Routing

Suppose host A wants to send an IP datagram to host B on the same local network.

A knows B’s IP address, but to create an Ethernet frame, A also needs B’s MAC address.

IPv4 uses ARP, the Address Resolution Protocol, to map IP addresses to MAC addresses inside a local network.

Each device maintains an ARP table, conceptually like this:

IP address        MAC address        TTL
192.168.1.10      aa:bb:cc:dd:ee:ff  ...

The TTL is important because mappings are soft state. A host may leave the network, another device may later receive the same IP address, or the mapping may otherwise become stale.

If A does not know B’s MAC address, A sends an ARP request.

The request is sent as a link-layer broadcast:

Destination MAC = ff:ff:ff:ff:ff:ff

This is the Ethernet broadcast address. In binary it is all ones; in hexadecimal it is written as all ff.

The ARP request says, in effect:

Who has this IP address? Please tell me your MAC address.

Every device on the local link receives the broadcast frame.

Only the device whose IP address matches the target IP should answer.

The ARP reply does not need to be broadcast. It can be sent directly back to the requester because the ARP request already contained the requester’s source MAC address.

After receiving the reply, A stores the mapping in its ARP table and can send the actual Ethernet frame.

ARP has no built-in authentication.

Because every device can see ARP requests, a malicious host can spoof replies and claim:

That IP address belongs to my MAC address.

This is the basis of ARP spoofing or ARP poisoning attacks.

There are defenses, but the instructor described them as awkward and not very clean compared with having security built into the protocol.

ARP only works on the local link.

If A wants to send to an IP address outside its own subnet, A does not ARP for the final destination. Instead, A sends the frame to the MAC address of its default gateway.

So the logic is:

Destination IP inside my subnet?
  Yes -> ARP for destination IP directly.
  No  -> ARP for default gateway's IP, then send frame to gateway MAC.

The IP destination remains the final destination, but the Ethernet destination is the next hop.

IPv6 devices can create link-local addresses.

Historically, the interface identifier part of an IPv6 address could be derived from the MAC address. The MAC address is 48 bits, while the IPv6 interface identifier is often 64 bits.

The old EUI-64-style transformation roughly worked by:

1. splitting the MAC address into two 24-bit halves;
2. inserting ff:fe in the middle;
3. flipping one specific bit.

This allowed a device to automatically create a likely unique link-local address.

If the interface identifier is derived from a globally unique MAC address, then the device may be trackable across networks.

For example, if a phone keeps the same interface identifier while moving between networks, observers can recognize it.

Therefore, modern systems often randomize the interface identifier. Some systems, such as Apple devices in some scenarios, may also randomize the MAC address when joining networks.

NDP creates a neighbor table, conceptually similar to an ARP table:

IPv6 address / interface identifier -> MAC address, TTL

Instead of broadcasting to everyone, a node sends a Neighbor Solicitation to a solicited-node multicast address derived from the target IPv6 address. This reduces unnecessary processing by unrelated hosts.

The target replies with a Neighbor Advertisement.

A network can be represented as a graph:

\[ G = (N, E) \]

where:

• \(N\) is the set of nodes, typically routers;
• \(E\) is the set of edges, typically links.

A path is a sequence of connected routers/edges.

Each edge can have a cost:

\[ c(x, y) \]

The cost may represent different things:

• always 1, if only hop count matters;
• inverse of bandwidth, so low-bandwidth links get higher cost;
• congestion, so congested links become more expensive.

Routing algorithms try to find a good path, usually the least-cost path.

However, the instructor noted that in real Internet routing, other factors such as policy and money can be more important than pure shortest path.

Dijkstra’s algorithm is used in link-state routing.

All nodes have the same topology and cost information. Each node then runs Dijkstra from itself as the source.

The result is a shortest-path tree rooted at that node.

From the shortest-path tree, the router derives its forwarding table.

The lecture uses the following notation:

• \(c(i,j)\): cost from node \(i\) to node \(j\);
  • infinite if \(i\) and \(j\) are not direct neighbors.
• \(D(v)\): current known cost from the source to node \(v\).
• \(p(v)\): predecessor of \(v\) on the current best path.
• \(N'\): set of nodes whose least-cost path is already known.

Start at source node A.

Initially:

\[ N' = \{A\} \]

For each node \(v\):

• if \(v\) is adjacent to A, set \(D(v) = c(A,v)\);
• otherwise set \(D(v) = \infty\).

