School of Computing Science

1

• School of Computing Science
• Simon Fraser University
• CMPT 765/408 Computer Networks
• Networking Basics II
• Instructor Dr. Mohamed Hefeeda

2
Review of Basic Networking Concepts

• Internet structure
• Protocol layering and encapsulation
• Internet services and socket programming
• Network Layer
• Network types Circuit switching, Packet
  switching
• Addressing, Forwarding, Routing
• Transport layer
• Reliability, congestion and flow control
• TCP, UDP
• Link Layer
• Multiple Access Protocols
• Ethernet

3
Transport services and protocols

• provide logical communication between app
  processes running on different hosts
• transport protocols run in end systems
• send side breaks app messages into segments,
  passes to network layer
• rcv side reassembles segments into messages,
  passes to app layer
• more than one transport protocol available to
  apps
• Internet TCP and UDP

4
Transport vs. network layer

• network layer logical communication between
  hosts
• transport layer logical communication between
  processes
• relies on, enhances, network layer services

• Household analogy
• 12 kids sending letters to 12 kids
• processes kids
• app messages letters in envelopes
• hosts houses
• transport protocol Ann and Bill
• network-layer protocol postal service

5
Multiplexing/demultiplexing
delivering received segments to correct socket
gathering data from multiple sockets, enveloping
data with header (later used for demultiplexing)
process
socket
application
P4
application
application
P1
P2
P3
P1
transport
transport
transport
network
network
network
link
link
link
physical
physical
physical
host 3
host 1
host 2
6
Connectionless demux
client IP A
Client IPB
server IP C

• UDP socket identified by (dst IP, dst Port) ?
• datagrams with different src IPs and/or src ports
  are directed to same socket

7
Connection-oriented demux (cont)
S-IP B
D-IPC
SP 9157
Client IPB
DP 80
server IP C
S-IP A
S-IP B
D-IPC
D-IPC

• TCP socket identified by 4-tuple (src IP, src
  Port, dst IP, dst Port)

8
UDP User Datagram Protocol RFC 768

• no frills, bare bones Internet transport
  protocol
• best effort service, UDP segments may be
• lost
• delivered out of order to app
• Connectionless
• no handshaking between UDP sender, receiver
• each UDP segment handled independently of others

• Why is there a UDP?
• no connection establishment (which can add delay)
• simple no connection state at sender, receiver
• small segment header
• no congestion control UDP can blast away as fast
  as desired

9
UDP

• often used for streaming multimedia apps
• loss tolerant
• rate sensitive
• other UDP uses
• DNS
• SNMP
• reliable transfer over UDP add reliability at
  application layer
• application-specific error recovery!

32 bits
source port
dest port
Length, in bytes of UDP segment, including header
checksum
length
Application data (message)
UDP segment format
10
Reliable data transfer

• important in application, transport, and link
  layers
• top-10 list of important networking topics!

• characteristics of unreliable channel will
  determine complexity of reliable data transfer
  protocol (rdt)

11
Pipelined (Sliding Window) Protocols

• Pipelining sender allows multiple, in-flight,
  yet-to-be-acknowledged pkts
• range of sequence numbers must be increased
• buffering at sender and/or receiver

• Two generic forms of pipelined protocols
  go-Back-N, selective repeat

12
Go-Back-N

• Sender
• k-bit seq in pkt header
• window of up to N, consecutive unacked pkts
  allowed

• ACK(n) ACKs all pkts up to, including seq n --
  cumulative ACK
• may receive duplicate ACKs (see receiver)
• timer for each in-flight pkt
• timeout(n) retransmit pkt n and all higher seq
  pkts in window
• i.e., go back to n

13
GBN inaction
Go back to 2
Window size, N 4
14
Go-Back-N

• Do you see potential problems with GBN?
• Consider high-speed links with long delays
• (called large bandwidth-delay product pipes)
• GBN can fill that pipe by having large N ?
• many unACKed pkts could be in the pipe
• A single lost pkt could cause a re-transmission
  of a huge number (up to N) of pkts ? waste of
  bandwidth
• Solutions??

