A4 - Where Does This Datagram Go?

Week 7 · 20 points · pass/fail · one paper worksheet per group, turned in before you leave

Why you are doing this

Chapter 4 boils down to one question a router answers for every packet it sees: which way does this one go? Today you ask Onyx that question directly. Onyx is a host, not a router, but it has a forwarding table and it does the same longest prefix match a router does, so you can watch the data plane work from a prompt.

Along the way you find Onyx's subnet in binary, see why one datagram fits on the wire and a datagram one byte bigger does not, and count the routers between Boise and Salt Lake City using nothing but the TTL field.

This one is instructor led, like A2. I do each step on the projector, you run the same command on Onyx, and we do not move on until the room has caught up. It takes about 40 minutes.

WARNING

One paper worksheet per group, turned in before you leave. Graded pass/fail, and every round attempted in good faith is a pass. A wrong prediction costs you nothing, but write it down before we run the command.

Before you start

• Groups of 3 or 4. One scribe owns the worksheet and puts everyone's name on it.
• Everyone logs into Onyx with ssh onyx, the shortcut you set up in A2. If yours still asks for a password, share a screen with someone whose does not, and finish A2 steps 1 to 3 after class.
• Everything today runs on Onyx, so it is the same for every laptop in the room.

How every round works

Each round is the same three beats, and the worksheet has a box for each:

1. Predict. I ask the question. Your group writes an answer.
2. Run. We all run the command on Onyx.
3. Check. Was the prediction right? Which part of chapter 4 says why?

Round 1 - Onyx's address

Log in and ask Onyx for its IPv4 addresses:

ssh onyx
ip -4 -br addr

You should see results similar to what is shown below.

lo               UNKNOWN        127.0.0.1/8
eno12399np0      UP             132.178.227.11/25

Predict: how many addresses are in Onyx's subnet, and how many of them can be given to hosts?

Check: work it out in binary on the worksheet. A /25 means the first 25 bits are the network and the last 7 identify the interface. Write the last octet of 132.178.227.11 in binary, draw the line after the first bit, and find the network address, the broadcast address, the usable range, and the host count. Then answer two more: is 132.178.227.200 on Onyx's subnet, and is Onyx's address a private (RFC 1918) address? (section 4.3)

Round 2 - Longest prefix match

Now look at the forwarding table:

ip route

default via 132.178.227.1 dev eno12399np0 proto static metric 100
132.178.227.0/25 dev eno12399np0 proto kernel scope link src 132.178.227.11 metric 100

Two lines. default is 0.0.0.0/0, the prefix that matches everything, and it sends packets to the gateway 132.178.227.1. The second line is Onyx's own subnet, delivered directly on the link with no gateway.

Predict: for each of these four destinations, which line matches, and does the packet go straight to the destination or through the gateway?

Destination	Matching line	Direct or gateway
132.178.227.50
132.178.227.200
8.8.8.8
127.0.0.1

Then ask the kernel to do the lookup for each one:

ip route get 132.178.227.50
ip route get 132.178.227.200
ip route get 8.8.8.8
ip route get 127.0.0.1

132.178.227.50 dev eno12399np0 src 132.178.227.11 uid 26544
132.178.227.200 via 132.178.227.1 dev eno12399np0 src 132.178.227.11 uid 26544
8.8.8.8 via 132.178.227.1 dev eno12399np0 src 132.178.227.11 uid 26544
local 127.0.0.1 dev lo src 127.0.0.1 uid 26544

via means the next hop is the gateway. No via means the destination is on the link and gets the packet directly.

Check: 132.178.227.50 matches both lines, since everything matches the default route. Why does it not go to the gateway? And 127.0.0.1 is not in the table at all, so where did that answer come from? Try ip route show table local to find out. This is exactly the lookup you will write in P3.

Round 3 - How big can a datagram be?

Every link has a largest datagram it will carry, its MTU:

ip link show eno12399np0

Look for mtu 1500 in the first line of the output.

Predict: ping -s sets the size of the ping's payload. What is the biggest payload that still fits in one 1,500 byte IPv4 datagram?

Then try one size on each side of your guess. -M do sets the don't fragment flag, so nothing gets quietly split into pieces:

ping -c 1 -M do -s 1472 132.178.227.1
ping -c 1 -M do -s 1473 132.178.227.1

PING 132.178.227.1 (132.178.227.1) 1472(1500) bytes of data.
1480 bytes from 132.178.227.1: icmp_seq=1 ttl=254 time=0.654 ms

PING 132.178.227.1 (132.178.227.1) 1473(1501) bytes of data.
ping: local error: message too long, mtu=1500

Check: where do the other 28 bytes go? (Two headers, one from each of two layers.) Did the message too long error come from the network or from Onyx itself? Without -M do, who would split the datagram, and who would put it back together? (section 4.3, fragmentation)

Round 4 - Counting routers with TTL

Every IPv4 datagram carries a TTL that each router decrements by one, and a router that decrements it to zero drops the datagram and sends back an ICMP message saying so. tracepath uses that to find the routers on the path.

Predict: how many routers are between Onyx and a server in Salt Lake City, about 475 km away?

tracepath -n mirrors.xmission.com

 1?: [LOCALHOST]                      pmtu 1500
 1:  132.178.227.1                                         0.651ms asymm  2
 1:  132.178.227.1                                         0.357ms asymm  2
 2:  no reply
 3:  132.178.1.147                                         1.238ms
 4:  132.178.1.98                                          1.301ms
 5:  209.249.232.13                                        1.911ms
 6:  no reply
 7:  no reply
 8:  no reply
 9:  no reply
10:  4.69.220.109                                         28.173ms asymm  9
11:  4.35.168.186                                         50.639ms asymm 16
12:  166.70.1.2                                           50.208ms asymm 18
13:  198.60.22.13                                         50.360ms reached
     Resume: pmtu 1500 hops 13 back 19

Check: explain in two sentences how tracepath learned the address of hop 3. Several hops say no reply, and yet the trace still reached the end. What does that tell you about those routers? And where have you seen pmtu 1500 before?

Exit question

A traditional router forwards on the destination address and nothing else. Name one other header field that a middlebox somewhere on that path to Salt Lake City could match on, and what it might do with a match. (sections 4.4 and 4.5)

Worksheet

Download: a4-worksheet.pdf

The printed worksheet is one page: a box per round for the prediction, the result, and the check questions, plus the exit question.