WIXLIB

Ch 6: NetworkingServices: NAT, DHCP, DNS,MulticastingMagda El ZarkiProf. of CSUniv. of CA, IrvineEmail: elzarki@uci.eduhttp: www.ics.uci.edu/ magda

Overivew of NAT NAT: Network Address Translation

Private Network Private IP network is an IP network that is not directlyconnected to the Internet IP addresses in a private network can be assigned arbitrarily. Not registered and not guaranteed to be globally unique Generally, private networks use addresses from the followingexperimental address ranges (non-routable addresses): 10.0.0.0 – 10.255.255.255 172.16.0.0 – 172.31.255.255 192.168.0.0 – 192.168.255.2553

Private AddressesH1H3H210.0.1.2Private network vate network 1

Network Address Translation(NAT) NAT is a router function where IP addresses (andpossibly port numbers) of IP datagrams are replaced atthe boundary of a private network NAT is a method that enables hosts on private networksto communicate with hosts on the Internet NAT is run on routers that connect private networks to thepublic Internet, to replace the IP address-port pair of anIP packet with another IP address-port pair.5

Basic operation of NATPrivatenetworkSourceDestination 10.0.1.2 213.168.112.3SourceDestinationNATdeviceprivate address: 10.0.1.2public address: 128.143.71.21H1InternetSourceDestination 213.168.112.3 10.0.1.2public ss10.0.1.2128.143.71.21 NAT device has address translation table One to one address translation6 128.143.71.21 213.168.112.3213.168.112.3 213.168.112.3 128.143.71.21H5

Pooling of IP addresses Scenario: Corporate network has many hosts but only asmall number of public IP addresses NAT solution: Corporate network is managed with a private address space NAT device, located at the boundary between the corporatenetwork and the public Internet, manages a pool of public IPaddresses When a host from the corporate network sends an IPdatagram to a host in the public Internet, the NAT devicepicks a public IP address from the address pool, and bindsthis address to the private address of the host7

Pooling of IP addressesPrivatenetworkInternetSource 10.0.1.2Destination 213.168.112.3private address:public address:Source 128.143.71.21Destination 213.168.112.3NATdevice10.0.1.2public address: .2Pool of addresses: 128.143.71.0-128.143.71.307

Supporting migration between network serviceproviders Scenario: In CIDR, the IP addresses in a corporate network areobtained from the service provider. Changing the service providerrequires changing all IP addresses in the network. NAT solution: Assign private addresses to the hosts of the corporate network NAT device has static address translation entries which bind theprivate address of a host to the public address. Migration to a new network service provider merely requires anupdate of the NAT device. The migration is not noticeable to thehosts on the network.Note: The difference to the use of NAT with IP address pooling is thatthe mapping of public and private IP addresses is static.9

Supporting migration between network private address:public address: 10.0.1.2 .143.71.21ISP 1allocates address block128.143.71.0/24 to ork10 128.143.71.21 Address10.0.1.2128.143.71.21128.195.4.120 128.195.4.120 213.168.112.3ISP 2allocates address block128.195.4.0/24 to privatenetwork:

IP masquerading Also called: Network address and port translation(NAPT), port address translation (PAT). Scenario: Single public IP address is mapped to multiplehosts in a private network. NAT solution: Assign private addresses to the hosts of the corporatenetwork NAT device modifies the port numbers for outgoing traffic11

IP masqueradingSource 10.0.1.2Source port 2001Source 128.143.71.21Source port 2100private address: 10.0.1.2H1Private networkNATdevice128.143.71.21private address: 10.0.1.3H212Source 10.0.1.3Source port 71.21/4444 128.143.71.21 4444Internet

Load balancing of servers Scenario: Balance the load on a set of identical servers,which are accessible from a single IP address NAT solution: Here, the servers are assigned private addresses NAT device acts as a proxy for requests to the server fromthe public network The NAT device changes the destination IP address ofarriving packets to one of the private addresses for a server A sensible strategy for balancing the load of the servers is toassign the addresses of the servers in a round-robin fashion.13

Load balancing of serversPrivate network10.0.1.2S1SouDes rcetination 12 10 8.195.4.12.0.10.2NATdeviceSourceDestination 128.195.4.120 128.143.71.21SourceDestination 213.168.12.3 .4S314rcenSou tinatiosDe204.195.1.28 1 .0.1.401 Inside networkOutside 21213.168.12.3

Concerns about NAT Performance: Modifying the IP header by changing the IP address requiresthat NAT boxes recalculate the IP header checksum Modifying port number and IP address requires that NATboxes recalculate TCP and UDP checksum (pseudo header) Fragmentation Care must be taken that a datagram that is fragmentedbefore it reaches the NAT device, is not assigned a differentIP address or different port numbers for each of thefragments.15

Concerns about NAT End-to-end connectivity: NAT destroys universal end-to-end reachability of hosts onthe Internet. A host in the public Internet often cannot initiatecommunication to a host in a private network. The problem is worse, when two hosts that are in a privatenetwork need to communicate with each other.16

Concerns about NAT IP address in application data: Applications that carry IP addresses in the payload of theapplication data generally do not work across a privatepublic network boundary. Some NAT devices inspect the payload of widely usedapplication layer protocols and, if an IP address is detectedin the application-layer header or the application payload,translate the address according to the address translationtable.17

Overview of DHCP DHCP – Dynamic Host Control Protocol

Dynamic Assignment of IPaddresses Dynamic assignment of IP addresses is desirable forseveral reasons: IP addresses are assigned on-demand Avoid manual IP configuration Support mobility of laptops19

