Few remarks on CS144...

I'm teaching computer networks for the past 10 or so years, and during that time I got used to a certain approach in teaching this subject. But as I already noted in the post about e2e design principle and middleboxes, I'm watching course Introduction to Computer Networks (CS144), given on Stanford university. The main reason being that I wanted to see how others are doing it. While I was watching the part of the first lecture, What is Internet - 4 layers, I had some comments, so I decided to write a post about it. But then, I decided to comment on the whole course, not just a single lecture. At least that is my intention at this moment.

One very important thing before I start. Note that every course has to simplify things and remove as much details as possible in order to make things "learnable". So, sometimes lecturers don't tell complete truth, or even they say something that isn't truth. This is acceptable as long as they correct themselves eventually. But because of this it means that there are many approaches to teach something, potentially very different, and I'm looking from the viewpoint of one specific approach, namely the one I'm using. This, in turn, might mean that some, or even majority, will not agree with my comments on CS144 in this post. That's perfectly OK, but anyone reading this post should bear that in mind and not take things for granted!

What is Internet - 4 Layers

The purpose of this lecture is to teach you about layering in the networks. This is a very important concept that is a mandatory knowledge for anyone doing anything that touches networking.

But there are few things that I don't like in the approach taken by CS144. First, more correctness problem than something major, is when the lecturer notes where particular layers are implemented. He doesn't give a complete information in this case because he says that everything below application layer is implemented in the operating system. But, the truth is that parts of "link layer" are implemented in hardware, which definitely isn't an operating system, and within firmware which also isn't part of an operating system. Also, where is the line between hardware/firmware and operating system greatly varies. There are, for example, hardware accelerators for TCP, and in that case hardware/firmware reaches almost up to application layer.

Next, ISO/OSI RM is mentioned only briefly, and the comment was "... that was widely used." It was introduced because network layer is frequently called Layer 3, while in model used in this course it is in layer 2. Before continuing, let me just note that Layer 2 is also frequently used, and Layer 7 (L7) isn't so rarely used, either. Anyway, first ISO/OSI has never been widely used for the purpose it was created, unless you count bureaucratic work done within OSI, which is a lot of (bureaucratic) work! On the other hand, it is widely used as a reference model, i.e. it is used to compare different networks. And also it is widely used when we try to be a general, not tied to a specific network. After all, Internet is only one instance of many other networks, past and future. Now, I agree that it is good policy these days to stick to the Internet when teaching basics of networking. But it should be clear that Internet isn't the only network around. If OSI did something right (well, truth to be told, they did several things right), than it is the stuff around network model (or architecture). Note that there are some things that are not right (e.g. number of layers), but in general it is very well thought subject. By the way, physical layer has much more to do than only wires and connectors, if nothing else because there are three main ways of communication (wireless, wired and optical) and then there are countless number of variations within each of those.

Now, when the lecturer compares the 4 layer model he uses with ISO, he says that TCP covers transport and session layers of ISO/OSI RM. This is the first time ever that I heard that TCP covers session layer. This is based on his premise that the purpose of session layer is connection establishment. But, that's simply not true. The purpose of session layer is management of multiple connections, which can degrade into a single connection and in that case session layer is very thin - in terms of the functionality. On the other hand, connection establishment for a single connection is part of the specific protocol within transport layer (there are of course those that don't have connection establishment). Take for example OSI transport protocol TP4 which has connection establishment, transfer and disconnect phases, just like TCP and OSI definitely places it in transport layer, not session layer!

Finally, the lecture implies that layers are the same thing as protocols, i.e. that transport layer is TCP. But, the layer is just a concept, while TCP is an entity, implementation, that logically belongs to a certain layer.

What is Internet - IP Service Model

This lecture is about IP service, which, as the lecturer says at the beginning is what IP offers to layer above and what it expects from layer below. But I think that this lecture actually mixes services expected from layers below and above, with the inner workings of the IP that are invisible to higher/lower layers:

• Packet fragmenting isn't visible outside of the IP protocol because it is the task of the IP itself to defragment fragmented packets before handing data to the protocol in the layer above. Also, when IP fragmets packets the protocols in lower layers don't know, neither they care, if those are fragments or not. They are treated as opaque data by the lower layer protocols.
• Feature to prevent packets from looping forever is also internal mechanism to IP protocol, and not something that higher or lower layers should know or care about. True, there is ICMP message that informs sender that this happened, but as I said, it is not intended for other layers. If nothing else, because those layers don't determine the value of TTL field. It is a sole discretion of IP protocol itself.
• Checksum in the IP packet isn't used to prevent IP packet to be delivered to wrong destination. Let me cite RFC791 which says that:
  

  This checksum at the internet level is intended to protect the internet header fields from transmission errors.