15
Selective Repeat

• receiver individually acknowledges all correctly
  received pkts
• buffers pkts, as needed, for eventual in-order
  delivery to upper layer
• sender only resends pkts for which ACK not
  received
• sender timer for each unACKed pkt
• sender window
• N consecutive seq s
• again limits seq s of sent, unACKed pkts

16
Selective repeat sender, receiver windows
17
TCP Overview RFCs 793, 1122, 1323, 2018, 2581

• point-to-point
• one sender, one receiver
• reliable, in-order byte steam
• no message boundaries
• pipelined
• TCP congestion and flow control set window size
• send receive buffers

• full duplex data
• bi-directional data flow in same connection
• MSS maximum segment size
• connection-oriented
• handshaking (exchange of control msgs) inits
  sender, receiver state before data exchange
• flow controlled
• sender will not overwhelm receiver

18
TCP segment structure
URG urgent data (generally not used)
counting by bytes of data (not segments!)
ACK ACK valid
PSH push data now (generally not used)
bytes rcvr willing to accept
RST, SYN, FIN connection estab (setup,
teardown commands)
Internet checksum (as in UDP)
19
TCP reliable data transfer

• TCP creates rdt service on top of IPs unreliable
  service
• Pipelined segments
• Cumulative acks
• TCP uses single retransmission timer

• Retransmissions are triggered by
• timeout events
• duplicate acks
• Initially consider simplified TCP sender
• ignore duplicate acks
• ignore flow control, congestion control

20
TCP sender events

• timeout
• retransmit segment that caused timeout
• restart timer
• Ack rcvd
• If acknowledges previously unacked segments
• update what is known to be acked
• start timer if there are outstanding segments

• data rcvd from app
• Create segment with seq
• seq is byte-stream number of first data byte in
  segment
• start timer if not already running (think of
  timer as for oldest unacked segment)
• expiration interval TimeOutInterval

21
TCP sender(simplified)
NextSeqNum InitialSeqNum
SendBase InitialSeqNum loop (forever)
switch(event) event
data received from application above
create TCP segment with sequence number
NextSeqNum if (timer currently
not running) start timer
pass segment to IP
NextSeqNum NextSeqNum length(data)
event timer timeout
retransmit not-yet-acknowledged segment with
smallest sequence number
start timer event ACK
received, with ACK field value of y
if (y gt SendBase)
SendBase y if (there are
currently not-yet-acknowledged segments)
start timer
/ end of loop forever /
22
TCP retransmission scenarios
Host A
Host B
Seq92, 8 bytes data
Seq100, 20 bytes data
ACK100
ACK120
Seq92, 8 bytes data
Sendbase 100
SendBase 120
ACK120
Seq92 timeout
SendBase 100
SendBase 120
premature timeout
23
TCP retransmission scenarios (more)
SendBase 120
24
TCP Round Trip Time and Timeout

• If TCP timeout is
• too short premature timeout ? unnecessary
  retransmissions
• too long slow reaction to segment loss
• Q how to set TCP timeout value?
• Based on RTT, but RTT itself varies with time!
• We need to estimate current RTT
• RTT Estimation
• SampleRTT measured time from segment
  transmission until ACK receipt
• ignore retransmissions
• SampleRTT will vary, want estimated RTT
  smoother
• average several recent measurements, not just
  current SampleRTT

25
TCP Round Trip Time and Timeout
EstimatedRTT (1- ?)EstimatedRTT ?SampleRTT

• Exponential weighted moving average
• influence of past sample decreases exponentially
  fast
• typical value ? 0.125

26
Example RTT estimation
27
TCP Round Trip Time and Timeout

• Setting the timeout
• EstimtedRTT plus safety margin
• large variation in EstimatedRTT -gt larger safety
  margin
• first estimate how much SampleRTT deviates from
  EstimatedRTT

DevRTT (1-?)DevRTT ?SampleRTT
- EstimatedRTT (typically, ? 0.25)
Then set timeout interval
TimeoutInterval EstimatedRTT 4DevRTT
28
Fast Retransmit

• Time-out period often relatively long
• long delay before resending lost packet
• Detect lost segments via duplicate ACKs.
• Sender often sends many segments back-to-back
• If segment is lost, there will likely be many
  duplicate ACKs.

