Sei sulla pagina 1di 135

INTRODUCTION TO IP NETWORKS

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 1

CONTENTS

INTRODUCTION TO TCP/IP

IP LAYER PROTOCOLS
IP OVER LAN / MAN / WAN TCP/IP : TRANSPORT LAYER

TCP/IP : APPLICATIONS
IP NETWORK INTERCONNECTIONS NETWORK ADMINISTRATION SECURITY IP VERSION 6
TCP/IP
Page 2

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Section 1 INTRODUCTION TO TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 3

DEFINITIONS

Network architecture covers all the hardware and software resources for interchanging data between two remotely located data processing systems The OSI model (Open Systems Interconnection) is a 7-layer architecture for communication between two open systems Communication between layers is defined by the concept of service Communication between peer layers is defined by the concept of communication protocol The TCP/IP architecture incorporates only three functional layers
TCP/IP
Page 4

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

FUNCTIONAL STRUCTURE

Application Presentation Session Management of application connections

Transport Network

End-to-end management Network interconnection

Data link Physical

Physical bearer access method

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 5

ENCAPSULATION

Layer (N+1)

(N+1) - PDU

(N)-PCI

(N) - SDU

Layer (N)

(N) - PDU

PDU : Protocol Data Unit SDU : Service Data Unit PCI : Protocol Control Information

Convention Layer 1 PDU : bit Layer 2 PDU : frame Layer 3 PDU : packet Layer 4 PDU : message

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 6

CONNECTION-ORIENTED AND CONNECTIONLESS MODE

The connection-oriented mode is associated with the concept of reliable transfer

It involves three phases:


- SET-UP

- TRANSFER
- RELEASE Connectionless mode has only one phase: - TRANSFER
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 7

RELIABLE TRANSFER

The concept of reliable transfer involves 3 functions: - SEQUENCING - ERROR RECOVERY - FLOW CONTROL

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 8

CLIENT-SERVER MODEL

TCP/IP communication complies with the CLIENT-SERVER model

A machine (host) running a SERVER software package (process), responds to requests sent by a CLIENT
It is always the CLIENT that sends requests to the server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 9

ARCHITECTURES

OSI Architecture
Application Presentation Session Transport VT, FTAM, X400,CMIP ASN.1 X409 ISO 8326

Novell Architecture

TCP/IP Architecture Telnet FTP, NFS SMTP HTTP SNMP TCP UDP IP

Microsoft Architecture

NCP SAP

S.M.B. NetBios
NetBeui

TP0, ..., TP4 X.25 PLP Internet 8473

SPX
IPX FDDI DQDB MAN

Network
Link Physical

HDLC, LAP-B, FR, ATM, X21, V35, S,T Copper, FO, Microwave WAN

802.2 802.x

Ethernet Token Ring

LAN
TCP/IP
Page 10

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

IP-RELATED ORGANIZATIONS

ISOC ("internet society") defines policy and development objectives IAB (Internet Activities Board) coordinates research and development activities IETF (Internet Engineering Task Force) manages technical standards IRTF (Internet Research Task Force) responsible for network development NICs (Network Information Centre) In France : AFNIC (www.nic.fr) In United States : INTERNIC (www.internic.net)
TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 11

REQUESTS FOR COMMENTS

The RFCs published by the IETF are the equivalent of ITU recommendations RFCs have no version N, but the number is changed on each update. Everyone can contribute

Document references on protocols and services Technical publications on networks Since 1969 (ARPANET) : more than 2300 RFCs Freely available over the Internet (www.internic.net) Not all RFCs are equivalent to standards

State
Standard Draft standard Proposed Experimental Informational

Status
Required Recommended Elective Limited use Not recommended
TCP/IP
Page 12

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP ARCHITECTURE

ping

Telnet SMTP DNS FTP X-Window


TCP IP

TFTP SNMP NNTP DHCP HTTP


UDP

NFS XDR RPC

IGP / EGP

ICMP

ARP HDLC, LAP-B X21, V35, S, T WAN


Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

FDDI MAN

Ethernet Token Ring LAN


TCP/IP
Page 13

Introduction : The essential

True or False

IP was created in the beginning of the 80 s, when the first PCs appeared. The OSI model has been defined in order to classify TCP/IP protocols. Both IP and X25 protocols allow to transmit data, but with different advantages

False False True False True False True

A reliable transfer must be transmitted by a reliable physical bearer.


Client/Server architecture is very often used in applications based on IP. IRTF et IETF are organizations depending on the DARPA All the protocols of TCP/IP architeture are defined in the RFCs.

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 14

Section 2 IP LAYER PROTOCOLS

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 15

IP LAYER

IP is a protocol that can be routed in connectionless mode

Type : Best Effort Delivery


The IP layer incorporates different protocols
IP datagram ICMP datagrams Routing datagrams

IP needs a transport protocol IP is non-reliable


Routing not guaranteed No error checking No flow control Sequencing not guaranteed
TCP/IP
Page 16

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

IP : MEDIATION LAYER

LAN Ethernet LAN Token Ring

WAN ppp

PSTN ISDN

WAN X.25, FR, ATM PSTN-ISDN

Internet
FDDI

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 17

IP ADDRESSES (V4)

10010110 150 .

00001010 10 .

00010100 20 .

