Course: COMP347 Computer Networks (Revision 10) | Textbook: Kurose & Ross, Computer Networking: A Top‑Down Approach (9th ed.)
Upon completion of this comprehensive review tutorial, students should be able to:
This final tutorial integrates all the concepts covered in Unit 4, providing a cohesive view of the network‑layer data plane. We revisit the fundamental principles—forwarding vs. routing, datagram vs. virtual‑circuit, best‑effort service—and show how they manifest in the architecture of routers, the design of IP (IPv4 and IPv6), and the mechanisms of fragmentation, NAT, and ICMP. We explore how generalized forwarding and SDN are transforming the data plane, and how queueing, scheduling, and QoS provide differentiated services. We also consolidate security and operational considerations, emphasizing the need for defense in depth. By the end, you will have a comprehensive understanding of how packets are processed, forwarded, and controlled in the Internet's network layer.
The network layer provides host‑to‑host communication, encapsulating transport segments into datagrams. Its two primary functions are forwarding (local, per‑router action of moving packets from input to output) and routing (network‑wide process of determining paths). The Internet adopts a connectionless, best‑effort datagram service, where each packet is independent and routers maintain no per‑flow state. This design enables scalability and robustness, while reliability is delegated to higher layers (TCP).
Key distinctions:
Routers consist of input ports (line termination, link‑layer processing, lookup, queuing), switching fabric (shared memory, bus, crossbar), output ports (buffering, scheduling, encapsulation), and the routing processor (control plane). The forwarding lookup at input ports uses longest‑prefix matching, often accelerated by TCAM. Switching fabrics determine the internal throughput; crossbars are non‑blocking but require scheduling. Output ports manage buffers and schedule transmissions using algorithms like FIFO, Priority, or WFQ.
Design trade‑offs:
Forwarding tables map destination prefixes to next hops. CIDR allows variable‑length prefixes, so routers use longest‑prefix matching to select the most specific entry. Data structures include binary trie, Patricia trie, multi‑bit trie, and TCAM. Route aggregation reduces table size by combining contiguous prefixes.
IPv4 header fields (version, IHL, TOS, total length, identification, flags, fragment offset, TTL, protocol, checksum, source/destination addresses, options) are critical for forwarding and fragmentation. IP addressing is hierarchical: network prefix and host identifier. Special addresses: private (RFC 1918), loopback, broadcast, multicast. DHCP dynamically assigns addresses.
Subnetting divides a network into smaller subnets using subnet masks. VLSM allows different subnet sizes. CIDR notation (prefix length) enables efficient allocation and route summarization (aggregation), which reduces routing table size.
When a datagram exceeds the MTU of a link, routers fragment it (if DF flag is 0). Fragments are reassembled at the destination. The fragment offset is in 8‑byte units; MF flag indicates more fragments. Path MTU Discovery (PMTUD) uses ICMP Fragmentation Needed messages to avoid fragmentation.
NAT conserves public IP addresses by translating private addresses to public ones. PAT (NAPT) uses port numbers to multiplex many private hosts to one public IP. NAT provides a basic firewall but breaks end‑to‑end connectivity. Traversal techniques (STUN, TURN, ICE) and ALGs are used for protocols that embed addresses (FTP, SIP). Carrier‑grade NAT (CGNAT) and NAT64 are used in IPv6 transition.
ICMP provides error reporting and diagnostics. Common messages: Destination Unreachable, Time Exceeded, Echo Request/Reply (ping), Redirect, Parameter Problem. Traceroute uses Time Exceeded to discover the path. ICMP is also used for PMTUD. Security concerns include ping floods, Smurf attacks, and ICMP redirect spoofing; filtering and rate limiting are recommended.
IPv6 addresses are 128 bits, written in colon‑hexadecimal notation. Address types: unicast (global, link‑local, unique local), multicast, anycast. The IPv6 fixed header is 40 bytes (no checksum, no fragmentation fields). Extension headers (Hop‑by‑Hop, Routing, Fragment, etc.) provide optional features. Stateless Address Autoconfiguration (SLAAC) and Neighbor Discovery Protocol (NDP) replace ARP. Transition mechanisms: dual‑stack, tunneling (6to4, Teredo), and translation (NAT64).