• If sender receives 3 ACKs for the same data, it
  supposes that segment after ACKed data was lost
• fast retransmit resend segment before timer
  expires

29
TCP Connection Management opening

• TCP 3-way handshake
• Step 1 client host sends TCP SYN segment to
  server
• specifies initial seq
• no data
• Step 2 server host receives SYN, replies with
  SYNACK segment
• server allocates buffers
• specifies server initial seq.
• Step 3 client receives SYNACK, replies with ACK
  segment, which may contain data

A. SYN Flood DoS attack
Q. How would a hacker exploit TCP 3-way handshake
to bring a server down?
30
TCP Connection Management closing

• Step 1 client end system sends TCP FIN segment
  to server
• Step 2 server receives FIN, replies with ACK.
  Closes connection, sends FIN
• Step 3 client receives FIN, replies with ACK
• Enters timed wait may need to re-send ACK to
  received FINs
• Step 4 server, receives ACK Connection closed

31
TCP Connection Management
TCP server lifecycle
TCP client lifecycle
32
TCP Flow Control

• receive side of TCP connection has a receive
  buffer

• speed-matching service matching the send rate to
  the receiving apps drain rate

• app process may be slow at reading from buffer

33
TCP Flow control how it works

• Rcvr advertises spare room by including value of
  RcvWindow in segments
• Sender limits unACKed data to RcvWindow
• guarantees receive buffer doesnt overflow

• (Suppose TCP receiver discards out-of-order
  segments)
• spare room in buffer
• RcvWindow
• RcvBuffer-LastByteRcvd - LastByteRead

34
Congestion Control

• Congestion sources send too much data for
  network to handle
• different from flow control, which is e2e
• Congestion results in
• lost packets (buffer overflow at routers)
• more work (retransmissions) for given goodput
• long delays (queueing in router buffers)
• Premature (unneeded) retransmissions
• Waste of upstream links capacity
• Pkt traversed several links, then dropped at
  congested router

35
Approaches towards congestion control
Two broad approaches towards congestion control

• Network-assisted congestion control
• routers provide feedback to end systems
• single bit indicating congestion (SNA, DECbit,
  TCP/IP ECN, ATM)
• explicit rate sender should send at

• End-end congestion control
• no explicit feedback from network
• congestion inferred from end-system observed
  loss, delay
• approach taken by TCP

36
TCP congestion control Approach

• Approach probe for usable bandwidth in network
• increase transmission rate until loss occurs then
  decrease
• Additive increase, multiplicative decrease (AIMD)

Saw tooth behavior probing for bandwidth
Rate (CongWin)
time
37
TCP Congestion Control

• Sender keeps a new variable, Congestion Window
  (CongWin), and limits unacked bytes to
• LastByteSent - LastByteAcked ? min CongWin,
  RcvWin
• For our discussion assume RcvWin is large enough
• Roughly, what is the sending rate as a function
  of CongWin?
• Ignore loss and transmission delay
• Rate CongWin/RTT (bytes/sec)
• So, rate and CongWin are somewhat synonymous

38
TCP Congestion Control

• Congestion occurs at routers (inside the network)
  
• Routers do not provide any feedback to TCP
• How can TCP infer congestion?
• From its symptoms timeout or duplicate acks
• Define loss event timeout or 3 duplicate acks
• TCP decreases its CongWin (rate) after a loss
  event
• TCP Congestion Control Algorithm three
  components
• AIMD additive increase, multiplicative decrease
• slow start
• Reaction to timeout events

