Internet.Security

4, 5, and 0: 01000101 00000000 28: 00000000 00011100 1: 00000000 00000001

0 and 0: 00000000 00000000

4 and 17: 00000100 00010001 0: 00000000 00000000 10.12: 00001010 00001100 14.5: 00001110 00000101 12.6: 00001100 00000110 7.9: 00000111 00001001

Sum: 01110100 01001110

Checksum: 10001011 10110001

•Source IP address (32 bits): This 32-bit field specifies the IP address of the sender of the IP datagram.

•Destination IP address (32 bits): This 32-bit field designates the IP address of the host to which this datagram is to be sent. Source and destination IP addresses are discussed in more detail in Section 2.1.1.2, IP Addressing.

•Options (variable length): The IP header option is a variable length field, consisting of zero, one or more individual options. This field specifies a set of fields, which may or may not be present in any given datagram, describing specific processing that takes place on a packet. RFC 791 defines a number of option fields with additional options defined in RFC 3232. The most common options include:

–The security option tends not to be used in most commercial networks. Refer to RFC 1108 for more details.

–A record route option is used to record the Internet routers that handle the datagram. Each router records its IP address in the option field, which can be useful for tracing routing problems.

–The timestamp option is used to record the time of datagram processing by a router. This option requests each router to record both the router address and the time. This option is useful for debugging router problems.

–A source routing option is used by the source to predetermine a route for the datagram as it travels through the Internet. This option enables a host to define the routers the packet is to be transmitted through. Dictation of a route by the source is useful for several reasons. The sender can choose a route with a specific type of service, such as minimum delay or maximum throughput. It may also choose a route that is safer or more reliable for the sender’s purpose. Because the option fields are of variable length, it may be necessary to add additional bytes to the header to make it a whole number of 32-bit words. Since the IP option fields represent a significant overhead, they tend not to be used, especially for IP routers. If required, additional padding bytes are added to the end of any specific options.

2.1.1.2IP Addressing

Addresses belonging to three different layers of TCP/IP architecture are shown in Table 2.2 below.

•Physical (local or link) address: At the physical level, the hosts and routers are recognised by their physical addresses. The physical address is the lowest-level address which is specified as the node or local address defined by LAN or WAN. This local address is included in the frame used by the network access layer. A local address is called a physical address because it is usually (but not always) implemented in hardware. Ethernet or token ring uses a six-byte address that is imprinted on the network interface card (NIC) installed in the host or router. The physical address should be unique locally, but not necessary universally. Physical addresses can be either unicast (one single recipient), multicast (a group of recipients), or broadcast (all recipients on the network). The physical addresses will be changed as a packet moves from network to network.

•IP address: An IP address is called a logical address at the network level because it is usually implemented in software. A logical address identifies a host or router at the network level. TCP/IP calls this logical address an IP address. Internet addresses can be either unicast, multicast or broadcast. IP addresses are essentially needed for universal communication services that are independent of underlying physical networks. IP addresses are designed for a universal addressing system in which each host can be identified uniquely. An Internet address is currently a 32-bit address which can uniquely define a host connected to the Internet.

•Port address: The data sequences need the IP address and the physical address to move data from a source to the destination host. In fact, delivery of a packet to a host or router requires two levels of addresses, logical and physical. Computers are devices that can run multiple processes at the same time. For example, computer A communicates with computer B using TELNET. At the same time, computer A can communicate with computer C using File Transfer Protocol (FTP). If these processes occur simultaneously, we need a method to label different processes. In TCP/IP architecture, the label assigned to a process is called a port address. A port address in TCP/IP is 16 bits long.

The Internet Assigned Numbers Authority (IANA) manages the well-known port numbers between 1 and 1023 for TCP/IP services. Ports between 256 and 1023 were normally used by UNIX systems for UNIX-specific services, but are probably not found on other operating systems.

Table 2.2 TCP/IP architecture and corresponding addresses

Servers are normally known by their port number. For few examples, every TCP/IP implementation that provides a File Transfer Protocol (FTP) server provides that service on TCP port 21. Telnet is a TCP/IP standard with a port number of 23 and can be implemented on almost any operating system. Hence, every Telnet server is on TCP port 23. Every implementation of the Trivial File Transfer Protocol (TFTP) is on UDP port 69. The port number for the Domain Name System is on TCP port 53.

written as four decimal integers separated by decimal points i.e. 239.247.135.93. If this IP address changes from decimal-point notation to binary form, it becomes 11101111 11110111 10000111 01011101. Thus, we see that each integer gives the value of one octet (byte) of the IP address.

IP addresses are divided into five different classes: A, B, C, D and E. Classes A, B and C differ in the number of hosts allowed per network. Class D is used for multicasting and class E is reserved for future use. Table 2.3 shows the number of networks and hosts in five different IP address classes. Note that the binary numbers in brackets denote class prefixes.

