Ipv6 Extension Headers Review and Considerations
Total Page:16
File Type:pdf, Size:1020Kb
Load more
Recommended publications
-
Lesson 1 Key-Terms Meanings: Internet Connectivity Principles
Lesson 1 Key-Terms Meanings: Internet Connectivity Principles Chapter-4 L01: "Internet of Things " , Raj Kamal, 2017 1 Publs.: McGraw-Hill Education Header Words • Header words are placed as per the actions required at succeeding stages during communication from Application layer • Each header word at a layer consists of one or more header fields • The header fields specify the actions as per the protocol used Chapter-4 L01: "Internet of Things " , Raj Kamal, 2017 2 Publs.: McGraw-Hill Education Header fields • Fields specify a set of parameters encoded in a header • Parameters and their encoding as per the protocol used at that layer • For example, fourth word header field for 32-bit Source IP address in network layer using IP Chapter-4 L01: "Internet of Things " , Raj Kamal, 2017 3 Publs.: McGraw-Hill Education Protocol Header Field Example • Header field means bits in a header word placed at appropriate bit place, for example, place between bit 0 and bit 31 when a word has 32-bits. • First word fields b31-b16 for IP packet length in bytes, b15-b4 Service type and precedence and b3-b0 for IP version • Chapter-4 L01: "Internet of Things " , Raj Kamal, 2017 4 Publs.: McGraw-Hill Education IP Header • Header fields consist of parameters and their encodings which are as per the IP protocol • An internet layer protocol at a source or destination in TCP/IP suite of protocols Chapter-4 L01: "Internet of Things " , Raj Kamal, 2017 5 Publs.: McGraw-Hill Education TCP Header • Header fields consist of parameters and their encoding which are as -
Ipv6 Security: Myths & Legends
IPv6 security: myths & legends Paul Ebersman – [email protected] 21 Apr 2015 NANOG on the Road – Boston So many new security issues with IPv6! Or are there… IPv6 Security issues • Same problem, different name • A few myths & misconceptions • Actual new issues • FUD (Fear Uncertainty & Doubt) Round up the usual suspects! Remember these? • ARP cache poisoning • P2p ping pong attacks • Rogue DHCP ARP cache poisoning • Bad guy broadcasts fake ARP • Hosts on subnet put bad entry in ARP Cache • Result: MiM or DOS Ping pong attack • P2P link with subnet > /31 • Bad buy sends packet for addr in subnet but not one of two routers • Result: Link clogs with routers sending packet back and forth Rogue DHCP • Client broadcasts DHCP request • Bad guy sends DHCP offer w/his “bad” router as default GW • Client now sends all traffic to bad GW • Result: MiM or DOS Look similar? • Neighbor cache corruption • P2p ping pong attacks • Rogue DHCP + rogue RA Solutions? • Lock down local wire • /127s for p2p links (RFC 6164) • RA Guard (RFC 6105) And now for something completely different! So what is new? • Extension header chains • Packet/Header fragmentation • Predictable fragment headers • Atomic fragments The IPv4 Packet 14 The IPv6 Packet 15 Fragmentation • Minimum 1280 bytes • Only source host can fragment • Destination must get all fragments • What happens if someone plays with fragments? IPv6 Extension Header Chains • No limit on length • Deep packet inspection bogs down • Confuses stateless firewalls • Fragments a problem • draft-ietf-6man-oversized-header-chain-09 -
Packet Processing at Wire Speed Using Network Processors
Packet processing at wire speed using Network processors Chethan Kumar and Hao Che University of Texas at Arlington {ckumar, hche}@cse.uta.edu Abstract 1 Introduction Recent developments in fiber optics and the new The modern day Internet has seen an explosive bandwidth hungry applications have put more stress growth of applications being used on it. As more and on the active components (switches, routers etc.,) of a more applications are being developed, there is an network. Optical fiber bandwidth is no longer a increase in the amount of load put on the internet. At constraint for increasing the network bandwidth. the same time the fiber optics bandwidth has However, the processing power of the network has not increased dramatically to meet the traffic demand, but scaled upto the increase in the fiber bandwidth. the present day routers have limited processing power Communication industry is looking forward for more to handle this profound demand increase. Hence the innovative ways of designing router1 architecture and networking and telecommunications industry is research is being conducted to develop a scalable, compelled to look for new solutions for improving flexible and cost-effective architecture for routers. A the performance and the processing power of the successful outcome of this effort is a specialized routers. processor called Network processor. Network processor provides performance at hardware speeds One of the industry’s solutions to the challenges while attaining the flexibility of software. Network posed by the increased demand for the processing processors from different vendors employ different power is programmable functional units grouped into architectures and the choice of a particular type of a processor called Application Specific Instruction network processor can affect the architecture of the Processor (ASIP) or Network processor (NP)2. -