39
AIMD

• additive increase (congestion avoidance phase)
• increase CongWin by 1 MSS every RTT until loss
  detected
• TCP increases CongWin by MSS x (MSS/CongWin) for
  every ACK received
• Ex. MSS 1,460 bytes and CongWin 14,600 bytes
• With every ACK, CongWin is increased by 146 bytes
  
• multiplicative decrease
• cut CongWin in half after loss

40
TCP Slow Start

• When connection begins, CongWin 1 MSS
• Example MSS 500 bytes RTT 200 msec
• initial rate CongWin/RTT 20 kbps
• available bandwidth may be gtgt MSS/RTT
• desirable to quickly ramp up to respectable rate
• Slow start
• When connection begins, increase rate
  exponentially fast until first loss event. How
  can we do that?
• double CongWin every RTT. How?
• Increment CongWin by 1 MSS for every ACK received

41
TCP Slow Start (contd)

• Increment CongWin by 1 MSS for every ACK
• Summary initial rate is slow but ramps up
  exponentially fast

Host A
Host B
one segment
RTT
two segments
four segments
42
Reaction to a Loss event

• TCP Tahoe (Old)
• Threshold CongWin / 2
• Set CongWin 1
• Slow start till threshold
• Then Additive Increase // congestion
  avoidance
• TCP Reno (most current TCP implementations)
• If 3 dup acks // fast
  retransmit
• Threshold CongWin / 2
• Set CongWin Threshold // fast recovery
• Additive Increase
• Else //
  timeout
• Same as TCP Tahoe

43
Reaction to a Loss event (contd)
3 dup acks

• Why differentiate between 3 dup acks and timeout?
  
• 3 dup ACKs indicate network capable of
  delivering some segments
• timeout indicates a more alarming congestion
  scenario

44
TCP Congestion Control Summary

• Initially
• Threshold is set to large value (65 Kbytes), has
  no effect
• CongWin 1 MSS
• Slow Start (SS) CongWin grows exponentially
• till a loss event occurs (timeout or 3 dup ack)
  or reaches Threshold
• Congestion Avoidance (CA) CongWin grows
  linearly
• 3 duplicate ACK occurs
• Threshold CongWin/2 CongWin Threshold CA
• Timeout occurs
• Threshold CongWin/2 CongWin 1 MSS SS till
  Threshold

45
TCP throughput

• Whats the average throughout of TCP as a
  function of window size and RTT?
• Ignore slow start
• Let W be the window size when loss occurs
• When window is W, throughput is W/RTT
• Just after loss, window drops to W/2, throughput
  to W/2RTT
• Average throughout 0.75 W/RTT

46
Review of Basic Networking Concepts

• Internet structure
• Protocol layering and encapsulation
• Internet services and socket programming
• Network Layer
• Network types Circuit switching, Packet
  switching
• Addressing, Forwarding, Routing
• Transport layer
• Reliability, congestion and flow control
• TCP, UDP
• Link Layer
• Multiple Access Protocols
• Ethernet, MAC addressing

47
Link Layer

• Some terminology
• hosts and routers are nodes
• communication channels that connect adjacent
  nodes along communication path are links
• wired links
• wireless links
• LANs
• layer-2 packet is a frame, encapsulates datagram

data-link layer has responsibility of
transferring datagram from one node to adjacent
node over a link
48
Link layer context

• transportation analogy
• trip from Burnaby to Lausanne, Switzerland
• limo Burnaby to YVR
• plane YVR to Geneva
• train Geneva to Lausanne
• tourist datagram
• transport segment communication link
• transportation mode link layer protocol
• travel agent routing algorithm

• Datagram transferred by different link protocols
  over different links
• e.g., Ethernet on first link, frame relay on
  intermediate links, 802.11 on last link
• Each link protocol provides different services
• e.g., may or may not provide rdt over link