00011110 30

In IP V4, an address is coded on 32 bits


It is represented by the decimal value of each of the 4 octets, separated by a dot It consists of two fields: - Net ID field - Host ID field The field separator position is variable

It is identified using the concept of address class


Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 18

IP ADDRESSES : CLASSES

Net Id

Host Id

Class A : NET ID 1st octet, Host ID 3 octets


Net Id Host Id

Class B : NET ID 2 octets, Host ID 2 octets

Net Id

Host Id

Class C : NET ID 3 octets, Host ID 1 octet


Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 19

IP ADDRESSES : CLASSES

Nets : 128

Hosts : 16 777 214

Class A : NET ID 1st octet, Host ID 3 octets. 1st octet value from 1 to 126 Nets : 16 384 Hosts : 65 534

Class B : NET ID 2 octets, Host ID 2 octets. 2nd octet value from 128 to 191

Nets : 2 097 152

Hosts : 254

Class C : NET ID 3 octets, Host ID 1 octet. 1st octet value from 192 to 223

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 20

IP ADDRESSES : FEATURES

Value 0 : represents ANY Host

150.10.0.0 represents any host on network 150.10 Value 1 : represents ALL Hosts 150.10.255.255 represents all hosts on network 150.10

127.X.X.X addresses are LOOPBACK addresses


These addresses are never sent over the network

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 21

IP ADDRESSES : FEATURES

Any station can be reached at its UNICAST address Eg. : 150.10.20.30 Any station can be reached at its BROADCAST address Selected broadcast Eg. : 150.10.255.255

Restricted broadcast : 255.255.255.255


Any station can be reached at its MULTICAST address MULTICAST addresses are structured : 224.X.X.X They are class D addresses and represent ALL hosts in a group IP V6 does not support Broadcasts but introduces the concept of ANYCAST: Any (at least one) host in a group
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 22

IP ADDRESSES : MASK

The function of routing is to reach any host in a network Eg. : 150.10.0.0 The HOST part of the UNICAST address must be masked Eg. : 150.10.20.30 must be converted to 150.10.0.0 A logical AND must be applied to the UNICAST address and the mask value Configuring a mask entails: Setting the NET part to 1 and the Host part to 0 It is therefore sufficient to know the class Eg. : for network 150.10, class B, the mask will be:

255.255.0.0
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 23

IP ADDRESSES : MASK

10010110 150 AND 11111111 .

00001010 10 11111111 .

00010100 20 00000000 .

00011110 30 00000000

255
10010110

255

00001010

00000000

00000000

150

10

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 24

IP ADDRESSES : FEATURES
IP network 192.1.1.0
192.1.1.1 192.1.1.2 192.1.1.3

Requirements Two stations separated by router: Different network Ns Two stations connected with no router: Same network Ns

On same network: Different host Ns


192.1.1.17 Router 128.15.1.1

An IP machine must know:


- its IP address

128.15.1.13 128.15.187.1

- its subnetwork mask - at least one IP router address

IP network 128.15.0.0
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 25

SENDING THE IP DATAGRAM

Logical network N1

Logical network N2

Packet ready to send C:\netstat -r network address 0.0.0.0 127.0.0.0 150.10.0.0 150.10.20.30 255.255.255.255 150.10.255.255 224.0.0.0 network mask 0.0.0.0 255.0.0.0 255.255.0.0 255.255.255.255 255.255.255.255 255.255.255.255 224.0.0.0 Gateway addr. 150.10.20.31 127.0.0.1 150.10.20.30 127.0.0.1 150.10.20.30 150.10.20.30 150.10.20.30

Routing table

Interface 150.10.20.30 127.0.0.1 150.10.20.30 127.0.0.1 150.10.20.30 150.10.20.30 150.10.20.30


TCP/IP

metric 1 1 1 1 1 1 1
Page 26

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

SENDING THE IP DATAGRAM

Logical network N1

Logical network N2

Packet ready to send

Routing table

LAN

Interface

ARP cache
No Entry

ARP cache

08 20 02 12 63 48

150.10.20.30

MAC frame ARP request


Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 27

ADDRESSING BY SUBNETWORK
Network 2 160.10.0.0 Network 3 170.10.0.0

Network 1
150.10.0.0

S/Network 3

S/Network 1

S/Network 2

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 28

ADDRESSING BY SUBNETWORK Example: Class B address 150.10.0.0 can be subnetted using one of the masks below, depending on the number of subnetworks required

N of bits 2 3 4 5 6 7 8 9 etc.
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Mask 255.255.192.0 255.255.224.0 255.255.240.0 255.255.248.0 255.255.252.0 255.255.254.0 255.255.255.0 255.255.255.128

N of SNs 2 6 14 30 62 126 254 510


TCP/IP
Page 29

ADDRESSING BY SUBNETWORK

Network 2

160.10.0.0
Network 1 150.10.0.0 Network 3 170.10.0.0

S/Network 1 160.10.64.0 S/Network 2

160.10.128.0

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 30

PRIVATE / PUBLIC ADDRESSING

RFC 1918
The following network numbers are not routed on the Internet

Class A 10.0.0.0

Class B
172.16.0.0 to 172.31.0.0

Class C

192.168.0 to 192.168.255

Natural segregation of private traffic from Internet traffic Requires the presence of an address translator Network Address Translator (Router function) The NAT does not replace the FireWall and/or Proxy Server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 31

ADDRESS TRANSLATION
Firewall

Internet
Translator

ISP

@priv1,150.10.20.30 @pubA,194.10.212.47

@priv2,150.10.20.31
@priv3,150.10.20.32

@pubA, 194.10.212.49
@pubA, 194.10.212.49

Dynamic management of a mapping table translating private/public IP @

Translator location In the Firewall In the router Types of translation N private @ to 1 public @ N private @ to M public @ 1 private @ to 1 public @

Example : N to M
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 32

IP: DATAGRAM FORMATS


0 VERSION 7 LENGTH SERVICE TYPE TOTAL LENGTH IDENTIFICATION DF MF FRAGMENT OFFSET TIME TO LIVE PROTOCOL CHECKSUM SOURCE IP ADDRESS DESTINATION IP ADDRESS OPTIONS + PADDING 15

Frame header

IP packet

Physical frame

CRC

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 33

ICMP : INTERNET CONTROL MESSAGE PROTOCOL

ICMP packet

Network 1

Network 2

Network 3

IP packet

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 34

ICMP: PACKET FORMAT

15

TYPE CHECKSUM

CODE

Frame header
IP header

Physical frame IP datagram

DATA

ICMP packet

CRC

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 35

ICMP: PING UTILITY

Remote system activity test IP network transfer time


IP ICMP ECHO REQUEST 160.10.20.30

Ping 150.10.20.30

Network 1

Network 2

Network 3

IP

ICMP

ECHO REPLY

Note: a ping in itself checks IP layer activity only, and not the network board
TCP/IP
Page 36

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

ICMP REDIRECT

Network 3 Network 2

Server

2
R1 3

R2 5
Default gateway:

R1

Client

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 37

ICMP : TRACEROUTE UTILITY

Traceroute is a software tool for identifying nodes crossed by an IP datagram sent to a remote machine. Traceroute is based on the use of "TTL exceeded" ICMP messages.

