L11: Other Transports, Nat

RTP - Real-time Transport protocol

• Used to transport voice and video
• Doesn't do anything you can't do yourself with UDP.
• An example of a protocol created for a very specific use case.
• Tradeoffs between latency and quality
• Contains a sequence number and timestamp in each packet (TCP has timestamp but its not available to applications)

Difference with TCP

• No acknowledgements
• Receiver knows when packet was sent, and how many were sent.
• Receiver can can discard late packets and detect duplicates

RTP setup

• RTCP (real time control protocol) used to setup video.
• SIP (session initialization protocol) used to setup voip.
  
  
• Most video streaming now uses traditional TCP with sufficient buffering to deal with variation in latency, plus heavy compression with MPEG.
• MPEG means it doesn't use a constant stream of packets which doesn't work well with RTP as rtp expects a steady stream.

General Lesson

• If you want to make your own protocol you are gonna make something like UDP but with a few extra pieces. If the protocol is too general it will be too complicated, or if it is too specific, no one will want it. So make it work over existing protocols.

Exceptions - Multipath TCP

• Allows multiple paths to be used by one TCP connection (Wfif and 4G simultaneously) and load balances between them.
• Doesn't require significant application change

Address Translation

• Cope with lack of IP numbers
• Also provides some security as many devices behind one IP address

Outbound Nat:

• Connection is modified so that connections from multiple source UP addresses are encoded into port number space of a smaller number of addresses

Inbound Nat:

• Connection is modified so that connections to multiple ports on a small number of IP addresses are expanded out to a large number of addresses

• Relies on ports in TCP

NAT for TCP

• NAT devices sees "SYN" packet and builds a mapping between inside and outside addresses.
• Modifies TCP packet (including IP header, as involves change to source address to be own), recomputes check sums, sends packet.
• On receipt of packet, looks at source IP and port and destination port, performs reverse mapping and sends the packet.
• Tracks TCP state, and deletes entry from translation table when FINs have all completed.

NAT for UDP

• Rewrite outgoing UDP and then accept return packets until there is silence for "10s"
• Can also impose limit on number of replies, like DNS

• Makes it difficult to track where connections are coming from, for security reasons.
• Creates problems in IOT as it means that you need a server elsewhere to act as a brokerage point as cant directly connect as don't have ip.
• IPv6 does not require NAT

NAT "Security"

• NAT is conceptually a stateful firewall
• NAT products not certified or designed for security
• Ip-address based authentication schemes lose resolution, because all of a site appears as one address (should not use this anyway).

UPnP - Universal Plug 'n' Play

• Allows "inside" devices to communicate with a NAT point and request inbound NAT, effectively automating a bypass of any firewall
• Used heavily in residential products such as WebCams
• UPnP is a dream for malware as it makes opening a connection to a command and control server particularly easy.

L12: Multiple IP

Routing

• Use a linux machine with Multiple IP as a router, much cheaper and more capable.
• Large file servers would saturate single networks so may need to use multiple.

Source Addresses

• Machine has multiple IP numbers, so the source address is chosen either by the programmer or the operating system.

Clients to multihomed servers

• Clients need to be written to loop through all available IP addresses of a machine, can often be done in parallel.
• Caching "live" interface considered OK, choose a sensible time-out

Asymmetric Routes

• Packets may travel via different routes out and back
• But must cross same NAT point or same stateful firewall with same source address: almost impossible to deal with connections where NAT/FW only sees half of traffic or it is mis-labeled

UDP

• If using UDP, the query sent to an IP must have a reply coming from the same IP, otherwise the sender will discard it.
• To fix, open a separate socket for each interface the machine has and only respond to the socket that the message came in on.

• Defends against cables breaking, as if one breaks, the system is still up and running. Therefor want to spread the activity over the interfaces and have it work.
• Today we are trying to move away from machines with multiple interfaces with multiple IP numbers, as multiIP systems are a pain, instead use Link-Agg.

Summary

• You can connect multiple IP networks to one host, and there might be reasons to do it, but it's complicated for both clients and servers and can have undesirable side-effects. In 2019, use dedicated routers, but you still might need multiple connections for performance or availability: next part is solutions.

Link-Agg

• Bunch of ethernet connections, make them behave as if they are one

• If supported by a switch, you can put interfaces into a Link Aggregation group, controlled with LACP.

• Appears to operating systems as one interface, on IP number, one entry in routing table.

• Failure detection faster and simpler, done at link level

Benefits

• One IP number
• Fast failover
• Efficient multiplexing and load spreading (hashes header, so all traffic from one flow goes down one cable)

Problems

• Only goes as far as your nearest switch.
• Doesn't provide for spreading over multiple internet connections.

