Saturday, October 24, 2015

MPLS PART 5 - LDP NEIGHBORSHIP FORMATION


LDP neighbor discovery and session establishment
When you enable MPLS LDP, the LSRs send out messages to try to find other LSRs with which they can create LDP sessions.
The following sections explain the differences between
1) directly connected LDP sessions
2) nondirectly connected LDP sessions.

 

 

Directly Connected MPLS LDP Sessions

 

If an LSR is one hop from its neighbor, it is directly connected to its neighbor.
-          The LSR sends out LDP link Hello messages as UDP packets on port 646 to all the routers on the subnet (multicast)224.0.0.2.
-          A neighboring LSR may respond to the link Hello message, allowing the two routers to establish an LDP session. This is called basic discovery.
-          To initiate an LDP session between routers, the routers determine which router will take the active role and which router will take the passive role.
-          The router that takes the active role establishes the LDP TCP connection session and initiates the negotiation of the LDP session parameters. To determine the roles, the two routers compare their transport addresses. The router with the higher IP address takes the active role and establishes the session.
-          After the LDP TCP connection session is established, the LSRs negotiate the session parameters, including the method of label distribution to be used.
-          Two methods are available:
Downstream Unsolicited: An LSR advertises label mappings to peers without being asked to.
Downstream on Demand: An LSR advertises label mappings to a peer only when the peer asks for them.

Nondirectly Connected MPLS LDP Sessions

If the LSR is more than one hop from its neighbor, it is nondirectly connected to its neighbor.
-          For these nondirectly connected neighbors, the LSR sends out a targeted Hello message as a UDP packet, but as a unicast message specifically addressed to that LSR.
-          The nondirectly connected LSR responds to the Hello message and the two routers begin to establish an LDP session. This is called extended discovery.
An MPLS LDP targeted session is a label distribution session between routers that are not directly connected. When you create an MPLS traffic engineering tunnel interface, you need to establish a label distribution session between the tunnel headend and the tailend routers. You establish nondirectly connected MPLS LDP sessions by enabling the transmission of targeted Hello messages.
You can use the mpls ldp neighbor targeted command to set up a targeted session when other means of establishing targeted sessions do not apply, such as configuring mpls ip on a traffic engineering (TE) tunnel or configuring Any Transport over MPLS (AToM) virtual circuits (VCs). For example, you can use this command to create a targeted session between directly connected MPLS label switch routers (LSRs) when MPLS label forwarding convergence time is an issue.
The mpls ldp neighbor targeted command can improve label convergence time for directly connected neighbor LSRs when the link(s) directly connecting them are down. When the links between the neighbor LSRs are up, both the link and targeted Hellos maintain the LDP session. If the links between the neighbor LSRs go down, the targeted Hellos maintain the session, allowing the LSRs to retain labels learned from each other. When a link directly connecting the LSRs comes back up, the LSRs can immediately reinstall labels for forwarding use without having to reestablish their LDP session and exchange labels.
The exchange of targeted Hello messages between two nondirectly connected neighbors can occur in several ways, including the following:
Router 1 sends targeted Hello messages carrying a response request to Router 2. Router 2 sends targeted Hello messages in response if its configuration permits. In this situation, Router 1 is considered to be active and Router 2 is considered to be passive.
Router 1 and Router 2 both send targeted Hello messages to each other. Both routers are considered to be active. Both, one, or neither router can also be passive, if they have been configured to respond to requests for targeted Hello messages from each other.
The default behavior of an LSR is to ignore requests from other LSRs that send targeted Hello messages. You can configure an LSR to respond to requests for targeted Hello messages by issuing the mpls ldp discovery targeted-hello accept command.

The active LSR mandates the protocol that is used for a targeted session. The passive LSR uses the protocol of the received targeted Hello messages.

MPLS PART4 - MPLS order of Things

MPLS/LDP Order of forming tables
-          IP IGP routing protocols build the IP tables
-          LSRs assign a local label for each route learned
-          LSRs share their labels with other LSRs using LDP

-          LSRs build their own LIP, LFIB and FIBs based on what they have learned from their LDP neighbors

MPLS PART 3 - Important Queestions found at Cisco FAQ

Forwarding Equivalence Class (FEC)

FEC is a group of IP packets which are forwarded in the same manner, over the same path, and with the same forwarding treatment. An FEC might correspond to a destination IP subnet, but it also might correspond to any traffic class that the Edge-LSR considers significant. For example, all traffic with a certain value of IP precedence might constitute a FEC.

Can an LSR transmit/receive a native IP packet (non-MPLS) on an MPLS interface
Yes, if the IP is enabled on the interface. Native packets are received/transmitted as usual. IP is just another protocol. MPLS packets have a different Layer 2 encoding. The receiving LSR is aware of the MPLS packet, based on the Layer 2 encoding.