Usenet News HOWTO
Usenet News HOWTO Shuvam Misra (usenet at starcomsoftware dot com) Revision History Revision 2.1 2002−08−20 Revised by: sm New sections on Security and Software History, lots of other small additions and cleanup Revision 2.0 2002−07−30 Revised by: sm Rewritten by new authors at Starcom Software Revision 1.4 1995−11−29 Revised by: vs Original document; authored by Vince Skahan. Usenet News HOWTO Table of Contents 1. What is the Usenet?........................................................................................................................................1 1.1. Discussion groups.............................................................................................................................1 1.2. How it works, loosely speaking........................................................................................................1 1.3. About sizes, volumes, and so on.......................................................................................................2 2. Principles of Operation...................................................................................................................................4 2.1. Newsgroups and articles...................................................................................................................4 2.2. Of readers and servers.......................................................................................................................6 2.3. Newsfeeds.........................................................................................................................................6 -
Cisco Unified Border Element H.323-To-SIP Internetworking Configuration Guide, Cisco IOS Release 12.4T Iii
Cisco Unified Border Element H.323-to- SIP Internetworking Configuration Guide, Cisco IOS Release 12.4T Americas Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA 95134-1706 USA http://www.cisco.com Tel: 408 526-4000 800 553-NETS (6387) Fax: 408 527-0883 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. -
Packet Processing Execution Engine (PROX) - Performance Characterization for NFVI User Guide
USER GUIDE Intel Corporation Packet pROcessing eXecution Engine (PROX) - Performance Characterization for NFVI User Guide Authors 1 Introduction Yury Kylulin Properly designed Network Functions Virtualization Infrastructure (NFVI) environments deliver high packet processing rates, which are also a required dependency for Luc Provoost onboarded network functions. NFVI testing methodology typically includes both Petar Torre functionality testing and performance characterization testing, to ensure that NFVI both exposes the correct APIs and is capable of packet processing. This document describes how to use open source software tools to automate peak traffic (also called saturation) throughput testing to characterize the performance of a containerized NFVI system. The text and examples in this document are intended for architects and testing engineers for Communications Service Providers (CSPs) and their vendors. This document describes tools used during development to evaluate whether or not a containerized NFVI can perform the required rates of packet processing within set packet drop rates and latency percentiles. This document is part of the Network Transformation Experience Kit, which is available at https://networkbuilders.intel.com/network-technologies/network-transformation-exp- kits. 1 User Guide | Packet pROcessing eXecution Engine (PROX) - Performance Characterization for NFVI Table of Contents 1 Introduction ................................................................................................................................................................................................................ -
Structure of IEEE 802.11 Packets at Various Physical Layers