VLANs

• Here's an ethernet connection, make it behave as if it is many.
• Way to get multiple networks delivered over single cable.
• Ethernet frames have optional extra "tag" identifying which network it is
• Untagged frames are assigned to a per-port default network, which in turn has a per-switch default of either 0 or 1.
• OS sees them as separate networks.

VLAN on switches

• Each port of a switch can output one or more VLANs, one of them optionally untagged (PVID VLAN).
• Ports can be configured to accept combinations of tagged and untagged frames, the untagged frames if permitted, assumed to be in the PVID, tagged frames possibly filtered against an acceptable list.
• Ports outputting untagged frames sometimes called "access", tagged frames "trunk".

Untagged Ports - access ports

• Devices attached to them don't have to understand VLANs
• Packets from one VLAN on the switch are transmitted with the tag stripped
• Packets arriving without a tag have a pre-defined tag added (PVID)

Tagged Ports

• All packets are transmitted with a tag, and only tagged packets are expected to be received.

VLAN Security

• Weak
• All fails if attacker can reconfigure switch and most switches aren't very secure.

Link-Agg + VLANs

• Eg: Link two ethernet switches together with two or four cables, so now you have a fast robust link. They can detect cables failing and swap out cables and load balance. Then use VLANs over the top to have separate networks.
• You can deliver two or more networks over two or more cables, with load balancing and failover.
• Aggregate using Link Aggregation
• Then apply VLAN tagging for the separate networks running over the aggregated link

Load Balancers

• Use inbound NAT, make one IP number available on the outside, and keep track of activity on the machines on the inside.
• Constantly ping devices/ count live connects.
• Sends incoming connection to least loaded, active machine.
• For "sessions", load balancer stores source of old sessions, uses same server for subsequent requests from same source.

VRRP

• Used to move IP between load balances if a load balancer fails
• Advertise shared IP number as real service address.
• Mutual monitoring and takeover of shared address.
• Ideally with multiple redundant networks between peers so if cable in between breaks, they don't fight over master (split brain).

Full Architecture

• Pair of load balances in front of a pool of back-end server.

L13: DNS

• Loose key/value pair of domain name/IP number.
• Lots of caching and redundancy, dating back to a slower, less reliable, less connected Internet.

Resource Records (RR Sets)

• Map a name to some data + book keeping data
• Simple case, A records contain IPv4 addresses
• AAAA records contain IPv6 addresses
• Bunch of other record types PTR(address->name), MX(Mail Exchangers), NS(name server), TXT(random dumping ground for textual information)

TTL - Time to Live

• How long you can safely cache a record for, in seconds

Zones

• Which domains are served from which nameserver. Each zone served by a nameserver and its slaves.

DNS Components

• Clients: ask questions to recursive servers and receive answers.
• Recursive Servers: (caching servers): can be asked a complete question and will give a complete but sometimes inauthoritative answer.
• Authoritative Server: (iterative servers) only give authoritative answers about zones they are configured to know about, contains the "truth".
  • Masters (Primaries) and Slaves (Secondaries) are both authoritative.

Header

• ID: 16 bit identifier (way too small)
• QR: 0 is a query, 1 is a response to a query
• Op:
  • 0 is a query ( or an answer to a query if QR = 1)
  • 1 is an IQUERY (obsolete since 2002) - get name from ip
  • 2 is a STATUS (rarely implemented)
  • 4 is NOTIFY (master informing slave that zone has changed)
  • 5 is UPDATE (dynamic DNS)

Flags

• AA: Authoritative Answer
  • 1 means either I am authoritative, or this answer freshly come from an authoritative server. 0 means from cache.
• TC: Truncation
  • 1 means that there is more than 512 bytes of response so the client should establish a TCp connection and fetch data that way.
  • If it's just "additional information" that has been truncated, may not bother.
• RD, RA
  • Recursion Desired means "please answer this question in its entirety"
  • Recursion Available means "I would do recursion if you asked me for it"

Resource Records

• stored as size, data, size, data ...... end.
• foo.domain.com = [3] foo [6] domain [3] com.
• Label Compression:
  • Labels are maximum 63 bytes, so largest value for a length field is 00111111.
  • Length fields starting 11 (>=192) are special, then the next six bits plus the next byte, total fourteen bits are read as "read from this offset in message next to zero"
  • see worked example below

Clients

• See if name is listed in /etc/hosts, otherwise go to DNS
• Modern systems maintain a cache (nscd on most Unixes)
  • nscd caches tend to be sloppy with TTL handling and cache everything for up to an hour