CCIE Professional Development: Routing TCP/IP, Volume I

Copyright Information

Copyright© 1998 by Macmillan Technical Publishing

Cisco Press logo is a trademark of Cisco Systems, Inc.

Al
l rights reserved. No part of this book may be reproduced or transmitted in any form
or by any means, electronic or mechanical, including photocopying, recording, or by
any information storage and retrieval system, without written permission from the
publi
sher, except for the inclusion of brief quotations in a review.

Printed in the United States of America 2 3 4 5 6 7 8 9 0

Library of Congress Cataloging
-in-
Publication Number 98
-
84220

Warning and Disclaimer

This book is designed to provide information abou
t
TCP/IP
. Every effort has been
made to make this book as complete and as accurate as possible, but no warranty or

Hughes and Lynette
Quinn, who managed the project, and Julie Fairweather, the
Executive Editor. In addition to being highly competent, they are three of the nicest
people anyone could hope to work with. Also, thanks to Jim LeValley, Associate
Publisher, who first approached
me about writing this book.

Thanks to Wandel & Golterman, and to Gary Archuleta, W&G's Regional Sales
Manager in Denver, for arranging the use of one of their excellent protocol analyzers
for the length of the project.

Finally, I want to thank my wife, Sa
ra, and my children: Anna, Carol, James, and
Katherine. Their patience, encouragement, and support were critical to the completion
of this book.

Feedback Information

At Cisco Press, our goal is to create in
-
depth technical books of the highest quality and value. Each
b
ook is crafted with care and precision, undergoing rigorous development that involves the unique
expertise of members from the professional technical community.

Readers' feedback is a natural continuation of this process. If you have any comments regarding

how we could improve the quality of this book, or otherwise alter it to better suit your needs, you
can contact us at


I ntroduction
Routing is an essential element of all but the
smallest data communications networks. At one level,
routing and the configuration of routers are quite simple. But as internetworks grow in size and
complexity, routing issues can become at once both large and subtle. Perversely, perhaps, I am
grateful f
or the difficult problems large
-
scale routing can present
—
as a network systems consultant,
these problems are my bread and butter. Without them, the phrase "You want fries with that?" could
be an unfortunate part of my daily vocabulary.

Cisco Certified Int
ernetwork Experts are widely recognized for their ability to design, troubleshoot,
and manage large internetworks. This recognition comes from the fact that you cannot become a
CCIE by attending a few classes and then regurgitating some memorized facts ont
o a written test. A
CCIE has proven his or her expertise in an intense, famously difficult hands
-
on lab exam.

Objectives

This book is the first in a series designed to aid you in becoming a Cisco Certified Internetwork
Expert and the first of two volumes t
hat focuses on TCP/IP routing issues. Early in the project, Kim
Lew, Cisco Systems program manager, said, "Our objective is to make CCIEs, not to make people
who can pass the CCIE lab." I entirely agree with that statement and have used it as a guiding

on expertise
with Cisco routers and is ready to take the CCIE lab; however, he or she wants a structured
review and series of exercises for verification and validation.
CCIE Professional Development: Routing TCP/IP, Volume I focuses primarily on the intermediate-
level networking professional while offering to the beginner a structured outline of fundamental
information and to the expert the required challenges t
o hone his or her skills.

Organization

The fourteen chapters of the book are divided into three parts.

Part I examines the basics of networks and routing. Although more advanced readers may wish to
skip the first two chapters, I recommend that they at leas
t skim
Chapter 3, "Static Routing,"
and
Chapter 4, "Dynamic Routing Protocols."

Part II covers t
he TCP/IP Interior Gateway Protocols. Each protocol
-
specific chapter begins with a
discussion of the mechanics and parameters of the protocol. This general overview is followed by
case studies on configuring and troubleshooting the protocol on Cisco router
s in various network
topologies.

