The IPv4 header, fragmentation, NAT and IPv6

On the previous page we calculated addresses. Now we look inside the packet that carries those addresses, the datagram. This is exactly what the network layer calls the data plane: the header is read, the TTL is decremented, the datagram is fragmented if necessary, and forwarded. The exam has three types of question: header field questions, fragmentation calculation, and IPv6 differences. Golden rules:

1. An IPv4 header without options is 20 bytes.
2. The offset is written in 8-byte units. The fragment data must be a multiple of 8 (except for the last fragment).
3. Only the destination host reassembles the fragments. Intermediate routers do not.
4. NAT changes the source address and port and keeps the mapping in a table.
5. The IPv6 header is a fixed 40 bytes, and routers do not fragment.

The IPv4 datagram header

If a TCP segment is carried over IPv4, there are at least 20 bytes of IP + 20 bytes of TCP header, that is 40 bytes of overhead per payload.

PITFALL · TTL is not seconds. Although it is called “time to live”, in practice it is a hop counter. A packet with TTL = 5 is dropped by the 5th router.

ICMP (Internet Control Message Protocol) carries error and control messages for this layer: echo request/reply (ping), destination unreachable, time exceeded. ICMP messages are carried inside IP datagrams (protocol = 1).

Fragmentation

Each link has a different maximum frame payload it can carry: the MTU (Maximum Transmission Unit). It is 1500 bytes for Ethernet. If a large datagram reaches a link with a small MTU, an IPv4 router splits it into pieces. Each fragment carries its own IP header, with the same Identification value, its own offset and the MF flag.

The calculation template:

$\text{fragment data}_{\max} = \left\lfloor \frac{\text{MTU} - 20}{8} \right\rfloor \times 8 \qquad \text{offset} = \frac{\text{byte position in the data}}{8}$

Example: a 5200-byte datagram (20-byte header), MTU = 1420.

data               = 5200 - 20 = 5180 bytes
data per fragment  = (1420 - 20) = 1400 → 1400/8 = 175, exactly a multiple of 8

fragment  data   total length  offset            MF
1         1400   1420          0                 1
2         1400   1420          1400/8 = 175      1
3         1400   1420          2800/8 = 350      1
4          980   1000          4200/8 = 525      0
check: 1400*3 + 980 = 5180

If MTU - 20 is not a multiple of eight, round down. For example, if the MTU is 1000, you can put 976 bytes of data, not 980, because the offset of the next fragment must be divisible by 8.

PITFALL · counting the header twice or not at all. What gets fragmented is the data. First remove the original header, split the data, then add 20 bytes again to each fragment. The total length of the fragments is larger than the original (because of the extra headers).

Backward questions also appear: the offset and length of the last fragment are given and the original size is asked. Formula: $\text{offset} \times 8 + (\text{last fragment length} - 20) + 20$.

last fragment: offset = 250, total length = 620, MF = 0
start of its data   250 * 8 = byte 2000
last fragment data  620 - 20 = 600 bytes
original data       2000 + 600 = 2600 bytes
original size       2600 + 20 = 2620 bytes

In these questions the fact that MF = 0 is critical: only the last fragment shows the end of the original. You can’t find the original size from a fragment with MF = 1.

If the DF flag is 1, the router cannot fragment; it drops the datagram and sends an ICMP “fragmentation needed”. If one fragment is lost, the destination throws away the whole datagram. This makes fragmentation expensive, and it is a security problem too: attacks using overlapping fragments (overlapping fragment attacks) try to get past firewalls.

NAT (Network Address Translation)

IPv4 addresses ran out. Dozens of devices in a home network reach the Internet with a single public address. The home router does NAT: for every outgoing packet it replaces the source IP with its own public address and the source port with a port of its choosing, and writes the mapping into the NAT translation table.

Private network: 192.168.1.0/24     NAT router public address: 203.0.113.9

OUTGOING  192.168.1.20:41000 → 198.51.100.80:443
NAT       source changes → 203.0.113.9:6012 → 198.51.100.80:443
table     203.0.113.9:6012  ↔  192.168.1.20:41000

RETURNING 198.51.100.80:443 → 203.0.113.9:6012
NAT       look up table   → 198.51.100.80:443 → 192.168.1.20:41000

Since the port field is 16 bits, a single public address can in theory support up to 65536 simultaneous mappings.

Criticisms of NAT: routers fiddling with port numbers violates the layering principle; it makes it hard to start a connection from outside to inside (P2P, hosting a server), which requires port forwarding or NAT traversal. On the security side, NAT is not a firewall, but it indirectly blocks unwanted inbound connections.

IPv6

The 32-bit IPv4 space ($2^{32} \approx 4.3$ billion) was not enough. An IPv6 address is 128 bits, $2^{128}$ addresses. Even a single /64 subnet has $2^{64} = 18446744073709551616$ addresses.

Notation rules. Eight 16-bit groups, in hexadecimal, separated by colons. Leading zeros in each group are dropped. Consecutive zero groups are shortened once with ::.

2001:0db8:0000:0000:0000:ff00:0042:8329  →  2001:db8::ff00:42:8329
fe80:0000:0000:0000:0204:61ff:fe9d:f156  →  fe80::204:61ff:fe9d:f156
2001:0db8:0000:0001:0000:0000:0000:0001  →  2001:db8:0:1::1
0000:0000:0000:0000:0000:0000:0000:0001  →  ::1   (loopback)

In the third example there are two zero regions: a single group (0) and three groups. :: is given to the longer one, and the single zero is written as 0.

Transition from IPv4 to IPv6. All routers cannot be replaced overnight. Two methods:

• Dual stack: the device speaks both IPv4 and IPv6.
• Tunneling: the IPv6 datagram is placed in the data part of an IPv4 datagram and carried through the IPv4-only routers in between. The router at the other end of the tunnel extracts it and continues as IPv6 (IPv4 protocol field 41).

TIP · why was the checksum removed? TCP/UDP and Ethernet already do error checking. Dropping a field that is recomputed at every hop makes routers faster. By the same logic, fragmentation was left to the source.

Security note: don’t trust the IP header

No field in the IP header is verified. The sender writes the source address itself; sending packets with a forged source address is called IP spoofing. It is the basis of the DDoS reflection attacks in week 10. Fragmentation can also be abused: fragments with overlapping offsets or fragment sequences that are never completed can fill the destination’s reassembly buffer or get past a firewall’s inspection. That is why ISPs filter packets with forged sources leaving their networks (ingress filtering), and firewalls reassemble fragments before inspecting them. If identity and integrity are needed, cryptography is used at a higher layer (IPsec, TLS).

Common mistakes