49
Link Layer Services

• Framing, link access
• encapsulate datagram into frame, adding header,
  trailer
• channel access if shared medium
• MAC addresses used in frame headers to identify
  source, dest
• Reliable delivery between adjacent nodes
• we learned how to do this already (chapter 3)!
• seldom used on low bit error link (e.g., fiber)
• used in wireless links high error rates
• Q why both link-level and end-end reliability?
• LL local correction (bet adjacent nodes) ?
  faster
• e-2-e is still needed because not all LL
  protocols provide reliability

50
Link Layer Services (more)

• Flow Control
• pacing between adjacent sending and receiving
  nodes
• Error Detection
• errors caused by signal attenuation, noise
• receiver detects presence of errors
• signals sender for retransmission or drops frame
• Error Correction
• receiver identifies and corrects bit error(s)
  without resorting to retransmission
• Half-duplex and full-duplex
• with half duplex, nodes at both ends of link can
  transmit, but not at same time

51
Adaptors Communicating
datagram
rcving node
link layer protocol
sending node
adapter
adapter

• receiving side
• looks for errors, rdt, flow control, etc
• extracts datagram, passes to rcving node
• adapter is semi-autonomous
• link physical layers

• link layer implemented in adaptor (aka NIC)
• Ethernet card, PCMCI card, 802.11 card
• sending side
• encapsulates datagram in a frame
• adds error checking bits, rdt, flow control, etc.

52
Multiple Access Links and Protocols

• Two types of links
• point-to-point
• Single sender and single receiver
• E.g., dial-up links ? point-to-point protocol
  (PPP)
• broadcast (shared wire or medium)
• Multiple senders and multiple receivers
• E.g., traditional Ethernet, 802.11 wireless LAN
• ? need Multiple Access protocol (MAC)

53
Multiple Access protocols

• Two or more simultaneous transmissions on a
  shared channel ? interference (collision)
• Collision node receives two or more signals at
  the same time
• Multiple Access (MAC) protocol
• distributed algorithm that determines how nodes
  share channel, i.e., determine when node can
  transmit
• communication about channel sharing must use
  channel itself!
• no out-of-band channel for coordination

54
MAC Protocols a taxonomy

• Three broad classes
• Channel Partitioning
• Channel Partitioning, by time, frequency or code
• TDMA, FDMA, CDMA
• Random Access
• channel not divided, allow collisions
• recover from collisions
• Taking turns
• Nodes take turns, but nodes with more to send can
  take longer turns
• E.g., Token bus and token ring

55
Random Access Protocols

• When node has packet to send
• transmit at full channel data rate R
• no a priori coordination among nodes
• two or more transmitting nodes ? collision
• random access MAC protocol specifies
• how to detect collisions
• how to recover from collisions (e.g., via delayed
  retransmissions)
• Examples of random access MAC protocols
• Slotted ALOHA
• ALOHA
• CSMA, CSMA/CD, CSMA/CA

56
CSMA (Carrier Sense Multiple Access)

• CSMA listen before transmit
• If channel sensed idle transmit entire frame
• If channel sensed busy, defer transmission
• Can collisions still occur?
• Yes, because of propagation delay
• two nodes may not hear each others transmission
• During collision, entire packet transmission time
  is wasted ? detect collision and abort
  immediately (CSMA/CD)

57
Ethernet

• dominant wired LAN technology
• cheap 20 for 100Mbs!
• first widely used LAN technology
• Simpler, cheaper than token LANs and ATM
• Kept up with speed race 10 Mbps 10 Gbps

Metcalfes Ethernet sketch
58
Ethernet Frame Structure

• Sending adapter encapsulates IP datagram (or
  other network layer protocol packet) in Ethernet
  frame
• Preamble
• 7 bytes with pattern 10101010 followed by one
  byte with pattern 10101011
• used to synchronize receiver, sender clock rates