The Exterior Gateway Protocols, as well as such topics as multicast routing, Quality of Service
routing, router security and management, and routing IPv6 will be covered in Volume II.

Boldface
indicates commands and keywords that are entered literally as shown.

Italics
indicate arguments for which you supply values.

Important concepts are called out in margin notes fo
r quick reference.

Figure I.1
shows the conventions used in the illustrations throughout the book.

Figure I.1. Illustration conventions used in this book.All protocol analyzer displays shown in the book are taken from a Wandel & Goltermann DA
-
320
DominoLAN Internetwork Analyzer.

Foreword

In today's world of networki
ng, mission
-
critical networks are being designed for data, voice, and
video. Due to different traffic patterns and the quality of service required by each type of
information, solid hands-
on experience is imperative for managing, designing, and troubleshoo
ting

Routing TCP/IP, Volume I
, Jeff Doyle does a fantastic job of building the TCP/IP concepts, from IP
address classes to analyzing protocol metrics. Each chapter contains examples, network t
opologies
with IP addresses, packet analysis, and Cisco debugging outputs. In my opinion, the best parts are
the case studies, in which Jeff compares different features of the protocol by using more or less the
similar topology. This generates a strong und
erstanding of the protocol concepts and features.

I recommend
CCIE Professional Development: Routing TCP/IP, Volume I
for any networking
certification, and I believe that it also makes an excellent university networking course book.

Imran Qureshi

CCIE Prog
ram Manager

Part I: Routing Basics

Chapter 1
Basic Concepts: Internetworks, Routers, and Addresses
Chapter 2
TCP/IP Review
Chapter 3
Static Routing
Chapter 4
Dynamic Routing Protocols
Chapter 1. Basic Concepts: Internetworks, Routers, and

-
boggling pace, but it was certainly not an immediate
alternative to centralized, mainframe
-
based computing. There was a ramping
-
up period in whic
h both
software and hardware had to be developed to a level where personal computers could be taken seriously.

Bicycles with Motors

One of the difficulties of decentralized computing is that it isolates users from one another and from the
data and applicat
ions they may need to use in common. When a file is created, how is it shared with Tom,
Dick, and Harriet down the hall? The early solution to this was the storied SneakerNet: Put the file on
floppy disks and hand carry them to the necessary destinations.
But what happens when Tom, Dick, and
Harriet modify their copies of the file? How does one ensure that all information in all versions are
synchronized? What if those three coworkers are on different floors or in different buildings or cities?
What if the
file needs to be updated several times a day? What if there are not three coworkers, but 300
people? What if all 300 people occasionally need to print a hard copy of some modification they have
made to the file?

The
local-area network, or LAN, is a small s
tep back to centralization. LANs are a means of pooling and
sharing resources. Servers enable everyone to access a common copy of a file or a common database; no
more "walkabouts" with floppies, no more worries about inconsistent information. E

protocol
, i
s generally called a
Media Access Control
(MAC). The MAC, as the name
implies, dictates how each machine will access and share a given medium.

So far, a LAN has been defined as being a community of devices such as PCs, printers, and servers
coexisting on a
common communications medium and following a common protocol that regulates how
they access the medium. But there is one last requirement: As in any community, each individual must be
uniquely identifiable.

Data Link Addresses

In a certain community in Co
lorado, two individuals are named Jeff Doyle. One Jeff Doyle frequently
receives telephone calls for the person with whom he shares a name—
so much so that his clever wife has
posted the correct number next to the phone to redirect errant callers to their d
esired destination. In other
words, because two individuals cannot be uniquely identified, data is occasionally delivered incorrectly
and a process must be implemented to correct the error.

Among family, friends, and associates, a given name is usually suf
ficient for accurately distinguishing
individuals. However, as this example shows, most names become inaccurate over a larger population. A
more unique identifier, such as a United States Social Security number, is needed to distinguish one
person from eve
ry other.

address and a source address. The format of the addr
ess depends on the particular MAC protocol, but all
the addresses serve the same purpose: to uniquely identify the machine for which the frame is destined
and the device from which it was sent.

