Lecture 14 IP Wrap upOutlineNetwork Address TranslationTypes of NATsNAT ConsiderationsNAT Research PlugIP v6IPv6 AddressingIPv6 Cleanup - Router-friendlyIPv6 Header CleanupIPv6 Fragmentation CleanupMigration from IPv4 to IPv6IPv6 DiscussionTunnelingIP-in-IP TunnelingTunneling ExampleTunneling ConsiderationsTunneling ApplicationsOverlay NetworksOverlay Networks 2Network ManagementAutoconfigurationDHCPDHCP FeaturesIPv6 AutoconfigurationManagement: MonitoringCommon Monitoring ToolsSimple Network Management Protocol (SNMP)MIB1Lecture 14IP Wrap upDavid AndersenSchool of Computer ScienceCarnegie Mellon University15-441 Networking, Spring 20052OutlineNAT.IPv6.Tunneling / OverlaysNetwork Management»Autoconfiguration»SNMP3B IPB IPNetwork Address TranslationNAT maps (private source IP, source port) onto (public source IP, unique source port)»reverse mapping on the way back»destination host does not know that this process is happeningVery simple working solution.»NAT functionality fits well with firewallsPubl A IPPubl A IPB IPB IPA Port’A Port’B PortB PortPriv A IPPriv A IPB IPB IPA PortA PortB PortB PortPubl A IPPubl A IPB PortB PortB IPB IPPriv A IPPriv A IPB PortB PortA PortA PortA Port’A Port’AB4Types of NATsBi-directional NAT: 1 to 1 mapping between internal and external addresses.»E.g., 128.237.0.0/16 -> 10.12.0.0/16»External hosts can directly contact internal hosts»Why use?–Flexibility. Change providers, don’t change internal addrs.–Need as many external addresses as you have hosts - can use sparse address space internally.“Traditional” NAT: Unidirectional»Basic NAT: Pool of external addresses–Translate source IP address (+checksum,etc) only» Network Address Port Translation (NAPT): What most of us use–Also translate ports.E.g., map (10.0.0.5 port 5555 -> 18.31.0.114 port 22) to (128.237.233.137 port 5931 -> 18.31.0.114 port 22)–Lets you share a single IP address among multiple computers5NAT ConsiderationsNAT has to be consistent during a session.»Set up mapping at the beginning of a session and maintain it during the session»Recycle the mapping that the end of the session–May be hard to detectNAT only works for certain applications.»Some applications (e.g. ftp) pass IP information in payload»Need application level gateways to do a matching translationNAT has to be consistent with other protocols.»ICMP, routing, …NAT is loved and hated»Breaks a lot of applications. Inhibits new applications like p2p.»Little NAT boxes make home networking simple.»Saves addresses. Makes allocation simple.6NAT Research PlugWant to play with your own NAT, and help out some researchers who are looking at techniques to communicate from behind NATs?http://nutss.gforge.cis.cornell.edu/stunt-client.php7IP v6“Next generation” IP.Most urgent issue: increasing address space.»128 bit addresses Simplified header for faster processing:»No checksum (why not?)»No fragmentation (?)Support for guaranteed services: priority and flow idOptions handled as “next header”»reduces overhead of handling optionsV/PrV/PrFlow labelFlow labelLengthLengthNextNextHop LHop LSource IP addressSource IP addressDestination IP addressDestination IP address8IPv6 AddressingDo we need more addresses? Probably, long term»Big panic in 90s: “We’re running out of addresses!”»Big reality in 2005: We’re about 50% used.–CIDR–Tighter allocation policies; voluntary IP reclamation–NAT»Big worry: Devices. Small devices. Cell phones, toasters, everything.128 bit addresses provide space for structure (good!)»Hierarchical addressing is much easier»Assign an entire 48-bit sized chunk per LAN -- use Ethernet addresses»Different chunks for geographical addressing, the IPv4 address space,»Perhaps help clean up the routing tables - just use one huge chunk per ISP and one huge chunk per customer.Registry010 Provider HostSubNetSubscriber9IPv6 Cleanup - Router-friendlyRecall router architecture:»Common case: Switched in silicon (“fast path”)»Weird cases: Handed to CPU (“slow path”, or “process switched”)»Typical division:–Fast path: Almost everything–Slow path:FragmentationTTL expiration (traceroute)IP option handling»Slow path is evil in today’s environment–“Christmas Tree” attack sets weird IP options, bits, and overloads router.–Developers can’t (really) use things on the slow path for data flow.If it became popular, they’d be in the soup!»Other speed issue: Touching data is expensive. Designers would like to minimize accesses to packet during forwarding.10IPv6 Header CleanupNo checksum»Why checksum just the IP header?–Efficiency: If packet corrupted at hop 1, don’t waste b/w transmitting on hops 2..N.–Useful when corruption frequent, b/w expensive–Today: Corruption rare, b/w cheapDifferent options handling»IPv4 options: Variable length header field. 32 different options.–Rarely used–No development / many hosts/routers do not support–Processed in “slow path”.»IPv6 options: “Next header” pointer–Combines “protocol” and “options” handlingNext header: “TCP”, “UDP”, etc.–Extensions header: Chained together–Makes it easy to implement host-based options–One value “hop-by-hop” examined by intermediate routersThings like “source route” implemented only at intermediate hops11IPv6 Fragmentation CleanupIPv4:IPv6:»Discard packets, send ICMP “Packet Too Big”–Similar to IPv4 “Don’t Fragment” bit handling»Sender must support Path MTU discovery–Receive “Packet too Big” messages and send smaller packets»Increased minimum packet size–Link must support 1280 bytes;–1500 bytes if link supports variable sizesReduced packet processing and network complexity.Increased MTU a boon to application writersHosts can still fragment - using fragmentation header. Routers don’t deal with it any more.Large MTUSmall MTURouter must fragment12Migration from IPv4 to IPv6Interoperability with IP v4 is necessary for gradual deployment.Two complementary mechanisms:»dual stack operation: IP v6 nodes support both address types»tunneling: tunnel IP v6 packets through IP v4 cloudsAlternative is to create IPv6 islands, e.g. corporate networks, ...»Use of form of NAT to connect to the outside world»NAT must not only translate addresses but also
View Full Document