Inside a router

We usually divide the inside of a router into four logical parts:

• Input ports: Receives data, consults the lookup table, and forwards the data to the correct output port (see next subsection for details). Input ports usually have a queue, in case the correct output port is busy.
• Switching fabric: Connects input ports and output ports. Can be viewed as a small network inside the router.
• Output ports: Sends out data. In most cases, ports are bidirectional, so all physical ports are both input and output ports.
• Routing processor: Performs the intelligence of the router, such as running routing protocols, building the lookup and forwarding table etc.

Forwarding

The lookup table of the router is used by input ports to see where an incoming packet should be forwarded. The table usually contains entries with a triplet of (address, mask, interface). The address specifies a prefix (what the destination address should start with), a mask (how long the prefix is), and the interface/output port the packet should be forwarded to on a match. On non-core network routers, a default entry is usually added for packets that don't match any other rule. Packets are forwarded using a longest-prefix match, which is based on the most specific table entry (longest mask).

Content-Addressable Memory (CAM)

The lookup process in the previous subsection needs to be performed for every incoming packets. In today's networks, with potentially multiple terabits of data per second for a single ISP-grade router, this needs to happen very quickly. A software implementation is therefore not fast enough. Instead, the lookup process is implemented in hardware, using the Content-Addressable Memory technique.

CAM uses dedicated hardware for the search and comparison between the lookup table and destination addresses of incoming packets. This gives a time complexity of O(1), meaning that the correct search result will be found in constant time. The downside of CAM is that it requires dedicated hardware for the patterns (but the patterns themselves can be configured using software). This increases the size, cost, and power usage of the router.

Address types

Network Address Translation (NAT)

To save on IPv4 addresses, internet users are usually allocated only a single external IP address for their household. To be able to connect multiple devices to the internet with only one address, NAT is used. When NAT is used, the router replaces source and destination addresses (translates) of network packages between internal and external addresses. To remember which packets should be sent to which device on the local network, TCP and UDP ports are used. This violates the principle that the router should only work on layer 3 of the TCP/IP protocol stack, but has been a requirement for the internet to scale to the size it is today.

IPv6

IPv6 is the latest version of the internet protocol. The main difference is the increased address size: from 32 to 128 bits. This gives a total of $2^{128}\approx3.4\cdot 10^{38}$ different possible addresses. Because of the large amount of addresses, it is common to allocate many more than required, to guarantee scalability.

Address planning

To make a network manageable as more routers and hosts are added, proper planning of both topology and addressing is required. Creating an address plan consists of defining rules for which IP addresses should be used for what. For example, deciding what addresses should be used for internal links, loopbacks, external links, and customers (for an ISP).

Definition of an AS

RFC1930 defines an Autonomous System (AS) as:

An AS is a connected group of one or more IP prefixes run by one or more network operators which has a SINGLE and CLEARLY DEFINED routing policy.

In practice, when we talk about an AS, we refer to an ISP or company network with several routers, where a single entity (the owner) has control over the routing and addressing plan. A single AS might use multiple IGPs within its own AS, and probably communicates with other AS's using an EGP (which is almost always BGP).

Routing Information Protocol (RIP)

RIP was one of the first attempts at an interior gateway protocol, and does show signs of old age in terms of scalability and features. RIP is a distance vector protocol, with hop count (amount of routers a packet visits on its path) as metric. Hop count does not consider link capacity, so a single 1 Mbps link would have been preferred over two 10 Gbps links in the eyes of RIP.

RIP (by default) works by broadcasting its distance vector every 30 seconds. In a large network, this creates large traffic bursts twice every minute. In addition, hop counts are limited to a maximum of 15 hops, which makes it impossible to use RIP in large networks. However, of the widely used IGPs, RIP has the least requirements for configuration, and is easy to get running.

RIP does not support IPv6. An extension of RIP, known as RIPng, was created to support IPv6 networks.

