Unit 4: Network layer - Subjective Questions

Classful addressing divides the IPv4 address space into predefined classes. The class is determined by the leading bits and the value of the first octet.

• Class A:
  • Leading bit: 0
  • First-octet range: 1–126
  • Default mask: 255.0.0.0 or /8
  • Intended for very large networks
  • Supports networks and approximately hosts per network
• Class B:
  • Leading bits: 10
  • First-octet range: 128–191
  • Default mask: 255.255.0.0 or /16
  • Intended for medium-sized networks
  • Supports networks and hosts per network
• Class C:
  • Leading bits: 110
  • First-octet range: 192–223
  • Default mask: 255.255.255.0 or /24
  • Intended for small networks
  • Supports networks and hosts per network
• Class D:
  • Range: 224–239
  • Used for IP multicast; it has no network-host division
• Class E:
  • Range: 240–255
  • Reserved for experimental or future use

The first-octet value 127 is reserved for loopback testing. Classful addressing has largely been replaced by CIDR because fixed class boundaries waste address space.

The addresses are interpreted according to classful addressing as follows:

• 10.25.8.7:
  • Class: A
  • Default mask: 255.0.0.0 or /8
  • Network address: 10.0.0.0
  • Type: Private, because it belongs to 10.0.0.0/8
• 172.20.40.5:
  • Class: B
  • Default mask: 255.255.0.0 or /16
  • Network address: 172.20.0.0
  • Type: Private, because it falls within 172.16.0.0–172.31.255.255
• 192.168.2.100:
  • Class: C
  • Default mask: 255.255.255.0 or /24
  • Network address: 192.168.2.0
  • Type: Private, because it belongs to 192.168.0.0/16
• 200.10.5.9:
  • Class: C
  • Default mask: 255.255.255.0 or /24
  • Network address: 200.10.5.0
  • Type: Public, assuming it has been allocated by an authorized registry or ISP

The network address is obtained by performing a bitwise AND operation between the IP address and its default classful mask.

Public IPv4 addresses are globally unique addresses that can be routed across the public Internet. They are assigned through regional Internet registries and Internet service providers.

Private IPv4 addresses are reserved for use inside local networks and are not directly routed on the public Internet. The private ranges defined by RFC 1918 are:

• 10.0.0.0/8 — 10.0.0.0 to 10.255.255.255
• 172.16.0.0/12 — 172.16.0.0 to 172.31.255.255
• 192.168.0.0/16 — 192.168.0.0 to 192.168.255.255

Key differences:

• Public addresses must be globally unique, whereas private addresses may be reused in different organizations.
• Public addresses are Internet-routable; private addresses require NAT to communicate with the public Internet.
• Public addresses are limited and usually assigned by an ISP; private addresses can be assigned internally by an administrator or DHCP server.

Private addressing conserves public IPv4 space, supports flexible internal addressing, and hides internal address structures from external networks.

Network Address Translation (NAT) is a function normally performed by a router or firewall that modifies IP addresses, and sometimes transport-layer port numbers, as packets pass between private and public networks.

For an outgoing connection:

1. A private host, such as 192.168.1.10, sends a packet to an Internet server.
2. The NAT router receives the packet on its inside interface.
3. It replaces the private source address with a public address.
4. In PAT, it may also replace the source port with a unique translated port.
5. The router records the mapping in a NAT translation table.
6. The Internet server replies to the translated public address and port.
7. The NAT router consults its translation table, restores the original private destination address and port, and forwards the reply to the host.

Benefits include:

• Conservation of public IPv4 addresses
• Reuse of private addresses
• Hiding of internal addressing details
• Easier internal network renumbering

NAT is not a complete security mechanism, although it prevents unsolicited inbound traffic when no mapping or forwarding rule exists.

The three common forms of NAT differ in how private addresses are mapped to public addresses.

• Static NAT:

  • Creates a permanent one-to-one mapping.
  • Example: 192.168.1.20 is always translated to 203.0.113.20.
  • Useful for internal servers that must be reachable from outside.
  • Requires one public address for every mapped private host.

• Dynamic NAT:

  • Maps a private address to an available address from a public address pool.
  • Example: hosts in 192.168.1.0/24 may use addresses from 203.0.113.10–203.0.113.20.
  • The mapping is temporary and may change between sessions.
  • The number of simultaneous translated hosts is limited by the pool size.

• Port Address Translation:

  • Maps many private hosts to one or a few public addresses by using unique port numbers.
  • Example: 192.168.1.10:5000 and 192.168.1.11:5000 may become 203.0.113.5:30001 and 203.0.113.5:30002.
  • Also called NAT overload or many-to-one NAT.
  • It is the most widely used method for Internet access in homes and offices.