Appendix A: Structure of IEEE 802.11 Packets at Various Physical Layers This appendix gives a detailed description of the structure of packets in IEEE 802.11 for the different physical layers. 1. Packet Format of Frequency Hopping Spread-spectrum Physical Layer (FHSS PHY) The packet is made up of the following elements (Figure A.1): 1.1 Preamble It depends on the physical layer and includes: – Synch: a sequence of 80 bits alterning 0 and 1, used by the physical circuits to select the correct antenna (if more than one are in use), and correct offsets of frequency and synchronization. – SFD: start frame delimiter consists of a pattern of 16 bits: 0000 1100 1011 1101, used to define the beginning of the frame. 1.2 Physical Layer Convergence Protocol Header The Physical Layer Convergence Protocol (PLCP) header is always transmitted at 1 Mbps and carries some logical information used by the physical layer to decode the frame: – Length of word of PLCP PDU (PLW): representing the number of bytes in the packet, useful to the physical layer to detect correctly the end of the packet. – Flag of signalization PLCP (PSF): indicating the supported rate going from 1 to 4.5 Mbps with steps of 0.5 Mbps. Even though the standard gives the combinations of bits for PSF (see Table A.1) to support eight different rates, only the modulations for 1 and 2 Mbps have been defined. – Control error field (HEC): CRC field for error detection of 16 bits (or 32 bits). The polynomial generator used is G(x)=x16 + x12 + x5 +1. -
Guidelines for the Secure Deployment of Ipv6
Special Publication 800-119 Guidelines for the Secure Deployment of IPv6 Recommendations of the National Institute of Standards and Technology Sheila Frankel Richard Graveman John Pearce Mark Rooks NIST Special Publication 800-119 Guidelines for the Secure Deployment of IPv6 Recommendations of the National Institute of Standards and Technology Sheila Frankel Richard Graveman John Pearce Mark Rooks C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 December 2010 U.S. Department of Commerce Gary Locke, Secretary National Institute of Standards and Technology Dr. Patrick D. Gallagher, Director GUIDELINES FOR THE SECURE DEPLOYMENT OF IPV6 Reports on Computer Systems Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analysis to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security and its collaborative activities with industry, government, and academic organizations. National Institute of Standards and Technology Special Publication 800-119 Natl. Inst. Stand. Technol. Spec. Publ. 800-119, 188 pages (Dec. 2010) Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. -
Wireless Real-Time IP Services Enabled by Header Compression
Wireless Real-time IP Services Enabled by Header Compression Krister Svanbrof, Hans Hannu f, Lars-Erik Jonsson f, Mikael Degermarkf f Ericsson Research f Dept. of CS & EE Ericsson Erisoft AB Lulei University of Technology Box 920, SE-971 28 Lulei, Sweden SE-971 87 Lulei, Sweden Abstract - The world of telecommunications is currently A major problem with voice over IP over wireless is the going through a shift of paradigm from circuit switched, large headers of the protocols used when sending speech connection oriented information transfer towards packet data over the Internet. An IPv4 packet with speech data switched, connection-less transfer. For application will have an IP header, a UDP header, and an RTP header independence and to decrease costs for transport and making a total of 20+8+12=40 octets. With IPv6, the IP switching it is attractive to go IP all the way over the air header is 40 octets for a total of 60 octets. The size of the ' interface to the end user equipment, i.e., to not terminate speech data depends on the codec, it can be 15-30 octets. the IP protocols before the air interface. A major reason to These numbers present a major reason for terminating the avoid using voice over IP over the air interface has, up to IP protocols before the air interface: the IP/UDP/RTP now, been the relatively large overhead imposed by the headers require a higher bit rate and would cause IP/UDP/RTP headers of voice packets. This paper presents inefficient use of the expensive radio spectrum. -
Lightweight Internet Protocol Stack Ideal Choice for High-Performance HFT and Telecom Packet Processing Applications Lightweight Internet Protocol Stack
