Where is the 4 bytes of thee IPv4 header? - networking

In the RFC791 (Internet Protocol Specification) on page 12 said:
"For example, this size allows a data block of 512 octets plus 64
header octets to fit in a datagram. The maximal internet header is 60
octets, and a typical internet header is 20 octets, allowing a margin
for headers of higher level protocols."
I understand why maximal IPv4 header is 60 octets, but I can't understand where is there 4 bytes more of header from this string:
"plus 64 header octets to fit in a datagram"
Maybe someone can explain me where this 4 bytes lost/or used?

This RFC was written way back in 1981. Back then, apparently, this was a typical system block/header size. Today, virtual all systems support much larger datagrams, and probably block sizes as well (some other experts can address that part, maybe).
--I re-read this. I see what you are getting at. I think the answer is in the RFC: "allowing a margin for headers of higher level protocols."
If the 60 in "internet header is 60 octets, and a typical internet header is 20 octets" refers to TCP (vs IP) header, then there should be an errata on the RFC. There is not.

Related

Extra Bytes in IP Fragmentation

I am currently going through my networking slides and was wondering if someone could help me with the concept of fragmentation
so i understand the first part till "108 Bytes" but what I don't understand is this "8 Bytes = 13.5 => 13 * 8
Bytes = 104 Bytes"
what are these extra bytes ?
the rest is clear.
You must fragment the packet payload on eight-byte boundaries. With a 128-byte MTU, the largest payload fragment you can have is 104 bytes, which is smaller than simply subtracting the IP header from the MTU (108 bytes). What the text is telling you that subtracting the packet header size (20 bytes) from the MTU, the next smaller fragment size divisible by eight is 104 bytes.
RFC 791, Internet Protocol has a complete description of how IP fragmentation works:
Fragmentation
Fragmentation of an internet datagram is necessary when it originates
in a local net that allows a large packet size and must traverse a
local net that limits packets to a smaller size to reach its
destination.
An internet datagram can be marked "don't fragment." Any internet
datagram so marked is not to be internet fragmented under any
circumstances. If internet datagram marked don't fragment cannot be
delivered to its destination without fragmenting it, it is to be
discarded instead.
Fragmentation, transmission and reassembly across a local network
which is invisible to the internet protocol module is called intranet
fragmentation and may be used [6].
The internet fragmentation and reassembly procedure needs to be able
to break a datagram into an almost arbitrary number of pieces that can
be later reassembled. The receiver of the fragments uses the
identification field to ensure that fragments of different datagrams
are not mixed. The fragment offset field tells the receiver the
position of a fragment in the original datagram. The fragment offset
and length determine the portion of the original datagram covered by
this fragment. The more-fragments flag indicates (by being reset) the
last fragment. These fields provide sufficient information to
reassemble datagrams.
The identification field is used to distinguish the fragments of one
datagram from those of another. The originating protocol module of an
internet datagram sets the identification field to a value that must
be unique for that source-destination pair and protocol for the time
the datagram will be active in the internet system. The originating
protocol module of a complete datagram sets the more-fragments flag to
zero and the fragment offset to zero.
To fragment a long internet datagram, an internet protocol module (for
example, in a gateway), creates two new internet datagrams and copies
the contents of the internet header fields from the long datagram into
both new internet headers. The data of the long datagram is divided
into two portions on a 8 octet (64 bit) boundary (the second portion
might not be an integral multiple of 8 octets, but the first must be).
Call the number of 8 octet blocks in the first portion NFB (for Number
of Fragment Blocks). The first portion of the data is placed in the
first new internet datagram, and the total length field is set to the
length of the first datagram. The more-fragments flag is set to one.
The second portion of the data is placed in the second new internet
datagram, and the total length field is set to the length of the
second datagram. The more-fragments flag carries the same value as
the long datagram. The fragment offset field of the second new
internet datagram is set to the value of that field in the long
datagram plus NFB.
This procedure can be generalized for an n-way split, rather than the
two-way split described.
To assemble the fragments of an internet datagram, an internet
protocol module (for example at a destination host) combines internet
datagrams that all have the same value for the four fields:
identification, source, destination, and protocol. The combination is
done by placing the data portion of each fragment in the relative
position indicated by the fragment offset in that fragment's internet
header. The first fragment will have the fragment offset zero, and
the last fragment will have the more-fragments flag reset to zero.
Per the definition of the Fragment offset field in the IP header:
Fragment offset(13 bits): In case of fragmented IP datagrams, this field contains the offset( in terms of 8 bytes units) from the start of IP datagram. So again, this field is used in reassembly of fragmented IP datagrams.
So even though payload sizes can be whatever, offset values can only be multiple of 8 bytes on IP headers thus payload sizes are 8-byte multiples. The calculation rounds down the IP payload size.