Generalized forwarding uses match‑plus‑action, allowing forwarding based on multiple header fields. OpenFlow is a southbound protocol that enables centralized control. Flow tables contain entries with match fields, priority, counters, instructions, and timeouts. Multiple tables form a pipeline. Group tables support multicast/load balancing; meter tables handle rate limiting. SDN decouples control and data planes; controllers (OpenDaylight, ONOS, Ryu) manage the network. P4 enables programmable data planes, allowing custom protocols and in‑network computing.
Queueing and scheduling determine packet order and drop decisions. Algorithms: FIFO (simple), Priority Queueing (low delay for high priority), Round‑Robin and Weighted Round‑Robin (fairness), Weighted Fair Queueing (bit‑level fairness). Active Queue Management (RED, WRED, ECN) signals congestion before buffer overflow. Traffic shaping (leaky bucket, token bucket) controls rate. QoS architectures: Best‑Effort, IntServ (RSVP, per‑flow), DiffServ (aggregated classes, PHBs).
Data‑plane security protects against IP spoofing, fragmentation attacks, ICMP abuse, and flow table overflow. Techniques: ACLs (permit/deny rules), stateful firewalls, ingress/egress filtering (BCP 38), uRPF, CoPP. Operational best practices: secure management (SSH), logging (syslog), monitoring (NetFlow/sFlow), and regular audits. In SDN, security challenges include controller compromise and flow table exhaustion; mitigations include TLS, rate limiting, and controller redundancy. Zero‑trust networking and encryption (MACsec, IPsec) are emerging trends.
The data plane does not operate in isolation; it interacts with the control plane (routing protocols, forwarding table updates), the transport layer (TCP/UDP checksums, ports), and the link layer (MTU, framing). The end‑to‑end principle argues for a simple network core with intelligence at the edges. The evolution from IPv4 to IPv6, from static forwarding to SDN, and from best‑effort to differentiated services reflects the ongoing quest for scalability, performance, and flexibility. Understanding these relationships is essential for network design, troubleshooting, and innovation.
Q1. Which of the following is a function of the data plane?
B) Forwarding packets based on destination address
Q2. In longest‑prefix matching, which entry is selected for a given destination IP?
B) The entry with the longest matching prefix
Q3. Which IPv4 header field is used to prevent packets from looping indefinitely?
B) TTL
Q4. Which subnet mask corresponds to a /27 prefix?
C) 255.255.255.224
Q5. In IPv4 fragmentation, the Fragment Offset field is measured in units of:
B) 8 bytes
Q6. Which of the following is a private IP address range?
B) 192.168.0.0/16 (also 10.0.0.0/8, 172.16.0.0/12)
Q7. What does the DF flag indicate in the IPv4 header?
B) The datagram should not be fragmented
Q8. In NAT, PAT (NAPT) uses which field to differentiate multiple internal hosts?
B) Source port number
Q9. Which ICMP message is used by traceroute to discover intermediate routers?
C) Time Exceeded
Q10. In IPv6, which address type is used for one‑to‑many communication?
B) Multicast
Q11. In OpenFlow, a flow entry contains which of the following?
A) Match fields, priority, counters, instructions
Q12. Which scheduling algorithm provides fair bandwidth allocation based on weights?
C) Weighted Fair Queueing
Q13. Which of the following is a mechanism to prevent IP spoofing?
D) All of the above
Q14. The primary advantage of SDN is:
B) Programmability and centralized control
Q15. Which field in the IPv6 header replaces the IPv4 TTL?
A) Hop Limit
Q16. RED (Random Early Detection) is an example of:
C) Active Queue Management
Q17. Which of the following is NOT a component of router architecture?
D) Transport layer
Q18. The IPv6 unspecified address is:
B) ::
Q19. In DiffServ, which PHB is used for low‑delay, low‑loss traffic like VoIP?
A) EF
Q20. Which ICMP message is sent when a router receives a datagram with TTL=0?
