1 How the TCP/IP Protocol Works Les Cottrell – SLAC Lecture # 1 presented at the 26 th International Nathiagali Summer College on Physics and Contemporary Needs, 25 th June – 14 th July, Nathiagali, Pakistan Partially funded by DOE/MICS Field Work Proposal on Internet End-to-end Performance Monitoring (IEPM), also supported by IUPAP
This document is posted to help you gain knowledge. Please leave a comment to let me know what you think about it! Share it to your friends and learn new things together.
Transcript
1
How the TCP/IP Protocol Works
Les Cottrell – SLACLecture # 1 presented at the 26th International Nathiagali Summer College on Physics
and Contemporary Needs, 25th June – 14th July, Nathiagali, Pakistan
Partially funded by DOE/MICS Field Work Proposal on Internet End-to-end Performance Monitoring (IEPM), also supported by IUPAP
2
Overview• This is not a lecture on how to program TCP/IP,
rather an introduction to how major portions works• IP• Addressing: IP addresses, ARP, routing• ICMP • UDP• TCP: flow control, error recovery, establishment,
diconnect• References:
– “Internetworking with TCP/IP, volume I, principles, protocols & Architecture”, by Douglas Comer
– “TCP/IP Illustrated: the protocols”, by W. Richard Stevens– Most information also available free via Web searches
3
Internet Protocol (IP RFC-791)
Transport Services
Connectionless packet delivery service
Application services
TCP/IP Internet provides 3 layers of service
•Layering allows one to replace one service without affecting others•IP layer (basic unit of transfer in TCP/IP) provides:
•Best-effort (does not discard capriciously), unreliable (no guarantees)
•Packet may be lost, duplicated, out-of-order with no notification
IP datagram format (cont.)• Vers (4 bits): version of IP protocol (IPv4=4)• Hlen (4 bits): Header length in 32 bit words, without options
(usual case) = 20• Type of Service – TOS (8 bits): little used in past, now being
used for QoS• Total length (16 bits): length of datagram in bytes, includes
header and data• Time to live – TTL (8bits): specifies how long datagram is
allowed to remain in internet– Routers decrement by 1– When TTL = 0 router discards datagram– Prevents infinite loops
• Protocol (8 bits): specifies the format of the data area– Protocol numbers administered by central authority to guarantee
agreement, e.g. TCP=6, UDP=17 …
6
IP Datagram format (cont.)• Source & destination IP address (32 bits each):
contain IP address of sender and intended recipient
• Options (variable length): Mainly used to record a route, or timestamps, or specify routing
7
IP Fragmentation• How do we send a datagram of say 1400 bytes through a
link that has a Maximum Transfer Unit (MTU) of say 620 bytes?
• Answer the datagram is broken into fragments
– Router fragments 1400 byte datagrams• Into 600 bytes, 600 bytes, 200bytes (note 20 bytes for IP header)
• Routers do NOT reassemble, up to end host
Net 1MTU=1500
Net 2MTU=620
Net 3MTU=1500
8
Fragmentation Control• Identification: copied into fragment, allows destination to
know which fragments belong to which datagram• Fragment Offset (12 bits): specifies the offset in the
original datagram of the data being carried in the fragment– Measured in units of 8 bytes starting at 0
• Flags (3 bits): control fragmentation– Reserved (0-th bit)– Don’t Fragment – DF (1st bit):
• useful for simple (computer bootstrap) application that can’t handle • also used for MTU discovery (see later)• if need to fragment and can’t router discards & sends error to source
– More Fragments (least sig bit): tells receiver it has got last fragment
• TCP traffic is hardly ever fragmented (due to use of MTU discovery). About 0.5% - 0.1% of TCP packets are fragmented .
9
Fragment series composition
NB. If data segment contains its own header that is not replicated
Offset=0More frags
Offset=1480More frags
Offset=2960More frags
Offset=3440Last frag
10
Internet Addressing• IP address is a 32 bit integer
– Refers to interface rather than host– Consists of network and host portions
• Enables routers to keep 1 entry/network instead of 1/host
– Class A, B, C for unicast– Class D for multicast– Class E reserved– Classless addresses
• Written as 4 octets/bytes in decimal format– E.g. 134.79.16.1, 127.0.0.1
11
Internet Class-based addresses• Class A: large number of hosts, few networks
– 0nnnnnnn hhhhhhhh hhhhhhhh hhhhhhhh• 7 network bits (0 and 127 reserved, so 126 networks), 24 host bits (> 16M
hosts/net)• Initial byte 1-127 (decimal)
• Class B: medium number of hosts and networks– 10nnnnnn nnnnnnnn hhhhhhhh hhhhhhhh
• 16,384 class B networks, 65,534 hosts/network• Initial byte 128-191 (decimal)
• Class C: large number of small networks– 110nnnnn nnnnnnnn nnnnnnnn hhhhhhhh
• Class D: 224-239 (decimal) Multicast [RFC1112]• Class E: 240-255 (decimal) Reserved
12
Subnets• A subnet mask is applied to the host bits to
determine how the network is subnetted, e.g. if the host is: 137.138.28.228, and the subnet mask is 255.255.255.0 then the right hand 8 bits are for the host (255 is decimal for all bits set in an octet)
• Host addresses of all bits set or no bits set, indicate a broadcast, i.e. the packet is sent to all hosts.
