Lecture 15

The lecture starts with some exam-related remarks.

• The exam will allow a handwritten cheat sheet:
  • four pages;
  • written on both sides;
  • must be handwritten by the student;
  • not printed or photocopied.
• The exam will contain MCQs, but MCQs are only a part of the exam. Students will also have to solve networking tasks themselves.
• The lecture itself has no proper slides. The instructor draws a topology and goes through the full protocol stack step by step.

The main technical goal of the lecture is:

Given a concrete network topology, follow all required steps until a client can send an HTTP request to a web server.

So this lecture is a synthesis lecture: it combines Ethernet, MAC addresses, IP addresses, subnetting, routing, ARP, DNS, TCP, and HTTP.

MAC addresses are layer-2 addresses.

They are assigned to network interfaces, not to whole devices in an abstract sense.

For example, a router with two Ethernet interfaces has two MAC addresses:

Router interface 1: MAC B1
Router interface 2: MAC B2

A host usually has one MAC address per network interface.

Important point:

An unmanaged switch usually does not need a MAC address for normal frame forwarding.

Why?

Because the switch is not normally the destination of frames. It forwards frames based on the MAC addresses of other devices.

Managed switches may have MAC addresses or IP addresses for management access, but that is not needed for basic switching.

IP addresses are layer-3 addresses.

They are also assigned to interfaces.

A router has one IP address per IP subnet it is connected to.

For example:

Router interface toward LAN:      4.4.4.1/27
Router interface toward Internet: 3.3.3.17/30

Important:

Each router interface belongs to one subnet.

If a router connects two different links, then those links are usually different IP subnets.

With a switch, each switch port is usually its own collision domain.

Example:

Client --- Switch --- Router
             |
        DNS Resolver

The link between client and switch is one collision domain. The link between switch and router is another collision domain. The link between switch and DNS resolver is another collision domain.

Routers separate layer-2 networks.

So a link between two routers is also its own collision domain.

If the switch were replaced by a hub, then all hosts connected to the hub would share one collision domain.

Client --- Hub --- Router
           |
      DNS Resolver

In this case, all attached devices share the same layer-2 medium.

In ordinary IPv4 subnets, two addresses are not usable by hosts:

• the network address;
• the broadcast address.

Example:

3.3.3.16/30

A /30 subnet contains 4 addresses:

3.3.3.16  network address
3.3.3.17  usable host/router address
3.3.3.18  usable host/router address
3.3.3.19  broadcast address

So a /30 gives 2 usable addresses.

This is useful for point-to-point links, for example between two routers.

Some useful IPv4 subnet sizes:

/30 -> 4 total addresses, 2 usable
/29 -> 8 total addresses, 6 usable
/28 -> 16 total addresses, 14 usable
/27 -> 32 total addresses, 30 usable

If a LAN has 16 hosts plus one router interface, it needs at least 17 usable addresses.

A /28 has only 14 usable addresses, so it is too small.

A /27 has 30 usable addresses, so it works.

For point-to-point links, /31 can sometimes be used.

Normally, IPv4 reserves one network address and one broadcast address. But on a point-to-point link, there are only two endpoints, so a broadcast address is not really needed.

Therefore, there are RFCs allowing /31 on point-to-point links.

However, in simple examples and many teaching contexts, /30 is still commonly used.

Subnets must start at valid boundaries.

For example, a /30 subnet has a block size of 4.

So valid starting addresses are:

... .0
... .4
... .8
... .12
... .16
... .20
...

Thus:

3.3.3.16/30

is valid.

But:

3.3.3.17/30

is not the network address of a valid /30 subnet.

Important intuition:

The subnet start address must align with the subnet block size.

A router needs entries for directly attached subnets.

For example, if a router is directly connected to:

3.3.3.16/30

then it needs a forwarding-table entry for that subnet.

A router may also need entries for remote subnets behind another router.

Example:

2.2.2.0/29 -> send toward interface 2

This tells the router how to reach a subnet that is not directly attached.

A default route is:

0.0.0.0/0

It matches every IPv4 address.

It is used when no more specific forwarding-table entry matches.

Example:

0.0.0.0/0 -> send toward the Internet

Routers use longest prefix matching.

If several entries match a destination IP address, the router chooses the most specific one.

Example:

Destination IP: 4.4.4.10

Matching entries:
0.0.0.0/0
4.4.4.0/27

Chosen entry:
4.4.4.0/27

The /27 is longer and more specific than /0.

One could try to aggregate several nearby subnets into one larger prefix.

But this is dangerous if the larger prefix also includes addresses that are not actually reachable through that interface.

For example:

4.4.4.0/27
5.5.5.0/30
6.6.6.0/30

could perhaps be covered by some larger prefix, but that larger prefix may include many unrelated addresses.

So the forwarding table should not over-aggregate unless the network topology really supports it.