ICMP TTL Exceeded

B
TTL=1

R1
TTL=2

R2
TTL= 3

R3

...

Rn

TTL= n

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 38

DYNAMIC HOST CONFIGURATION PROTOCOL

Dynamic configuration of IP machine addresses (clients)


(DHCP is carried by IP broadcast in BOOTP packets to UDP)

DHCP client

DHCP client

I want an individual IP address

DHCP client

Here is your IP address X.X.X.X

DHCP server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 39

INITIALIZATION

DHCP DISCOVER
Source Address: 0.0.0.0 Dest. Address: 255.255.255.255

DHCP client

DHCP server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 40

SERVER SELECTION

DHCP OFFER
Source Address: 150.10.20.30 Dest. Address: 255.255.255.255 IP Address: 150.10.20.31 Subnet Mask: 255.255.0.0 Server Identifier: 150.10.20.30 Lease Length: 48 Hours

DHCP client

150.10.20.30

DHCP server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 41

SERVER CHOICE / REQUEST

DHCP REQUEST
Source Address: 0.0.0.0 Dest. Address: 255.255.255.255 Req IP Address: 150.10.20.31 Server Identifier: 150.10.20.30 Requested Parameters........

150.10.20.30

DHCP client

DHCP server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 42

ATTACHMENT

DHCP ACK
Source Address: 150.10.20.30 Dest. Address: 255.255.255.255 IP Address: 150.10.20.31 Subnet Mask: 255.255.0.0 Server Identifier: 150.10.20.30 Lease Length: 48 Hours Default Gateway: 150.10.20.35 Other Requested Parameters....

150.10.20.30

DHCP client

DHCP server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 43

RENEWAL

DHCP REQUEST
Source Address: 150.10.20.31 Dest. Address: 150.10.20.30 Req IP Address: 150.10.20.31 Server Identifier: 150.10.20.30 Requested Parameters........

150.10.20.30

DHCP client

150.10.20.31
DHCP server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 44

REATTACHMENT

DHCP REQUEST
Source Address: 150.10.20.31 Dest. Address: 255.255.255.255 Req IP Address: 150.10.20.31 Server Identifier: 150.10.20.30 Requested Parameters........

DHCP server

DHCP client 150.10.20.31

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 45

EXTENDED INTERSECTION

Extended

Extended

DHCP server 1

150.10.20.1 to 150.10.20.100

150.10.20.75 to 150.10.20.175

DHCP server 2

The DHCP client leases @IP 150.10.20.85 from DHCP server 1

ERROR!! Duplicated address

The DHCP client leases @IP 150.10.20.85 from DHCP server 2


TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 46

IP Layer : The essential

True or False

IP is named this way because it can interconnect any type of networks. An IP characteristic is as follow : Best Effort Delivery ; So, it s a protocol ideal for voice transmission. A broadcast packet never goes through routers. The mask is used for IP packets routing. A router has several IP addresses, one per each connected network. ICMP goal is to allow IP packets to go correctly to the destination. An IP host can not work correctly if DHCP is not managed.

True False

False True True False False

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 47

Section 3 IP over LAN / MAN / WAN

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 48

IP OVER ALL NETWORKS

IP

LAN MAN Ethernet Token Ring FDDI DQDB Transparent

WAN Virtual circuit X.25, FR, ATM

LL, PSTN, ISDN

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 49

IP OVER ETHERNET / 802.3

Encapsulation - IP/Ethernet DIX V2 - (RFC 894)


Destination
48 bits

Source
48 bits

Type
16 bits

IP Header

Data

0x0800

IP datagram

Encapsulation - IP/IEEE 802.2/IEEE 802.3 - (RFC 1042)

Destination
48 bits

Source
48 bits

Data length
16 bits

DSAP
8 bits

SSAP
8 bits

Ctrl
8 bits

IP header

Data

IP datagram

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 50

ADDRESS RESOLUTION PROTOCOL (ARP)

A B

Router

Eth(B) = 080026235577 ARP Reply

ARP Request

Mac Broadcast
IP(A) = 150.10.20.30 IP(B) = 150.10.20.31 Eth(A) = 00 10 7B 38 52 EC Eth(B) = ?

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 51

PROXY ADDRESS RESOLUTION PROTOCOL (ARP)

A B

Router

Eth(Router) 00 00 0C 07 AC 01 ARP Reply

ARP Request Mac Broadcast IP(A) = 150.10.20.30 IP(B) = 160.10.20.31 Eth(A) = 00 10 7B 38 52 EC Eth(B) = ?
TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 52

POINT-TO-POINT PROTOCOL

PPP is a layer 2 protocol (HDLC type) Usable on transparent circuit with synchronous or asynchronous transmision Basic functionalities Link configuration and link option negotiation Protocol multiplexing by encapsulation and identification Link quality testing and error detection Authentication Header compression Choice of CRC Incorporates sub-protocols LCP (Link Control Protocol) IPCP (IP Control Protocol) NCP: Network Control Protocol
TCP/IP
Page 53

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

PPP AUTHENTICATION

PAP Password Authentication Protocol Plain text password CHAP Challenge Handshake Authentication Protocol
Challenge (random) Challenge (random) Secret password

Secret password

MD 5

MD 5

PPP client
Reply

rcvd

OK or OK
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

= calc
TCP/IP

PPP server

Page 54

IP OVER MULTIPOINT WAN : IP OVER X.25

LAN 1

@X121 R1
@X121 R3

LAN 3
@X121 R2

X.25 network Routing table

LAN 2 Address table


@IP R1 Wan --> @X121 R1 @IP R2 Wan --> @X121 R2

LAN1 --> @IP R1 Wan LAN2 --> @IP R2 Wan

PLP X.25 HDLC X.25

IP 802.2 ARP table


@IP --> @MAC ...