Private IP Addresses• IP addresses that are not globally unique, but used
exclusively in an organization• Three ranges:
– 10.0.0.0 - 10.255.255.255 a single class A net– 172.16.0.0 - 172.31.255.255 16 contiguous class Bs– 192.168.0.0 – 192.168.255.255 256 contiguous class Cs
• Connectivity provided by Network Address Translator (NAT)– translates outgoing private IP address to Internet IP
address, and a return Internet IP address to a private address
– Only for TCP/UDP packets
17
Class InterDomain Routing (CIDR)• Many organization have > 256 computers but few
have more than several thousand
• Instead of giving class B (16384 nets) give sufficient contiguous class C addresses to satisfy needs– < 256 addresses assign 1 class C– …– < 8192 addresses assign 32 contiguous Class C nets
18
• Since assigned contiguously, class C CIDR has same most significant bits & so only needs one routing table entry
• CIDR block represented by a prefix and prefix length– Prefix = single address representing block of nets, e.g
• 192.32.136.0 = 11000000 00100000 10001000 00000000 while
– Prefix length indicates number of routing bits, e.g.192.32.136.0/21 means 21 bits used for routing
• CIDR collects all nets in range 192.32.136.0 through 143.0 into a single router entry – reduces router table entries
• Removes address classes A, B & C boundaries• For more details see RFC 1519
CIDR & Supernetting
21 bit prefix (2048 host addresses)
19
Address Recognition Protocol (ARP)• IP address is at network layer, need to map it to the
MAC (Ethernet address) link layer address• Use ARP to map 48 bit Ethernet address to 32 bit IP
– IP requests MAC address for IP address from local ARP table
– If not there, then an ARP request packet for IP address is sent using physical broadcast address (all FFFs)
– Host with requested IP address responds with its MAC address as a unicast packet
– On return, host updates ARP table and returns MAC address
– ARP cache times out– ARP packets are on top of Ethernet
20
ARP cont.• ARP requests are local only, do not cross routers
• Compare local IP and subnet mask => local subnet
• Compare local subnet to destination IP– if local, ARP for MAC address– else remote so
• if ROUTE entry, ARP for router to subnet
• if default route, ARP for default gateway
• otherwise, drop packet & return error
134.79.10.17 134.79.15.3134.79.15.1134.79.10.1
User A User B
Subnet 1 Subnet 2
21
Routing• Routers must select next hop for packet
• Get route information from other routers via a routing protocol (RIP, OSPF, EIGRP etc.)
• Note the following are non-routable:– private networks: 10.0.0.0/8, 172.16.0.0/12,
192.168.0.0/16– Loopback 127.0.0.0/24
22
ICMP Purpose (RFC 792)• Communicates control & error information
– Between routers and hosts– Only reports to original source, suggests corrections– Error messages about error messages are not generated– Never generated due to multicasts
• To ID connection need:– Source: (address, port) AND Destination: (address, port)– Only need one port on host to allow multiple connections, since each
connection will have different (host, port) at other end• E.g. single host can serve multiple telnet connections
• Passive open: application contacts OS & indicates will accept incoming connection, OS assigns port and listens
• Active open: application requests OS to connect to an (host, port)
IP
Port 1
TCP UDP
Port 2 Port 1 Port 2
Demux on IP protocol
Demux onPort number
Network
Transport
App.