If the client wants to know the MAC address for an IP address on the same LAN, it sends an ARP request.

Example:

Who has IP 4.4.4.3?
Tell 4.4.4.2.

At Ethernet layer:

Source MAC:      client's MAC address
Destination MAC: ff:ff:ff:ff:ff:ff
Payload:         ARP request

The destination MAC address is the broadcast MAC address.

In hexadecimal, the Ethernet broadcast address is:

ff:ff:ff:ff:ff:ff

This means all bits are 1.

The device owning the requested IP address replies with its MAC address.

Example:

4.4.4.3 is at A1.

At Ethernet layer, the ARP reply is normally unicast:

Source MAC:      resolver's MAC address
Destination MAC: client's MAC address
Payload:         ARP reply

Switches learn from source MAC addresses.

When a switch receives a frame, it records:

source MAC -> incoming port

For the initial ARP request:

• the destination is broadcast;
• the switch floods the frame to all ports except the incoming port;
• while doing so, the switch learns where the client MAC address is.

For the ARP reply:

• the reply is unicast;
• the switch already knows the client’s port;
• so the switch forwards the reply only toward the client.

This is one of the useful automatic properties of Ethernet switches.

The client asks the resolver for the IP address of:

example.com

For IPv4, the relevant DNS record type is:

A record

For IPv6, the relevant DNS record type would be:

AAAA record

A typical DNS query stack:

Ethernet
IPv4
UDP
DNS

Important fields:

IP source:        client IP
IP destination:   DNS resolver IP

UDP source port:  ephemeral client port
UDP dest port:    53

DNS query:        A record for example.com

DNS normally uses destination port:

53

The client’s source port is usually an ephemeral port.

It should be above the well-known port range.

Well-known ports are:

0-1023

So the client might use something like:

source port = 11100
destination port = 53

The exact source port is chosen by the operating system.

The client normally sends a recursive query to its resolver.

Meaning:

The client asks the resolver to do the full DNS resolution process and return the final answer.

The client does not normally contact the root server, TLD server, and authoritative server directly.

If the resolver does not have the answer cached, it resolves the name iteratively.

Simplified process:

1. Ask root server:
   Who knows about .com?

2. Root replies:
   Ask a .com TLD name server.

3. Ask .com name server:
   Who knows about example.com?

4. .com server replies:
   Ask the authoritative server for example.com.

5. Ask authoritative server:
   What is the A record for example.com?

6. Authoritative server replies:
   example.com -> web server IP address.

The lecture notes that exam tasks may specify which caches are filled.

Possible caches include:

• DNS resolver cache;
• client DNS cache;
• ARP cache.

This matters because if something is already cached, some steps can be skipped.

For example:

• if the client already knows the DNS answer, no DNS query is needed;
• if the ARP cache already contains the router’s MAC address, no ARP request is needed.

The instructor briefly discusses QName minimization.

Traditionally, a resolver may send the full queried domain name to each DNS server in the chain.

Example:

a.b.c.example.com

could be sent in full to:

• root server;
• TLD server;
• authoritative servers.

This can be a privacy problem, because higher-level name servers learn more of the full domain than they need.

QName minimization tries to reduce this leakage.

Instead of always asking for the full name, the resolver asks only as much as needed at each step.

Simplified idea:

Ask root: who handles .com?
Ask .com server: who handles example.com?
Ask example.com server: who handles c.example.com?
...

However, there are practical complications:

• some DNS servers are buggy;
• sometimes asking the full name can get an answer earlier;
• not every label necessarily has a separate name server delegation.

So QName minimization improves privacy, but can interact with real-world DNS behavior.

If the web server is remote, the Ethernet frame is not sent directly to the web server’s MAC address.

Instead:

IP destination:       web server IP address
Ethernet destination: default gateway / router MAC address

Reason:

• IP is end-to-end;
• Ethernet is only for the local link.

So the client uses:

destination IP  = final web server
destination MAC = next hop router

This is one of the central points of the lecture.

If the web server is not in the client’s local subnet, the client sends the packet to its default gateway.

Therefore, the client needs to know the router’s MAC address.

If it is not cached, the client performs ARP:

Who has the router's IP address?

The router replies with its MAC address.

After that, the client can send the first TCP SYN frame to the router.

Client sends SYN to server.

Layer 2:
  Source MAC:      client MAC
  Destination MAC: router MAC

Layer 3:
  Source IP:       client IP
  Destination IP:  web server IP

Layer 4:
  Source port:     10033
  Destination port:80
  Flags:           SYN
  Sequence number: 1000

The destination MAC is the router’s MAC because the server is remote.

The destination IP is the web server’s IP because IP is end-to-end.

When the packet goes through routers:

• the IP source address stays the same;
• the IP destination address stays the same;
• the TCP source port stays the same;
• the TCP destination port stays the same;
• the Ethernet source and destination MAC addresses change at each hop.