802.3/5

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 55

IP OVER MULTIPOINT WAN : IP OVER FR

LAN 1

DLCI R1
DLCI R3

LAN 3 FR network
DLCI R2

Routing table LAN 2 Address table


@IP R1 Wan --> DLCI R1 @IP R2 Wan --> DLCI R2 LAN1 --> @IP R1 Wan LAN2 --> @IP R2 Wan

IP Frame Relay 802.2 ARP table


@IP --> @MAC ...

802.3/5

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 56

IP OVER MULTIPOINT WAN : IP OVER ATM

LAN 1

VPI/VCI R1
VPI/VCI R3

LAN 3 ATM network


VPI/VCI R2

Routing table LAN 2 IP Address table


@IP R1 Wan --> VPI/VCI R1 @IP R2 Wan --> VPI/VCI R2
LAN1 --> @IP R1 Wan LAN2 --> @IP R2 Wan

802.2 AAL/ATM

ARP table
@IP --> @MAC ...

802.3/5

Frame Relay
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 57

IP bearers : The essential

True or False

IP packets are segmented into packets of 1500 bytes for delivery to the lower layer. ARP allows to find an IP host by knowing the MAC address. PPP is a protocol at the same layer as Ethernet

False False True True True True

2 LANs may be connected through the PSTN using PPP.


2 PCs can be connected together by serial link, in order to make an IP network. This local network can be connected to the Internet, by linking one of them by modem. As IP can be placed above any type of physical network, it can be implemented in the mobile networks. An IP host may be a router, by only adding specific software.
TCP/IP

True True

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 58

Section 4 TCP/IP : TRANSPORT LAYER

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 59

APPLICATION-ORIENTED ADDRESSING

Appli X Client

Appli Y Server

Appli Z Server

Appli X Server

Appli Y Client

Station A

Station B

TCP - UDP IP

Source port-Destination port

TCP - UDP
IP

Physical network : layers 1 and 2


Port number: Communication local identification Socket: Association of IP address and port number Communication: Association of Server and Client sockets, transport type (TCP / UDP)
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 60

WELL KNOWN PORTS Services file


Number 20/tcp 21/tcp 23/tcp 25/tcp 53/udp 67/udp 68/udp 69/udp 79/tcp 80/tcp 88/udp 109/tcp 110/tcp 111/udp 161/udp 162/udp 512/tcp 513/tcp 520/udp

Protocol
File Transfer Protocol [Default Data] File Transfer Protocol [Control] Telnet Simple Mail Transfer Protocol Domain Name Server Bootstrap Protocol Server Bootstrap Protocol Client Trivial File Transfer Protocol Finger World Wide Web HTTP Kerberos Post Office Protocol - Version 2 Post Office Protocol - Version 3 SUN Remote Procedure Call SNMP SNMP TRAP Remote Process Execution Remote Login RIP

Keyword ftp-data ftp telnet smtp domain bootps bootpc tftp finger www-http kerberos pop2 pop3 sunrpc snmp snmptrap exec login router

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 61

TRANSMISSION CONTROL PROTOCOL

Connection-oriented mode 3 Phases : Set-up - Transfer - Release Reliable transfer mode Fragmentation (octet stream) Guaranteed sequencing Error recovery (timer protection) Window flow control "Forced delivery" option PSH flag "Urgent data" option URG flag

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 62

TCP: CONNECTION SET-UP

TCP client A
<SYN> Snd SEQ N : 3256 <ACK> Snd SEQ N : 3257 Ack SEQ N : 2651

TCP server B
<ACK> <SYN> Snd SEQ N 2650 Ack SEQ N 3257

IP network

IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 63

TCP: DATA TRANSFER

Client Appli

TCP
SYN 3256

IP network

TCP

Server Appli

S e t u p T r a n s f e r

ACK 3257, SYN 2650 ACK 2651 PSH 3257, ACK 2651, lg=100

ACK 3357, PSH 2651, lg=500 ACK 3151 ACK 3357, PSH 3151, lg=200 ACK 3357, PSH 3351, lg=600

ACK 3951

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 64

TCP: CONNECTION RELEASE

TCP client A
<END> Snd SEQ N 3357 <ACK> Snd SEQ N 3258 Ack SEQ N 3952

TCP server B

<ACK> <END> Snd SEQ N 3951 Ack SEQ N 3258

IP network

IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 65

TCP : FORMAT
0 7 SOURCE PORT N DESTINATION PORT N SEND SEQUENCE NUMBER ACKNOWLEDGEMENT NUMBER OFFSET RESERVED WINDOW CHECKSUM URGENT POINTER OPTIONS + PADDING URG ACK PSH RST SYN FIN 15

Frame header IP header


Physical IP packet frame

TCP segment

crc

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 66

USER DATAGRAM PROTOCOL

Connectionless mode transport protocol Transactional traffic oriented Also used by applications which have control over transmissions (eg.: tftp) In network terms, reduced overhead compared to TCP UDP packet checksums calculated in a pseudo-header (UDP header + source and destination IP addresses sent are replaced by IP source and IP local ports in receive mode) Used by NFS, BOOTP, TFTP, SNMP, RIP, ...
TCP/IP
Page 67

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

UDP : FORMAT

7 SOURCE PORT N DESTINATION PORT N LENGTH CHECKSUM

15

Frame header IP header IP Physical packet frame

DATA

UDP segment

CRC

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 68

SOCKET INTERFACE

Development interface for communication between remote processes


The "socket" interface is derived from BSD UNIX 4.2. It generalizes interprocess communication and allows development of network-based client-server applications Sockets are used as interfaces with communication protocols Among other things, they allow a port N (application) to be associated with an IP address (host) They make TCP/IP protocols transparent to applications

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 69

Transport layer : The essential

True or False

All the applications must use TCP or UDP to access the IP network. If an application is associated to a port number, it means that this application is connected to the Internet at this moment. The checksum on the TCP/UDP header also allows to verify parts of the IP header. TCP is defined as reliable because it has 3 working steps : Establishment, Transfer, Release. A WEB server will always listen on its dedicated port (port 80). Either, this server will not work at all. All TCP messages must be acknowldeged. If UDP is used to send data, the transmission may become reliable by adding controls in the application layer part.
TCP/IP