Figure 1.2. The frame format of a few common LAN data link fra
mes.The three most common data links currently used in LANs are Ethernet, Token Ring, and FDDI.
Although each link is drastically different from the
others, they share a common format for addressing
devices on the network. This format, originally standardized by Xerox's Palo Alto Research Center
(PARC)
[2]
and now administered by the Institute
of Electrical and Electronics Engineers (IEEE), is
variously called the burned
-
in address,
[3]
the physical address, the machine address, or most commonly,
the MAC address.
[2]

The full name, as rea
ding any modern text on networking will tell you, is The Now Famous Xerox PARC.

[3]
The address is usually permanently programmed, or burned in, to a ROM on the network interface.

and goes wherever the device goes.
[5]

[5]
Although some data link addresses may be or must be administratively configured, the point is that they are identifiers, unique within a
network.

Most adults have several street addresses through their lives, but few have mo
re than one given name. A
name identifies an entity
—
whether a person or a PC. An address describes where that person or PC is
located.

In the interest of clarity, this book uses the term
data link identifier
or
MAC identifier instead of MAC
address. The re
ason for making such a distinction will soon be clear.

Repeaters and Bridges

The information presented so far may be distilled into a few brief statements:
A data communication network is a group of two or more devices connected by a common, shared
medium.

These devices have an agreed
-
upon set of rules, usually called the Media Access Control, or


Attenuation
Interference
Distortion

As the distance the signal must tra
vel down the wire increases, so do the degrading effects of these three
factors. Photonic pulses traveling along an optical fiber are much less susceptible to interference but will
still succumb to attenuation and distortion.

Repeaters are added to the wir
e at certain intervals to alleviate the difficulties associated with excessive
distance. A repeater is placed on the media some distance from the signal source but still near enough to
be able to correctly interpret the signal (see
Figure 1.5
). It then repeats the signal by producing a new,
clean copy of the old degraded signal. Hence, the name
repeater.
Figure 1.5. By placing a repeater in the link at a distance where th
e original signal can still be recognized,
despite the effects of attenuation, interference, and distortion, a fresh signal can be generated and the
length of the wire extended.A repeater may be thought of as part of the physical medium. It has no real intelligence, but merely
regenerates a signal; a digital repeater is sometimes facetiously called a "bit spitter" for this reason.
The second problem a
ssociated with growing LANs is congestion. Repeaters are added to extend the
distance of the wire and to add devices; however, the fundamental reason for having a LAN is to share
resources. When a too-


The bridge l
earns by listening
promiscuously on all its ports. That is, every time a station transmits a
frame, the bridge examines the source identifier of the frame. It then records the identifier in a
bridging
table, along with the port on which it was heard. The b
ridge therefore learns which stations are out port 1,
which are out port 2, and so on.
In
Figure 1.6, the bridge uses the information in its bridging table to forward fr
ames when a member of
one population—say, a station out port 1—
wants to send a frame to a member of another population: a
station out port 2.
A bridge that only learns and forwards would have no use. The real utility of a bridge is in the third
function, f
iltering.
Figure 1.6
shows that if a station out port 2 sends a frame to another station out port 2,
the bridge will examine the frame. The bridge consults its bridging
table and sees that the destination
device is out the same port on which the frame was received and will not forward the frame. The frame is
filtered.

Bridges enable the addition of far more devices to a network than would be possible if all the devices
we
re in a single population, contending for the same bandwidth.
Filtering
means that only frames that


Table 1.1

compares and contrasts LANs and WANs.
[7]

A third term, which is falling into general disuse, is metropolitan-
area network, or MAN. It is just as well that this term is dying off; it grays
the distinction between a LAN and a WAN. Is a MAN a big LAN or a small WAN? Dying also is a truly bad pun, which is that bridges ensure
that no MAN is an island.