B) Time Exceeded
Q21. In an M/M/1 queue, if arrival rate λ = 0.6 and service rate μ = 1, what is the average queue length?
B) 1.5 (L = ρ/(1‑ρ) = 0.6/0.4 = 1.5)
Q22. Which of the following is a transition mechanism for IPv6?
D) All of the above
Q23. In OpenFlow, the pipeline of multiple tables allows:
A) Sequential processing of packets by multiple tables
Q24. Which of the following is used for traffic policing at the network edge?
B) Leaky bucket
Q25. The main purpose of egress filtering is to:
B) Prevent internal hosts from sending spoofed packets
Q26. Which of the following is true about IPv6 fragmentation?
B) Only the source host can fragment
Q27. In SDN, the southbound interface connects:
B) Controller to switches
Q28. What is the role of the "Identification" field in IPv4?
B) To identify fragments belonging to the same datagram
Q29. Which QoS architecture requires per‑flow state and uses RSVP?
B) IntServ
Q30. A router's control plane is responsible for:
B) Exchanging routing information and computing forwarding tables
Q31. In IPv6, which extension header is used for source routing?
B) Routing
Q32. Which of the following is a countermeasure against flow table overflow in SDN?
D) All of the above
Q33. Explain the relationship between the RIB and FIB in a router, and how they are used in forwarding.
The Routing Information Base (RIB) contains all routes learned from routing protocols, with multiple paths and metrics. The Forwarding Information Base (FIB) is a subset optimized for fast lookup, containing the best routes for forwarding. The RIB is maintained by the control plane; the FIB is distributed to the data plane (input ports) for per‑packet forwarding decisions.
Q34. Describe the process of Path MTU Discovery and the role of ICMP in it.
PMTUD works by sending packets with the DF flag set. When a router encounters a link with a smaller MTU, it drops the packet and sends an ICMP Fragmentation Needed (Type 3, Code 4) message back to the source, indicating the MTU of the next hop. The source adjusts its packet size accordingly and retransmits.
Q35. Compare and contrast the operation of NAT and IPv6 in terms of end‑to‑end connectivity and address conservation.
NAT conserves IPv4 addresses by allowing many private hosts to share a public IP, but it breaks end‑to‑end connectivity and complicates peer‑to‑peer applications. IPv6 provides a huge address space (128 bits), eliminating the need for NAT and restoring end‑to‑end connectivity, while also simplifying header processing.
Q36. Explain the concept of generalized forwarding and how OpenFlow implements it.
Generalized forwarding allows forwarding decisions based on multiple header fields, not just destination IP. OpenFlow implements this through flow tables, where each entry has match fields (e.g., source/destination IP, MAC, ports, protocol), priority, counters, instructions (actions like output, drop, modify), and timeouts.
Q37. What is the difference between a leaky bucket and a token bucket traffic shaper?
The leaky bucket enforces a constant output rate by buffering packets and draining them at a fixed rate; excess packets are dropped. The token bucket allows bursts up to the bucket size; packets are transmitted only if tokens are available, and tokens are generated at a constant rate, enabling average rate control with burst tolerance.
Q38. An enterprise network has the private IP block 172.16.0.0/16. They need to create subnets for 6 departments with host requirements: Dept A: 4000, Dept B: 2000, Dept C: 1000, Dept D: 500, Dept E: 200, Dept F: 100. Design a VLSM scheme and provide the subnet addresses for each department.
Dept A: /20 (4094 usable) → 172.16.0.0/20 (0.0‑15.255). Dept B: /21 (2046) → 172.16.16.0/21 (16.0‑23.255). Dept C: /22 (1022) → 172.16.24.0/22 (24.0‑27.255). Dept D: /23 (510) → 172.16.28.0/23 (28.0‑29.255). Dept E: /24 (254) → 172.16.30.0/24 (30.0‑30.255). Dept F: /25 (126) → 172.16.31.0/25 (31.0‑31.127).
Q39. A router receives an IPv4 datagram with total length 4000 bytes, header length 20 bytes, DF=0, and MTU of the outgoing link is 1500 bytes. Calculate the fragment offsets, MF flags, and total lengths for each fragment. How many fragments?
