Post on 14-Mar-2018
transcript
Computer Networks
Lecture23:LANConnectivity
Repeaters
Ethernetsegmentislimitedto500mduetosignalattenuation
Arepeater:
• ananalogelectronicdevice
• continuouslymonitorselectricalsignalsoneachLAN
• repeatsandstrengthens/amplifiessignal
Ethernetonlyallows4repeaters:max2.5km.Why?
Repeater
Hubs
Hubsjoinsmultipleinputlineselectrically
• bitscomingfromonelinkgooutallotherlinks
• atthesamerate
• noframebuffering
• donotnecessarilyamplifysignal
• extendsmaxdistancebetweennodes
NoCSMA/CDathub:
• collisiondetectionlefttohostadaptors• individualsegmentcollision
domainsbecomeonelarge
collisiondomain
hub
hub
hub
hub
LimitationsofRepeatersandHubs
Onelargesharedlink• eachbitispropagatedtothewholenetwork
• aggregatethroughputislimited
• e.g.,threedepartmentseachhasa10MbpsLAN
• ifconnectedviaahub,theymustsharethe10Mbps
CannotsupportmultipleLANtechnologies• doesnotbufferorinterpretframes
• can’tinterconnectbetweendifferentratesorformats
• e.g.,can’tinterconnect10BaseT&100BaseT
Limitationsonmaximum#nodesanddistances• sharedmediumimposeslengthlimits
• e.g.,cannotgobeyond2500metersonEthernet
Switches/Bridges
Linklayerrouter-equivalent:
• connectLANsatthelinklayer
• unlikerouters,onlyknowwhether
anodeisinasegment
• canconnectsegmentswithdifferentMACprotocols
• canalsoconnectdirectlytohost,atfullduplex
Storeandforwardframesbetweensegments
• extractsdestinationaddressfromtheframe
• looksupthedestinationinatable
hub hub
hub
switch
1 2
3
Bridges/SwitchesSupportconcurrentcommunication(A�C,B�D)
• doesnotpropagateinterferenceandcollisions�mustbuffer
• whenaframeistobeforwardedonasegment,
usesCSMA/CDtoaccesssegment
• increaseeffective/aggregatebandwidthofaLANby
takingadvantageofspatiallocality
host host host host host
host host host host host
host
host
Bridge
A
C
B
D
TransparentBridges/Switches
Transparent:hostsareunawareofthepresenceofswitches
Eachswitchhasaswitchtable
Entryinswitchtable:
• <MACaddress,interface,timestamp>
• staleentriesintabledropped(TTLcanbe60mins)
Plug-and-play:self-learningswitches
donotneedtobeconfigured
hub hub
hub
switch
1 2
3
BackwardLearning
Howdoesaswitchknowatwhichsegmentanodeislocated?
Backwardlearning:
• whenaframeisreceived,switch“learns”theincominginterfacethroughwhichasendermaybereached
• recordssender/interfacepairinswitchtable
FrameFiltering/ForwardingWhenaswitchreceivesaframe:
LookfortheMACdestinationaddressinswitchtable
ifentryfoundfordestination{
ifdestinationisonthesamesegmentfromwhichframearrived{
droptheframe
}else{
forwardtheframeoninterfaceindicated
}
}else{
flood//forwardtoallinterfacesexcepttheincominginterface
}
FloodingExample
SupposeCsendsaframetoD
SwitchreceivesframefromC recordsinswitchtablethatCisoninterface1becauseDisnotintable,switchforwards
frametointerfaces2and3framereceivedbyD
hub hub hub
switch
A
B CD
EF G H
I
address interface
ABEG
1123
1 2 3
BackwardLearningExample
SupposeDnowsendsaframetoC
SwitchreceivesframefromD recordsinswitchtablethatDisoninterface2becauseCisintable,switchforwardsframe
onlytointerface1framereceivedbyC
hub hub hub
switch
A
B CD
EF G H
I
address interface
ABEGCD
112312
1 2 3
Switch:TrafficIsolationSwitchbreakssubnetintoLANsegments
Switchfilterspackets:• same-LAN-segmentframesarenotusuallyforwardedontootherLANsegments
• segmentsbecomeseparatecollisiondomains
hub hubhub
switch
collisiondomain collisiondomain
collisiondomain
Switches:DedicatedAccess
Hostscanhavedirectconnectiontoswitch• fullduplex:dedicatedtransmissionline
ineachdirection,stillCSMA/CD,
butnochanceofcollision
Switching:A-to-DandB-to-Esimultaneously,nocollisions
Switchescansupportcombinationsofshared/dedicatedand
10/100/1000Mbpsinterfaces
switch
A
D
B
E
C
F
Cut-ThroughSwitching
Bufferingdelaycanbeahighfractionoftotaldelay• receivingaframeoflengthLfromalinkwithtransmission
rateRtakesL/Rtimeunits
• overshortdistancespropagationdelayissmall
• andbufferingdelaycanbecomealargefractionoftotal
Cut-throughswitching:streamingtransmission• inspecttheframeheaderanddothetablelook-up
• ifoutgoinglinkisidle,immediatelystartforwardingthe
headoftheframetotheoutgoinglink• whilestillreceivingthetailviatheincominglink
A B
switches
ExampleEnterpriseNetworkSwitch/HubInstallment
hub hubhub
switch
toexternalnetwork
router
IPsubnet
mailserver
webserver
CyclesandBroadcastStorm
LANsmayformcycles• eitheraccidentally,orbydesign,forhigherreliability• useoffloodingcanleadtoforwardingloops
• causing“broadcaststorm”
Topreventbroadcaststorm,
switchesneedtoavoidsome
linkswhenflooding,soasnottoformaloop
Howtodecidewhichlinktoavoid?