Thus, static NAT provides predictability, dynamic NAT uses a public pool, and PAT offers maximum public-address conservation.

Advantages of NAT:

• Conserves scarce public IPv4 addresses, especially when PAT is used.
• Allows organizations to use reusable private addresses internally.
• Hides the internal addressing scheme from external networks.
• Makes it possible to change the ISP or public address without renumbering all internal devices.
• Can control inbound access through static mappings and port-forwarding rules.
• Helps networks handle overlapping addressing in some migration scenarios.

Limitations of NAT:

• Breaks the original end-to-end communication model of the Internet.
• Adds processing overhead and requires the router to maintain translation state.
• Can complicate peer-to-peer applications, VoIP, online gaming, and protocols that embed IP addresses in their payloads.
• Unsolicited inbound communication requires static NAT or port forwarding.
• Makes troubleshooting and host identification more difficult because multiple devices may share one public address.
• Some protocols require NAT traversal techniques or application-level gateways.
• NAT itself does not provide comprehensive security; firewall rules are still required.

Therefore, NAT is important for IPv4 address conservation, but it introduces complexity and should not be treated as a substitute for a firewall.

Static routing is a routing method in which routes are entered manually by a network administrator rather than learned through a dynamic routing protocol.

A static route normally specifies:

• The destination network and prefix or mask
• The next-hop router address or outgoing interface
• Optionally, an administrative distance

A conceptual route can be written as:

Destination network → Next-hop address

For example, a router may be configured to reach 192.168.20.0/24 through next hop 10.0.0.2.

Advantages:

• Simple and predictable in small networks
• Uses no routing-update bandwidth
• Requires little CPU and memory
• Does not advertise routing information to neighboring routers
• Offers precise administrative control over forwarding paths

Disadvantages:

• Must be manually configured and maintained
• Does not automatically adapt to failures or topology changes
• Is prone to human configuration errors
• Does not scale well in large or frequently changing networks

Static routes are best suited to small, stable networks, stub networks, backup paths, and default routing.

Static routing and dynamic routing differ as follows:

• Configuration: Static routes are manually entered, while dynamic routes are learned through routing protocols.
• Scalability: Static routing is suitable for small networks; dynamic routing scales more effectively in medium and large networks.
• Resource overhead: Static routes use little CPU, memory, or bandwidth. Dynamic protocols consume resources to exchange and process updates.
• Response to failure: Static routes do not normally change automatically. Dynamic routing can discover a failure and select an alternative path.
• Convergence: Static routes have no protocol convergence process. Dynamic protocols require time to reach a consistent view after a change.
• Maintenance: Static routing creates a large administrative burden as the network grows. Dynamic routing reduces manual maintenance.
• Security and control: Static routing does not exchange route advertisements and offers predictable control. Dynamic routing must be authenticated and filtered to reduce false or unauthorized updates.
• Applications: Static routes are useful for stub networks, fixed paths, and defaults. Dynamic routing is preferable when several routers, alternative paths, or topology changes exist.

Many practical networks use a hybrid approach, combining dynamic routing for general reachability with static or default routes for specific purposes.

Dynamic routing allows routers to exchange network-reachability information and automatically build or modify their routing tables.

A dynamic routing protocol performs the following major functions:

• Neighbor discovery: Identifies other routers participating in the same protocol.
• Route advertisement: Exchanges information about reachable networks.
• Path calculation: Applies an algorithm and metric to determine the best path.
• Route installation: Places selected routes in the routing table.
• Topology adaptation: Detects failed links, new networks, and other changes.
• Convergence: Works toward a state in which all routers have consistent and accurate routing information.
• Loop prevention: Uses protocol-specific techniques to reduce persistent routing loops.
• Route maintenance: Refreshes, ages, or removes routes as required.

Dynamic protocols can be broadly grouped into distance vector, link state, and path vector protocols. RIP is a distance vector protocol, while OSPF is a link state protocol.

In distance vector routing, each router maintains a vector containing the known distance or metric to each destination and the next hop used to reach it. A router does not initially possess a complete map of the network.

Routers periodically, or after significant changes, share routing information with directly connected neighbors. On receiving a neighbor's vector, a router calculates whether reaching a destination through that neighbor is better than its current route.

The Bellman-Ford relation is:

where:

• is router 's estimated cost to destination .
• is the cost from router to neighboring router .
• is neighbor 's advertised cost to destination .
• The minimum is taken over all neighbors .

The router installs the neighbor producing the lowest total metric as the next hop. Distance vector routing is simple but may converge slowly and can suffer from routing loops and the count-to-infinity problem.