Then repeat:

1. choose the node \(w\) not in \(N'\) with the smallest \(D(w)\);
2. add \(w\) to \(N'\);
3. update all neighbors \(v\) of \(w\):

\[ D(v) = \min(D(v), D(w) + c(w,v)) \]

This means:

The best known path to \(v\) is either the old one, or the path to \(w\) plus the edge from \(w\) to \(v\).

In the example, the algorithm computes shortest paths from node A.

At the beginning, A directly knows the costs to its neighbors B, C, and D. Other nodes are set to infinity.

Then:

1. D is selected first because A can reach D with cost 1.
2. From D, paths to C and E may improve.
3. E is selected next.
4. From E, the path to C improves and F becomes reachable.
5. B is selected next.
6. Then C and F are processed.

The final result is a shortest-path tree from A.

From that tree, A only needs the next hop for each destination. For example:

Destination B -> use link (A,B)
Destination D -> use link (A,D)
Destination E -> use link (A,D)
Destination C -> use link (A,D)
Destination F -> use link (A,D)

A does not need the full path in the forwarding table. It only needs to know which outgoing link to use next.

With \(n\) nodes, each iteration needs to find the next minimum-distance node.

Depending on the data structure, the complexity can be:

• \(O(n^2)\);
• \(O(n \log n)\) or similar with better data structures.

The instructor also mentioned that link-state routing can have oscillation problems if link costs depend on current traffic load.

For example:

1. a link becomes expensive because many routers use it;
2. routers recompute paths and move traffic elsewhere;
3. the old link becomes cheap again;
4. routers move traffic back.

One mitigation is randomized update timing, so not every router recomputes at exactly the same time.

The instructor briefly connected link-state/global knowledge to Software-Defined Networking.

In SDN:

• forwarding devices can be simpler;
• a central controller has global network information;
• the controller computes forwarding tables;
• the controller installs those tables in routers/switches.

This can be useful in controlled environments such as data centers.

But it has disadvantages:

• centralized controller can become a single point of failure;
• it requires control over the whole network;
• it is not suitable for the entire Internet.

Distance-vector routing does not require every router to know the full topology.

Each node knows:

• its neighbors;
• the cost to each neighbor;
• its own current distance vector;
• the distance vectors advertised by neighbors.

A distance vector is a list of estimated costs from this node to every destination.

For node \(x\):

\[ D_x(y) \]

means node \(x\)’s current estimate of the least cost to destination \(y\).

The least-cost path from \(x\) to \(y\) can be computed as:

\[ d_x(y) = \min_v \{ c(x,v) + d_v(y) \} \]

where \(v\) ranges over the neighbors of \(x\).

Meaning:

To reach destination \(y\), node \(x\) considers each neighbor \(v\). The total cost is the cost from \(x\) to \(v\), plus \(v\)’s cost to \(y\). Choose the minimum.

The neighbor that gives the minimum becomes the next hop.

Suppose \(u\) wants to reach \(z\).

It has neighbors \(v\), \(x\), and \(w\).

If:

\[ d_v(z)=5 \] \[ d_x(z)=3 \] \[ d_w(z)=3 \]

and the link costs from \(u\) are:

\[ c(u,v)=2 \] \[ c(u,x)=1 \] \[ c(u,w)=5 \]

then:

\[ d_u(z) = \min \{2+5, 1+3, 5+3\} \]

\[ d_u(z) = \min \{7,4,8\} = 4 \]

So \(u\) should send via \(x\).

The important point is that \(u\) does not need to know the complete path from \(x\) to \(z\). It only needs to know that \(x\) claims it can reach \(z\) with cost 3.

At each node \(x\):

1. Initialize distances:
   • distance to itself is 0;
   • distance to direct neighbors is the link cost;
   • distance to other nodes is infinity.
2. Periodically send the current distance vector to neighbors.
3. When receiving a neighbor’s distance vector, recompute:

\[ D_x(y) = \min_v \{ c(x,v) + D_v(y) \} \]

for every destination \(y\).

1. If the distance vector changes, notify neighbors.

The algorithm is:

• iterative;
• asynchronous;
• distributed.

There is no central controller and no global topology knowledge.

If a link becomes better, the improvement can propagate quickly.