The relationship between IP address classes and dotted decimal numbers is summarised in Table 2.4, which shows the range of values for each class. The use of leading bits as class prefixes means that the class of a computer’s network can be determined by the numerical value of its address.

A number of IP addresses have specific meanings. The address 0.0.0.0 is reserved and 224.0.0.0 is left unused. Addresses in the range 10.0.0.0 through to 10.255.255.255 are available for use in private intranets. Addresses in the range 240.0.0.0 through to 255.255.255.255 are class E addresses and are reserved for future use when new protocols are developed. Address 255.255.255.255 is the broadcast address, used to reach all systems

Table 2.3 Number of networks and hosts in each address class

D (1110): Multicast address only

E (1111): Reserved for special use

on a local link. Although the multicast address of class D may extend from 224.0.0.0 to 239.255.255.255, address 224.0.0.0 is never used and 224.0.0.1 is assigned to the permanent group of all IP hosts, including gateways. A packet addressed to 224.0.0.1 will reach all multicast hosts on the directly connected network. In addition, a hostid of 255 specifies all systems within a given subnet, and a subnetid of 255 specifies all subnets within a network.

When an IP address is given, the address class can be determined. Once the address class is determined, it is easy to extract the netid and hostid. Figure 2.3 shows how to extract the netid and hostid by the octets and how to determine the number of networks and hosts.

According to Table 2.3 or Figure 2.3, the two-layer hierarchy established in IP address pairs (netid, hostid) lacks the flexibility needed for any sophisticated size of network. To begin with, a class A network can contain 16 777 214 host identifiers (hostids). These are too many identifiers to configure and manage as an address space. Many of these hosts are likely to reside on various locally administered LANs, with different media and data-link protocols, different access needs and, in all likelihood, different geographical locations. In fact, the IP addressing scheme has no way to reflect these subdivisions within a large organisation WAN. In addition, class A, B and C network identifiers (netids) are a limited and scarce resource, whose use under the class addressing scheme was often in efficient. In reality, many medium-sized organisations found class C hostids to be too small, containing fewer than 256 hosts. On the other hand, they often requested class B identifiers despite having far fewer than 65 534 hostids. As a result, many of the (netid, hostid) pairs were allocated but unused, being superfluous to the network owner and unusable by other organisations.

Subnetting and supernetting

The increasing number of hosts connected to the Internet and restrictions imposed by the Internet addressing scheme led to the idea of subnetting and supernetting. In subnetting, one large network is divided into several smaller subnetworks, and class A, B and C addresses can be subnetted. In supernetting, several networks are combined into one large

Example 2.2 Consider the IP address in decimal point notation (141.14.2.21).

Without subnetting (level 2 of the hierarchy)

netid hostid

141.14· 2.21

Network access Host access

With subnetting (level 3 of the hierarchy)

141.14· 2 · 21

To accommodate the growth of address space, by 1993 the supernetting scheme had begun to take an approach that is complementary to subnet addressing. Supernetting allows addresses to assign a single organisation to span multiple classed prefixes. A class C address cannot accommodate more than 254 hosts and a class B address has sufficient bits to make subnetting convenient. Therefore, one solution to this is supernetting. An organisation that needs 1000 addresses can be granted four class C addresses. The organisation can then use these addresses in one supernetwork. Suppose an organisation requests a class B address and intends to subnet using the third octet as a subnet field. Instead of a single class B number, supernetting assigns the organisation a block of 256 contiguous class C numbers that the organisation can then assign to physical networks.

Mapping by mask

Masking is a process that extracts the physical network address from an IP address. Masking can be accomplished regardless of whether it has subnetting or not. Consider two cases in which a network is either subnetted or is not. With no subnetting, masking extracts the network address from an IP address, while with subnetting, masking also extracts the subnetwork address from an IP address. The masking operation can be done by performing a 32-bit IP address on another 32-bit mask. A masking pattern consists of a contiguous string of 1s and 0s. The contiguous mask means a string of 1s precedes a string of 0s. To get either the network address or the subnet address, the logical AND operation with the bit-by-bit basis must be applied on the IP address and the mask. An example is shown below.

Example 2.3 Suppose a 32-bit IP address is 141.14.5.23 and the mask 255.255.0.0. Find the network address and subnetwork address.

Mapping of a logical address to a physical address can be static or dynamic. Static mapping involves a list of logical and physical address correspondences, but maintenance of the list requires high overhead. Address Resolution Protocol (ARP) is a dynamic mapping method that finds a physical address given a logical address. An ARP request is broadcast to all devices on the network, while an ARP reply is unicast to the host requesting the mapping. Reverse Address Resolution Protocol (RARP) is a form of dynamic mapping in which a given physical address is associated with a logical addresses. ARP and RARP use unicast and broadcast physical addresses. These subjects will be discussed in a later section.