Can an LSR receive/transmit a labeled packet on a non-MPLS interface?
No. Packets are never transmitted on an interface which is not enabled for that protocol. MPLS has a certain Ether type code associated with it. When a Cisco router receives a packet with an Ether type which is not enabled on the interface, it drops the packet.


What is the range of label values? What label values are reserved? What do the reserved values signify?.

Theoretically, the range is 0 through (220-1). Label values 0-15 are reserved, and values 4-15 are reserved for future use. Values 0-3 are defined as:
·         A value of 0 represents the "IPv4 Explicit NULL Label". This label indicates that the label stack must be popped, and the packet forwarding must be based on the IPv4 header. This helps to keep Exp bits safe until the egress router. It is used in MPLS based QoS.
·         A value of 1 represents the "Router Alert Label". When a received packet contains this label value at the top of the label stack, it is delivered to a local software module for processing. The actual packet forwarding is determined by the label beneath it in the stack. However, if the packet is forwarded further, the Router Alert Label should be pushed back onto the label stack before forwarding. The use of this label is analogous to the use of the "Router Alert Option" in IP packets (for example, ping with record route option)
·         A value of 2 represents the "IPv6 Explicit NULL Label". It indicates that the label stack must be popped, and the packet forwarding must be based on the IPv6 header.
·         A value of 3 represents the "Implicit NULL Label". This is a label that an LSR can assign and distribute. However, it never actually appears in the encapsulation. It indicates that the LSR pops the top label from the stack and forwards the rest of the packet (labeled or unlabeled) through the outgoing interface (as per the entry in Lfib). Although this value might never appear in the encapsulation, it needs to be specified in the Label Distribution Protocol, so a value is reserved.

Difference between Implicit null and explicit null Label


What protocol and port numbers do LDP and TDP use to distribute labels to LDP/TDP peers?

 LDP uses TCP port 646, and TDP uses TCP port 711. These ports are opened on the router interface only when mpls ip is configured on the interface. The use of TCP as a transport protocol results in reliable delivery of LDP/TDP information with robust flow control and congestion handling mechanisms.


What options are available for load balancing MPLS packets?
A. MPLS packets can be load balanced with the MPLS label information and/or the source and destination address of the essential IP header.

What does LSR do if it received a labelled packet that it does not have a local label for?
If an LSR receives a labelled packet that it does not have local label for , it drops it.

What are benefits of PHP?

PHP- PHP helps an egress PE from and extra LFIB lookup

MPLS PART 2 - THE MPLS LABEL

MPLS LABEL



    The label is imposed between the data link layer (Layer 2) header and network layer (Layer 3) header. The top of the label stack appears first in the packet, and the bottom appears last. The network layer packetimmediately follows the last label in the label stack.

-        Bottom most label will be mpls vpn label, and top label will be for the Provider Edge egress side of routers
   
     An Ethernet header is modified to indicate the presence of an MPLS label.
• 0x8847 – indicates a labeled unicast IP packet
• 0x8848 – indicates a labeled multicast IP packet
• 0x0800 – indicates an unlabeled unicast IP packet



LETS HAVE A LOOK AT HOW MPLS PACKET LOOKS IN WIRESHARK






MPLS Part 1 ( Control Plane and Data Plane) And different Kind of Labels associated

Control plane: Responsible for Exchanging layer 3 routing information and labels.
Control plane consists complex mechanism to exchange routing information such as OSPF, EIGRP, IS-IS, and BGP and to exchange label such as TDP, LDP, BGP and RSVP.

Data plane: Responsible to forward packet based on labels and IP header.
Data plane has simple forwarding engine it maintains LFIB and FIB.

Control Plane:
Routing protocol: Responsible for exchange of routing information .It prepares IP routing table.
IP routing table: Responsible to build IP forwarding table (FIB) in Data Plane (Forwarding plane).
LDP: Responsible for exchange of labels between the peers. After exchanging the labels with LDP peer LFIB is formed in Data Plane (Forwarding Plane).

Data Plane:

  1.  As the IP packet comes in it will do a IP routing lookup and check is any label is associated with particular FEC. If yes then label is imposed in the packet and process by LFIB as labeled packet.
  2. If no label is associated with IP Packet then it is processed as normal IP Packet by FIB.
  3. If incoming packet is labeled then by using LFIB the label is swapped and the packet is processed
RIB Table
show ip route

CEF Table
show ip cef - shows the cef table. The major difference is that the next hop is figured out in the cef output.