A routing loop occurs when routers repeatedly forward a packet to one another because their routing tables contain inconsistent information. The count-to-infinity problem occurs when routers gradually increase a failed route's metric while incorrectly believing that another router still has a valid path.

For example, if a network connected to router A fails, router B may advertise an old route to that network through A. Router A may then assume that B has an alternative route, creating a loop. Each update increases the metric until the protocol's infinity value is reached.

Mitigation techniques include:

• Split horizon: A route is not advertised back through the interface from which it was learned.
• Route poisoning: A failed route is advertised with an infinite metric.
• Poison reverse: A route is explicitly advertised back to its source with an infinite metric.
• Triggered updates: A router immediately advertises an important change instead of waiting for the periodic timer.
• Hold-down timers: Potentially unstable updates are temporarily ignored to allow the network to stabilize.
• Maximum metric: A finite infinity value limits how long counting can continue; RIP uses 16 as unreachable.

These mechanisms reduce loops but do not make convergence instantaneous.

Routing Information Protocol (RIP) is an interior gateway protocol based on the distance vector approach.

Its main characteristics are:

• Uses hop count as its routing metric.
• A route with the lowest hop count is preferred.
• The maximum usable metric is 15 hops.
• A metric of 16 represents an unreachable destination.
• Routers normally send periodic routing updates approximately every 30 seconds.
• RIP uses UDP port 520 for IPv4 route exchanges.
• It applies techniques such as split horizon, route poisoning, triggered updates, and hold-down timers.
• It is simple to configure but converges relatively slowly.

Operation:

1. A router initializes routes to directly connected networks.
2. It exchanges routing information with neighboring RIP routers.
3. The receiving router increments the advertised hop count by one.
4. It compares the new route with existing entries.
5. A route with a better metric is installed in the routing table.
6. Invalid or expired routes are eventually removed.

RIP is mainly suitable for small networks because its 15-hop limit and slow convergence restrict scalability.

RIPv1 and RIPv2 differ in several ways:

• Addressing information: RIPv1 does not include subnet masks in updates and is therefore classful. RIPv2 includes subnet masks and supports classless routing.
• VLSM and CIDR: RIPv1 does not properly support variable-length subnet masks or CIDR. RIPv2 supports both.
• Update delivery: RIPv1 sends updates using broadcast. RIPv2 normally uses multicast address 224.0.0.9.
• Authentication: RIPv1 provides no routing-update authentication. RIPv2 supports authentication.
• Route tags: RIPv2 supports route tags that help identify external or redistributed routes.
• Next-hop field: RIPv2 can include next-hop information to improve forwarding efficiency.

Both versions use hop count, permit a maximum of 15 hops, and use UDP port 520.

RIPv2 is preferred because it supports modern classless addressing, VLSM, more efficient multicast updates, and authentication. Nevertheless, it retains RIP's scalability and convergence limitations.

In link state routing, every router develops a synchronized map of the network topology and independently calculates the shortest paths.

The general operation is:

1. Neighbor discovery: A router discovers directly connected link state neighbors using hello messages.
2. Adjacency formation: Compatible routers establish neighbor relationships and, when required, full adjacencies.
3. Link-cost determination: The router determines the state and cost of each active interface or link.
4. Link state advertisement creation: It creates an advertisement describing its links, neighbors, networks, and costs.
5. Reliable flooding: Link state information is distributed throughout the routing domain or area.
6. Database construction: Each router stores received advertisements in a link state database.
7. Shortest-path calculation: The router applies Dijkstra's shortest path first algorithm with itself as the root.
8. Route installation: Best paths are placed in the routing table with the appropriate next hops and metrics.

When a topology change occurs, updated link state information is flooded and routers recalculate affected paths. Link state protocols generally converge faster and scale better than distance vector protocols, but require more CPU, memory, and configuration knowledge.

Dijkstra's shortest path first (SPF) algorithm computes the minimum-cost paths from one source router to all other reachable nodes.

The main steps are:

1. Place the source router at the root of the shortest-path tree with cost 0.
2. Assign tentative costs to directly connected neighbors.
3. Select the unvisited node with the smallest tentative cost.
4. Add that node permanently to the shortest-path tree.
5. Examine each of its neighbors and update their tentative costs if a lower-cost path has been found.
6. Repeat the selection and update process until all reachable nodes are processed.

If the current cost from source to node is and the link cost from to is , the candidate cost is:

A link state router runs SPF on its link state database. The resulting tree identifies the lowest-cost path to every destination. The first router along each path becomes the next hop used when installing the corresponding route in the routing table.

Open Shortest Path First (OSPF) is an open-standard, classless link state interior gateway protocol used within an autonomous system.

