Mobile Routing - End-to-End Protocols - nmap, netstat, Wireshark

CS158a

Chris Pollett

Mar. 15, 2023

Outline

Routing for Mobile Hosts
Start End-to-End Protocols - UDP
netstat
nmap
In-Class Exercise
Wireshark

Introduction

Last day, we finished up talking about IPv6.
We then about NAT (network address translation), a technique to make better use of IPv4 addresses.
We talked about different algorithms for routing in the multicast setting, DVMRP and PIM-SM and finally, about multi-protocol label switching (MPLS)
We begin today with the final topic from the advanced interworking chapter -- mobile routing.

Routing for Mobile Hosts

Forwarding Packets in the Mobile Setting

In a mobile setting, a host can become disconnected from one network and connected to a different one.
An IP address on the other hand is supposed to indicate roughly when a host is in a network.
One solution to this problem is to have the mobile device get a new IP address using something like DHCP.
For some internet applications this might work: For instance, if all you were doing was requesting and receiving web pages.
For other applications like Voice over IP it would probably cause the application to fail
One of the reasons for this, is that IP addresses serve two roles:
1. It acts as an identifier of an endpoint.
2. It acts as a means to locate an endpoint.
In Voice over IP, you could start sending voice data to an IP, the devices changes networks, so the old IP is no longer that of the receiver, and the connection is dropped or worse yet a malicious person can start receiving the packets addressed to the original receiver.
As long as devices don't move, both jobs above can be done by IP. Otherwise, one probably wants to separate them. I.e., have an endpoint identifier for the first job, and have a locator for the second.
(Network-layer) Mobility consists of techniques to allow nodes to move around in the network. It should be contrasted with wireless which are technologies for communicating between A and B without a wire.

More Routing for Mobile Hosts

The procedures to solve the problem of getting IP to work in the mobile setting are called Mobile IP and there is an IETF Mobile IP Working group dedicated to solving them.
One technology introduced to support Mobile IP is the use of a home agent.
This router is located on the "home" network of the mobile host.
Each mobile host has a permanent IP address called its home address which has a network number equal to that of the home network.
In addition, to the home agent, another special router called the foreign agent is also often used.
Home and foreign agents use advertisements to announce their presence.
The Home agent's advertisement enable the Mobile Host to learn its Home Network's address before it leaves that network.
When the Mobile Host connects to a new network, it determines who is a foreign agent by listening for foreign agent advertisements. It then registers with the foreign agent for that network, telling the foreign agent what its home network is.
The foreign agent then contacts the home agent providing a care-of address (the IP address of the foreign agent).

Sending and Receiving Mobile IP

To send a packet, a mobile host sets the destination of the IP packet to where ever it wants to send, and it sets the source IP to its permanent IP address.
For some other host B to send to the mobile host A, B uses A's permanent IP address as the destination.
The Home agent, uses a technique called proxy ARP to impersonate the Mobile Host on the Home Network.
It should be noted it only does this if A has registered with a foreign agent; otherwise, it just lets the packet go to A on the Home Network.
Suppose the Home Agent receives the packet destined for A. In this case, it forwards the packet to the foreign agent by just wrapping the packet in another IP header with destination the Foreign Agent.
The foreign agent unwraps this packet and sends it to the hardware (Ethernet) address registered with it by A.

Route Optimization in Mobile IP

The route from the correspondent node to the mobile node can be very sub-optimal using just the techniques of the last slide.
For example, this might happen if the correspondent and mobile node might be on the same network, but the home network is far away.
In this situation, the sending correspondent sends messages to the home address, which are then tunneled back to the mobile node.
The three nodes, correspondent, home address, mobile node, in Mobile IP can be viewed as forming a triangle, and routing as we've described involves traversing two sides of the triangle rather than take the single side direct route. So this problem is sometimes called the triangle routing problem.
To improve the performance of sending to the Mobile Host, the Home Agent can send a binding update message back to correspondent with the care-of address of the mobile node.
Using this address, the correspondent can write an entry in its binding cache and use it to directly send messages to the mobile node.
If the mobile node moves to a new network, the foreign agent for the old network notices the mobile node is gone and sends a binding warning to the home agent and back to the correspondent, telling the correspondent to remove the binding entry.
Direct communication can resume when a new binding update message is sent. Cache entries also have timeouts to further mitigate against mobile host switching network issues.
This allows sending host to directly send to mobile node at this new address.