IP port 6
34
TCP – providing reliability• Positive acknowledgement (ACK) with
retransmission– Sender keeps record of each packet sent– Sender awaits an ACK– Sender starts timer when sends packet
Send pkt 1
Rcv ACK 1Send pkt 2
Rcv ACK 2
Network messages
Rcv pkt 1
Rcv pkt 2Send ACK 2
Send ACK 1
Sender site Receiver siteT
ime
35
TCP – simple lost packet recovery
Send pkt 1Start timer
ACK normallyarrives
Rcv ACK 1
Network messages
Pkt should arrive
Rcv pkt 1Send ACK 1
ACK should be sent
Sender site Receiver siteLoss
Timer expiresRetransmit pkt 1 start timer
36
TCP – improving performance• BUT simple ACK protocol wastes bandwidth since it must delay
sending next packet until it gets ACK• Use sliding window
• Sender can send 4 packets of data without ACK– When sender gets ACK then can send another packet– Window = unacknowledged packets/bytes– Keeps timer for each packet
1 2 3 4 5 6 7 8 …
Initial window of 4 packets
1 2 3 4 5 6 7 8 …
Window slides
Packets successfully sent
Packets sent, awaiting ACK
Packets to be sent
37
Tuning to fill pipe• Optimal window size depends on:
– Bandwidth end to end, i.e. min(BWlinks) AKA bottleneck bandwidth
– Round Trip Time (RTT)– For TCP keep pipe full
• Window (sometime called pipe) ~ RTT*BW
– Can increase bandwidth by
orders of magnitude
• Windows also used for flow control
Src Rcv
ACKt = bits in packet/link speed
RTT
38
Implementation• Sliding window operates at byte level, NOT packet
• Receiver keeps similar window to put stream back together
• Since full duplex, altogether 4 windows & pointer sets
1 2 3 4 5 6 7 8 …
Current window
Highest byte that can be sent
Bytes sent and acknowledged
3 pointersHighest byte sent
39
TCP flow control• Windows vary over time
– Receiver advertises (in ACKs) how many it can receive• Based on buffers etc. available
– Sender adjusts its window to match advertisement– If receiver buffers fill, it sends smaller adverts
• Used to match buffer requirements of receiver
• Also used to address congestion control (e.g. in intermediate routers)
40
TCP Segment format
• Source/Dest port: TCP port numbers to ID applications at both ends of connection
• Sequence number: ID position in sender’s byte stream
Source port Destination port
Sequence number
0 8 16 3124
Acknowledgement number
4
Hlen
10
Resv Code Window
Urgent ptrChecksum
Options (if any) Padding
Data if any
…
41
TCP segment format – cont.• Acknowledgement: identifies the number of the
byte the sender of this segment expects to receive next
• Hlen: specifies the length of the segment header in 32 bit multiples. If there are no options, the Hlen = 5 (20 bytes)
• Reserved for future use, set to 0
• Code: used to determine segment purpose, e.g. SYN, ACK, FIN, URG
42
TCP Segment format- cont• Window: Advertises how much data this station is
willing to accept. Can depend on buffer space remaining.
• Checksum: Verifies the integrity of the TCP header and data. It is mandatory.
• Urgent pointer: used with the URG flag to indicate where the urgent data starts in the data stream. Typically used with a file transfer abort during FTP or when pressing an interrupt key in telnet.
• Options: used for window scaling, SACK, timestamps, maximum segment size etc.
43
TCP timeout• Need a timeout estimate that will work for LANs
(RTT < msec.) to satellite WANs (hundreds of msec. to secs). RTT can vary a lot with time of day, day of week, or one second to next.– TCP records time segment sent – and time ACK received– Then calculates RTT sample– Smooth & use to estimate timeout, e.g.
• Timeout=beta * RTTs
• Timeout= RTTs + eta{=4}*f(dev(RTTs))
– Needs to take account of losses, e.g.• New_timeout=gamma{2} * timeout
May 12th
RT
T m
s.
Time of day
44
TCP connection establishment• 3 way handshake
• Initial sequence numbers (x, y) are chosen randomly• Guarantees both sides ready & know it, and sets
initial sequence numbers, also sets window & mss• Once connection established, data can flow in both
directions, equally well, there is no master or slave
Send SYN seq x
Rcv SYN/ACK
Send ACK y+1
Rcv SYN segment
Rcv ACK segment
Send SYN seq=y, ACK x+1
Site 1 Site 2ActiveWin 4096, mss 1024Passive
Win 4096, mss 1024
45
TCP close connection• Modified 3 way handshake (or 4 way termination)
• App tells TCP to close, TCP sends remaining data & waits for ACK, then sends FIN
• Site 2 TCP ACKs FIN, tells its application “end of data”• Site 2 sends FIN when its app closes connection (may be long
Example: 3 way handshake• atlas> telnet sunstats.cern.ch
– atlas is a WNT PC, sunstats is a Sun Solaris 5.6 host– MSS is set in TCP option in a SYN segment,
communicates the MSS the sender wants to receive – len=ip_hlen/tcp_hlen:ip_total_len– Initial Sequence Numbers are randomly selected– Telnet = port 23– W=Receive window size advertises how much data this
host will accept
48
Example: 3 way handshake - cont.• TCP from atlas:1174 to sunstats:23 seq=180839, A=0,
W=8192, SYN [len=5/6:44, opt=020405B4 <opt=2, len=4, mss=0x5B4=1460>]
• TCP from sunstats:23 to atlas:1174 seq=1383568304, A=180840, W=64240, SYN/ACK [len=5/6:44, opt=020405B4]
• TCP from atlas:1174 to sunstats:23 seq =180840, A=1383568305, W=8760 [len=5/5:40, opt=nul]– Notice window size can vary from segment to segment depending on
buffer space available– Notice smaller PC window advertisement– Notice ephemeral port selected by telnet client – Notice acknowledge next expected byte (=seq+1)– 0x020405B4: 02 = option type, 04=len, 0x5B4=1460
49
Session startSLAC>CERN: 256kbyte window,1 stream, full speed > 30msec, 13MBytes in 20s, 5.1MBytes/s