59
Ethernet Frame Structure (more)

• Addresses 6 bytes
• if adapter receives frame with matching
  destination address, or with broadcast address
  (e.g., ARP packet), it passes data in frame to
  net-layer protocol
• otherwise, adapter discards frame
• Type indicates the higher layer protocol (mostly
  IP but others may be supported such as Novell IPX
  and AppleTalk)
• CRC checked at receiver, if error is detected,
  the frame is simply dropped

60
Unreliable, connectionless service

• Connectionless No handshaking between sending
  and receiving adapter.
• Unreliable receiving adapter doesnt send acks
  or nacks to sending adapter
• stream of datagrams passed to network layer can
  have gaps
• gaps will be filled if app is using TCP
• otherwise, app will see the gaps

61
Ethernet CSMA/CD algorithm

• 1. Adaptor receives datagram from net layer
  creates frame
• 2. If adapter senses channel idle, it starts to
  transmit frame. If it senses channel busy, waits
  until channel idle and then transmits
• 3. If adapter transmits entire frame without
  detecting another transmission, the adapter is
  done with frame!

• 4. If adapter detects another transmission while
  transmitting, aborts and sends jam signal
• 5. After aborting, adapter enters exponential
  backoff after the mth collision, adapter chooses
  K at random from 0,1,2,,2m-1. Adapter waits
  K?512 bit times and returns to Step 2

62
Ethernets CSMA/CD (more)

• Jam Signal make sure all other transmitters are
  aware of collision 48 bits
• Bit time 0.1 microsec for 10 Mbps Ethernet for
  K1023, wait time is about 50 msec

• Exponential Backoff
• Goal adapt retransmission attempts to estimated
  current load
• heavy load random wait will be longer
• first collision choose K from 0,1 delay is K?
  512 bit transmission times
• after second collision choose K from 0,1,2,3
• after ten collisions, choose K from
  0,1,2,3,4,,1023

See/interact with Java applet on AWL Web
site highly recommended !
63
CSMA/CD efficiency

• Tprop max prop between 2 nodes in LAN
• ttrans time to transmit max-size frame
• Efficiency goes to 1 as tprop goes to 0
• Goes to 1 as ttrans goes to infinity
• Much better than ALOHA, but still decentralized,
  simple, and cheap

64
Hubs

• Hubs are essentially physical-layer repeaters
• bits coming from one link go out all other links
• at the same rate
• no frame buffering
• no CSMA/CD at hub adapters detect collisions
• provides net management functionality

65
Interconnecting with hubs

• Backbone hub interconnects LAN segments
• Extends max distance between nodes
• But individual segment collision domains become
  one large collision domain
• Cant interconnect 10BaseT 100BaseT

hub
hub
hub
hub
66
Switch

• Link layer device
• stores and forwards Ethernet frames
• examines frame header and selectively forwards
  frame based on MAC dest address
• when frame is to be forwarded on segment, uses
  CSMA/CD to access segment
• transparent
• hosts are unaware of presence of switches
• plug-and-play, self-learning
• switches do not need to be configured

67
Forwarding
1
3
2

• How to determine onto which LAN segment to
  forward frame?
• Looks like a routing problem...

68
Self learning

• A switch has a switch table
• entry in switch table
• (MAC Address, Interface, Time Stamp)
• stale entries in table dropped (TTL can be 60
  min)
• switch learns which hosts can be reached through
  which interfaces
• when frame received, switch learns location of
  sender incoming LAN segment
• records sender/location pair in switch table

69
Switch example

• Suppose C sends frame to D

address
interface
switch
1
A B E G
1 1 2 3
3
2
hub
hub
hub
A
I
F
D
G
B
C
H
E

• Switch receives frame from C destined to D
• notes in switch table that C is on interface 1
• because D is not in table, switch forwards frame
  into interfaces 2 and 3
• frame received by D