Reason:

Layer 2 is hop-by-hop, but layer 3 is end-to-end.

At each router, the incoming Ethernet frame is removed, the IP packet is forwarded, and a new Ethernet frame is created for the next link.

IPv4 has a TTL field.

TTL means Time To Live.

Routers decrement TTL by 1.

Example:

Initial TTL: 64

After first router:  63
After second router: 62
...

If TTL reaches 0, the packet is dropped.

This prevents packets from looping forever.

Traceroute uses TTL behavior.

Simplified idea:

1. Send packet with TTL = 1.
   First router decrements TTL to 0 and drops it.
   Router sends ICMP Time Exceeded message back.

2. Send packet with TTL = 2.
   Second router eventually drops it and replies.

3. Continue increasing TTL.

This reveals routers along the path.

The instructor also mentions that real routers sometimes misbehave, for example by not decrementing TTL correctly or resetting it to a fixed value. This can make traceroute results misleading.

Server replies with SYN-ACK.

Layer 3:
  Source IP:       web server IP
  Destination IP:  client IP

Layer 4:
  Source port:     80
  Destination port:10033
  Flags:           SYN, ACK
  Sequence number: 5000
  Acknowledgment:  1001

Why acknowledgment = 1001?

Because the client’s SYN consumes one sequence number.

The server is saying:

I received your SYN with sequence number 1000. The next byte I expect from you is 1001.

Client sends final ACK.

Layer 3:
  Source IP:       client IP
  Destination IP:  web server IP

Layer 4:
  Source port:     10033
  Destination port:80
  Flags:           ACK
  Sequence number: 1001
  Acknowledgment:  5001

Why acknowledgment = 5001?

Because the server’s SYN also consumes one sequence number.

After this packet, the TCP connection is established.

The client sends 100 bytes of HTTP data.

Client -> Server

Flags:           ACK
Sequence number: 1001
Acknowledgment:  5001
Payload:         HTTP GET request, 100 bytes

After sending 100 bytes, the next client sequence number will be:

1001 + 100 = 1101

The server can acknowledge receiving the GET request.

Server -> Client

Flags:           ACK
Sequence number: 5001
Acknowledgment:  1101

Meaning:

I have received bytes up to 1100. The next byte I expect from you is 1101.

If the response is 500 bytes, the server sends:

Server -> Client

Flags:           ACK
Sequence number: 5001
Acknowledgment:  1101
Payload:         HTTP response, 500 bytes

After sending 500 bytes, the next server sequence number will be:

5001 + 500 = 5501

The client acknowledges the response:

Client -> Server

Flags:           ACK
Sequence number: 1101
Acknowledgment:  5501

Meaning:

I received the 500-byte response. The next byte I expect from you is 5501.

TCP sequence numbers count bytes, not packets.

Important details:

• SYN consumes one sequence number.
• Data increases the sequence number by the number of payload bytes.
• Pure ACK packets do not consume sequence numbers.
• The acknowledgment number means:
  • “the next byte I expect from you”.

MTU means Maximum Transmission Unit.

A common Ethernet MTU is:

1500 bytes

This is the maximum size of the IP packet that can fit into one Ethernet frame payload.

MSS means Maximum Segment Size.

For TCP over IPv4 without options:

IPv4 header: 20 bytes
TCP header:  20 bytes
MTU:         1500 bytes

Therefore:

MSS = 1500 - 20 - 20 = 1460 bytes

So one TCP segment can carry at most 1460 bytes of TCP payload without exceeding the 1500-byte MTU.

If the website data is 1500 bytes, it cannot fit into one TCP segment with MSS 1460.

So TCP should split it into two segments:

Segment 1: 1460 bytes
Segment 2:   40 bytes

This is TCP segmentation, not IP fragmentation.

Large segments are usually more efficient than many tiny segments.

Reason:

Every packet has headers.

If we send many tiny packets, we waste more bandwidth on repeated headers and create more processing overhead.

So TCP usually sends as much payload as allowed by:

• MSS;
• congestion window;
• flow-control window.

If an IP packet is too large for the next link’s MTU, a router may fragment it.

Example:

Original IP packet too large
 -> Fragment 1
 -> Fragment 2

Each fragment gets its own IP header.

IP fragmentation is undesirable for several reasons.

First, the transport-layer header is usually only in the first fragment.

Example:

Fragment 1:
  IP header
  TCP header
  first part of payload

Fragment 2:
  IP header
  later part of payload

The second fragment may not contain the TCP or UDP port numbers.

This is a problem for:

• NAT devices;
• firewalls;
• middleboxes;
• connection tracking.

A firewall may want to check the TCP destination port, but the second fragment may not contain that information.

So the firewall may drop the fragment.

If one fragment is dropped, the whole original packet cannot be reassembled.