IP Fragmentation and Reassembly

I am currently going through my networking slides and was wondering if someone could help me with the concept of fragmentation and reassembly.
I understand how it works, namely how datagrams are split into smaller chunks because network links have a MTU. However the example in the picture is confusing me.
So the first two sections show a length of 1500, because this is the MSU, but shouldn't this mean that the last one should have 1000 (for a total of 4000 bytes) and not 1040? Where did these extra 40 bytes come from? My guess is that because the previous two fragments both had a header of 20 bytes, this extra 40 bytes of data needed to go somewhere, so it will arrive in the last fragment?
Fragflag essentially means that there is another fragment, so all of them will have a Fragflag of 1 except the last fragment which will be at zero. However I don't understand what offset is or how it is calculated. Why is the first offset at zero? Why did we divide the bytes in the datafield (1480) by 8 to get the second offset? Where did this 8 come from? Aside from that, I am assuming that each fragments offset will just increase by this value?
For example, the first fragment will have a offset of 0, the second 185, the third 370 and the fourth 555? (370+185)
Thanks for any help!
There is a 20 byte header in each packet. So the original packet contains 3,980 bytes of data. The fragments contain 1480, 1480, and 1020 bytes of data. 1480 + 1480 + 1020 = 3980
Every bit in the header is precious. Dividing the offset by 8 allows it to fit in 13 bits instead of 16. This means every packet but the last must contain a number of data bytes that is a multiple of 8, which isn't a problem.
The fragmentation and Reassembly has been exclusively explained in the RFC 791. Do go through the Internet Protocol Specification RFC. The RFC has various sections explaining the sample fragmentation and reassembly. All your doubts and questions are well catered in it.
Ans 1: Regarding the lengths of the packet: The original Packet contains 4000 Bytes. This packet is a fully IP packet and hence contains the IP header as well . Thus the payload length is actually 4000 - ( IP Header Length i. e. 20 ).
Actual Payload Length = 4000 - 20 = 3980
Now the packet is fragmented owing to the fact that the length is greater than the MTU ( 1500 Bytes).
Thus the 1st packet contains 1500 Bytes which includes IP header + Payload Fraction.
1500 = 20 ( IP header ) + 1480 ( Data Payload )
Similarly for the other packet.
The third packet shall contain remaining left over data ( 3980 - 1480 -1480 ) = 1020
Thus length of the packet is 20 ( IP Header ) + 1020 ( payload ) = 1040
Ans 2: The offset is the address or the locator from where the data starts with reference to the original data payload. For IP the data payload comprises all the data thats after the IP header and Options header. Thus the system/router takes the payload and divides it into smaller parts and keeps the track of the offset with reference to the original packet so that reassembly can be done.
As given in the RFC Page 12.
"The fragment offset field tells the receiver the position of a fragment in the original datagram. The fragment offset and length determine the portion of the original datagram
covered by this fragment. The more-fragments flag indicates (by being reset) the last fragment. These fields provide sufficient information to reassemble datagrams. "
The fragment offset is measured in Units of 8 bytes each. It has 13 bit field in the IP header. As said in the RFC page 17
"This field indicates where in the datagram this fragment belongs.The fragment offset is measured in units of 8 octets (64 bits). The first fragment has offset zero."
Thus as you asked in the question where did this 8 come from, its the standard thats been defined for IP protocol specification, where 8 octets are taken as one value. This also helps us to transmit large packets via this.
Page 28 of the RFC writes:
*Fragments are counted in units of 8 octets. The fragmentation strategy is designed so than an unfragmented datagram has all zero fragmentation information (MF = 0, fragment offset =
0). If an internet datagram is fragmented, its data portion must be
broken on 8 octet boundaries. This format allows 2**13 = 8192 fragments of 8 octets each for a
total of 65,536 octets. Note that this is consistent with the the
datagram total length field (of course, the header is counted in the
total length and not in the fragments).*
the offset size is 13 bits in the IP header but we need 16 bits as in worst case. So we use a scaling factor of 8 i.e. (2^16/2^13).
those are not extra bits but the total length of last fragment.
as 1500 is MTU this means there can be 1500 byte of data in one fragment including header. Header is appended with every fragment. this means in fragment we are capable of sending 1500-20 =1480 byte of data.
it is given there is 4000B datagram .datagram is nothing but a packet encapsulation of data at network layer.so the total data we have to send is 4000-20=3980 . then it is fragmented into 3parts (ceil(3980/1480)) each of length 1480,1480,1020 respectively . hence when 20B header is appended to last fragment its length becomes 1020+20=1040 .