Example:

• initially, cost \(x-y = 4\);
• later, cost \(x-y = 1\);
• \(y\) notices the local change;
• \(y\) updates its distance vector;
• \(y\) tells \(z\);
• \(z\) realizes it can reach \(x\) more cheaply through \(y\).

This is called:

Good news travels fast.

If a link becomes worse, distance-vector routing can react badly.

Example:

• initially, \(y\) reaches \(x\) with cost 4;
• \(z\) reaches \(x\) through \(y\) with cost 5;
• then the direct \(x-y\) cost increases to 60.

Now \(y\) sees:

• direct path to \(x\): cost 60;
• path via \(z\): cost \(1 + 5 = 6\).

So \(y\) incorrectly believes it can reach \(x\) via \(z\) with cost 6.

But \(z\)’s path to \(x\) was actually going through \(y\).

This creates a routing loop.

Then:

• \(z\) updates its cost to 7;
• \(y\) updates to 8;
• \(z\) updates to 9;
• and so on.

This is the count-to-infinity problem.

In the example, the instructor said it would take many iterations before the algorithm stabilizes.

The count-to-infinity problem happens because routers do not know the full topology.

A router only knows that a neighbor claims some distance. It does not know whether that neighbor’s path goes back through itself.

So two routers may keep increasing their estimates gradually before finally discovering that the route is bad.

A mitigation is poisoned reverse.

If \(z\) routes through \(y\) to reach \(x\), then \(z\) tells \(y\):

\[ D_z(x) = \infty \]

This prevents \(y\) from trying to reach \(x\) through \(z\).

In simple cases, this breaks the loop.

However, poisoned reverse does not completely solve count-to-infinity in all topologies, especially when loops involve more than two routers.

Link-state algorithms distribute topology/link-state information broadly.

Distance-vector algorithms only exchange updates with direct neighbors.

Link-state algorithms can converge quickly if all routers receive consistent topology information, but they may oscillate if costs depend on traffic.

Distance-vector algorithms can converge slowly and may suffer from routing loops and count-to-infinity.

In link-state routing:

• a broken router may advertise an incorrect link cost;
• each router still computes its own table independently.

In distance-vector routing:

• a broken router may advertise incorrect path costs;
• other routers use those advertised costs;
• errors can propagate through the network.

The data plane is local and per-router.

It decides how a datagram arriving on an input port is forwarded to an output port.

The data plane uses:

• packet header fields;
• forwarding table entries.

Forwarding can be implemented very efficiently, often in hardware.

The control plane is network-wide logic.

It determines how datagrams should be routed along an end-to-end path from source host to destination host.

There are two main control-plane approaches:

1. per-router control plane;
2. Software-Defined Networking control plane.

In the traditional model, every router runs routing logic.

Each router has:

• forwarding hardware/software;
• local forwarding table;
• routing algorithm component.

The routing components in different routers exchange information and compute routes.

In Software-Defined Networking, the control logic is moved out of routers and into a remote controller.

The controller:

• collects network information;
• computes forwarding tables;
• installs forwarding rules in routers/switches.

This can work well in controlled environments such as data centers.

The instructor noted that it is less suitable for very large networks such as a national ISP network, where centralizing everything would be difficult.

The Internet provides best-effort service.

This means there are no guarantees for:

• successful delivery;
• delay;
• ordering;
• bandwidth.

Packets may be:

• lost;
• delayed;
• delivered out of order;
• sent over different paths.

The lecture briefly contrasts the Internet with other models, such as ATM:

• Constant Bit Rate;
• Available Bit Rate.

There are also Internet QoS(Quality of Service)-related approaches such as:

• IntServ (Integrated Service);
• DiffServ (Differentiated Services).

These try to provide stronger guarantees, but the instructor emphasized that they are not generally used as the scalable service model of the global Internet.

Best effort succeeded because it is simple.

The Internet is a network of networks. Different operators can build and manage their own networks as long as they interoperate using the basic best-effort model.

This makes deployment easier.

Performance can still be good enough most of the time because of:

• sufficient bandwidth provisioning;
• content distribution networks;
• replicated services;
• congestion control for elastic traffic.

The instructor also mentioned that some special environments need stronger guarantees, for example:

• autonomous driving or sensor-control networks;
• financial trading networks.

These may require strict timing constraints, unlike the general Internet.

Forwarding is the local process of moving a packet from an input interface to an output interface.