Major features:

• Uses Dijkstra's SPF algorithm.
• Uses cost as its metric, commonly derived from interface bandwidth.
• Supports CIDR, VLSM, route summarization, and equal-cost multipath routing.
• Converges faster than traditional distance vector protocols.
• Supports authentication mechanisms.
• Uses triggered link state updates rather than periodically sending the entire routing table.
• Organizes large networks into hierarchical areas.
• Runs directly over IP using protocol number 89.

Operation:

1. Routers send Hello packets to discover neighbors.
2. Compatible neighbors establish relationships and required adjacencies.
3. Adjacent routers synchronize their link state databases.
4. Link state advertisements are reliably flooded within the appropriate scope.
5. Each router builds a consistent link state database for its area.
6. Each router runs SPF and constructs a shortest-path tree.
7. The best routes are installed in the routing table.

OSPF is suited to medium and large enterprise networks because it offers fast convergence, hierarchical design, and efficient routing updates.

OSPF uses a hierarchical design to improve scalability and limit the propagation of detailed topology information.

• Area 0:
  • Called the backbone area.
  • Connects the other OSPF areas.
  • Inter-area traffic normally passes through Area 0.
• Internal router:
  • Has all OSPF interfaces in the same area.
  • Maintains detailed link state information for that area.
• Backbone router:
  • Has at least one interface participating in Area 0.
  • An Area Border Router is also a backbone router when connected to Area 0.
• Area Border Router (ABR):
  • Connects Area 0 to one or more non-backbone areas.
  • Maintains separate link state databases for connected areas.
  • Can summarize routes between areas.
• Autonomous System Boundary Router (ASBR):
  • Introduces routes from another routing domain or protocol into OSPF.
  • Advertises these routes as external OSPF information.

By dividing a network into areas, OSPF reduces link state database size, limits SPF recalculations, controls flooding, and permits route summarization. All regular non-backbone areas should have logical connectivity to Area 0.

OSPF uses five main packet types:

1. Hello packet:

   • Discovers and maintains neighbors.
   • Carries parameters such as area ID, timers, and router priority.
   • Participates in designated-router election on multiaccess networks.

2. Database Description (DBD) packet:

   • Provides summaries of entries in a router's link state database.
   • Helps adjacent routers determine whether their databases differ.

3. Link State Request (LSR) packet:

   • Requests complete information for specific link state advertisements that are missing or outdated.

4. Link State Update (LSU) packet:

   • Carries one or more complete link state advertisements.
   • Is used to distribute topology changes and answer requests.

5. Link State Acknowledgment (LSAck) packet:

   • Acknowledges received link state advertisements.
   • Supports reliable flooding of link state information.

Together, these packets allow routers to discover one another, form adjacencies, synchronize databases, reliably exchange topology information, and maintain a consistent network view.

RIP and OSPF differ in the following respects:

• Routing approach: RIP is a distance vector protocol; OSPF is a link state protocol.
• Algorithm: RIP is based on Bellman-Ford concepts; OSPF uses Dijkstra's SPF algorithm.
• Metric: RIP uses hop count. OSPF uses cost, commonly based on interface bandwidth.
• Maximum network diameter: RIP supports at most 15 hops; OSPF has no comparable 15-hop restriction.
• Convergence: RIP generally converges slowly. OSPF usually converges faster after a topology change.
• Updates: RIP periodically sends routing information to neighbors. OSPF floods link state changes and periodically refreshes link state information.
• Network view: A RIP router learns destination distances from neighbors. An OSPF router maintains a topology database for its area.
• Scalability: RIP is appropriate for small networks. OSPF supports large hierarchical networks through areas.
• Resources: RIP requires fewer CPU and memory resources. OSPF requires more resources to maintain databases and run SPF.
• Complexity: RIP is easier to configure. OSPF design and troubleshooting are more complex.

RIP is suitable for small and simple environments, whereas OSPF is generally preferred for medium and large enterprise networks.

A default route is a route used when the routing table contains no more specific match for a packet's destination address.

For IPv4, the default route is represented as:

0.0.0.0/0

Because its prefix length is zero, it matches every IPv4 destination. However, routers apply the longest-prefix-match rule, so any more specific matching route is selected before the default route.

For example, if a table contains:

• 192.168.10.0/24 through router A
• 0.0.0.0/0 through an ISP router

Traffic for 192.168.10.50 uses the /24 route, while traffic for an unknown Internet network uses the default route.

Common uses include:

• Stub networks with only one path to other networks
• Customer routers with one ISP connection
• Edge routers forwarding unknown destinations upstream
• Reducing the number of routing-table entries on smaller routers

A default route may be configured statically or learned through a dynamic routing protocol. If no matching route, including a default, exists, the router discards the packet and may return an ICMP destination-unreachable message.