Open Shortest Path First (OSPF)

OSPF is a protocol for use within an AS to let routers and devices discover each other, and maintain routes when routers go down. It is widely used in large enterprise networks, while IS-IS is more common in ISP networks. OSPF runs directly on top of IP, without using TCP or UDP for transport. Support for IPv6 in OSPF required a new version of the protocol, OSPFv3.

OSPF is a "link-state" based protocol. This means that instead of transmitting known distances to other routers (like a "distance vector" protocol such as RIP), only the status of links is transmitted, and each router calculates distances and paths to other routers.

OSPF has to be configured on each router, but when it has been enabled on all participating routers, it operates without human interaction. Each router is configured to belong to an area, which is used to create some separation within the AS. OSPF requires that the area with id 0 is the backbone area. All other areas should have some direct or indirect connection to the backbone area, creating a "core" or "center" of the AS.

While RIP uses only hop count as a metric, OSPF calculates a cost of routes. This cost is usually related to link bandwidth, but can be configured by the operator. This makes it easier to prioritize links, and creates more scalable paths through the network.

IS-IS

IS-IS (Intermediate System - Intermediate System) is an alternative to OSPF. Both protocols are link-state protocols, and work in a similar way. Unlike OSPF, IS-IS does not run over IP, but rather runs directly on layer 3 of the protocol stack. IS-IS does not make any assumptions about the underlying network, and therefore only required a small extension to support IPv6.

Network managing models

We usually look at four different network management models:

• The organizational model defines the components of a managed network system. It defines objects (managed devices), agents (receive commands from the manager and use them to configure the device. A SNMP server is an agent), and managers (sends commands to the agents).
• The information model describes which data is managed. For example, the structure of the MIB (see below).
• The communication model defines how commands and data is transmitted over the network.
• The functional model defines five application areas within network management: configuration, fault, performance, security, and accounting.

Command line interfaces

A common way to manage a network device, is to use a command line interface (CLI). These are often very specific to the device, with little standardization. It is possible to automate CLI usage using scripts, but these are prone to break as the CLI is changed. A CLI is also very vulnerable to human error when humans type in commands. However, a CLI is often flexible, and easier to extend than a protocol.

OID

Throughout the rest of this compendium, the term OID will be used to refer to an "Object Identifier". This is a standardized string of digits that is used to refer to some "object" or "thing". OID's are structured in a tree, where each number refers to the index of the child node to traverse down. Most OID's in this course starts with 1.3.6.1, which refer to the internet.

Managed Information Base (MIB)

The MIB is a database within the router that stores information in the router. It is structured as a tree structure, based on OID. We usually interact with the MIB using SNMP. It is part of the information model.

Genericity vs Transparency

When designing some management API, a choice of transparency and generality has to be made. Transparency describe how precise parameters are defined (higher transparency $\rightarrow$ less specific parameters), while genericity describe how general the method itself is. Example:

High transparency is more flexible with what to request, but requires more difficult parsing, and more documentation over supported features.

SNMP message types

SNMP lives up to the "simple" in its name by only having four different messages. Of these, only the trap message is sent from the SNMP agent to the manager unprovoked.

• The get message is used by the manager to retrieve a piece of information from a SNMP agent, using an OID. A get-response is sent as a reply by the agent with the requested information.
• The get-next message is used by the manager when retrieving data that does not fit in a single UDP packet, the get-next request can be sent to receive the next part of the data.
• The set message is used by the manager to set a value in the MIB. Its parameters are an OID and the new value.
• A trap message is sent from an agent to the manager on certain conditions set by the manager. For example, it is possible to configure traps to be sent when an event occurs.

Measurements

We often distinguish between two types of measuring:

• Passive measurements: Passively analyze existing network traffic. Can be done using a dedicated device, or directly on a host, router (running protocols like SNMP and NetFlow), or other existing device on the network.
• Active measurements: Generate new traffic for performing measurements. An example is using the ping tool for obtaining round-trip time, which injects new traffic in the network. If done on a large scale, this new traffic may affect the network, giving less precise measurements for a normal scenario.

Types of traffic analysis

When measurements are performed on a copy of the entire traffic in a link, there are several ways to analyze the traffic to obtain measurements. This can be chosen based on available resources (e.g. header-only analysis is much lighter than full packet monitoring).