2.1.1.3IP Routing

In a connectionless packet delivery system, the basic unit of transfer is the IP datagram. The routing problem is characterised by describing how routers forward IP datagrams and deliver them to their destinations. In a packet switching system, ‘routing’ refers to the process of choosing a path over which to send packets. Unlike routing within a single network, the IP routing must choose the appropriate algorithm for how to send a datagram across multiple physical networks. In fact, routing over the Internet is generally difficult because many computers have multiple physical network connections.

To understand IP routing, a TCP/IP architecture should be reviewed completely. The Internet is composed of multiple physical networks interconnected by routers. Each router has direct connections to two or more networks, while a host usually connects directly

to one physical network. However, it is possible to have a multihomed host connected directly to multiple network.

Packet delivery through a network can be managed at any layer in the OSI stack model. The physical layer is governed by the Media Access Control (MAC) address; the data link layer includes the Logical Link Control (LLC); and the network layer is where most routing takes place.

Delivery

The delivery of an IP packet to its final destination is accomplished by means of either direct or indirect delivery. Direct delivery occurs when the source and destination of the packet are located on the same physical network. The sender can easily determine whether the delivery is direct or not by extracting the network (IP) address of the destination packet and comparing this address with the addresses of the networks to which it is connected. If a match is found, the delivery is direct. In direct delivery, the sender uses the senders IP address to find the destination physical address. This mapping process can be done by Address Resolution Protocol (ARP).

If the destination host is not on the same network as the source host, the packet will be delivered indirectly. In an indirect delivery, the packet goes from router to router through a number of networks until it reaches one that is connected to the same physical network as its final destination. Thus, the last delivery is always a direct delivery, which always occurs after zero or more indirect deliveries. In an indirect delivery, the sender uses the destination IP address and a routing table to find the IP address of the next router to which the packet should be delivered. The sender then uses the ARP to find the physical address of the next router.

2.1.2 Address Resolution Protocol (ARP)

IP (logical) addresses are assigned independently from physical (hardware) addresses. The logical address is called a 32-bit IP address, and the physical address is a 48-bit MAC address in Ethernet and token ring protocols. The delivery of a packet to a host or a router requires two levels of addressing, such as logical (IP) address and physical (MAC) addresses. When a host or a router has an IP datagram forwarding to another host or router, it must know the logical IP address of the receiver. Since the IP datagram is encapsulated in a form to be passed through the physical network (such as a LAN), the sender needs the physical MAC address of the receiver.

Mapping of an IP address to a physical address can be done by either static or dynamic mapping. Static mapping means creating a table that associates an IP address with a physical address. But static mapping has some limitations because table lookups are inefficient. As a consequence, static mapping creates a huge overhead on the network. Dynamic mapping can employ a protocol to find the other. Two protocols (ARP and RARP) have been designed to perform dynamic mapping. When a host needs to find the physical address of another host or router on its network, it sends an ARP query packet. The intended recipient recognises its IP address and sends back an ARP response which contains the recipient IP and physical addresses. An ARP request is broadcast to all devices on the network, while an ARP reply is unicast to the host requesting the mapping.

(a) Request for the physical address by broadcast

Figure 2.4 ARP dynamic mapping.

Figure 2.4 shows an example of simplified ARP dynamic mapping. Let a host or router call a machine. A machine uses ARP to find the physical address of another machine by broadcasting an ARP request. The request contains the IP address of the machine for which a physical address is needed. All machines (M1, M2, M3, . . .) on the network receive an ARP request. If the request matches a M2 machine’s IP address, the machine responds by sending a reply that contains the requested physical address. Note that Ethernet uses the 48-bit address of all 1’s (FFFFFFFFFFFF) as the broadcast address.

A proxy ARP is an ARP that acts on behalf of a set of hosts. Proxy ARP can be used to create a subnetting effect. In proxy ARP, a router represents a set of hosts. When an ARP request seeks the physical address of any host in this set, the router sends its own physical address. This creates a subnetting effect. Whenever looking for the IP address of one of these hosts, the router sends an ARP reply announcing its own physical address.

To make address resolution easy, choose both IP and physical addresses the same length. Address resolution is difficult for Ethernet-like networks because the physical address of the Ethernet interface is 48 bits long and the high-level IP address is 32 bits long. In order for the 48-bit physical address to encode a 32-bit IP address, the next generation of IP is being designed to allow 48-bit physical (hardware) addresses P to be encoded in IP addresses I by the functional relationship of P = f (I). Conceptually, it will be necessary to choose a numbering scheme that makes address resolution efficient by selecting a function f that maps IP addresses to physical addresses.

As shown in Figure 2.5, the ARP software package consists of the following five components: