support 1280 bytes;– 1500 bytes if link supports variable sizes Reduced packet processing and network complexity. Increased MTU a boon to application writers Hosts can still fragment - using fragmentation header. Routers don’t deal withit any more.LargeMTUSmallMTURouter must fragment12Migration from IPv4 to IPv6 Interoperability with IP v4 is necessary forgradual deployment. Two complementary mechanisms:» dual stack operation: IP v6 nodes support both addresstypes» tunneling: tunnel IP v6 packets through IP v4 clouds Alternative is to create IPv6 islands, e.g.corporate networks, ...» Use of form of NAT to connect to the outside world» NAT must not only translate addresses but also translatebetween IPv4 and IPv6 protocolsPage ‹#›13IPv6 Discussion IPv4 Infrastructure got better» Address efficiency» Co-opted IPv6 ideas: IPSec, diffserv, autoconfigurationvia DHCP, etc. Massive challenge» Huge installed base of IPv4-speaking devices» Chicken & Egg problem– Who’s the first person to go IPv6-only? Steady progress in deployment.» Most hosts & big routers support.» Long-term: The little devices will probably force IPv614Tunneling Force a packet to go to aspecific point in the network.» Path taken is
View Full Document
Unlocking...