SpanningTreeWhatisaspanningtreeofagraph?• asub-graphthatcoversallnodes,butcontainsnocycle
Toavoidloops,linksnotinthespanningtreedonot
forwardframes
Needadistributedalgorithmtocomputespanningtree• switchescooperatetobuildthespanningtree
• andadaptautomaticallywhenfailuresoccur[afterRexford]
ConstructingaSpanningTreeKeyingredientsofthealgorithm
• switchesneedtoelecta“root”• root::=theswitchwiththesmallestidentifier
• “rootmessages”oftheform(X, R, d)isbroadcast• XistheIDofthenodesending/forwardingtherootmessage• Risthecurrentroot(smallestIDseen)• disX’scost/distancetoR
• eachswitchcheckswhetheritsinterfaceisonthe
shortestpathfromtheroot• excludefromthespanningtreeinterfacesnotontheshortestpathfromroot,breaktiebyID
• eachLANhasadesignatedswitch• multipleswitcheselectonewithshortestrootpath,breaktiebyID
[afterRexford]
StepsinSpanningTreeAlgorithm
Initially,eachswitchthinksitistheroot• switchsendsarootmessageouteveryinterface
• identifyingitselfastherootwithdistance0• example:switchXannounces(X, X, 0)
Switchesupdatetheir“rootview”• uponreceivingarootmessage,checktherootid
• ifthenewidissmaller,startviewingthatswitchasroot
Switchescomputetheirdistancefromtheroot• add1tothedistancereceivedfromaneighbor
• identifyinterfacesnotonashortestpathtotheroot• andexcludethemfromthespanningtree
• floodanupdatedrootmessage
[afterRexford]
ExamplefromSwitch4’sViewpoint
Switch4thinksitistheroot• sends(4, 4, 0)rootmessageto2and7
Then,switch4hearsfromswitch2• receives(2, 2, 0)rootmessagefrom2• andthinksthatswitch2istheroot• atdistanceonehopaway
Then,switch4hearsfromswitch7• receives(7, 2, 1)from7• realizesthatthisisalongerpath• so,prefersitsown1-hoppath(onrootport)• andremoves4-7linkfromthetree
1
2
3
4
5
67
[afterRexford]
Switch2hearsaboutswitch1• switch2hears(3, 1, 1)from3• switch2startstreating1asroot• andsends(2, 1, 2)toneighbors
Switch4hearsfromswitch2• switch4startstreating1asroot• andsends(4, 1, 3)toneighbors
Switch4hearsfromswitch7• switch4receives(7, 1, 3)from7• andrealizesthatthisisalongerpath• prefersitsown3-hoppath(onrootport)• andremoves4-7Iinkfromthetree
ExamplefromSwitch4’sViewpoint
1
2
3
4
5
67
[afterRexford]
RobustSpanning-TreeAlgorithm
Algorithmmustreacttofailures• failureoftherootnode• needtoelectanewroot,withthenextlowestidentifier
• failureofotherswitchesandlinks• needtore-computethespanningtree
Rootswitchcontinuestosendrootmessages• periodicallyre-announcesitselfastheroot(1, 1, 0)• otherswitchescontinuetoforwardrootmessages
Detectfailuresthroughtimeout(softstate)• aswitchwaitstohearfromothers• eventuallytimesoutandclaimstobetheroot,and
restartsthedistributedalgorithmalloveragain
[afterRexford]
ForwardingonSpanningTreeSummaryofdistributedspanningtreecomputation:• switchwithlowestIDbecomesrootoftree
• allswitches(exceptroot)determinerootport(porttoroot)
• thespanningtreeconsistsofswitchesandroot-portlinks
• designated-portlinksconnectdesignatedswitchestoLANs
Forwardingonthetree:
• forwardframesonlyonroot-portanddesignated-portlinks
• treedoesnotprovideshortestpath,e.g.,AtoCdoesnotgothroughB3
Peterson&Davie
AdvantagesofSwitchesoverHubs/Repeaters
Onlyforwardsframesasneeded• filtersframestoavoidunnecessaryloadonsegments
• sendsframesonlytosegmentsthatneedtoseethem