Payload = 3980 bytes. Max payload per fragment = 1480 bytes. Number of fragments = ceil(3980/1480) = 3. Fragments: 1) offset 0, MF=1, total length=1500; 2) offset 185 (1480/8), MF=1, total length=1500; 3) offset 370, MF=0, total length=20+(3980-2960)=20+1020=1040.
Q40. An internal host 192.168.1.10:12345 initiates a TCP connection to external server 8.8.8.8:80 via a PAT router with public IP 203.0.113.5. The router assigns external port 50001. What mapping is stored? What are the source and destination addresses/ports on the outgoing packet?
Mapping: (192.168.1.10:12345, 8.8.8.8:80) ↔ (203.0.113.5:50001, 8.8.8.8:80). Outgoing: source 203.0.113.5:50001, destination 8.8.8.8:80.
Q41. A network administrator wants to prioritize VoIP traffic (RTP) over web traffic. They have a 10 Mbps link. Describe a QoS strategy using DiffServ and scheduling.
Mark VoIP packets with DSCP EF, web traffic with BE. Use Priority Queueing for EF traffic to ensure low delay. For web traffic, use a separate queue with WRR or a weighted scheduler to allocate remaining bandwidth. To prevent VoIP from starving web, rate‑limit VoIP to, say, 7 Mbps.
Q42. In an SDN network, the controller detects a compromised host sending many spoofed packets. How can the controller respond automatically?
The controller can install a flow entry in the edge switch to drop all traffic from that host's MAC or IP, or redirect the traffic to a quarantine VLAN for inspection. This can be done programmatically via the southbound API.
Q43. A router receives a packet with source IP 192.168.1.5, destination IP 10.0.0.1, TTL=2. The router has a forwarding table with default route via eth0. What happens to the packet? What ICMP message, if any, is sent?
The router decrements TTL to 1 and forwards the packet to the next hop via eth0. No ICMP is sent because TTL is not 0. If TTL had been 1, it would drop and send Time Exceeded.
Q44. Compare the processing of an IPv4 packet through a traditional router vs. an OpenFlow switch. Highlight the differences in lookup and actions.
Traditional router: lookup on destination IP only (longest‑prefix), action is forward to a specific port. OpenFlow: lookup on multiple match fields (e.g., IPs, ports, protocol) with priority; actions can be output, drop, modify header, send to controller, or group. Traditional is stateless; OpenFlow can be stateful with counters and timeouts.
Q45. Explain how SLAAC works in IPv6. Include the roles of Router Solicitation, Router Advertisement, and Duplicate Address Detection.
Host sends Router Solicitation (RS) to all‑routers multicast. Routers reply with Router Advertisement (RA) containing the network prefix (typically /64). Host combines the prefix with its interface identifier (from MAC or random) to form an address. It then performs Duplicate Address Detection (DAD) using Neighbor Solicitation to ensure uniqueness. If successful, the address is configured.
Q46. A network uses WFQ with three classes: weights 1, 2, and 3, and link capacity 100 Mbps. What are the guaranteed rates for each? If class 1 has no traffic, how is the bandwidth distributed?
Total weight = 6. Rates: 16.67 Mbps, 33.33 Mbps, 50 Mbps. If class 1 has no traffic, its bandwidth is distributed proportionally to the remaining weights (2 and 3), so class 2 gets 40 Mbps, class 3 gets 60 Mbps.
Q47. An organization uses private addresses and NAT. They want to host a public web server. What steps are needed? How does NAT affect incoming connections?
Configure static NAT or port forwarding on the NAT router: map public IP:80 to internal server IP:80. Incoming connections to the public IP on port 80 are translated to the internal server. This allows external access, but the server cannot initiate outbound connections using the same public IP unless PAT is also configured.
Q48. Describe the role of the Flow Label in IPv6. How can it be used for QoS?
The Flow Label (20 bits) identifies packets belonging to a specific flow, allowing routers to classify and process them without deep packet inspection. It can be used for QoS by providing a hint for similar treatment (e.g., same path, same priority).