LIB Table
show mpls ldp bindings - shows all the labels bounded to the networks, contains all good and bad networks labels. Here Liberal retention mode is used. That means even not the best labels are remembered


















LFIB  Table
# show mpls forwarding – LFIB is winner circle. Best paths for the label forwarding go in the LFIB


Saturday, October 17, 2015

ARP PACKET FORMAT AND DIFFERENT TYPES OF ARP's

ARP PACKET FORMAT




Protocol type (PTYPE) :
This field specifies the internetwork protocol for which the ARP request is intended. For IPv4, this has the value 0x0800. The permitted PTYPE values share a numbering space with those for EtherType

Operation Code:
Specifies the operation that the sender is performing: 1 for request, 2 for reply


Wireshark View Of ARP


ARP

ARP is address resolution protocol. It is mapping of Layer 3 address to a Layer 2 address.
When a host wants to send data to an IP address it requires a destinationMAC address to send the frame to.To get a corresponding Layer 2 (MAC address) it looks at its ARP table. If the MAC address is not found in the ARP table the computer sends a broadcast (ARP Request) requesting the host with that IP address to reply with his MAC address.
This process is called ARP.

Inverse ARP

Frame-relay uses inverse arp.  Inverse arp is to associate a dlci with an ip address.  From the perspective of the router doing the inverse arp, the dlci is known.  So basically inverse arp allows us to ask what IP address is at the other end of a pvc associated with a given dlci.  Arp on the other hand is an Ethernet concept and works the other way.  The router performing the arp knows the IP address it needs to communicate with, but not the mac address.  So arp allows us to send out a broadcast requesting the layer 2 information.  Inverse arp sends out a request asking for layer 3 information.  

Proxy (Promiscuous ARP)

Host A wants to send data to Host B which is not on that network.
But the HostA is not configured with default gateway information and therefore does not know how to reach a router(gateway).Host A sends an ARP to get a MAC address for Host B. Local Router receiving the ARP request ,replies to Host A with its own MAC address stating itself as destination  hence when the data is sent to the destination by Host A it would be sending to the gateway (as destination MAC is given as Gateway's MAC) which would in-turn send to host B. This is called proxy arp.

Advantages: 1) Used when hosts cannot be configured with default gateway 2) Proxy ARP makes the subnetted network topology transparent to the hosts.
Enabled by default in IOS and might be disabled on a per interface basis with the command no ip proxy-arp


Gratuitous ARP

Host A sends an ARP request using source and destination address as its own address.
mainly used to update other devices about its own IP address.

GARP is used to
-          Detect duplicate address by sending an ARP packet with destination as its own IP address and if it gets any reply back that means there is another device with same IP address.
-          Used when a Host wants to update other local Hosts ARP tables.
-          A router running HSRP that is just become active uses GARP to update the ARP cache of subnet hosts

Reverse ARP


Some devices, such as diskless workstations, might not know their IP address at startup. RARP might be programmed into firmware on these devices, allowing them to issue an ARP Request that has their burned-in hardware address. The reply from a RARP server will supply the appropriate IP address.

ETHERNET HEADER

ETHERNET HEADER



The preamble is 56 bits of alternating 1s and 0s that synchronizes communication on an Ethernet network. It is followed by an 8-bit start of frame delimiter (10101011) that indicates a valid frame is about to begin.Preamble and start frame delimiter (SFD), which are both part of the layer 1 Ethernet packet.

Ethertype/Length field provides a different function depending on the standard - Ethernet II or 802.3.

Ether Type :

-          Values of 1500 (0x05DC) and below indicate that it is used as the size of the payload in octets
-          Values of 1536 (0x0600) and above indicate that it is used to represent EtherType.
EtherType is used to indicate which protocol is encapsulated in the payload of an Ethernet Frame.
0800 - IPv4
0806 - ARP
8035 - RARP
8600 - IPv6
8100 - 802.1Q

With 802.3, the field identifies the length of the payload. The length of a frame is important – there is both a minimum and maximum frame size.

The absolute minimum frame size for Ethernet is 64 bytes (or 512 bits) including headers. A frame that is smaller than 64 bytes will be discarded as a runt. The required fields in an Ethernet header add up to 18 bytes – thus, the frame payload must be a minimum of 46 bytes, to equal the minimum
64-byte frame size. If the payload does not meet this minimum, the payload is padded with 0 bits until the minimum is met.
Note: If the optional 4-byte 802.1Q tag is used, the Ethernet header size will total 22 bytes, requiring a minimum payload of 42 bytes.

By default, the maximum frame size for Ethernet is 1518 bytes – 18 bytes of header fields, and 1500 bytes of payload - or 1522 bytes with the 802.1Q tag. A frame that is larger than the maximum will be discarded as a giant. With both runts and giants, the receiving host will not notify the sender that
the frame was dropped. Ethernet relies on higher-layer protocols, such as TCP, to provide retransmission of discarded frames.
Some Ethernet devices support jumbo frames of 9216 bytes, which provide less overhead due to fewer frames. Jumbo frames must be explicitly enabled on all devices in the traffic path to prevent the frames from being dropped. The 32-bit Cycle Redundancy Check (CRC) field is used for errordetection. A frame with an invalid CRC will be discarded by the receiving device. This field is a trailer, and not a header, as it follows the payload.


The 96-bit Interframe Gap is a required idle period between frame transmissions, allowing hosts time to prepare for the next frame.