It uses:

• the forwarding table;
• information in the packet header.

Forwarding is the data-plane function.

Routing is the process by which forwarding tables are built and maintained.

It uses:

• routing protocols;
• routing algorithms;
• routing information from other routers.

Routing is the control-plane function.

Routing determines the forwarding table.

Forwarding uses the forwarding table to handle actual packets.

A router does not run the full routing algorithm for every packet. The expensive control-plane work happens separately, and the packet fast path only performs lookup and forwarding.

The Internet has an enormous number of destinations.

If every router had to store a route to every destination, routing tables would become too large.

If every router exchanged full routing information with every other router, routing updates would consume too much bandwidth.

The instructor emphasized that routing information should not swamp the links; links should primarily carry user/application traffic.

The Internet is a network of networks.

Each network operator wants to control routing inside its own network.

Therefore, Internet routing is organized using autonomous systems.

Intra-AS routing, also called intra-domain routing, happens inside one AS.

Routers within the same AS usually run the same intra-domain routing protocol.

Different ASes may use different internal routing protocols.

Inter-AS routing, also called inter-domain routing, happens between ASes.

Gateway or border routers connect one AS to another AS.

Inter-AS routing tells an AS which external destinations are reachable through which neighboring ASes.

The forwarding table is configured by both intra-AS and inter-AS routing.

For internal destinations:

• intra-AS routing determines the forwarding entries.

For external destinations:

• inter-AS routing learns reachability information;
• intra-AS routing determines how to reach the correct gateway router.

Example:

If a router in AS1 receives a packet for a destination outside AS1, AS1 must know:

1. whether the destination is reachable via AS2 or AS3;
2. which AS1 border router should be used;
3. how to route internally to that border router.

The main purpose of this hierarchy is scalability and administrative autonomy.

Older Ethernet used a bus topology.

In a bus:

• all nodes share the same medium;
• all nodes are in the same collision domain;
• frames can collide.

Modern Ethernet usually uses a star topology.

In a star:

• hosts connect to a central switch;
• each host has a separate link to the switch;
• collisions are avoided or greatly reduced;
• full-duplex communication is possible.

Ethernet has many physical variants.

They share a common MAC protocol and frame format, but may differ in:

• speed;
• copper vs. fiber;
• physical-layer encoding.

Examples include:

• 100BASE-TX;
• 100BASE-FX;
• 1 Gbps Ethernet;
• 10 Gbps Ethernet;
• 100 Gbps Ethernet.

Hubs:

• operate at bit level;
• do not isolate collision domains;
• can be arranged in a hierarchy;
• are simple and inexpensive;
• can extend physical distance.

But hubs have major limitations:

• all attached devices still share the same collision domain;
• collisions can happen across the whole hub-based LAN;
• loops can cause broadcast storms.

The instructor mentioned an anecdote where a loop created in a building network caused the network to go down.

Hosts do not need to know that switches exist.

The switch’s MAC address is not normally used as the destination MAC for traffic passing through it.

A switch may have a MAC address for management purposes, but that is not relevant for normal host-to-host forwarding through the switch.

Switches are plug-and-play.

They do not need manual configuration for basic forwarding.

They learn automatically by observing frames.

If the switch does not know the destination MAC address, it floods the frame:

Forward the frame on all interfaces except the one it arrived on.

This is similar to hub behavior for that frame.

If the switch knows the destination MAC address:

• if the destination is on the same interface the frame came from, drop it;
• otherwise forward it only on the interface listed in the switch table.

If A sends to A’ and the switch table is initially empty:

1. switch learns that A is reachable via interface 1;
2. destination A’ is unknown;
3. switch floods the frame;
4. A’ replies;
5. switch learns that A’ is reachable via interface 4;
6. reply to A is forwarded only to interface 1.

After this, communication between A and A’ can be selective rather than flooded.

Self-learning works even with multiple switches.

If A sends to G through a network of switches:

• each switch learns where A is based on the incoming interface;
• unknown destinations are flooded;
• when G replies, switches learn where G is;
• future frames can be forwarded more selectively.

Switches are link-layer devices.

They inspect Ethernet headers and forward based on MAC addresses.

Their tables are built by:

• filtering;
• learning;
• spanning tree algorithms.

Switches are good for small networks, for example a few hundred hosts.

Routers are network-layer devices.

