Model Solutions for Midterm II, 11/05/05. Problem 1: look at your notes. Problem 2. TCPdump. 11:46:36.901599 0:2:b3:d3:d4:86 0:2:b3:cd:cd:c9 0800 74: 10.14.0.1.38463 > 63.111.66.12.80: S [tcp sum ok] 2363626268:2363626268(0) win 5840 (DF) (ttl 64, id 17277, len 60) 2A. Explain all fields. 11:46:36.901599 TCPdump timestamp, hours:minutes:seconds.microseconds. This is the time the interface where TCPdump runs sees the packet. 0:2:b3:d3:d4:86 ethernet (physical) source address. 0:2:b3:cd:cd:c9 ethernet (physical) destination address. Note: while in the frame the destination address comes first, in the TCPdump listing the source address comes first. 0800 ethertype, or frametype. 0800 indicates that there is an IPv4 packet inside the ethernet frame. 74 frame size. Size of the ethernet frame, excluding preamble and CRC. 10.14.0.1.38463 Source IP address and portnumber. 63.111.66.12.80 Destination IP address and portnumber. Port 80 indicates this is an http (or www) packet. S The Syn flag is set in this packet. (So it must be a TCP packet!) [tcp sum ok] The TCP checksum has been checked and is OK. 2363626268:2363626268(0) Initial Sequence Number. There is no TCP data. win 5840 An advertised window. ``You can send me up to 5840 databytes before I acknowledge anything''. Now the TCP options start. mss 1460 ``my MSS is 1460 Bytes''. sackOK ``I understand SACK, if you also understand SACK, let's use SACK''. timestamp 126701665 0 ``I understand TCP timestamps. If you also understand TCP timestamps, let's use them. MY TS value is 126701665 and since this is an original SYN the TS echo is zero.'' wscale 0 ``I understand Window scaling. If you also understand window scaling, let's use window scaling. BTW, I will use a window scale factor of zero.'' DF (Now we see things about the IP Hdr) The do not fragment bit is set. ttl 64 The Time to Live is 64. id 17277 the identity is 17277. len 60 the total length of the IP packet is 60 Bytes. (W already knew that: the frame length was 74, and 74 - 14 = 60) 14 = 6 + 6 + 2. 2B This was an ``original SYN''. There are at least three ways to see this: i. There is no acknowledgement number. ii. The TS echo value is zero. iii. This is an packet to port 80. (As far as i know) in www traffic the client always is the initiator. (Not entirely sure, though: what if server initiates an advertisement?) 3. As part of a tcpdump output we obtained the following: 11:46:36.901599 0:2:b3:d3:d4:86 0:2:b3:cd:cd:c9 0800 74: 10.14.0.1.38463 > 63.111.66.12.80: S [tcp sum ok] 2363626268:2363626268(0) win 5840 (DF) (ttl 64, id 17277, len 60) 4500 003c 437d 4000 4006 6bb5 0a0e 0001 3f6f 420c 963f 0050 8ce2 131c 0000 0000 a002 16d0 1731 0000 0204 05b4 0402 080a 078d 5061 0000 0000 0103 0300 11:46:36.905182 0:2:b3:cd:cd:c9 0:2:b3:d3:d4:86 0800 62: 63.111.66.12.80 > 10.14.0.1.38463: S [tcp sum ok] 498819721:498819721(0) ack 2363626269 win 1380 (ttl 58, id 61490, len 48) 4500 0030 f032 0000 3a06 050c 3f6f 420c 0a0e 0001 0050 963f 1dbb 6289 8ce2 131d 7012 0564 3b9e 0000 0204 0564 0101 0402 3A. Which of the two senders ``understands'' windowscaling? The first of the two packets has the window scaling option, so the sender of that packet understands window scaling. The second packet is the corresponding SYN_ACK and does not have the WS option, while the original SYN had the WS option. So the responder does not understand window scaling. NB. If the first one had not had the WS option, the reponse would not have had it either, whether the responder understands window scaling or not. 3B. Explain how you derive from this output the Kind (or Type) and Length of the TCP MSS option. Since in both packets the MSS option is listed first, we tentatively assume that in both the first option is the MSS option. Since the IP headers start with 45 we know that neither IP header has options. Counting to 10 we see that in the first packet TCP options start with 0204 05b4 and in the second packet the TCP options start with 0204 0564 . This makes us suspect that the MSS option has Type 02 and Length 04. Double checking: 05b4(hex) is indeed 1460(dec), and 0564(hex) is indeed 1380(dec). If you did not do the last check I did not deduct points. (But you should have checked). 