Why does UDP have the field "UDP Length" twice in its packet?

Why does UDP have the field "UDP Length" twice in its packet? Isn't it redundant? If it is required for some kind of error checking, please provide an example.
Your observation is correct. The length field is redundant because both the IP header and the UDP header has a length field. My only guess about the reason for this redundancy is, that it happened because UDP was designed at a time, where it was not yet clear what the IP protocol suite would look like.
All legitimate UDP packets should have a length field matching exactly what could be derived from the length field in the IP header. If you don't do that, you can't know for sure, what the receiver is going to do with the packet.
UDP packets with inconsistent length fields are seen in the wild on the Internet. I guess they are probing for buffer overflows, which might happen if one length field is used to allocate memory and the other length field is used when copying data to the allocated buffer.
In the newer UDP Lite protocol, the length field has been repurposed. The length field in the UDP Lite header does not indicate how much data there is in the packet, but rather how much of it has been covered by the checksum. The length of the data in a UDP Lite packet is always computed from the length field in the IP header. This is the only difference between the UDP and UDP Lite header formats.
From RFC 768:
Length is the length in octets of this user datagram including
this header and the data. (This means the minimum value of the
length is eight.)
The pseudo header conceptually prefixed to the UDP header contains
the source address, the destination address, the protocol, and
the UDP length. This information gives protection against misrouted
datagrams. This checksum procedure is the same as is used in TCP.
0 7 8 15 16 23 24 31
+--------+--------+--------+--------+
| source address |
+--------+--------+--------+--------+
| destination address |
+--------+--------+--------+--------+
| zero |protocol| UDP length |
+--------+--------+--------+--------+
The REAL answer is that this is a "pseudo header" - that is, it is used for calculating the checksum, but not actually sent. at least that is what I conclude from What is the Significance of Pseudo Header used in UDP/TCP

How many A records can fit in a single DNS response?

What are the size limits on DNS responses? For instance how many 'A' resource records can be present in a single DNS response? The DNS response should still be cache-able.
According to this RFC, the limit is based on the UDP message size limit, which is 512 octets. The EDNS standard supports a negotiated response with a virtually unlimited response size, but at the time of that writing (March 2011), only 65% of clients supported it (which means you can't really rely on it)
The largest guaranteed supported DNS message size is 512 bytes.
Of those, 12 are used up by the header (see §4.1.1 of RFC 1035).
The Question Section appears next, but is of variable length - specifically it'll be:
the domain name (in wire format)
two bytes each for QTYPE and QCLASS
Hence the longer your domain name is, the less room you have left over for answers.
Assuming that label compression is used (§4.1.4), each A record will require:
two bytes for the compression pointer
two bytes each for TYPE and CLASS
four bytes for the TTL
two bytes for the RDLENGTH
four bytes for the A record data itself
i.e. 16 bytes for each A record (§4.1.3).
You should if possible also include your NS records in the Authority Section.
Given all that, you might squeeze around 25 records into one response.