  So it is intended to protect header from errors, not to prevent deliver of IP packet to wrong destination. True, it might happen that the error occurs in destination address and that, in that case, delivery is prevented but this is only a special case, a consequence, not something specifically targeted.
  Furthermore, while I'm at checksum, it uses simple addition and thus it is a very weak protection mechanism. Actually, it was so useless, and also it was slowing routers, so it was removed in IPv6. By the way, the same version of checksum is equally useful in TCP.
• Options within IPv4 are, again, specific to IPv4 protocol and not something offered as a service to higher layers.

I have to admit that the bullet "Allows for a new versions of IP" totally confused me?

Next, the definition of connectionless service is that no state is established in the network. That is true, but the point is that it is not the feature of a service but of the protocol operation, and thus protocols above (i.e. in higher layers) simply don't care about that. It is possible for some protocol to offer connection oriented service while operating over connectionless "subnetwork" (e.g. TCP over IP) as it is possible to offer connectionless service over connection oriented "subnetwork (e.g. IP over ATM). More about connectionless vs. connestion oriented you can read in my other post.

Note, the term IP layer is somewhat wrong, or at least discussable  Namely, there is no IP layer but network layer in which one of the protocols is IP protocol. Now, I'm aware that many say IP layer so, if we assume that the majority is right, then I'm wrong. :)

Also, for the end of this part it was interesting to see the mixed use of the terms datagram and a packet. I'm almost always using the term packet, rarely datagram, but I'll have to take a look at this more closely.

Anyway, could be that the lectures of this course and I have different view on what "service model" is, but I didn't notice that they defined what they mean by it, they just started to explain service model of different protocols.

Now, while solving quizzes the following questions surprised me:

• An Internet router is allowed to drop packets when it has insufficient resources -- this is the idea of "best effort" service. There can also be cases when resources are available (e.g., link capacity) but the router drops the packet anyways. Which of the following are examples of scenarios where a router drops a packet even when it has sufficient resources?
  
  I thought that the answer was a, c and d (corrupted packet). But, d was rejected.
• In an alternative to the Internet Protocol called "ATM" proposed in the 1990s, the source and destination address is replaced by a unique "flow" identifier that is dynamically created for each new end-to-end communication. Before the communication starts, the flow identifier is added to each router along the path, to indicate the next hop, and then removed when the communication is over. What are the consequences of this design choice?
  
  Here, I thought that the answers are a and c. But apparently, a and d were accepted. Now, c says that  there is a need for control entity to manage flow labels. Might be that I misunderstood "control entity", that it actually means something centralized. In that case probably I'm wrong. And d says there is no more need for transport layer. I would like to hear some arguments for that. Anyway, I'll have to read a bit more details about ATM, after all.

What is internet - TCP UDP

This video starts with the introduction in which the following sentence is stated: ... two different transport layer services, one of them is TCP and the other is UDP. The problem is that TCP and UDP are not services but protocols that offer some service.

"TCP is an example of transport layer". As I said, TCP is protocol, not a layer!

I wouldn't say that the property "stream of bytes" means that the bytes will be delivered in order. That's more the property of reliability. What "stream of bytes" means, in the case of TCP, is that there is no concept of the message and message boundaries. So, if the application sends two times 500 octets, it can be delivered on the other end in one go of 1000 octets, in three rounds, etc.

Source port isn't only used so that TCP knows where to send back data, but also for receiving entity to know how to demultiplex incoming TCP segment. Namely, every connection is uniquely identified by a four tuple (IP src addr, src port, IP dst addr, dst addr) and so source port is used for demultiplexing.

Checksum in TCP is quite weak, as I already argued, so it is not particularly good mechanism for detecting errors.

It is possible that TCP connection is closed in three exchanges, but could be that this will be explained later.

