My FAQs 1 - TCP/IP, RIP

How are the protocols classified?

Protocols are classified into two based on whether they use hop count as the metric or not. Distance vector protocols like RIP use Bellman Ford algorithm. Link state protocols like OSPF uses complete knowledge of the network to detemine the path to destination.

Another classification is based on whether they are running in the same AS or different AS. Protocols like OSPF,RIP which run within the same AS are called Interior Gateway Protocol(IGP) and others are Exterior Gateway Protocol(EGP)

What is Jumbo packet?
Packets whose size exceeds the MTU of the medium. Such packets are fragemented if the Don't Fragment bit in IP header is not set and discarded otherwise

What is ARP?

ARP is used for obtaining the hardware address for the given IP address. ARP requests are sent as broadcast to ff:ff:ff:ff:ff:ff:ff and ARP replies are sent as unicast.

Different types of ARP?

RARP- Reverse Address Resolution - used by diskless machines to obtain their own IP for the MAC address given
GARP- Gratuitous ARP - both request and reply - Source and destination IP set to the address of the machine issuing the request. Destination MAC is broadcast. Usually no reply obtained.
-> Used to detect IP conflicts
->Used to update other machines' arp table
->Every time an interface goes up, the driver for that interface sends out a gratuitous arp to preload the arp tables of other machines.
Proxy arp - Router will respond with its own MAC on the behalf of the host to which the arp request is sent. Usually occur when two hosts are connected over a router.

Collision domain and broadcast domain?
Collision domain- Network segment where packets can collide while sent over that shared medium
Broadcast domain - Logical division of network where all nodes can reach each other though an L2 broadcast

CSMA/CD?
When two hosts would send at the same time, though, a collision would occur. When the signals would collide, both would be rendered unusable. A standard had to be created that would have the hosts follow rules relating to when they could send data and when they could not. This standard is Carrier Sense Multiple Access with Collision Detection, referred to as CSMA/CD.

If two of the three computers on this segment send data at the same time, a collision occurs.

To avoid this, CSMA/CD forces computers to “listen” to the Ethernet before sending in order to make sure that no other host on the wire is sending. When the Ethernet segment is not busy, the device that wants to send data can do so. The sender will then continue to listen, to make sure that sending the data didn’t cause a collision.

If a collision is heard, both of the senders will send a jam signal over the Ethernet. This jam signal indicates to all other devices on the Ethernet segment that there has been a collision, and they should not send data onto the wire. (A second indication of a collision is the noise created by the collision itself.)

After sending the jam signal, each of the senders will wait a random amount of time before beginning the entire process over. The random time helps to ensure that the two devices don't transmit simultaneously again.

Packet firewall filter and proxy based firewall filter?

Packet firewall filter- L3 firewall filter
Proxy based firewall filter - application layer filter

RIP - Routing Information Protocol

Protocol & port?
UDP port 520

Infinity metric/count to infinity ?

To prevent routing loops, the RIP protocol depends on a function known as “counting to infinity.” A maximum metric (the infinity metric) is defined within the protocol, and all routes with a larger metric are deemed unusable. For RIP, the maximum hop count is defined as 15. If a router receives a RIP update with a metric value over 15 (that is, 16 or greater) after it is incremented, the router must throw the update away and the destination is considered unreachable.

Messages?

Request and response
The purpose of a Request message is to ask for all or some part of the local router’s current routing table Request message has a single entry in it with a metric of 16 and an address family identifier field that contains all zeros. This message translates into “Send me your entire routing table.” A Request message may contain one or more specific route entries. In this case, the local router consults its routing table for each of the destinations listed

A RIP router receives Response messages for one of three different reasons:
>In response to a Request message generated by the local router
>A regular (unsolicited) Response message sent by a neighbor
>A triggered update Response message sent by a neighbor


Split horizon?
When the Update timer expires and a Response message is generated, split horizon prevents the local router from including any routes learned from a neighbor on the interface from which the message is being sent out.

SH with Poisoned Reverse?
Instead of never advertising a route back to the neighbor it was learned from, the router advertises it with an infinity metric.