When the full packets are analyzed, it is possible to obtain very detailed data about user activity. This is required for some types of monitoring, like intrusion detection, but has a high computational cost in high-bandwidth networks.

A different alternative is to just look at packet headers. With the header, it is possible to obtain information about the source and destination of the packet, size, and protocol. Using only headers is also enough to perform flow monitoring (see below).

Flow monitoring and NetFlow

When monitoring network traffic, it may be difficult to tell traffic patterns from packet data alone. One alternative is to aggregate packages into "flows". A "flow" can be seen as a session between two hosts, such as a TCP session or two-way UDP traffic with the same source and destination address/port. Many routers support aggregating flows, for example with NetFlow.

Netconf operations

Netconf assumes that the device's configuration can be represented as an object, or a document. Since this object can be quite large for a complex network setup, all Netconf methods support various filtering to only fetch or set parts of the configuration. Some important Netconf operations are:

• get-config: Gets the current configuration, with an optional filter.
• get: Like get-config, but also returns state information in addition to configuration.
• edit-config: Edits some part of the current configuration.
• copy-config: Copy some configuration from a source to a destination, for example to copy the current configuration over to startup configuration to preserve it after reboot.
• delete-config

Label distribution

MPLS reduces the requirement for routers to know the addresses of other routers, but introduces a new problem: How do we know what the different labels mean? For this, we use a Label Distribution Protocol (LDP).Some LDP's are extensions of existing protocols (for example MPLS-BGP uses BGP to distribute labels), while some are new for this specific purpose. One of the most common LDP's is MPLS-LDP, which is confusingly enough often just called LDP.

Label distribution is often only done within a single MPLS domain, such as within the backbone network of an AS. However, it is possible for two different core network to agree to exchange labels with each other, in order to improve performance for traffic that passes through both.

SDN interfaces

When talking about SDN, we often talk about four different interfaces.

• The southbound interface is the defining interface of SDN. This is the interface between software-controlled switches, and the controller. On this interface, a standardized protocol like OpenFlow is used.
• The northbound interface is the interface between the SDN controller and an application. Requirements for different applications differ by a lot, so this interface is not standardized, and such standardization would probably lead to more restrictions on what SDN could be used for.
• The westbound interface is the interface between SDN controllers belonging to different networks. This could be used to exchange information, such as monitoring results and routing information. For normal routing information, standardized protocols like BGP can be used.
• The eastbound interface is the interface between an SDN controller and a non-SDN network. For this interface, some kind of translation is needed, and it depends on the type of legacy network. For some networks, speaking normal BGP is enough.

Advantages of SDN

The main advantages and features about SDN are:

• Programmability: This is the key feature of SDN. The whole network can be programmed even after physical deployment without much hassle.
• Protocol independence: Since e.g. forwarding rules are entirely programmable, a SDN network is easy to adapt to new protocols. For example, upgrading from IPv4 to a dual IPv4 and IPv6 stack is possible by just updating the controller.
• Ability to dynamically alter network parameters: This is closely linked with programmability. The network can be altered dynamically, for example to respond better to specific types of traffic.
• Granularity: A SDN network can be controlled at different granularity. From just mapping input interfaces to output interfaces, to working on a per-packet or flow basis. This gives the network operator great flexibility in how the network is programmed.
• Elasticity: Since the controller runs entirely in software, it is possible to scale it up and down as a response to traffic changes. In a traditional network, this would probably have required to replace the routers, which is time-consuming, expensive, and (most likely) introduces downtime.

Specialized services

In the European Union, net neutrality is a legal requirement for ISP's. However, there exists an exemption for "specialized services". The idea of a specialized service is that ISP's should be allowed to do more than just sell internet access, while still having fair competition.

The full definition of a "specialized service" given by the EU is:

services other than internet access services which are optimised for specific content, applications or services, or a combination thereof, where the optimisation is necessary in order to meet requirements of the content, applications or services for a specific level of quality

Defining specialized services has been difficult, and there are gray areas.