A fourth problem is one of scalability. Bridges allow a network to be segregated into smaller populations
of stations; in this way station
-to-
station traffic is localized. Certain types of frames cannot be localized,
though. Some applications require data to be
broad cast—
that is, the data must be delivered to all stations
on a network. Ethernet, Token Ring, and FDDI networks use a reserved destination identifier of all ones
(0?ffff.ffff.ffff) for broadcasting. Bridges must forward a broadcast frame out all ports to ensu
re that all
stations receive a copy. As a bridged network becomes larger and larger, more and more stations will be
originating broadcast traffic; soon, broadcasted frames cause the network to become congested again.
Table

1.1. Fundamental differences be
tween LANs and WANs.

LAN


interface message processors.
[8]
More recently,
routers were called
gateways
; remnants of this nomenclature can still be found in terms such as Border
Gateway
Protocol (BGP) and Interior
Gateway
Routing Protocol (IGRP).
[9]
In the Open System
Interconnection (OSI) world, routers are known as
Intermediate Systems
(IS).

[8]
The parent of modern packet
-
switched networks was the AlohaNet, crea
ted at the University of Hawaii in the late 1960s by Norman
Abramson. Because routers at that time were called IMPs, Dr. Abramson rather impishly named his router Menehune: a Hawaiian elf.

[9]
The term gateway is now generally accepted to mean an applicati
on gateway, as opposed to a router, which would be a network gateway.

All of these aliases are descriptive of some aspect of what a router does. As interface message processor
implies, a router switches data messages, or packets, from one network to anothe
r. As

Just as a data link may directly connect two devices, a router a
lso creates a connection between two
devices. The difference is that, as
Figure 1.8
shows, whereas the communication path between two
devices sharing a common data link
is a physical path, the communication path provided by routers
between two devices on different networks is a higher
-
level, logical path.
Figure 1.8. A router creates a logical path between networks.NOTE

Packet
This concept is vitally important for understanding a router's function. Notice that the logical path, or
route, between the devices in
Figure 1.8
traverses several types of data links: an Ethernet, an FDDI ring, a
serial link, and a Token Ring. As noted earlier, to be delivered on the physical path of a data link, data
must be encapsulated within a frame, a
sort of digital envelope. Likewise, to be delivered across the
logical path of a routed internetwork, data must also be encapsulated; the digital envelope used by routers
is a packet.
As noted earlier, each type of data link has its own unique frame format. The internetwork route depicted
in
Figure 1.8
crosses several data links, but the packet remains the same from end to end.


2.
That router (router A in
Figure 1.9
) removes the packet from the Ethernet frame; router A knows
that the next-
hop router on the path is router B, out its FDDI interface, so router A encapsulates
the packet in an FDDI frame. Now the destination identifier in the frame
is the FDDI interface of
router B, and the source identifier is the FDDI interface of router A.

3.
Router B removes the packet from the FDDI frame, knows that the next
-
hop router on the path is
router C across the serial link, and sends the packet to C encaps
ulated in the proper frame for the
serial link.
4. Router C removes the packet and recognizes that the station for which the packet is destined is on
its directly connected Token Ring network; C encapsulates the packet in a Token Ring frame with
the destination identifier of the destination station and the source identifier of its Token Ring
interface. The packet has been delivered.

The key to understanding this entire process is to notice that the frames and their related data link
identifiers, which have rel
evance only for each individual network, change for each network the packet
traverses. The packet remains the same from end to end.