Timers?
RIP uses a number of timers in its operation, among them the Update timer, the Hold-Down timer, the Timeout timer, and the Garbage Collection timer. A RIP router uses an Update timer to advertise its complete routing table (less split horizon) to all its neighbors. The JUNOS software uses 30 seconds as the default Update timer.

Hold down timer prevents the propagation of bad routing information throughout the network. The Hold-Down timer is used when an update is received by the local router that contains a route from a peer with a higher metric (other than infinity) than the one in the current routing table.

The Timeout timer is used to ensure that the copy of the route is valid and usable. When the route is first installed in the table, this timer is initialized to 120 seconds, its maximum value. The timer value is updated when a Response message from a neighbor is processed and the route is maintained in the table. In this case, the timer is reset to 120.

The Garbage Collection timer runs to a maximum non-configurable value of 180 seconds, at which time the route will be removed from the routing table.

Limitations ?

Scalability
RIP does not scale well for large networking environments. One issue is the maximum hop count used (discussed next). Another issue is the use of the 255.255.255.255 broadcast address for Response message updates in RIP version 1. On broadcast networks, this is quite disruptive to other IP (non-RIP) hosts.
Small hop count limit
Sixteen hops is the defined infinity metric that denotes an unreachable or unusable subnet. This value limits the size or “diameter” of the networks that can be built using RIP.
Slow convergence
Although triggered updates can help advertise new information into RIP, the timers can have the opposite effect. When a route needs to be removed from the protocol, the timer values for the Hold-Down, Timeout, and Garbage Collection timers can mean that a topology change at one end of the network may not be known at the other end of the network for several minutes.
Suboptimal routing
Since RIP routers utilize only the hop count as the metric, some suboptimal routing may occur. This occurs because hop count does not allow for dissimilar bandwidths, fewer delays, or less congestion on other alternate paths to a destination. When these alternate paths are available, RIP will always pick the one with the smallest hop count regardless of the interface speeds of the other path.
Nonhierarchical design
As the size of the RIP routing domain grows larger and approaches the maximum diameter of 15 routers, there is no mechanism to divide the domain into smaller, more manageable subdomains

RIPv2 over v1?

VLSM support By default, all RIPv2 Response updates include the subnet mask. This allows v2 routers to support variable-length subnet mask (VLSM) routing and provides for a classless network routing environment.

Multicast announcements RIPv2 sends all Request and Response messages to a multicast address (224.0.0.9) instead of the 255.255.255.255 broadcast address. This provides for better scalability since only RIP-speaking routers (or hosts) need to process the packets.

Authentication RIPv2 supports authentication by means of a password. This allows a RIP router to accept Response messages only from a “trusted” source. Although RFC 2453 specifies the use of a plain-text password only, the JUNOS software also supports the use of MD5 hashes, as defined in RFC 2082.

Route tag RIPv2 supports a 16-bit field called a route tag. This field was originally included to indicate whether the route was derived internally or externally to the RIP network. This field can also be used for other purposes, including administrative routing policy control.

Next hop address RIPv2 allows the sending router to advertise the immediate next hop address for a route entry. Similar to an ICMP redirect message, this field is helpful in a broadcast environment to avoid an extra forwarding hop when the advertising RIP router is not the immediate next hop for the route.


Configurations?

user@Cabernet# show
rip {
group neighbor-routers {
neighbor fe-0/0/0.0;
neighbor fe-0/0/1.0;
}
}

user@Cabernet> show rip neighbor
Source Destination Send Receive In
Neighbor State Address Address Mode Mode Met
-------- ----- ------- ----------- ---- ------- ---
fe-0/0/0.0 Up 172.16.1.2 224.0.0.9 mcast both 1
fe-0/0/1.0 Up 172.16.2.1 224.0.0.9 mcast both 1

user@Riesling> show route protocol rip
inet.0: 27 destinations, 27 routes (27 active, 0 holddown, 0 hidden)
+ = Active Route, - = Last Active, * = Both

172.16.2.0/24 *[RIP/100] 00:07:25, metric 2
> to 172.16.1.2 via fe-0/0/0.0
192.168.8.1/32 *[RIP/100] 00:07:25, metric 2
> to 172.16.1.2 via fe-0/0/0.0