Networks and security: the big picture

This course is a journey in two parts. In the first half you learn how the Internet works: layers, links, routers, TCP. In the second half you see where this structure is open to attack and how to write software securely. You can’t understand security without knowing the network. An attacker forges an IP header (spoofing), abuses the TCP handshake (SYN flood) or fills the queues (DoS). All of that is the subject of these first weeks.

This page teaches two things: the big picture of the Internet and delay calculation. An exam almost certainly includes a “how long does it take?” question. These rules are enough:

1. Transmission delay is $L/R$, propagation delay is $d/s$. Don’t mix them up.
2. Convert units. Bytes to bits (×8), km to metres, Mbps to $10^6$ bit/s.
3. Store-and-forward: a router does not forward a packet before it has received all of it. Each link adds its own $L/R$.
4. Throughput is the bottleneck link: the slowest link on the path.
5. If $La/R > 1$, the queue grows without bound.

What is the Internet?

There are two ways to look at it.

The hardware (“nuts and bolts”) view. The Internet is a network of networks that connects billions of end systems (hosts). A laptop, a phone and a server are each a host. Hosts are connected by communication links (fiber, copper, wireless) and packet switches (routers and link-layer switches). Hosts reach the Internet through an ISP (Internet Service Provider); ISPs in turn connect to each other hierarchically (access ISP, regional ISP, tier-1 ISP, IXP points).

The service view. The Internet is an infrastructure that provides communication services to distributed applications (web, email, video). The application programmer says “send this data reliably to that address” and the network handles the rest. This service is offered through a socket interface.

A protocol is a set of rules that defines the format and order of the messages exchanged between two or more parties, and the actions taken when a message is received. TCP, IP, HTTP and Ethernet are protocols. Standards are written in the IETF’s RFC documents.

The network edge and the network core

Packet switching and circuit switching

In the core, data can be moved in two basic ways.

Circuit switching. Before communication starts, a path is set up from source to destination, and resources are reserved on every link for this connection. The classic telephone network works this way. Link capacity is shared either by frequency (FDM, frequency-division multiplexing) or by time (TDM, time-division multiplexing). In TDM, time is divided into frames and frames into slots; each circuit gets one slot in every frame.

• Advantage: guaranteed rate, no queuing, predictable delay.
• Disadvantage: setup time; when a user goes silent, the reserved slot is wasted.

Packet switching. The message is divided into packets. Each packet is forwarded individually by routers that know the way. No resources are reserved; the link belongs to whoever has a packet at that moment. So packets may wait in a queue, and if the buffer fills up they may be lost (packet loss).

• Advantage: far more efficient for bursty traffic, no setup, simple.
• Disadvantage: delay and loss vary.

Worked example: file time in circuit switching

A 1,200,000-bit file is sent over a circuit that uses TDM on a 2.4 Mbps link with 30 slots. Setup takes 250 ms.

Rate per circuit   = 2.4 Mbps / 30 = 80,000 bps
Transmission time  = 1,200,000 / 80,000 = 15 s
Total              = 15 + 0.25 = 15.25 s

PITFALL · the whole link is not yours. In TDM your rate is $R/\text{number of slots}$. If you divide the file by 2.4 Mbps and get 0.5 s, you lose the question.

Statistical multiplexing

A 1 Mbps link; each user wants 100 kbps while active and is active only 10% of the time. Circuit switching admits at most 10 users. With packet switching and 35 users, the probability that more than 10 are active at the same time follows from the binomial distribution:

$P(X \ge 11) = \sum_{k=11}^{35}\binom{35}{k}(0.1)^k(0.9)^{35-k} \approx 4.24\times10^{-4}$

The problem is very rare. Packet switching carries 3.5 times as many users on the same link. This is why the Internet uses packet switching.

The four kinds of delay

When a packet goes from one router to the next, four delays add up:

$d_{nodal} = d_{proc} + d_{queue} + d_{trans} + d_{prop}$

Analogy: a convoy on a highway. A convoy of 10 cars passing through a toll booth is the transmission delay (convoy length / booth speed). One car covering the road between two booths is the propagation delay (distance / car speed). The two depend on completely different things.