But how did the originating host know that the packet needed to be delivered to its default gateway for
routing? And how did the routers know where to send the packet?
Network Addresses
Now one of
the two questions posed at the end of the last section can be answered: The routers can
deliver the packet because the originating host put a destination address in the packet. From the
perspective of the router, the destination address is all that is nee
ded. As a rule, all routers really care
about is the location of each network. Individual devices are not relevant to the router; the router only
needs to deliver the packet to the correct destination network. When the packet arrives at the network, the
da
ta link identifier can be used to deliver the data to the individual device on the network.
NOTE

The fundamental purpose and function of a router
How routers handle destination addresses is critically important and bears repeating. The purpose of a
router
is to deliver packets to the proper destination networks. As such, the only individual devices
routers typically care about are other routers. When a router sees that the destination address of a packet is
one of its directly connected networks, it acts a
s a station on that network and uses the data link identifier
of the destination device to deliver the packet (encapsulated in a frame) on the network.
[11]

[11]

It should be pointed out that ther
e are such things as host routes, a route to a specific device. These will be seen later in this book. However, at
this point, host routes just confuse the issue.
With this understanding of the relationship between routers and network addresses, a question arises:
When the router sees that the destination address of a packet is one of its directly connected networks,

co
nnected networks. As a member of that network myself, I know that station 4.3 has a MAC identifier of
0000.2354.AC6B; I'll just pop this packet into a Token Ring frame and deliver it."

Looking Ahead

This chapter has established that a network address must
have both a network portion and a host portion
and that some mechanism must exist for mapping a network address to a data link identifier.
Chapter 2,
"TCP/IP Review,"
shows how
IP meets these requirements. It examines the IP address format, the method
by which IP does network
-to-
data link mappings, and a few other mechanisms important to the IP routing
process.

Recommended Reading

Perlman, R.
Interconnections: Bridges and Routers. Reading, Massachusetts: Addison-
Wesley; 1992.
Radia Perlman is one of the giants in the field of internetworking, and this book is a classic. Not only is it
a good basic text, but Perlman's sarcasm when she discusses the politics around standards bodies
should
not be missed.

Review Questions


What are th
e three sources of signal degradation on a data link?

9:

What is the purpose of a repeater?

10:

What is the purpose of a bridge?

11:

What makes a transparent bridge transparent?

12:

Name three fundamental differences between LANs and WANs.

13:

What is the purpose of a broadcast MAC identifier? What is the broadcast MA
C identifier, in hex
and in binary?

14:

What is the primary similarity between a bridge and a router? What is the primary difference
between a bridge and a router?


The purpose of this chapter is to examine the details of the protocols that enable, control, or contribute to
the routing of TCP/IP,
not to do an in-
depth study of the TCP/IP protocol suite. Several books on the
recommended reading list at the end of the chapter cover the subject in depth. Read at least one.
Conceived in the early 1970s by Vint Cerf and Bob Kahn, TCP/IP and its layered
protocol architecture
predates the ISO's OSI reference model. A brief review of TCP/IP's layers will be useful in understanding
how the various functions and services examined in this chapter interrelate.
The TCP/IP Protocol Layers

Figure 2.1
shows the TCP/IP protocol suite in relationship to the OSI reference model. The network
interface layer, which corresponds to the OSI physical and data link layers, is not really pa
rt of the
specification. However, it has become a de facto layer either as shown in
Figure 2.1
or as separate
physical and data link layers. It is described in this sect
ion in terms of the OSI physical and data link
layers.

Figure 2.1. The TCP/IP protocol suite.The
physical layer contains the protocols relating to the physical medium on which TCP/IP will be
communicating. Officially, the protocols of this layer fall within four categories that together describe all
aspects of physical media:


medium. Examples of data link protocols are IEEE 802.3/Ethernet, IEEE 802.5/Token Ring, and FDDI.

The
internet layer
, corresponding to the OSI network layer, i
s primarily responsible for enabling the
routing of data across logical internetwork paths, such as in
Figure 1.9
, by defining a packet format and
an addressing format.
This layer is, of course, the one with which this book is most concerned.