False False

True False

False

True True

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 70

Lower layers : The essential

Complete the following protocols stack : Applications Ping, traceroute, ... Applications protocols Sockets (Port + @IP)

TCP

(Reliability, Robust)

UDP

(Speed, Simple)

ICMP

IP

(Routage)

Interfaces Ethernet+ARP PPP/SLIP AAL5 Gateway

LAN

RTC

ATM

X25

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 71

Section 5 TCP/IP : APPLICATIONS

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 72

NAME SERVICE

The user manipulates server names and the network manipulates a server IP address. Problems: Finding an IP address based on a host name

More than one type of name


TCP/IP name: standard Used by applications such as http, ftp, smtp, snmp, Netbios name: Windows/Microsoft name Used by Netbios applications (SMB sharing, )

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 73

NAME-IP ADDRESS RESOLUTION

"Static" resolution Host (standard) or lmhosts (Netbios) file 150.10.20.30 Mon_Host 150.10.20.31 Ton_Host "Dynamic" resolution DNS Standard TCP/IP name resolution Replaces the hosts file WINS Netbios resolution Replaces broadcasts and lmhosts file

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 74

DNS RESOLUTION

History Impossible to load a hosts file into all Internet stations Domain Name Service standardized by RFC Principle Names organized hierarchically in a Domain Name Tree Simple request / response interchange protocol Uses UDP and TCP Cooperation between servers forming a network

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 75

DOMAIN NAME TREE

.
ru com fr jp

alcatel

alcatel

alcatel

co

mow
www.mow.alcatel.ru

usa
www.usa.alcatel.com

europe
www.europe.alcatel.fr

alcatel
www.alcatel.co.jp
TCP/IP
Page 76

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TOP LEVEL DOMAINS ON THE INTERNET

Open to all Com : Commercial (highest demand!) Edu : universities Net : network domain companies Org : miscellaneous organizations Int : international (little used) Reserved for United States Gov : American government And also Mil : American military Firm : Business (to alleviate .com) Shop : Trader Country (ISO naming) Web : Company working for the Web Fr : France Arts : Culture and events Rec : Recreation and leisure Uk : United Kingdom Info : Content editors, media Ru : Russia Nom : Personal home pages
TCP/IP
Page 77

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

RECURSIVE SEARCH

.
2 3

Root servers

com
4 5

fr alcatel europe

www.europe.alcatel.fr
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

www : 198.64.191.11
TCP/IP
Page 78

FORWARDER TYPE SEARCH

4 3

A
Forwarder : B

Server A extends the request to B


If server B fails, A executes a recursive search

www.europe.alcatel.fr ?
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 79

FTP

ftp>

Client
x y

Server
20
21

TCP IP Data Control

TCP IP

Control connection, Port 21 File transfer initialization and parameters Activation of remote commands Data connection, Port 20 Information transfer (files, results, ...)
TCP/IP
Page 80

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

FTP : EXAMPLE OF DIALOGUE


Client (150.10.20.30)
ftp serveur username password 331 Password required PASS password 230 User username logged in ascii, binary, mode, ... 220 Commands successful PORT 150,10,20,30,4,45 200 Port Command successful ls, dir, get, put LIST, RETR, STOR Data connection set up to client port 1069 150 ASCII data connection for /bin/ls 226 ASCII transfer complete List, file requested ........ Data connection closure on port 1069 bye, quit 221 Goodbye ... Control connection closure
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Control connection set up to server port 21

Server (150.10.20.31)

220 Server ready USER username

Connection

TYPE / STRU / MODE

Transfer

QUIT

Disconnection
TCP/IP

Page 81

FTP : USER COMMANDS

FTP user commands depend on implementations Commands are executed either locally or in the remote machine. Example: lcd : change local directory cd : change remote directory Some commands are redundant Example: bye and quit, get and recv, put and send, etc

append ascii bell binary bye cd close delete debug dir form get hash glob

help lcd ls mdelete mdir mget mkdir mls mode mput open prompt put pwd

quit quote recv remotehelp rename rmdir send sendport status struct tenex trace ? !
TCP/IP
Page 82

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

WORLD WIDE WEB

HTTP protocol Web Browser

Web Server

URL : Uniform Ressource Locator Protocol://Server-Name:Port/Resource http://www.estnet.ee/mart/rfc/index.html HTML page interpreted by a Browser, containing:

ASCII text describing the page display (tags, text) Pictures in gif or jpeg format Hypertext links to other pages or URLs Javascript or VB scripts run on the client Java Applets or Active X controls run by the client
TCP/IP
Page 83

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

SECURE SOCKET LAYER

1 Client Hello

3 Certificate ClientKeyExchange CertificateVerify ChangeCipherSpec

2 Server Hello Certificate ServerKeyExchange CertificateRequest ServerHello Done

4 Data Exchange
1: 2: 3: 4:

4 Data Exchange

Client sends a "hello" message to the target server Server returns a digital certificate containing the server's public key Client generates a random session key and returns the key encrypted using the server's public key Once secured protocol has been established, all documents are sent encrypted symmetrically in both directions (RC4)

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 84

ELECTRONIC MESSAGING : E-MAIL POP SMTP A.Dupont's POP server in domain aile.com Message sent by albert.dupont@aile.com to jacques.dupond@alcatel.fr SMTP

Jacques Dupond's IMAP server in domain alcatel.fr

IMAP

Mail received from albert.dupont@aile.com


Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 85

SMTP : EXAMPLE OF DIALOGUE

SMTP Client
TCP connection set-up to server port 25 220 Server ready

SMTP Server
Connection Synchronization
HELLO SMTP client

250 Server SMTP OK MAIL FROM username

250 Sender Ok
RCPT TO username1 250 Recipient Ok RCPT TO username2 550 User unknown DATA

Identity of Sender and Recipient(s)

354 Enter mail; end with <CRLF> <CRLF>


Message ... <CRLF> <CRLF> 250 Mail accepted QUIT 221 Service closing transmission channel TCP connection release

Message transfer

Disconnection
TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 86

TELNET

Client

$ telnet server $ login : My_name $ password :

Server

23

TCP

TCP

IP

IP

Characters typed on the keyboard are sent to the telnet server All characters received from the server are displayed