Q49. A router is configured with an ACL that permits TCP traffic from any to port 80 and denies all other traffic. An ICMP echo request is received. What happens?
The ICMP packet does not match the permit rule (since it's not TCP port 80) and will be implicitly denied (dropped) because of the implicit deny at the end of the ACL.
Q50. Explain the concept of "bufferbloat" and its impact on TCP performance. What AQM techniques can mitigate it?
Bufferbloat is excessive latency caused by oversized buffers in network devices. It degrades TCP performance by increasing RTT and causing spurious timeouts. AQM techniques like RED, CoDel, and PIE reduce bufferbloat by dropping or marking packets before the buffer is full, keeping queues short.
Given the IP address 192.168.5.25/28, determine the network address, broadcast address, and the range of usable host addresses.
/28 means mask 255.255.255.240, block size 16. Network address: 192.168.5.16 (since 25 is in 16‑31). Broadcast: 192.168.5.31. Usable hosts: 192.168.5.17 – 192.168.5.30.
Write an OpenFlow flow entry that matches on any packet with source IP 10.0.0.1 and destination TCP port 80, and forwards it to output port 5. Include priority and idle timeout.
Match: src_ip=10.0.0.1, protocol=TCP, dst_port=80. Priority: 100. Instructions: output:5. Idle timeout: 60 seconds.
Explain the difference between an ACL and a stateful firewall. When would you use each?
ACLs are stateless and filter packets based on headers. Stateful firewalls track connection state and can allow return traffic automatically. Use ACLs for simple filtering (e.g., restricting management) and stateful firewalls for perimeter security where connection tracking is required.
A router has a crossbar switch fabric with 8 ports, each at 10 Gbps. What is the maximum aggregate throughput if there is no contention? If all traffic is destined to a single output port, what is the throughput?
No contention: 8 * 10 = 80 Gbps. Single output: limited to 10 Gbps (output port capacity).
Calculate the checksum for a simple IPv4 header (in hex): 45 00 00 28 12 34 00 00 20 06 00 00 C0 A8 01 01 C0 A8 01 02. (Assume the checksum field is 0x0000).
Sum of 16‑bit words: 0x4500 + 0x0028 + 0x1234 + 0x0000 + 0x2006 + 0x0000 + 0xC0A8 + 0x0101 + 0xC0A8 + 0x0102. Sum = 0x4500+0x0028=0x4528; +0x1234=0x575C; +0x0000=0x575C; +0x2006=0x7762; +0x0000=0x7762; +0xC0A8=0x1380A (wrap to 0x380B); +0x0101=0x390C; +0xC0A8=0x0F9B4 (wrap to 0x9B5); +0x0102=0x9C7. One's complement = 0xFFFF - 0x09C7 = 0xF638. Checksum = 0xF638.
Describe the steps of the DHCP DORA process and the role of each message.
Discover: Client broadcasts to find DHCP servers. Offer: Server(s) reply with an offered IP address. Request: Client broadcasts its acceptance of an offer. Acknowledge: Server assigns the address and provides configuration parameters (lease time, DNS, gateway).
Compare IPv4 and IPv6 fragmentation handling. Why did IPv6 change the model?
IPv4 allows routers to fragment; IPv6 only allows source fragmentation using extension headers. IPv6 change reduces router processing, simplifies forwarding, and improves performance, but requires sources to perform PMTUD.
An organization has a /20 address block. They want to create subnets of size /24. How many subnets can they create, and what are the subnet addresses (first three)?
From /20 to /24, borrow 4 bits → 16 subnets. First three: if block is 192.168.0.0/20, subnets are 192.168.0.0/24, 192.168.1.0/24, 192.168.2.0/24.
Explain how ECN works with RED and TCP. What are the benefits over pure drop?
RED marks packets (sets CE bit) instead of dropping when congestion is detected. TCP receivers echo this to the sender (ECN‑Echo), and the sender reduces its rate. Benefits: no packet loss, lower retransmission, better throughput, and lower delay.