What is the Internet - ICMP

I have to admit that placing ICMP in transport layer is quite a novel approach to layering Internet protocols. The lecturer says that strictly speaking it uses IP and thus it belongs to transport layer. The truth is that it is far from clear where this protocol is, but the point is that when you place protocols in different layers it is not only what the protocol uses, but also what it offers and for what it is used - with respect to layer functionality. So, when we talk about ICMP, it doesn't offer services to layer above, that would be application layer, but it doesn't offer services to transport layer, either. Also, transport layer offers end-to-end communication services to application layer. Note that ICMP, on the other hand, allows communication of network layer entities (IP protocols) between any two nodes within the network. It is produced and consumed by IP protocol implemenations.

Two additional things have to be clarified that someone might take out now and counter argument me. First, there are applications that use ICMP, ping and traceroute. The truth is that ICMP actually was never designed to be used by applications, neither ping nor traceroute (especially not traceroute, search for the word "jelaous" on this page, its an interesting story). It just turned out that something can be used for the purpose not intended initially and so we now have those applications. But, I think that ping and traceroute access directly network layer, that is ICMP.

The second thing that someone might use to say that ICMP isn't in the network layer is OSPF. Namely, OSPF uses directly IP for a transfer service, not UDP nor TCP. So, someone might say that by placing ICMP into the network layer I'm placing OSPF to network layer too. There are those that think that OSPF is there. But, I think that OSPF is in application layer, along with other routing protocols. And that is for two reasons:

1. Routing protocols communicate from end-to-end. It doesn't matter that "end" in this case might be, and is, a network router somewhere within the network, the point is that OSPF application treats that as intended destionations, ends. With ICMP, any node might - for example - drop a packet and generate Time Exceeded message. Note that the node generating error message isn't an end point of the communication!
2. The functionality of the protocols is vastly different. And not only that, but also who is consuming the packets. ICMP is consumed, and generated, by IP protocol. (minus ping/traceroute for whom I already said that they are a special cases). OSPF on the other hand, is quite a complex protocol and IP protocol directly hands data to OSPF application process. IP doesn't consume those messages, neither it produces them.

So, I think OSPF is in application layer, while ICMP is in top part of the network layer.

Additionally, let me return to the lecture slides. Slide number 3 shows data for ICMP coming from the application. It's not true, data comes from the network layer itself, and ping and traceroute are misusing layering.

On slide 5 ICMP is treated as a network protocol in a sense like IP is. But I think that it's misleading. This actually leads me to one more argument why ICMP belongs to the network layer. Namely, ICMP doesn't have any separate implementation, there is no ICMP module within an operating system. There is IP module (protocol implementation) that produces and consumes ICMP messages.

Ok, so much about that lecture. Finally, when I was trying to solve quizzes, I had a problem with a first question: Which of the following statements are true about the ICMP service model? The offered answers were:

1. ICMP messages are typically used to diagnose network problems. This is true, but it's not service model.
2. Some routers would prioritize ICMP messages over other packets. This one isn' true. The routers treat ICMP messages as any other message (unless specifically configured to do so).
3. ICMP messages are useless, since they do not transport actual data. ICMP is definitely not useless.
4. ICMP messages can be maliciously used to scan a network and identify network devices. Yes, they can, but it's not a service model what this question asks.
5. ICMP messages are reliably transmitted over the Internet. They are transferred in IP which is unreliable.

After trial and error it turned out that b is also true!? But then again, I can say that I made mistake because I didn't read that "some would" prioritize, which could be true, and "would" doesn't mean it is necessarily so. Huh, I hate when someone plays with words.

Ok, I'll stop here because this post is brewing for too long, and as I'm having much other work to do, it will take time until I watch all the lectures. Not to mention that it becomes quite large. So, I decided to publish this, and expect new posts eventually...

Biser naših neukih novinara 8...

Dakle, evo novog bisera u kojima naši neuki novinari prenose (neću reći pišu!) s nerazumijevanjem o stvarima o kojima ništa ne znaju. Povod ovaj puta je pokušaj ITU-a da uvede kontrolu nad Internetom, i o tome sam već pisao, a i još ću kako stvari stoje. Nego, vratimo se temi ovog posta, a to je način na koji su naši novinari pisali o tom događaju.