GE Intelligent Platforms Lightweight Internet Protocol Stack Ideal Choice for High-Performance HFT and Telecom Packet Processing Applications Lightweight Internet Protocol Stack Introduction The number of devices connected to IP networks will be nearly three times as high as the global population in 2016. There will be nearly three networked devices per capita in 2016, up from over one networked device per capita in 2011. Driven in part by the increase in devices and the capabilities of those devices, IP traffic per capita will reach 15 gigabytes per capita in 2016, up from 4 gigabytes per capita in 2011 (Cisco VNI). Figure 1 shows the anticipated growth in IP traffic and networked devices. The IP traffic is increasing globally at the breath-taking pace. The rate at which these IP data packets needs to be processed to ensure not only their routing, security and delivery in the core of the network but also the identification and extraction of payload content for various end-user applications such as high frequency trading (HFT), has also increased. In order to support the demand of high-performance IP packet processing, users and developers are increasingly moving to a novel approach of combining PCI Express packet processing accelerator cards in a standalone network server to create an accelerated network server. The benefits of using such a hardware solu- tion are explained in the GE Intelligent Platforms white paper, Packet Processing in Telecommunications – A Case for the Accelerated Network Server. 80 2016 The number of networked devices -
How the Internet Works: Headers and Data; Packets and Routing 1
Howthe Internet Works: Headers and Data; Packets and Routing 1. Transmitting Information through the Ages Howcan you get information from one place to another? How, for example, can you get an image from one place to another? Two hundred years ago, you would have todraw, paint, or print the image on paper or canvas, then carry, on foot, horseback, boat, or wagon, this analog version of view. One hundred years later,technology had advanced. By the early part of the 20th century,fax machines existed. With fax, you could drawthe image and send it overwires. What newscientific developments made that change possible? Here are a fewmilestones: YEAR WHATWHO WHERE 1800 Invents electric battery Allesandro Volta Italy 1820 Discovers electric current creates magnetism Hans O/rsted Denmark 1837 Invents electric telegraph Samuel Morse USA Before the battery,electricity was available from lightning and by shuffling across rugs on dry days, but that static electricity could not provide a steady,evenflow.Volta’sbattery made it possible to create a steady electrical current. Twenty years later,O/rsted discovered that a steady current of electricity produced a magnetic effect. Later,Morse connected a battery,aswitch, and a coil so that closing the switch at one end of the wire would create magnetism that would attract a piece of metal at the other end of the wire. By closing the switch for short and long durations, he was able to transmit bits a long distance. This system, the electric telegraph, made long-distance, all-weather,pri- vate communication possible. This technology led to the Internet. -
Ipv6, the DNS and Big Packets
IPv6, the DNS and Big Packets Geoff Huston, APNIC The IPv6 Timeline… 2010 1990 2000 2020 The IPv6 Timeline… Yes, we’ve been working on this for close to 30 years! 2010 1990 2000 2020 The IPv6 Timeline… Yes, we’ve been working on this for close to 30 years! 2010 1990 2000 2020 In-situ transition… In-situ transition… Phase 1 – Early Deployment IPv4 Internet Edge Dual -Stack Networks IPv6 networks interconnect by IPv6-over-IPv4 tunnels In-situ transition… Phase 2 – Dual Stack Deployment Transit Dual-Stack Networks Edge Dual-Stack Networks IPv6 networks interconnect by Dual Stack transit paths In-situ transition… Phase 3 – IPv4 Sunset IPv6 Internet Edge Dual Stack Networks IPv4 networks interconnect by IPv4-over-IPv6 tunnels We are currently in Phase 2 of this transition Some 15% - 20% of Internet users have IPv6 capability Most new IP deployments use IPv6+ (NATTED) IPv4 IPv4-only Legacy networks are being (gradually) migrated to dual stack The Map of IPv6 penetration – August 2017 The Map of IPv6 penetration – August 2017 We are currently in Phase 2 of this transition Some 15% of Internet users have IPv6 capability Most new IP deployments use IPv6 IPv4-only Legacy networks are being (gradually) migrated to dual stack Today We appear to be in the middle of the transition! Dual Stack networks use apps that prefer to use a IPv6 connection over an IPv4 connection when both are available (*) This implies that the higher the IPv6 deployment numbers the less the level of use of V4 connection, and the lower the pressure on the NAT binding clients * Couple of problems with this: This preference is often relative, and in the quest for ever faster connections the ante keeps rising – Apple is now pressing for a 50ms differential.