A token bucket has rate r = 2 Mbps and bucket size b = 1 MB. A source sends a 3 MB file. How long will it take to send the file if the bucket is initially full? What is the average throughput?
Initial burst: 1 MB at wire speed (negligible). Remaining 2 MB sent at 2 Mbps = 2 MB / 2 Mbps = 16 seconds (since 2 MB = 16 Mb). Total time ≈ 16 s. Average throughput = 3 MB / 16 s = 1.875 Mbps (but the token rate is 2 Mbps, so over long time it's 2 Mbps).
Design a DiffServ policy for a network with four classes: Voice, Video, Business Data, and Best‑Effort. Assign DSCP values and describe the scheduling.
Voice: EF (46), Video: AF4 (34), Business: AF2 (18), Best‑Effort: BE (0). Scheduling: PQ for EF, WRR for AF classes with weights (e.g., AF4 weight 40%, AF2 30%, BE 30%).
Explain the concept of "micro‑segmentation" in zero‑trust networking and how SDN can enable it.
Micro‑segmentation divides the network into small security zones, often per application or workload. SDN can enforce policies by installing fine‑grained flow entries that isolate traffic between zones, using match fields like source/destination IP, VLAN, or application identity.
A router receives a packet with the following headers: IP src=10.0.0.1, dst=8.8.8.8, protocol=UDP, dst port=53. It has an ACL: permit udp any any eq 53, deny any any. What happens? What if the packet is a fragment with offset >0?
The packet matches the permit rule (UDP port 53) and is forwarded. If it is a fragment with offset >0, the destination port is not visible (only the first fragment carries the port), so the ACL may not match and could be denied. To handle this, some routers reassemble fragments before ACL evaluation.
Compare the operation of NDP in IPv6 with ARP in IPv4. What are the advantages of NDP?
ARP is used in IPv4 for address resolution. NDP in IPv6 provides address resolution, router discovery, prefix discovery, and neighbor unreachability detection. NDP is more integrated and efficient, using ICMPv6 messages, and includes security features like SEND (though optional).
Explain the role of the Flow Label in IPv6 and how it can be used for load balancing.
The Flow Label identifies packets belonging to a specific flow. Routers can use the Flow Label (along with source/destination) to assign packets to the same path for load balancing, ensuring that all packets of a flow use the same link, avoiding reordering.
Write a comprehensive essay (800‑1000 words) on the evolution of the network‑layer data plane from the early days of the Internet to the present, covering IPv4, IPv6, SDN, and programmable data planes.
The data plane has evolved from simple destination‑based forwarding in IPv4 to flexible, programmable forwarding. Early routers used software lookup; now hardware (TCAM) enables wire‑speed. The introduction of CIDR improved address efficiency. IPv6 simplified the header and removed fragmentation. SDN and OpenFlow decoupled control and data planes, enabling centralized management. P4 allows custom protocols and in‑network computing. The future points to AI‑driven, intent‑based networking.
Explain the end‑to‑end principle and how NAT, firewalls, and SDN affect it. Discuss the trade‑offs.
The end‑to‑end principle states that intelligence should be at the endpoints, and the network should be simple. NAT breaks this by modifying addresses, firewalls by filtering, but they provide security and address conservation. SDN reintroduces programmability but centralizes control, potentially violating the principle for management. Trade‑offs: security vs. transparency, scalability vs. flexibility.
Design a complete subnetting plan for a new campus network with the following requirements: 5 buildings, each with up to 2000 hosts, and 20 point‑to‑point links (each requiring 2 hosts). Use a private address block (e.g., 10.0.0.0/16). Provide VLSM assignments.
Building subnets: each /21 (2046 hosts). 10.0.0.0/21 (0‑7), 10.0.8.0/21 (8‑15), 10.0.16.0/21, 10.0.24.0/21, 10.0.32.0/21. Point‑to‑point: /30 (2 hosts). Use 10.0.40.0/30, 10.0.40.4/30, ..., up to 20 subnets. All within 10.0.0.0/16.
Compare and contrast the DiffServ and IntServ QoS architectures. Which is more suitable for the Internet and why?