Prvo što sam vidio bila je vijest na Monitoru o tome, i kao i uvijek na Monitoru su stavili linkove na druge novine koji pišu o toj temi detaljnije. Ali, pogledajmo prvo što su na Monitoru napisali. Evo ovdje c/p za referencu:

Članovi UN-ove Međunarodne telekomunikacijske unije dogovorili su usvojiti novi internet standard koji će omogućiti telekomunikacijskim kompanijama lakši nadzor podataka na internetu. Osnovat će se posebna inspekcija DPI koja će, prema tvrdnjama UN-a, štititi autorska prava. No stručnjaci upozoravaju da će inspekcija kopanjem po podacima kršiti privatnost korisnika.

Dakle, prva nebuloza koju su napisali je ITU usvaja novi internet standard! Ajmo' sada svi zajedno: ITU ne usvaja Internet standarde! I ako nije jasno, predlažem da se ponovi to još nekoliko puta, a novinaru predlažem da to i napiše nekoliko puta! Internet standarde može jedino predložiti IETF i odobriti RFC Editor, i nitko više!

Drugi gaf je još bolji: "Osnovat će se posebna inspekcija DPI...". Ovdje sam se odvalio od smijeha! Dobro, ajde, prvo nisam mogao vjerovati da su to napisali, a onda sam se odvalio od smijeha! Naime, DPI znači Deep Packet Inspection i označava pregledavanje svega što paketi nose. Nekakav Hrvatski prijevod bio bi "Dubinska analiza paketa", "Detaljna analiza paketa", ili tako nešto. Sam postupak ne zvuči kao nešto posebno, međutim, potrebno je poznavati neke osnove računalnih mreža kako bi se shvatilo koliko to odudara od standardnog postupanja s paketima tijekom njihova prijenosa kroz mrežu. Konačno, i najbitnije za ovaj post, radi se o tehnici ili metodi, kako god hoćete, a ne o nekakvom tijelu koje se osniva. Dakle, novinar je englesku riječ "inspection" shvatio u stilu Državnog inspektorata/inspekcije, a ne kao opću riječ "ispitivanje/provjera". Konačno, to je potvrdio i zadnjom rečenicom: "No stručnjaci upozoravaju da će inspekcija kopanjem po podacima kršiti privatnost korisnika!" Hahahaha... da mi je samo vidjeti tu inspekciju koja bi bila u stanju pratiti sav promet na internetu!

Ok, odlučih onda kliknuti na stranicu Večernjeg lista da provjerim što su oni napisali. Dakle, i oni lupetaju o "standardu za Internet!". Mislim, taj izraz je toliko besmislen da i uz najbolju volju ne mogu doći do nekog smislenog objašnjenja! Nadalje, i oni izgleda kao i Monitor (ili je obratno) tretiraju da se radi o nekakvoj inspekciji, kako drugačije protumačiti sljedeću rečenicu: "Iz UN-a tvrde da će uvođenje inspekcije zvane DPI..".

E da, potom je tu izjava tipa: Britanski računalni stručnjak kojega se naziva i "ocem interneta" Tim Berners-Lee... Ajmo mi sada jednu stvar utvrditi: Internet postoji od cca. 70-tih godina prošlog stoljeća, a dotični gospodin je smislio Web 1992. Dakle, kako on može biti "otac interneta" ako je internet postojao prije njega jedno 20-tak godina?

Ok, potom novinar nastavlja s:

To je ozbiljno kršenje privatnosti. Netko provede široku inspekciju na vašem priključku te pročita sve podatke i sve internetske stranice, pohrani ih na vaše ime te može dati adresu i telefonski broj Vladi kada ga pitaju u vezi s prodajom najboljem ponuđaču – rekao je Berners-Lee.

I za parsiranje ovoga mi je trebalo, i nisam uspio! Prvo, što znači "široku inspekciju"? I ako postoji "široka inspekcija", postoji li "uska inspekcija"? I koja bi bila razlika? Dalje kaže da netko pročita "sve podatke" i "sve internetske stranice", a ja ne mogu shvatiti po čemu su "sve internetske stranice" različite od podataka? Ali dobro, ajmo reć da se htjelo istaknuti zbog širokih narodnih masa da su tu i internetske stranice uključene. No, onda slijedi prava nebuloza "...pohrani ih na vaše ime..." koju također ne mogu nikako shvatiti, i totalno besmisleni šlag na kraju "...te može dati adresu i telefonski broj Vladi kada ga pitaju u vezi s prodajom najboljem ponuđaču".