TCP can recover from loss using retransmission.

So if fragmentation causes loss, TCP may eventually resend data.

But fragmentation is still inefficient and should be avoided.

TCP stacks therefore try to choose an MSS that fits the path MTU.

Fragmentation is worse for UDP.

UDP has no built-in retransmission and no connection state.

If a UDP fragment is lost, the application may simply not receive a response.

The sender may not know whether:

• the server does not exist;
• the server ignored the request;
• a firewall dropped a fragment;
• the network lost a packet.

So applications using UDP often avoid large datagrams.

The host only uses ARP for IP addresses on the local link.

Case 1: destination is local.

Destination IP is inside local subnet.
ARP for destination IP.

Case 2: destination is remote.

Destination IP is outside local subnet.
ARP for default gateway IP.

This is another core point of the lecture.

The client wants to access:

example.com

It needs an IP address.

If not cached, it asks the configured DNS resolver.

If the DNS resolver is on the local subnet, the client needs the resolver’s MAC address.

If not in ARP cache, it sends an ARP request.

Client broadcasts:

Who has resolver IP?

Resolver replies:

resolver IP is at resolver MAC

Client sends UDP DNS query:

Source IP:        client IP
Destination IP:   resolver IP
Source UDP port:  ephemeral port
Destination port: 53
Query:            A record for example.com

If not cached, resolver performs iterative DNS resolution:

root -> .com -> example.com authoritative server

The resolver returns the web server IP to the client.

The web server IP is remote.

So the client uses its default route:

0.0.0.0/0 via default gateway

If the router’s MAC address is not cached, the client ARPs for the router’s IP address.

The router replies with its MAC address.

Client sends TCP SYN:

Ethernet destination: router MAC
IP destination:       web server IP
TCP destination port: 80
TCP flag:             SYN

Each router:

• removes incoming layer-2 frame;
• checks destination IP;
• uses forwarding table with longest prefix matching;
• decrements TTL;
• sends packet in a new layer-2 frame on the next link.

Server replies with SYN-ACK.

The packet travels back through routers.

Client sends final ACK.

TCP connection is now established.

Client sends HTTP request over TCP:

GET / HTTP/1.1
Host: example.com
...

Server sends HTTP response over TCP.

If the response is larger than the MSS, TCP splits it into multiple segments.

TCP uses sequence and acknowledgment numbers to confirm received bytes.

Lost data can be retransmitted.

Different layers solve different problems:

Application:  HTTP, DNS
Transport:    TCP, UDP
Network:      IP routing across networks
Link:         Ethernet, MAC addresses, ARP
Physical:     actual transmission medium

MAC addresses only matter on the local link.

For a remote web server, the client does not send the Ethernet frame to the web server’s MAC address.

It sends it to the default gateway’s MAC address.

The IP destination address remains the final destination.

Routers change layer-2 headers, but normally keep the IP source and destination addresses unchanged.

ARP is only used inside a local layer-2 network.

You ARP for:

• the destination host, if it is local;
• the default gateway, if the final destination is remote.

If the user enters a domain name, the client needs DNS first.

Without DNS, the client could still connect to an IP address directly, but domain names require resolution.

TCP sequence numbers are not packet numbers.

They count bytes in the byte stream.

SYN consumes one sequence number.

TCP should segment data according to MSS so that IP packets fit into the path MTU.

This avoids IP fragmentation, which causes problems for NATs, firewalls, UDP, and QUIC.

Routers select forwarding entries using longest prefix matching.

The default route 0.0.0.0/0 is only used when no more specific route matches.

A client wants to contact a web server outside its local subnet. Which MAC address is used as the Ethernet destination for the first TCP SYN?

Answer:

The MAC address of the default gateway, not the MAC address of the web server.

A client sends a TCP SYN with sequence number 1000. What acknowledgment number should the server use in the SYN-ACK?

Answer:

1001

Because SYN consumes one sequence number.

With MTU 1500, IPv4 header 20 bytes, and TCP header 20 bytes, what is the TCP MSS?

Answer:

1500 - 20 - 20 = 1460 bytes

Why is IP fragmentation problematic for firewalls?

Answer:

Later fragments may not contain the transport-layer header, so the firewall may not see TCP/UDP port numbers.

When does a host ARP for the destination IP, and when does it ARP for the router?

Answer:

Destination inside local subnet:
  ARP for destination IP.

Destination outside local subnet:
  ARP for default gateway IP.

What does the DNS resolver do if it has no cached answer?

Answer:

It performs iterative resolution, usually starting from the root, then TLD, then authoritative name servers.

What changes when an IP packet passes through a router?

Answer:

Changes:
  Ethernet source MAC
  Ethernet destination MAC
  TTL decreases

Usually unchanged:
  IP source address
  IP destination address
  TCP/UDP ports