They inspect IP headers and forward based on IP prefixes.

Their tables are built using routing protocols and routing algorithms.

Routers are better for large networks with thousands or more hosts.

The lecture briefly mentions layer-3 switches.

A layer-3 switch combines switching and routing functionality, but may have limitations compared with a full router.

Advantages:

• simple operation;
• plug-and-play;
• low processing overhead;
• transparent to hosts.

Disadvantages:

• restricted topologies;
• need spanning tree to avoid loops;
• single broadcast domain unless VLANs or routing are used;
• no strong protection against broadcast storms;
• flat MAC address space does not scale globally.

Advantages:

• support arbitrary topologies;
• use TTL and routing protocols to limit cycles;
• can provide traffic isolation;
• can implement firewall policies;
• support hierarchical IP routing.

Disadvantages:

• more complex;
• require IP configuration;
• higher processing requirements;
• not as plug-and-play as switches.

NAT allows a local network to use one globally routable IP address as seen from the outside world.

Inside the local network, devices use private addresses, for example:

10.0.0.1
10.0.0.2
10.0.0.3
10.0.0.4

The local network might be:

10.0.0.0/24

The NAT router has:

• an internal private address, e.g. 10.0.0.1;
• an external public address, e.g. 138.76.29.7.

All outgoing packets appear externally to come from the NAT router’s public address.

NAT is a workaround for IPv4 address exhaustion.

Many home networks can all use the same private range, such as:

10.0.0.0/24
192.168.0.0/24

These addresses are not globally unique.

They only need to be unique inside the local network.

A NAT router modifies outgoing packets.

For an outgoing packet:

Source:      10.0.0.1:3345
Destination: 128.119.40.186:80

the NAT router may rewrite it to:

Source:      138.76.29.7:5001
Destination: 128.119.40.186:80

It stores the mapping in a NAT translation table:

WAN side              LAN side
138.76.29.7:5001  ->  10.0.0.1:3345

When the reply arrives:

Source:      128.119.40.186:80
Destination: 138.76.29.7:5001

the NAT router looks up the translation table and rewrites the destination:

Source:      128.119.40.186:80
Destination: 10.0.0.1:3345

Then it forwards the packet to the internal host.

If multiple internal hosts share one public IP address, the NAT router needs more than just the IP address to distinguish connections.

It usually uses transport-layer ports.

This means NAT is not purely a layer-3 operation.

The router must inspect and modify layer-4 information such as TCP or UDP port numbers.

NAT devices keep state.

They must remember translation entries so that incoming replies can be mapped back to the correct internal host.

This state is usually temporary and can time out.

Therefore, NAT can break long-idle connections or peer-to-peer scenarios.

Originally, the Internet was designed around the end-to-end principle:

Any host with a global IP address should, in principle, be able to communicate directly with any other host.

NAT breaks this idea.

Devices behind NAT are not directly reachable from the outside unless extra configuration is used.

For example:

• port forwarding;
• NAT traversal;
• VPNs;
• relay servers.

This is a problem for peer-to-peer applications and games.

The instructor mentioned that people often use VPN-like tools to create a direct-looking network with friends because NAT makes direct connection difficult.

The instructor emphasized:

NAT is not a firewall.

NAT may have firewall-like side effects because unsolicited inbound connections often fail without a translation entry.

But this is not the same as deliberate security policy enforcement.

A proper firewall should still be used.

Sometimes a home router does not even receive a globally routable public IPv4 address.

Instead:

1. devices are behind the home NAT;
2. the home router is itself behind another NAT at the ISP.

This is carrier-grade NAT.

It is common in mobile networks and some ISPs.

Multiple layers of NAT make peer-to-peer communication and inbound reachability even harder.

NAT contributes to protocol ossification.

Because many NAT devices expect TCP or UDP ports in specific places, it becomes difficult to deploy new transport protocols.

The instructor mentioned QUIC as an example: QUIC runs over UDP partly because UDP passes through NATs and middleboxes more easily than a completely new transport protocol would.

A NAT with one public IP address has a limited number of port numbers.

The slides mention that a 16-bit port-number field gives more than 60,000 simultaneous connections for one public address.

This sounds large, but it is still a limit, especially with many users or carrier-grade NAT.

The instructor’s view is that IPv6 is the proper solution to address shortage.

With enough globally routable addresses, NAT is not needed as an address-conservation workaround.