The
host-to-host layer
, corresponding to the OSI transport layer, specifies the protocols that control the
internet layer, much as the data link layer controls the physical layer. Bo
th the host
-to-host and data link
layers can define such mechanisms as flow and error control. The difference is that while data link
protocols control traffic on the data link
— the physical medium connecting two devices—
the transport
layer controls traffic on the logical link— the end-to-
end connection of two devices whose logical
connection traverses a series of data links.

The
application layer
corresponds to the OSI session, presentation, and application layers. Although
some routing protocols such as

Table 2.1
, along with a few of the relevant RFCs. All versions
other than 4 and 6 (built on a
n earlier proposal called Simple Internet Protocol, or SIP, which also carried
a version number of 6) now exist only as "culture," and it will be left to the curious to read their cited
RFCs.

Header Length is a four-
bit field that tells, as the name implie
s, the length of the IP header. The reason
this field is included is that the Options field (described later in this section) can vary in size. The
minimum length of the IP header is 20 octets, and the options may increase this size up to a maximum of
24 o
ctets. This field describes the length of the header in terms of 32
-bit words—
five for the minimum
160
-
bit size and six for the maximum.

Table

2.1. IP version numbers.

Number

Version

RFC


This field actually can be broken down into two subfields: Precedence and TOS. Precedence sets a
priority for the packet, the way a package might be sent overnight, 2
-
day delivery, or general post. TOS
al
lows the selection of a delivery service in terms of throughput, delay, reliability, and monetary cost.
Although this field is not commonly used (all the bits will usually be set to zero), early specifications of
the Open Shortest Path First (OSPF) protoco
l called for TOS routing. Also, the Precedence bits are
occasionally used in Quality of Service (QoS) applications.
Figure 2.3
summarizes the eight TOS bits; for
more in
formation , see RFC 1340 and RFC 1349.

Figure 2.3. The Type of Service field.Total Length is a 16-
bit field specifying the total length of the packe
t, including the header, in octets. By
subtracting the header length, a receiver may determine the size of the packet's data payload. Because the
largest decimal number that can be described with 16 bits is 65,535, the maximum possible size of an IP
packet
is 65,535 octets.
Identifier is a 16-bit field used in conjunction with the Flags
and
Fragment Offset
fields for fragmentation
of a packet. Packets must be fragmented into smaller packets if the original length exceeds the Maximum

Figure 2.4.
Figure 2.4. The Cisco Extended Ping utility allows the setting of the DF bit to test MTUs across an
internetwork. In the figure, the largest MTU of the path to destination 172.16.11
3.17 is 1,478 octets.The third bit is the More Fragments (MF) bit. When a router fragments a packet, it sets the MF bit to one
in all but the last f
ragment so that the receiver knows to keep expecting fragments until it encounters a
fragment with MF = 0.

Fragment Offset is a 13-
bit field that specifies the offset, in units of eight octets, from the beginning of the
header to the beginning of the fragm
ent.
[2]
Because fragments may not always arrive in sequence, the
Fragment Offset field allows the pieces to be reassembled in the correct order.

[2]

Units of eight octets are used so that a maximum-
size packet of 65,535 bytes may be described with 13 bits.
Note that if a single fragment is lost during a transmission, the entire packet must be resent and
refragmented at the same point in the internetwork. Therefore, error
-
prone data links could cause
a
disproportionate delay. And if a fragment is lost because of congestion, the retransmission of the entire
series of fragments may increase the congestion.

decrements to one, the second to
zero, and an error message is received from the second router. The third set has a TTL of three, and so
forth, until the destination is found. All routers along the internetwork path will have identified
themselves.
Figure 2.5
shows the output from a trace on a Cisco router.

Figure 2.5. The trace utility uses the TTL field to identify routers along a route. Asterisks indicate timed
-
out
pa
ckets.Protocol is an eight-
bit field that gives the "address," or protocol number, of the host
-to-host or transport
layer protocol for which the inf
ormation in the packet is destined.
Table 2.2
shows a few of the more
common of the 100 different protocol numbers currently assigned.