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 87

TELNET

Server Telnet : Cisco Router


Terminal Type option negotiation request IAC WILL ECHO IAC WILL SUPPRESS-GO-AHEAD IAC DO TERMINAL_TYPE IAC DO NAWS (Negotiate About Window Size)

Client Telnet : PC
TCP connection

IAC DO ECHO

OK to negotiate

TELNET DATA : Cisco>


IAC WILL ECHO IAC DO SUPPRESS-GO-AHEAD IAC WILL TERMINAL_TYPE IAC WONT NAWS (Negotiate About Window Size) IAC SB (Start of Subnegotiation Parameters) DATA : ANSI IAC SE (End of Subnegotiation Parameters)

IAC WONT NAWS (Negotiate About Window Size) TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 88

TFTP

Trivial File Transfer Protocol - RFC 1350 TFTP is a file transfer protocol based on connectionless mode transport (UDP port 69). TFTP is used to transfer files in ASCII and BINARY mode.

TFTP provides limited security (no user identification) and for this reason its use must be limited.
TFTP protocol is based on five packet types. Each packet sent from client to server must be acknowledged. TFTP is sometimes used for downloading configurations over the network (terminal server, X terminals, router, etc).
TCP/IP
Page 89

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

NFS

Network File System - RFC 1094 (specified by SUN Microsystems) NFS is used for file sharing in heterogenous environment NFS protocol is based on RPCs (Remote Procedure Call) NFS is hardware and system-independent. It is based on a presentation layer: XDR (eXternal Data Representation)

NFS XDR

RPC
UDP

IP
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 90

REMOTE PROCEDURE CALL

RPC protocol allows a program running on machine A to call a routine on machine B and remotely execute some of its operations.

CLIENT Request

SERVER 4

Service user

Service provider
1

Response 3

Port Mapper

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 91

X-WINDOW CLIENT-SERVER ARCHITECTURE

X-Window Clients

X11 protocol

X-Window server

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 92

Applications : The essential

True or False

Any IP host must know a DNS server to work correctly An URL is a server address. A host being FTP server, it can connect as a client to a WEB server.

False False True

FTP is the only way to get back a file from a remote Internet site.
TELNET is an application from Internet world, but only used by UNIX systems. The following URL is valid : http://155.132.10.53:2080/coucou.html SMTP is a protocol using the connected mode. To send and receive e-mails, we must configure a POP server !

False False
True True False

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 93

Section 6 -

IP NETWORK INTERCONNECTIONS

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 94

GATEWAY

Definition The concept of gateway is used in the application layer Eg. : SNA gateway on Digital machine By extension, this concept is applied to all layers and especially the lower layers "Network" gateways are then seen as level N interconnection equipment Terminology Repeater : level 1 gateway Bridge : level 2 gateway Router : level 3 gateway Special case IP gateway = IP router = Level 3 gateway Switch = level 2 switch (Ethernet, ATM, etc) = level 2 gateway

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 95

REPEATER

205m

Example: 100BaseT

5m 100m

100m

The binary signal is present at all ports


TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 96

BRIDGE

CSMA/CD filtering bridge


LAN 1
Dest@ Mac C Src@ Mac A ...

Bridging

LAN 2

Dest@ Mac B Src@ Mac A ...

Port 1 Port 0 BRIDGE

Filtering

Dest@ Mac C Src@ Mac A ...

Port 0 - @ Mac A - @ Mac B - ...


Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Port 1 - @ Mac C - @ Mac D - ...

D
TCP/IP

Page 97

BRIDGE : LIMITATIONS

CSMA/CD filtering bridge


LAN 3
Dest@ Mac C Src@ Mac A ...

LAN 1
Dest@ Mac C Src@ Mac A ...

Port 2
Dest@ Mac B Src@ Mac A ...

E
Port 0 BRIDGE Port 1 Bridging

Filtering

Dest@ Mac C Src@ Mac A ...

Port 0 - @ Mac A - @ Mac B - ...


Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Port 1 - @ Mac C - @ Mac D - ...

C
D LAN 2
TCP/IP
Page 98

ROUTER

A Network 1
Dest@ IP C Src@ IP A ...

Network 3

Port 2
Dest@ IP B Src@ IP A ...

Port 0

Routing

Port 1

Dest@ IP C Src@ IP A ...

Routing Table - Network 1 Connected to port 0 - Network 2 Connected to port 1 - Network 3 Connected to port 2 D

C Network 2
TCP/IP
Page 99

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

ROUTER

Network interconnection
network 3 170.10.0.0 network 1 LL, ISDN network 2 160.10.0.0

R1

150.10.0.0

X.25, FR, ATM

R2

A
@MAC R1 @IP B

@IP B DATA

DATA

Network 1
DATA

R1
@MAC R2 @IP B

@IP B DATA
@IP B @MAC B @IP B DATA @IP B

Network 3
DATA

R2 B
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Network 2
DATA

TCP/IP

Page 100

ROUTING

STATIC a route corresponds to a given address Eg. : Network 150.10.0.0 accessible via R1 in one hop DYNAMIC Routers interchange routing information for choosing the best route based on different criteria Questions: What information is interchanged? When is the information interchanged? What entity is information interchanged with? Choice criteria : metric simple : number of hops multiple : bit rate, load, reliability, etc.
TCP/IP
Page 101

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

ROUTING

Convergence time length of the routing update delay Volume of information to be interchanged low to very high Routing table size Impossible to control without an address hierarchy Impossible to control without a network hierarchy CIDR : Classless Inter Domain Routing Associates the concept of geographic prefix with class C IP addresses Eg. : 194.150.160.170 -- > 194 represents France Autonomous System Combines a significant number of networks in a single entity
TCP/IP
Page 102

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

ROUTING ON THE INTERNET

Routing architecture Division of the Internet into Autonomous Systems Protocol types "Internal" (IGP) : RIP, OSPF, IS-IS, EIGRP "External" (EGP) : BGP-4
Net 1 Net 1 RIP Net 2 AS 3 Net 2