Extendsthegeographicspanofthenetwork• separatesegmentsallowlongerdistances
Improvesprivacybylimitingscopeofframes• hostscan“snoop”onlythetraffictraversingtheirsegment
Canjoinsegmentsusingdifferenttechnologies
[afterRexford]
DisadvantagesofSwitchesoverHubs/RepeatersDelayinforwardingframes• bridge/switchmustreceiveandparsetheframe
• andperformalook-uptodecidewheretoforward
• storingandforwardingthepacketintroducesdelay
• solution:cut-throughswitching
Needtolearnwheretoforwardframes• bridge/switchneedstoconstructaforwardingtable
• ideally,withoutinterventionfromnetworkadministrators
• solution:self-learning
Highercost• morecomplicateddevicescostmoremoney
[afterRexford]
Switchesvs.Routers
Bothstore-and-forwarddevices
Givenbridges/switches,whydowestillneedrouters?
• routersarenetworklayerdevices(whatdoesthismean?)
• routersmaintainroutingtables,implementroutingalgorithms
• switchesarelinklayerdevices
• switchesmaintainswitchtables,implementfiltering,backwardlearningalgorithms
Switch
Segmentvs.Subnet
Acommonlyuseddifferentiator:
• segment:alayer-2collisiondomain
• subnet:alayer-3broadcastdomain
Asubnetmaycontainmultiplesegments
Asegmentmaycontainmultiplesubnets(notrecommended)
“Segment”isalsooftenusedtosimplymean“partofanetwork”notalwaysaccordingtoaprecisetechnicaldefinition
MovingFromSwitchestoRouters
Advantagesofswitchesoverrouters• plug-and-play• fastfilteringandforwardingofframes
Disadvantagesofswitchesoverrouters• topologyisrestrictedtoaspanningtree• largenetworksrequirelargeARPtables
• broadcaststormscancausenetworkcollapse
[afterRexford]
ComparingHubs,Switches,Routers
Hub/Repeater
Bridge/Switch
Router
Trafficisolation ✗ ✔ ✔
PlugandPlay ✔ ✔ ✗
Efficientrouting ✗ ✗ ✔
Cutthrough ✔ ✔ ✗
[afterRexford]
EvolutionTowardVirtualLANs
WhenbeingpartofaLANmeanstappingintoacablethatpasses
throughone’soffice• peopleinadjacentofficeswereputonthesameLAN
• regardlessoftheirfunctionalrole
Withhubsandswitchessittingincentralwiringclosets,oftenwith
multipleLANs(khubs)connectedbyswitches• adjacentofficescanbe
mappedtodifferentLANs
[afterRexford]
hubhub
switch
wiringcloset
WhyGroupbyOrganizationalStructure?Security• Ethernetisasharedmedia
• anyinterfacecardcanbeputinto“promiscuous”mode
• andgetacopyofallofthetraffic(e.g.,midtermexam)
• so,isolatingtrafficonseparateLANsimprovessecurity
Load• someLANsegmentsaremoreheavilyusedthanothers• e.g.,researchersrunningexperimentsthatgetoutofhandcansaturatetheirownsegmentandnottheothers
• plus,theremaybenaturallocalityofcommunication• e.g.,trafficbetweenpeopleinthesameresearchgroup
[afterRexford]
LANReconfiguration
Organizationalchangesarefrequent• administrativeofficebecomesamarketingoffice
• technicalsupportpersonnelbecomesanadministrativepersonnel
• aspeoplechangerole,theirmachinesmovefromoneLANto
another
Physicalrewiringisamajorpain• requiresunpluggingthecablefromoneport
• andpluggingitintoanother• andhopingthecableislongenoughtoreach• andhopingyoudon’tmakeamistake
Wouldliketo“rewire”thebuildinginsoftware• theresultingconceptisaVirtualLAN(VLAN)
[afterRexford]
VLANsImplementationsAddconfigurationtablesatbridges/switches• sayingwhichVLANsareaccessibleviawhichinterfaces
ApproachestoVLANmapping:• giveeachinterfaceaVLAN“color”• onlyworksifallhostsonthesamesegmentbelongtothesameVLAN