DHCP Message TypesValueMessage E5DHCPACK6DHCPNAK7DHCPRELEASE8DHCPINFORM20

Message Types DHCPDISCOVER: Broadcast by a client to find available DHCPservers." DHCPOFFER: Response from a server to a DHCPDISCOVER andoffering IP address and other parameters." DHCPREQUEST: Message from a client to servers that does one ofthe following:" Requests the parameters offered by one of the servers anddeclines all other offers." Verifies a previously allocated address after a system or networkchange (a reboot for example)." Requests the extension of a lease on a particular address.21

Contd. DHCPACK: Acknowledgement from server to client with parameters, includingIP address." DHCPNACK: Negative acknowledgement from server to client, indicating thatthe client's lease has expired or that a requested IP address is incorrect." DHCPDECLINE: Message from client to server indicating that the offeredaddress is already in use." DHCPRELEASE: Message from client to server canceling remainder of a leaseand relinquishing network address." DHCPINFORM: Message from a client that already has an IP address(manually configured for example), requesting further configuration parametersfrom the DHCP server.22

Client Server Interactions The client broadcasts a DHCPDISCOVER message on its localphysical subnet. " The DHCPDISCOVER message may include some options suchas network address suggestion or lease duration." Each server may respond with a DHCPOFFER message that includesan available network address (your IP address) and otherconfiguration options." The servers record the address as offered to the client to preventthe same address being offered to other clients in the event offurther DHCPDISCOVER messages being received before the firstclient has completed its configuration.23

DHCP Interaction (simplified)Argon00:a0:24:71:e4:44DHCP ServerDHCP Request00:a0:24:71:e4:44Sent to 44DHCP ServerDHCP Response:IP address: 128.143.137.144Default gateway: 128.143.137.1Netmask: 255.255.0.024

Contd. T\If the client receives one or more DHCPOFFER messagesfrom one or more servers. " The client chooses one based on the configurationparameters offered and broadcasts a DHCPREQUESTmessage that includes the server identifier option to indicatewhich message it has selected and the requested IPaddress option, taken from your IP address in the selectedoffer." In the event that no offers are received, if the client hasknowledge of a previous network address, the client mayreuse that address if its lease is still valid, until the leaseexpires.25

DHCP OperationDHCP Client00:a0:24:71:e4:44DHCP ServerDHCPDISCOVER DCHP DISCOVERSent to 255.255.255.255DHCP ServerDHCP Client00:a0:24:71:e4:44 DCHP OFFERDHCPOFFERDHCP ServerDHCPOFFERDHCP Server26

Contd. The servers receive the DHCPREQUEST broadcast from the client. " Those servers not selected by the DHCPREQUEST message usethe message as notification that the client has declined thatserver's offer. " The server selected in the DHCPREQUEST message commitsthe binding for the client to persistent storage and responds with aDHCPACK message containing the configuration parameters forthe requesting client.27

DHCP OperationDHCP Client00:a0:24:71:e4:44DHCP ServerDHCPREQUEST DCHP REQUESTDHCPACKAt this time, the DHCPclient can start to use the IPaddressDHCP ServerDHCP Client00:a0:24:71:e4:44 Renewing a Lease (sentwhen 50% of lease hasexpired) If DHCP server sendsDHCPNACK, then addressis released when timerexpires28DHCP ServerDHCPREQUESTDHCPACKDHCP Server

Contd. The combination of client hardware and assignednetwork address constitute a unique identifier for theclient's lease and are used by both the client and serverto identify a lease referred to in any DHCP messages. " The your IP address field in the DHCPACK messages isfilled in with the selected network address.29

Contd. The client receives the DHCPACK message with configurationparameters. " The client performs a final check on the parameters, forexample with ARP for allocated network address, and notesthe duration of the lease and the lease identification cookiespecified in the DHCPACK message. At this point, the clientis configured." If the client detects a problem with the parameters in theDHCPACK message (the address is already in use on thenetwork, for example), the client sends a DHCPDECLINEmessage to the server and restarts the configurationprocess.30

Contd. The client should wait a minimum of ten seconds beforerestarting the configuration process to avoid excessive networktraffic in case of looping." On receipt of a DHCPDECLINE, the server must mark theoffered address as unavailable (and possibly inform the systemadministrator that there is a configuration problem)." If the client receives a DHCPNAK message, the client restartsthe configuration process.31

Contd. The client may choose to relinquish its lease on anetwork address by sending a DHCPRELEASE messageto the server." The client identifies the lease to be released by includingits network address and its hardware address."32

DHCP OperationDHCP Client00:a0:24:71:e4:44DHCP ServerDHCPRELEASE DCHP RELEASEAt this time, the DHCPclient has released the IPaddress33DHCP Server

Lease Renewal When a server sends the DHCPACK to a client with IP addressand configuration parameters, it also registers the start of thelease time for that address. This lease time is passed to the client as one of the options inthe DHCPACK message, together with two timer values, T1and T2. The client is rightfully entitled to use the given address for theduration of the lease time.34

Contd. On applying the receive configuration, the client also starts thetimers T1 and T2. At this time, the client is in the BOUND state. Times T1 and T2 are options configurable by the server but T1must be less than T2, and T2 must be less than the lease time. According to RFC 2132, T1 defaults to (0.5 * lease time) andT2 defaults to (0.875 * lease time).35