AS 1

BGP4

Net 3 OSPF
Net 1 Net 2 AS 2

E.G.P. I.G.P.
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Net 3 EIGRP

Net 4

TCP/IP

Page 103

ROUTING : CATEGORIES

Distance Vector

Routers interchange routing tables cyclically

The best route has the least routers to be crossed Convergence time is lengthy Volume is significant There is a risk of looping Few processor resources are required

RIP, Routing Information Protocol (IETF) IGRP, Inter Gateway Routing Protocol (Cisco) EIGRP Enhanced Inter Gateway Routing Protocol (Cisco)
TCP/IP
Page 104

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

ROUTING : CATEGORIES

LINK STATE

Each router builds a network map Routers interchange link states on an event basis The best route incurs the lowest cost Convergence time is low Volume is low No risk of looping The process is bulky

OSPF, Open Shortest Path First (IETF) IS-IS , Intermediate System to Intermediate System (ISO)
TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 105

ROUTING : CATEGORIES

PATH VECTOR

Changes in the Link State Routes are described using the path taken Each router builds a network map Routers interchange path attributes on an event basis The best path incurs the least cost (including financial) Convergence time is fast Volume is low No risk of looping

BGP4, Border Gateway Protocol (IETF)

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 106

Interconnection : The essential

True or False

Internet is made of plenty of networks connected by routers. An IP network can contain several LANs Intelligents bridges can analyse the IP header to route packets better.

True True False True True False

Internet is shared in zones to decrease routing management traffic.


Routing protocols were implemented from the beginning of Internet 30 years ago. Any IP host must know the IP address of a router to communicate with other hosts. Each time a packet enters a router, OSPF is used in order to find the right route to destination.

False

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 107

Section 7 NETWORK ADMINISTRATION

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 108

ADMINISTRATION

Objective : To Manage, Optimize, Configure, Secure, Observe, Correct


INDEPENDENTLY OF PROPRIETARY TOOLS

MANAGING CONFIGURATIONS
Mechanisms to manage and set up resources

Norms / Standards
CMIS / CMIP
Common Management Information Service / Protocol

CARRYING OUT OBSERVATIONS


Measurements, statistics, performance, load

MANAGING EVENTS
Detection, location, restart on incident, alarms

CMOT
CMIS/CMIP Over TCP/IP

MANAGING COSTS
Allocating and distributing loads

SNMP
Simple Network Management Protocol

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 109

SIMPLE NETWORK MANAGEMENT PROTOCOL

MANAGER

Graphics tool providing the man/machine interface The Manager sends requests and receives responses to
administration commands HP Openview and SunNet Manager are SNMP Managers

AGENT The agent is the Server for Client Manager requests Manager and Agent dialogue via SNMP An agent can extend SNMP requests in proprietary format (agent proxy) SNMP Agents manipulate objects MIB Management Information Base MIB I and II describe more than 200 standardized objects
TCP/IP
Page 110

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

SNMP ADMINISTRATION
Manager
Server Agent
MIB

Agent Router Agent Agent Hub


MIB

MIB

Router

snmp
Agent
MIB

Agent Agent proxy

Bridge

MIB

Bridge Pabx Agent Agent

MIB

proprietary
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 111

SNMP PROTOCOL : 5 PDUs


AGENT MIB consultation Simple
MIB

MANAGER
Get_request (object,object,...) Get_response (value,value,...) Get_Next_request (object,object,...)

1 2 3

Multiple
MIB modification

MIB

Get_response (value,value,...)

Set_request ((object,value),...)
MIB

Get_response (value,value,...)

Agent Alert
MIB

Trap (infos)

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 112

MANAGEMENT INFORMATION BASE

OSI tree
ISOITU 3

ISO 1 ORG 3 DOD 6

ITU 2

Internet Branches
Directory ( 1.3.6.1.1 ) OSI directory in TCP/IP Mgmt ( 1.3.6.1.2 ) Standard MIB (MIB I and II) Experimental ( 1.3.6.1.3 ) IAB trials Private ( 1.3.6.1.4 ) Manufacturer private MIBs
TCP/IP

Internet 1
Directory 1

Mgmt 2

Experimental 3

Private 4

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 113

MANAGEMENT INFORMATION BASE

Internet tree - MIB-II


Internet
1

Directory 1

Mgmt 2

Experimental 3

Private 4

MIB-2 1

At System 3 1 Interface 2

ICMP 5 IP 4 TCP 6

UDP 7
EGP 8

CMOT 9 Trans. 10
TCP/IP

SNMP 11

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 114

STANDARD MIB I - II VARIABLES

Examples of variables
SysUpTime : Time elapsed since last startup (System) IfNumber : Number of network interfaces (Interface) ATTable : MAC-IP address translation table (Addr. Trans.) IPdefaultTTL : Time to live value for IP packets (Interface) IPInReceives : Number of datagrams received (IP) IPForwDatagrams : Number of datagrams forwarded (IP) IPOutNoRoutes : Number of packets routed in error (IP) IPReasmOKs : Number of packets reassembled correctly (IP) IPFragOKs : Number of packets fragmented (IP) IPRoutingTable : Routing table (IP) ICMPInEchos : Number of "Echo Request" PDUs received (IP) TCPMaxConn : Maximum number of TCP connections allowed (TCP) TCPInSegs : Number of TCP segments received (TCP) UDPInDatagrams : Number of UDP datagrams received (UDP)
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 115

ANALYSIS OF IP NETWORKS

Solution 1:
Analyzer

"conventional" analyzer
Analyzer

Analyzer
R2

R1
Local area network 1 Local area network 2

Local area network 3

Solution 2:

SNMP probe + MIB Rmon


Probe
SNMP

Probe R1 R2 Local area network 2 Local area network 3


TCP/IP

Probe

Administration station

Local area network 1

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 116

Network management : The essential

True or False

The MIB content is sent from the manager to the agent using the SNMP protocol. Some objects are defined in MIB I and II for standard equipments, but each firm may create his own objects hierarchy. SNMP is a pragmatical protocol like any other protocol from IP world. SNMP is simple and not reliable (over UDP), so a few constructors use it. Other network management architectures exist : Q3 (with CMIP) and CORBA Without network management, an equipment can not be set up. Analysing the IP branch of the MIB II, all the characteristics of this protocol can be retrieved (like those described in this document about IP introduction)