• giveeachMACaddressaVLAN“color”• usefulwhenhostsonthesamesegmentbelongtodifferentVLANs• usefulwhenhostsmovefromonephysicallocationtoanother
ChangeEthernetheader• addafieldforVLANtag
• recognizedbybridges/switchesonly• ignoredbyoldEthernetcards
[afterRexford]
Example:TwoVirtualLANs
RedVLANandOrangeVLANSwitchesforwardtrafficasneeded
R
O
RO
R
R
R
OOOR OR R R
O
O
O
[Rexford]
RedVLANandOrangeVLANBridgesforwardtrafficasneeded
RRO RO
ORO
Example:TwoVirtualLANs
[Rexford]
EthernetSwitches
Independent• followtheirownrules
• determinetheirownforwardingpath
• responsibleforVLANandotherservices
• communicatetopologyinformationwiththeirpeers
Onceaperson/hostgetsonanEthernet
network,itcandoanything
Whatifwewanttohavefinercontrolofwhata
host/personcandoonaLAN?
Ethane:aPrototypeSoftware-DefinedNetwork(SDN)
CentralizedNetworkControl• networkrulesenforcedbynetworkcontroller
• controllermonitorsandapprovesalltraffic• allowsforcompletepolicy-basedcontrolofthenetwork
• accesscontrolsbuiltin• networkunderstandsusers,hardware,topology,andpolicies
• controllerresponsiblefordamage-routing
[C+5]
FlowSetupProcess1. UserAtriestoconnecttoUserB
2. UserAtoUserBflowisn’tinSwitch1’sflowtable,
sothepacketisforwardedtotheController
3. Controllereitherapprovesordeniesroute
4. Ifapproved,Switch1andSwitch2establishaflowfromUserAtoUserB
[C+5]
Ethane’sAssumptions
Policydeterminespacketflow
Networkshouldmaintainastrong
connectionbetweenusersandtraffic
Bakesecurityintonetworkpolicy
Policyshouldbesimpletoimplement
Incrementaldeployability• shouldworkwithEthernet
EthanePolicyConfiguration
TheconfigurationlanguageforEthane:
• compiledintocontroller
• individualrulesareANDedofsimplestatements
• allowsforuser-basedrules
• rulesprioritydetermined
byorderinfile
• veryhuman-readable
[C+5]
Dependentoncontroller• requiresconnectiontocontrollertoroutenewtraffic
• communicateswithcontrolleroverasecurechannel
Simple• minimalon-boardlogic• “flow”tablelookuponly• onlystoresactiveflows• nounderstandingofnetworktopology• noNATknowledge• noVLANsupport
SDNSwitchesFlowTableEntry �
Type0OpenFlowSwitch
Switchport
MACsrc
MACdst
Ethtype
VLANID
IPsrc
IPdst
IPprot
TCPsport
TCPdport
Rule Action Stats
1. Forwardpackettoport(s)2. Encapsulateandforwardtocontroller3. Droppacket4. Sendtonormalprocessingpipeline
+mask
Packet+bytecounters
TheNetworkController
SwitchesreportnetworktopologytoNetworkController(NC)• NCusesthistocreateflowrules
Controlsallroutesbetweenhosts• allowsforprioritization
• NChandlescongestion• canrestrictclientmovement
HandlesAuthentication• users,devices,switches• understandswhereauserisphysicallyconnectedtothenetwork
TheNetworkController
Informedoflinkfailuresandupdatesflowrules
Cancutoffmisbehavinghostsattheswitch,
completelydenyingnetworkaccess
Supportsresourcelimitsonclients
Handlesbroadcastrequests
Allowsforverydetailednetworkusagelogs• usefulforfailurepost-mortems
• presentssomethingofaprivacyrisk [C+5]
SDNnotLimitedtoLANB4:Google’sWAN
• connectsafewdozenWANdatacenters
• hasbeenindeploymentsinceJuly2010• mosttrafficcarried:synchronizinglargedatasets
• usesSDNandOpenFlowtoimplementTrafficEngineering
• controlofedgesitesandapplications:• re-routetraffictolesscongestedpath
• schedulebackuptraffictoquiettime