IntServ provides per‑flow QoS with RSVP, offering guaranteed services but poor scalability. DiffServ aggregates traffic into classes with per‑hop behaviors, using DSCP marking, and is scalable. DiffServ is more suitable for the Internet core because it avoids per‑flow state.
Explain the process of IPv6 stateless address autoconfiguration (SLAAC) in detail, including the steps and messages involved.
Host generates link‑local address (FE80::/64) and performs DAD. Host sends Router Solicitation to all‑routers multicast. Router replies with Router Advertisement containing prefix (and possibly other info). Host combines prefix with interface identifier (EUI‑64 or random) and performs DAD for the global address. If successful, the address is configured.
Describe the security vulnerabilities of ICMP and propose mitigation strategies for each.
Vulnerabilities: Ping flood (rate limit), Smurf (disable directed broadcasts), Redirect spoofing (disable redirects or filter). Mitigation: rate limiting, filtering, using CoPP.
Explain the concept of "programmable data planes" and how P4 enables them. Provide two example use cases.
Programmable data planes allow custom packet processing pipelines. P4 is a language to define them. Use cases: custom protocol support (e.g., new encapsulation), in‑network computing (e.g., load balancing, aggregation).
Compare the operation of a traditional router's forwarding table with an OpenFlow flow table. Highlight differences in match fields, actions, and control.
Traditional: destination IP only, output port, populated by routing protocols. OpenFlow: multiple fields, priority, actions (output, drop, modify, group), populated by a controller.
Design an ACL for a router that protects a DMZ containing web (port 80/443), email (SMTP 25, IMAP 143), and DNS (53) servers. Allow management (SSH) from the internal network only. Deny all other traffic.
``` access-list 200 permit tcp any host WEB eq 80 access-list 200 permit tcp any host WEB eq 443 access-list 200 permit tcp any host EMAIL eq 25 access-list 200 permit tcp any host EMAIL eq 143 access-list 200 permit udp any host DNS eq 53 access-list 200 permit tcp internal-net host ROUTER eq 22 access-list 200 deny ip any any ```
Explain the role of the "meter" table in OpenFlow. How is it used for traffic shaping?
Meter table measures packet rates and applies actions (drop, DSCP remark) when a rate limit is exceeded. It enables traffic shaping by policing traffic at the switch.
Analyze the impact of NAT on peer‑to‑peer applications. How do STUN, TURN, and ICE help?
NAT prevents direct connections. STUN discovers public IP/port mapping; TURN relays when direct fails; ICE combines STUN/TURN to find the best path.
Describe the concept of "control plane protection" in routers and list three mechanisms used to protect it.
Control plane protection defends the routing processor from overload. Mechanisms: CoPP (rate limiting), ACLs for management access, and dedicated management interfaces.
Compare and contrast IPv4 and IPv6 addressing, header format, and fragmentation. Discuss the implications for router performance.
IPv4: 32‑bit, variable header, checksum, router fragmentation. IPv6: 128‑bit, fixed header (40 bytes), no checksum, no router fragmentation. IPv6 improves performance by simplifying processing and removing checksum calculation.
Explain the role of the "Group Table" in OpenFlow and describe the different group types (all, select, indirect, fast failover).
Group table defines groups of actions. All: execute all buckets. Select: choose one based on hash (load balancing). Indirect: execute one bucket (like a function). Fast failover: first live bucket (for redundancy).
Discuss the future of the network‑layer data plane, considering the rise of programmable switches, AI/ML, and security requirements. Write a 500‑word analysis.
The future data plane will be highly programmable (P4) enabling rapid innovation. AI/ML will be used for adaptive forwarding, anomaly detection. Security will be integrated with encryption and zero‑trust. SDN and NFV will continue to drive virtualization. Challenges include scalability, complexity, and security of the control plane.
This comprehensive review tutorial has consolidated all major topics of Unit 4, providing a holistic understanding of the network‑layer data plane. Key takeaways:
With this knowledge, you are well‑prepared to design, operate, and troubleshoot network‑layer data planes in modern Internet environments.