4. A large file of weather data will be ftp-ed from the supercomputer center in San Diego to the supercomputer center in Pittsburgh. The file size is 640 GBytes. The RTT is 100 msec. Internet II has promised that 600 Mbit/sec will be available for the transfer. For some reason the system administration people want to send this data in 1 FTP (sequentially, i.e, not in parallel in several ftp flows). In your computations you can disregard overhead in header bytes etc. 4A What window scale factor is needed? We want to be able to utilize all datarate that Internet II makes available. With a WS factor k we can reach a thput of ((2^k)*65535)/RTT Bytes/sec = (2^k)*655350 Bytes/sec. This must be at least 600 Mbits/sec = 75 MBytes/sec. So we want (2^k) .GEQ. 75,000,000/(655350) = 114.44 . Since k must be integer, we need k .GEQ. 7. I would choose k=7 . NOTE: The file size does not enter this computation! Only the rate at which you can/want to send enters this computation. 4B What size send_buff do we need in San Diego? To reach a speed of 75,000,000 Bytes/sec we need an Effective Window Eff_Win with EFF_Win/RTT = 75000000 (Bytes). I.e. Eff_WIN = 75,000,000 * .100 = 7,500,000 Bytes = 7.5 MBytes. The send_buff must be at least the maximal Eff_Win, so the send_buff must be at least 7.5 MBytes. 4C Also the rcve_buff must be at least 7.5 MBytes. Note: one student said we need at least (2^7)*65535 = 8,388,480 Bytes. That is not correct: the destination need not put the number 65535 into the WIN field! If the destinatioin knows an Eff_Win of 7.5 MBytes is desired, and knows the WSFactor is 7, it might very well ``always'' put 7,500,000/128 = 58594 in the WIN field of acknowledgements it sends out. And of course make sure it has a rcve_buff of a bit larger than 58594*128 = 7,500,032 Bytes. Say 8,000,000 Bytes, or even a bit more. 4D How long will the transfer take (if there are no problems)? The best we should hope for is to reach the limit of what Internet II promised: 75,000,000 Bytes/sec. If that happens it takes (640,000,000,000)/(75,000,000) = 640,000/75 = 8533.33 sec = 142.22 min = 2.37 hours. 4E If the system administrators had used the default window scale facter, how long would the transfer have taken? If no Window Scaling were in use, the highest possible thput would be 65535/RTT = 655350 Bytes/sec. A 640 GByte file then would take 640,000,000,000/655350 = 976,577.40 sec = 16,276.29 min = 271.27 hours = 11.30 days. 5. The list of allocated IPv4 multicast addresses in the IANA database contains the line 224.0.1.75 SIP [Schulzrinne] What is the physical destination address of an ethernet frame carrying a SIP multicast packet? We know that packet has an ethernet dest address that starts with 01:00:5E, and that the 25-th bit is zero. We also know that the last 48 - 25 = 23 bits are the same as the last 23 bits in the IP address 224.0.1.75, i.e. the last 25 bits from 1110 0000 : 0000 0000 : 0000 0001 : 0100 1011 Hence the ethernet destination address in question is (75(dec) = 4B(hex)): 01:00:5e:00:01:4B , or 0000 0001 : 0000 0000 : 0101 1101 : 0000 0000 : 0000 0001 : 0100 1011 (The first 25 bits of 01:00:5E:00:00:00 , then the last 23 bits of 224.0.1.75). 6. A network has address 128.235.64.0/20 . For each of the following addresses, tell whether it can be: Address of interface on the network / source address of packet in the network / destination address of packet in ther network. With a BRIEF but convincing explanation. a. 128.235.64.0 /n/n/n this is the network address b. 128.235.64.1 /y/y/y this is an address in the space, nothing special (the lowest legal interface address in this network) c. 128.135.63.255 /n/y/y This is a possible address in a different netw (It COULD also be a direct broadcast address to a different network, with mask length .GEQ. 18. In case of ignorance we assume it is legal.) d. 10.0.1.2 /n/n/n adress in private address space. e. 128.235.79.254 /y/y/y (the highest legal interface address in this netw) f. 0.0.0.0 /n/y/n the ``I am stupid'' address. ``THIS node on THIS network''. g. 128.235.79.255 /n/n/y The direct broadcast address. h. 224.0.0.1 /n/n/y A multicast address. i. 127.234.63.1 /n/n/n A loopback address. j. 255.255.255.255 /n/n/y The limited Broadcast address. I was deeply disappointed that not all students had a perfect score on this last question! A similar question will be on the final.