Worked example: a single link

$L = 1500$ bytes, $R = 10$ Mbps, link 2000 km, $s = 2\times10^8$ m/s.

L = 1500 x 8 = 12,000 bit
dtrans = 12,000 / 10^7      = 0.0012 s = 1.2 ms
dprop  = 2 x 10^6 / 2 x 10^8 = 0.01 s  = 10 ms
if dproc = 0.02 ms and dqueue = 2.4 ms are given:
dnodal = 0.02 + 2.4 + 1.2 + 10 = 13.62 ms

On a long link propagation dominates; on a slow link transmission dominates.

TIP · when is $d_{prop} = d_{trans}$? When $d = s \cdot L/R$. For $L = 12000$ bits and $R = 1$ Mbps, $d = 2\times10^8 \times 0.012 = 2400$ km. On a shorter link the first bit reaches the far end before the last bit has even left the sender.

Store-and-forward and multiple links

A router must receive the whole packet before it starts forwarding it. For $N$ links and a single packet (ignoring propagation):

$d_{end\text{-}to\text{-}end} = N \cdot \frac{L}{R}$

If $P$ packets are sent back to back, the first packet arrives after $N L/R$, and each following packet arrives one $L/R$ behind it:

$d = (N + P - 1)\frac{L}{R}$

L = 12,000 bit, R = 10 Mbps -> L/R = 1.2 ms
N = 3 links, P = 1 packet : 3 x 1.2 = 3.6 ms
N = 3 links, P = 4 packets: (3 + 4 - 1) x 1.2 = 6 x 1.2 = 7.2 ms

If propagation is present, add each link’s $d_{prop}$ too: $N(L/R + d_{prop})$ for a single packet.

Queuing delay and traffic intensity

Suppose packets arrive at an average of $a$ per second, each $L$ bits. The traffic intensity is:

$I = \frac{La}{R}$

• $I \approx 0$: the queue is almost empty, delay is small.
• $I \to 1$: delay grows rapidly (not linearly, it blows up).
• $I > 1$: bits arrive faster than they can be sent. The queue grows without bound; in reality the buffer overflows and packet loss begins.

Example: $a = 100$ packets/s, $L = 12000$ bits, $R = 2$ Mbps gives $I = 1.2\times10^6 / 2\times10^6 = 0.6$.

If a question asks for the queuing delay of a specific packet, count the work ahead of it: if 4 packets are waiting ahead and half of the packet being sent remains, the delay is $4.5 \times L/R$. With $L/R = 1.2$ ms that is $5.4$ ms.

PITFALL · packet loss is also a security topic. If an attacker fills the queue on purpose ($I \gg 1$), legitimate packets are dropped. This is the network-layer counterpart of the DoS attack you will see later.

Throughput and the bottleneck

Throughput is the number of bits per second that reach the receiver. On links in series, the end-to-end throughput is the rate of the slowest link:

$\text{throughput} = \min(R_1, R_2, \ldots, R_N)$

If a link is shared equally among $n$ flows, it gives each flow $R/n$, and that goes into the min. Example: a 40 Mbit file passing through links of 5, 20 and a 100 Mbps link shared by 10 flows: $\min(5, 20, 10) = 5$ Mbps, time 8 s.

Bandwidth-delay product

$R \cdot d_{prop}$ is the number of bits that can be inside the link at the same time. For 10 Mbps and 10 ms it is $10^7 \times 0.01 = 100{,}000$ bits. You will meet this number again in sliding-window efficiency in week 3 and in the TCP window in week 8.

A first look at security

The Internet was originally designed for “mutually trusting users”. Security was added later. That is why many protocols do not authenticate by default. The basic framework of the second half of the course is the CIA triad:

As you learn each layer, ask: “Who can forge, read or modify the header at this layer?” This question ties the two halves of the course together.

Common mistakes