Mobility in IPv6

Unlike with IPv4, mobility was built-into the IPv6 standards from the beginning.
Since all IPv6 hosts can acquire an address whenever they are attached to a foreign network, the foreign agent role is taken on directly by the host.
Rather than tunneling packets (inefficiently nesting IP packets within IP packets) between the Home Agent and the mobile node, in IPv6 the mobile node uses an extension header to give its address to the Home agent. I.e., to send to a correspondent, the destination address is correspondent, source address is home agent, and there is an extension header with the mobile node address.

End-to-end Protocols

We next want to turn our host-to-host communication of packets ability into a process-to-process communication channel between two hosts.
This is the role of the transport layer.
The transport layer should:
- Guarantee message delivery
- Deliver messages in the same order they are sent
- Deliver at most one copy of each message
- Support arbitrary large messages
- Support synchronization between sender and receiver
- Allow the receiver to apply flow control to the sender
- Support multiple application processes on each host.

Simple Demultiplexer (UDP)

The simplest possible transport protocol is one that extends host-to-host delivery to process-to-process communication.
There are likely to be many processes running on a given host; so this extension involves support for demultiplexing packets arriving at a host and sending them to a particular process.
This is essentially what the User Datagram Protocol (UDP) does.
Processes on a given machine are identified by a port number, which is a two-byte number.
Thus, the UDP header structure is relatively simple:

160 31

Source Port Destination Port

Length Checksum

Data

160	31
Source Port	Destination Port
Length	Checksum
Data

More on Ports

There are different ways that the port might be mapped to a particular process.
The easiest is that certain well-known services live at well-known port numbers.
So the Domain Name Service (DNS) usually receives messages on port 53.
Sometimes communication starts on a well-known port and then the two communicating processes agree on some less frequented port to begin communicating.
This can be generalized by having a group of services for whom clients all initially come to a single common port number when starting communication. Then using a single service called a port mapper they agree on a less common port for the rest of communication.
It should be noted port numbers don't depend on the OS.
The checksum is computed over the UDP header, the datagram data, and a pseudoheader -- the protocol number, and source and destination IP.

netstat

netstat (1983) is a command line tool available on Windows, Macos, Linux that allows you to display a variety of network statistics.
On Linux machines, it is considered obsolete and can be replaced by the ss and ip commands.
Because of its availability on multiple platforms it is still pretty useful.

Here are some example, uses of the command:

#give information about open sockets (on Linux, can use: ss)
netstat

#give information about routing table (on Linux, can use: ip route )
netstat -r

#give information about interfaces (on Linux, can use: ip -s link )
netstat -i

#give information about multicast groups (on Linux, can use: ip maddr)
netstat -g

Port Scanning (nmap - Lyon 1997)

It is common to want to know what ports are in use on a given machine.
You might want to do this to find out what kind of traffic is coming into or out of your machine that you are not aware of.
If you see that there seems to be an unknown service on your machine then you could analyze the traffic with tcpdump or Wireshark.
Bad guys might want to know which services are available on a machine in order to decide how to attack your system.
One common tool for checking what ports are in use is nmap https://nmap.org/.

This can be run from the command line with a line like:

nmap IP_address_or_hostname #or
nmap -v -A IP_address_or_hostname #verbose and enable OS detection

nmap supports lots of options to prevent the site you are looking at from detecting the scan as well.

In-Class Exercise

Use tools we have learned in this class to find the IP address of www.cs.sjsu.edu
Then use nmap to discover open ports on this machine. Try to figure out what each one is for.
While you are doing the above, make sure to keep a transcript.
Please post this transcript to the Mar 15 In-Class Exercise Thread.

Wireshark

We pause for a moment on the problem of routing to look at another network tool.
Wireshark (https://www.wireshark.org/) is a free packet sniffer much like tcpdump but with a graphical front-end.
It has a nice interface to easily allow you to look at Ethernet frames, IP packets, as well as, Wireless, TCP and UDP, etc. traffic.
It used to be called Ethereal but the name was changed in 2006 because of trademark issues.

Using Wireshark

When launched Wireshark looks like the above.
You can click on Capture > Options to set up the kind of traffic capture you want to do (or just click on the gear icon).
Notice you can also set a Capture Filter if you want. This would allow you to say just capture TCP traffic, or even further restrict the traffic you are looking at. For instance, you might want to look at just HTTP traffic to some host.
Once you have set-up the options as you like, you can use Capture > Start (Green Shark Fin) and Capture > Stop (Red Shark Fin) to begin/end recording traffic.
You can then either look at this traffic manually, by clicking on the packets you would like to look at in more detail or you can use the Analyze and Statistics menus to automate analyzing what you are seeing.