Comp 343/443 Week 9: Oct 22

ARP
TFTP
sliding-windows implementation
TCP timeout
BLAST
CIDR
routing

==============================================================================
==============================================================================
	                      

4.1.5: ARP

Basic ideas: broadcast request/unicast reply, cache

ICMP Destination Host Unreachable if nobody answers

Timeout: used to be ~10 minutes (20 min for early linux), 
now is much less (linux 2.4 arp timeout is ~60 seconds)

	see: www.cs.helsinki.fi/linux/linux-kernel/2002-07/0179.html
	ip -s neigh
	
Alternatives: polling, link-layer notice, IP-layer notice
        
finer points: 
If A arps "where is B?"
        1. B always puts A in its cache
        2. All hosts with A in their cache update the entry
Self-arp, or gratuitous arp: detects duplicates, ethernet addr changes
	send an arp request for yourself (and hope you don't get answers!)

Flooding: 
    what if A tries to send 100 packets to B; how many ARPs? 
    A b'casts, everyone replies & needs to ARP to get A's addr
ARP and networks without b'cast [eg ATM]
        Failure in presence of looping
security implications of ARP
proxy arp

=====

detecting sniffers:
To find out if host A is in promiscuous mode, send an ARP "who-has A?"
query. Address it not to the b'cast Ethernet address, though, but to,
well, EthDest. 

If promiscuous mode is off, NI will reject the packet.
If promiscuous mode is on, the NI will forward the arp request to the host.

Alas, linux kernels reject at the software level arp queries to 
physical ethernet addresses other than our own. 
BUT: they do respond to faked multicast addresses. 

Windows: try ff:ff:ff:00:00:00 or ff:ff:ff:ff:ff:fe

You can ping A's actual IP address (which requires a separate ping for each host,
and a prior scan to find all the hosts), or try pinging the IP b'cast address
(all 1's in the host part).
        
======

DHCP; once known as Reverse ARP (RARP)
	You b'cast your Ethernet addr, and hope a DHCP server finds it and
	sends you your IP address. Also other helpful startup options!!!
		subnet mask
		default router
		DNS Server

DHCP and servers: who's going to update the DNS entries?

Minimal network config:
	ip addr
	subnet mask
	default router
	DNS server
	
===========================================================================
===========================================================================	
	
TFTP/WUMP:	
	basic strategy
	dallying
	RRQ/REQ
	port change
	State view: differences between UNLATCHED, LATCHED, and DALLY
		

	TFTP/WUMP scenarios:
		
	1.	duplicate REQ
		
		If the first REQ is sent twice (perhaps due to a client timeout),
		two child processes start on the server. The one that the client receives
		DATA[1] from first is the one the client will "latch on" to; the other
		should be sent an ERROR packet.
		
	2.	lost final ACK
		This is addressed with the DALLY state
				
		
	3.	old late duplicates
		This is addressed by having EITHER side (preferably both) choose a new
		port number for each "connection" (ie transfer).
		
	4.	Sequence number wrap: not allowed (but do we check?)
		
	5.	HUMP/CHUMP: two scenarios where we get something other than requested:
		1. Lost REQ: 	REQ "foo" (received but response delayed)
				<abort>
				REQ "bar" (lost, but now delayed DATA1-foo arrives)
				
	6.	2. Malicious flood of DATA[1].bad from port, so
		
					   	BAD guy opens port 6666
					   <---- DATA[1].bad from 666
					   <---- DATA[1].bad from 666
					   <---- DATA[1].bad from 666
					   <---- DATA[1].bad from 666
					   
				REQ "good" --> server
						server creates good

					   <---- DATA[1].bad from 666	LATCH!
						
						
					<----  server sends DATA[1].good
					
					   <---- DATA[1].bad from 666
					   <---- DATA[1].bad from 666
					   <---- DATA[1].bad from 666

===========================================================================

Simple packet-based sliding-windows algorithm

receiver-side

	window size W
	Next packet expected N
	(window is N ... N+W-1)
	
	Generic:
	
		We have a pool EA of "early arrivals".
		When packet M arrives:
		if M<N or M>=N+W, ignore
		if M>N, put the packet into EA.

		if M=N, 
			1. output the packet (packet N)
			K=N+1
			while (packet K is in EA) output packet K
		   	slide window forward by K
		
	Specific implementation:
	
	bufs[]: array of size W. We always put packet M into position M % W
	
	At any point between packet arrivals, packet slot N is empty,
	but some or all of N+1 .. N+W-1 may be full.
	
	Suppose packet M arrives.
	
	1. M<N or M>=N+W: ignore
	2. otherwise, put packet M into bufs[M%W]
	3. while (buf[N % W] has a valid packet) {
		write it
		N++
	   }
	   If M!=N, this loop will do nothing.
	   But if M==N, we will write packet N and any further saved packets,
	   and slide the window forward.
	4. Send ACK[N]: number of next packet expected,
	   or ACK[N-1]: number of last cumulative packet, depending on protocol wording
	   
sender side:
	We will assume ACK[M] means all packets <=M have been received
	(second option immediately above)
	
	W = window size, N = bottom of window
	window is N, N+1, ..., N+W-1
	
	init: N=0. Send full windowful of packets 0, 1, ..., W-1
	
	Arrival of Ack M
	
	if M < N or M>=N+W, ignore
	otherwise:
	    set Last = N+W-1 (last packet sent)
	    set N = M+1. 
	    for (i=Last+1; i<N+W; i++) send packet i
	    
	   
	
===============================================================================

     6.2.5: TCP timeout & retransmission
        original adaptive retransmission: TimeOut = 2*EstRTT,
        EstRTT = \alpha*EstRTT + (1-\alpha)*SampleRTT
        
        RTT measurement ambiguity
        Karn/Partridge algorithm:
                Double Timeout
                Stop recording SampleRTT
                Use doubled Timeout as EstRTT when things resume

        Jacobson/Karels algorithm
                EstRTT = \alpha*EstRTT + (1-\alpha)*SampleRTT
                EstDev = \alpha*EstDev + (1-\alpha)*SampleDev
                TimeOut = EstRTT + 4*EstDev
                
        TCP timers: 
                TimeOut 
                2*MSL Timewait
                persist: sender polls receiver when windowsize = 0
                keepalive

Not covered:               
	Path MTU Discovery
		uses ICMP DONT_FRAG bit

===============================================================================

First look at RPC
	Blast protocol: fragment, and send frags, but try to do "optimized timeout"
	
	You will send a BLAST message to ulam2.cs.luc.edu, and get back a reply,
	sent *to a different port*.
	
	Don't try this at home! (simply because it will not work!)
	
===============================================================================

Subnet example:

suppose the Loyola CS dept (147.126.65.0/24) and the uchicago cs dept
(128.135.??? We'll say 128.135.119.0/24) install a private link.
How does this affect routing?

Packets still get routed out to the internet, and back, the long way!

We could add entries for these networks.