Size of empty UDP and TCP packet?

What is the size of an empty UDP datagram? And that of an empty TCP packet?
I can only find info about the MTU, but I want to know what is the "base" size of these, in order to estimate bandwidth consumption for protocols on top of them.
TCP:
Size of Ethernet frame - 24 Bytes
Size of IPv4 Header (without any options) - 20 bytes
Size of TCP Header (without any options) - 20 Bytes
Total size of an Ethernet Frame carrying an IP Packet with an empty TCP Segment - 24 + 20 + 20 = 64 bytes
UDP:
Size of Ethernet frame - 24 Bytes
Size of IPv4 Header (without any options) - 20 bytes
Size of UDP header - 8 bytes
Total size of an Ethernet Frame carrying an IP Packet with an empty UDP Datagram - 24 + 20 + 8 = 52 bytes
Himanshus answer is perfectly correct.
What might be misleading when looking at the structure of an Ethernet frame [see further reading], is that without payload the minimum size of an Ethernet frame would be 18 bytes: Dst Mac(6) + Src Mac(6) + Length (2) + Fcs(4), adding minimum size of IPv4 (20) and TCP (20) gives us a total of 58 bytes.
What has not been mentioned yet is that the minimum payload of an ethernet frame is 46 byte, so the 20+20 byte from the IPv4 an TCP are not enough payload! This means that 6 bytes have to be padded, thats where the total of 64 bytes is coming from.
18(min. Ethernet "header" fields) + 6(padding) + 20(IPv4) + 20(TCP) = 64 bytes
Hope this clears things up a little.
Further Reading:
Ethernet_frame
Ethernet
See User Datagram Protocol. The UDP Header is 8 Bytes (64 bits) long.
The mimimum size of the bare TCP header is 5 words (32bit word), while the maximum size of a TCP header is 15 words.
Best wishes,
Fabian
If you intend to calculate the bandwidth consumption and relate them to the maximum rate of your network (like 1Gb/s or 10Gb/s), it is necessary, as pointed out by Useless, to add the Ethernet framing overhead at layer 1 to the numbers calculated by Felix and others, namely
7 bytes preamble
1 byte start-of-frame delimiter
12 bytes interpacket gap
i.e. a total of 20 more bytes consumed per packet.
If you're looking for a software perspective (after all, Stack Overflow is for software questions) then the frame does not include the FCS, padding, and framing symbol overhead, and the answer is 54:
14 bytes L2 header
20 bytes L3 header
20 bytes L4 header
This occurs in the case of a TCP ack packet, as ack packets have no L4 options.
As for FCS, padding, framing symbol, tunneling, etc. that hardware and intermediate routers generally hide from host software... Software really only cares about the additional overheads because of their effect on throughput. As the other answers note, FCS adds 4 bytes to the frame, making it frame 58 bytes. Therefore 6 bytes of padding are required to reach the minimum frame size of 64 bytes. The Ethernet controller adds an additional 20 bytes of framing symbols, meaning that a packet takes a minimum of 84 byte times (or 672 bit times) on the wire. So, for example, a 1Gbps link can send one packet every 672ns, corresponding to a max packet rate of roughly 1.5MHz. Also, intermediate routers can add various tags and tunnel headers that further increase the minimum TCP packet size at points inside the network (especially in public network backbones).
However, given that software is probably sharing bandwidth with other software, it is reasonable to assume that this question is not asking about total wire bandwidth, but rather how many bytes does the host software need to generate. The host relies on the Ethernet controller (for example this 10Mbps one or this 100Gbps one) to add FCS, padding, and framing symbols, and relies on routers to add tags and tunnels (A virtualization-offload controller, such as in the second link, has an integrated tunnel engine. Older controllers rely on a separate router box). Therefore the minimum TCP packet generated by the host software is 54 bytes.

Resources