False True

True False True False

True

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 117

Section 8 SECURITY

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 118

SECURITY

System security Password verification Minimum privileges assigned to server processes Filtering on protocols Filtering router Firewall Proxy Server Information encryption SSL S/MIME User authentication Kerberos SecurID Radius
TCP/IP
Page 119

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

THE FILTERING ROUTER SOLUTION

Private addresses 150.10.0.0

Public addresses 192.170.145.0 ISDN, LL X.25, FR, ATM

INTRANET

ISP
Filtering router

I N T E R N E T

Filtering of: address, appli, protocol


Network Address Translation
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 120

THE INTERNET FIREWALL SOLUTION

Secured transparent access to Internet servers Intranet


ISDN, LL X.25, FR, ATM

ISP
Firewall

I N T E R N E T

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 121

THE PROXY SERVER SOLUTION

Powerful, non-transparent access to Internet applications Intranet

ISDN, LL X.25, FR, ATM

ISP
Proxy Server

I N T E R N E T

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 122

INFORMATION SECURITY

OBJECTIVES

Integrity Data must not be altered Authentication The recipient must be sure of the sender's identity Confidentiality Data must not circulate unencrypted Non-Repudiation The recipient must hold a proof of sending

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 123

SYMMETRIC KEY ENCRYPTION

This is a private message

Mr X

xxxxxxxx xxxxxxx xxxxxxx

xxxxxxxx xxxxxxx xxxxxxx

This is a private message

Mrs Y

Mr X creates the message and encrypts it using the key known to himself and Mrs Y He sends the encrypted message over the network Mrs Y receives the encrypted message and decodes it using the key

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 124

ASYMMETRIC KEY ENCRYPTION

This is a private message

Mr X
Mrs Y's public key

xxxxxxxx xxxxxxx xxxxxxx

xxxxxxxx xxxxxxx xxxxxxx

This is a private message

Mrs Y

Mrs Y's private key

Mrs Y creates two keys, one private and known to no-one else, and one public which is circulated over the network Mr X creates the message and encrypts it using Mrs Y's public key He sends the encrypted message over the network Mrs Y receives the encrypted message and decodes it using a private key (only she can decode the message, guaranteeing that no-one other than Mr X and Mrs Y can read the message) If Mrs Y wants to reply, she uses Mr X's public key
TCP/IP
Page 125

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

COMBINED SYMMETRIC / ASYMMETRIC KEY

This is a private message

Information confidentiality
xxxxxxxxx xxxxxx xxxxxxx Session key

Mr X

Session key Mrs Y's private key xxxxxxxxx xxxxxx xxxxxxx

This is a private message

Mrs Y

Mrs Y's public key

Mr X encrypts the message using a symmetric key created specifically for this purpose. Mr X then encrypts the session key using Mrs Y's public key and sends all this information to Mrs Y. Mrs Y decodes the session key using her private key, then decodes the message using the session key.
TCP/IP
Page 126

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Section 9 IP VERSION 6

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 127

IP VERSION 6

Addressing space running out 128-bit addresses Routing table size 128-bit addresses organized hierarchically Lack of security Authentication mechanism Incorporation of new services Machine mobility Simplicity of configuration New applications (multimedia, VoD, remote control, ...) New version of IP protocol extends the addressing and routing function broadcasts superseded by anycasts introduces quality of service information (real time applications, multipoint, security, etc)
TCP/IP
Page 128

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

IP V6 : HEADER
32 bits 4 bits Vers Pri. Payload Length 16 bits Flow Label Next Header 8 bits Hop Limit

Source Address (128 bits)

40 octets

Destination Address (128 bits)

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 129

IP V6 ADDRESSING
Unicast address general format 3 5 16
Provider identifier

16

32
Subnetwork identifier

Format Registry Prefix identifier

Subscriber Subscriber type identifier

Example: Site local addresses: Intranet with router 1111 1110 11


Prefix
Not used Subnetwork Isolated Intranet Interface

32

Examples: Link local addresses: network with no router 1111 1110 10


Prefix
Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Not used

@ MAC interface
TCP/IP
Page 130

The essential of the essential

True or False

To entirely secure a private network, we just have to install a firewall in order to connect to the Internet. A proxy server is a singular router; so, it s also an IP host. IP v6 evolution is necessary, because of a penury of addresses.

False

True True

Exercice

From home, you want to connect to a commercial Internet site in order to buy a CD on-line. Please complete the schema of the following page by drawing and naming the networks transitted to reach the Internet site, as well as their equipments Show and name the protocols used to make this connection work.

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 131

The essential of the essential

SHTTP/SSL/TCP/IP/...
Your PC

LAN

Server Y

Modem

OSPF or RIP or ...


PSTN

AS

IP/PPP

ISP

AS Internet Server POP3


Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Proxy
TCP/IP

SNMP Manager
Page 132

Glossary : A - I

ARP BOOTP DHCP DNS FTP HTML HTTP IAB IETF IP IRTF ITU-T

Address Resolution Protocol Boot Protocol Dynamic Host Configuration Protocol Domain Name Service File Transfer Hyper Text Markup Language Hyper Text Transfer Protocol Internet Activities Board Internet Ingineering Task Force Internet Protocol Internet Research Task Force International Telecommunications Union - Telecom
TCP/IP

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

Page 133

Glossary : L - R

LAN MAN MIB NIC OSI OSPF PDU POP PPP RFC RPC

Local Access Network Metropolitan Access Network Model Information Base Network Information Center Open System Interconnexion Open Shortest Path First Packet Data Unit Post Office Protocol Point to Point Protocol Request For Comment Remote Procedure Call

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 134

Glossary : S - Z

SDU SHTTP SLIP SMTP SNMP SSL TCP UDP WWW

Service Data Unit Secured HTTP Serial Link Internet Protocol Simple Mail Transfer Protocol Simple Network Management Protocol Secured Socket Layer Transmission Control Protocol User Datagram Protocol World Wide Web

Alcatel University - 8AS 90145 0007 VT ZZA Ed.02 - June 2000

TCP/IP

Page 135

Potrebbero piacerti anche