70
Switch traffic isolation

• switch installation breaks subnet into LAN
  segments
• switch filters packets
• same-LAN-segment frames not usually forwarded
  onto other LAN segments
• segments become separate collision domains

collision domain
collision domain
collision domain
71
Switches dedicated access

• Switch with many interfaces
• Hosts have direct connection to switch
• No collisions full duplex
• Switching A-to-A and B-to-B simultaneously, no
  collisions

A
C
B
switch
C
B
A
72
Institutional network
mail server
to external network
web server
router
switch
IP subnet
hub
hub
hub
73
Switches vs. Routers

• both store-and-forward devices
• Routers network layer devices
• Switches link layer devices ? faster processing
• Routers maintain routing tables, implement
  routing algorithms
• handle complex topologies, find efficient paths
• Switches maintain switch tables, implement
  learning algorithms
• handle simpler (spanning tree) topologies, paths
  may not be optimal

74
MAC Addresses

• 32-bit IP address
• network-layer address
• used to get datagram to destination IP subnet
• MAC (LAN, physical, or Ethernet) address
• used to get frame from one interface to another
  physically-connected interface (same network)
• 48 bit MAC address (for most LANs) burned in the
  adapter ROM

75
MAC Address
Each adapter on LAN has unique LAN address
Broadcast address FF-FF-FF-FF-FF-FF
adapter
76
MAC Address (more)

• MAC address allocation administered by IEEE
• manufacturer buys portion of MAC address space
  (to assure uniqueness)
• Analogy
• (a) MAC address like Social Insurance
  Number
• (b) IP address like postal address
• MAC flat address ? portability
• can move LAN card from one LAN to another
• IP hierarchical address ? NOT portable
• depends on IP subnet to which node is attached

77
MAC and IP addresses

• Why do we have TWO addresses (IP,MAC)? Do we have
  to have MAC addresses?
• Yes, we must have both
• To allow different network-layer protocols over
  same card (e.g., IP, Novell IPX, DECnet)
• Enable flexibility, mobility of cards
• Efficiency imagine that nodes have only IP
  addresses ? ALL packets sent over LAN will be
  forwarded by NIC to the IP layer ? too many
  useless interrupts

78
ARP Address Resolution Protocol

• Each IP node (Host, Router) on LAN has ARP table
• ARP Table IP/MAC address mappings for some LAN
  nodes
• lt IP address MAC address TTLgt
• TTL (Time To Live) time after which address
  mapping will be forgotten (typically 20 min)

237.196.7.78
1A-2F-BB-76-09-AD
237.196.7.23
237.196.7.14
LAN
71-65-F7-2B-08-53
58-23-D7-FA-20-B0
0C-C4-11-6F-E3-98
237.196.7.88
79
ARP protocol Same LAN (network)

• A caches (saves) IP-to-MAC address pair in its
  ARP table until information becomes old (times
  out)
• soft state information that times out (goes
  away) unless refreshed
• ARP is plug-and-play
• nodes create their ARP tables without
  intervention from net administrator

• A wants to send datagram to B, and Bs MAC
  address not in As ARP table.
• A broadcasts ARP query packet, containing B's IP
  address
• Dest MAC address FF-FF-FF-FF-FF-FF
• all machines on LAN receive ARP query
• B receives ARP packet, replies to A with its
  (B's) MAC address
• frame sent to As MAC address (unicast)

80
Routing to another LAN

• walkthrough send datagram from A to B via R
• assume A knows Bs IP
  address
• Two ARP tables in router R, one for each IP
  network (LAN)

A
R
B
81
Routing to another LAN (contd)

• Detailed steps
• A creates datagram with source A, destination B
• A uses ARP to get Rs MAC address for
  111.111.111.110
• A creates link-layer frame with R's MAC address
  as dest, frame contains A-to-B IP datagram
• As adapter sends frame
• Rs adapter receives frame
• R removes IP datagram from Ethernet frame, sees
  its destined to B
• R uses ARP to get Bs MAC address
• R creates frame containing A-to-B IP datagram
  sends to B