Potom malo dramaturgije u vidu naslova "SAD gubi kontrolu nad internetom". I nastavak u revijalnom tonu:

Glavni tajnik ITU-a odbacio je kritike te dodao da takav prijedlog ne predstavlja "prijetnju slobodi govora". – Ovo nam je šansa da nacrtamo svjetsku kartu i spojimo ono što trenutačno nije spojeno dok osiguravamo da je to investicija za kreiranje infrastrukture potrebne za eksponencijalni rast u glasovnom, video i prometu podacima – kazao je Hamadoun I. Toure te dodao da je "zlatna prilika da se omogući dostupan pristup internetu za sve, uključujući i milijarde ljudi diljem svijeta koji danas ne mogu na internet".

Ovo prvo što sam označio masnim slovima nikako da shvatim. No, u ovom paragrafu vjerojatno ima istine u smislu da je to Toure izjavio jer vjerujem da je ovo zadnje otisnuto masnim slovima mogao izgovoriti neki birokrat iz ITU-a.

Ostale postove iz ove "serije" možete pronaći ovdje.

Privjesci, pokloni, GPS, Rumunji i ostale budalaštine...

Dakle, već drugi put čujem nekoga kako spominje da je primio elektroničku poruku sljedećeg sadržaja:

Ovih dana na mnogim mjestima- benzinskim pumpama ili parkiralištima dijele se besplatno privjesci za auto ili mali nakit za vas auto.

Te stvari ne uzimajte! U tome je ugrađen čip- kriminalci vas prate sa benzinskih crpki sve do kuće i na taj način prate kada ste kod kuće. Kada ste odsutni koriste priliku da provale u vaš stan/kuću.

Radi se o rumunjskim kriminalcima koji su izmislili novi način provale.

Obavijestite svoje prijatelje!

Ako želite mišljenje, kratko rečeno: NE NASJEDAJTE NA OVE GLUPOSTI! Jednostavno izbrišite tu poruku i nastavite kao da se ništa nije desilo.

Ok, a sad malo opširnije. Ovdje se radi o bezveznom ulančanom pismu. Drugim riječima, ta poruka se nekontrolirano širi i pri tome zbunjuje ljude (zbog čega se i širi), a istovremeno troši mrežne resurse i vrijeme onih koji ju primaju. Dakle, šteta je indirektna, ali nije zanemariva.

Ali, evo argumenata koji dovode u pitanje ovu konkretnu poruku:

1. Prvo i osnovno, MUP ili neka nadležna institucija treba izdati priopćenje, i to ne na bilo kakav način, kao što je primjerice slanje elektroničke poruke poznanicima, već na nekom mjestu koje bi se moglo tretirati kao "službeno". Primjerice, priopćenje za javnost, Web stranice policije, ili nešto slično.
2. Čim u nekoj poruci vidim nastavak "... obavijestite sve svoje prijatelje jer" i onda nekakva prijetnja da ćete patiti do kraja života, još sam uvjereniji da je lažna obavijest.
3. Kako uopće kriminalci znaju što ćete napravili s privjeskom? Ili alternativno, kako znaju da ga nosite i/ili ga niste poklonili nekome drugome i/ili negdje zametnuli ili jednostavno bacili?
4. Zatim, zašto bi vas pratili s GPS-om, kad vas mogu pratiti i ovako?
5. Kako znaju da ste na putu doma? Kako znaju kad stanete da li vam je to doma? I da, ako netko kaže da znaju  da ste doma jer su, primjerice, koordinate na kojima ste stali u nekoj zgradi, ja mogu odgovoriti s protupitanjem: kako uopće znaju na temelju koordinate da je to vaš dom? I tu je još dodatno pitanje, ako je koordinata na mjestu velike - gusto naseljene zgrade - kako znaju koji je stan u pitanju?
6. Ako netko ima namjeru provaliti i pokrasti, što nije bolje upikirati kvart/kuću/stan na temelju nekih drugih parametara (recimo, koliko je prometno, zaklonjeno od prolaznika i slično), a ne hvatati nekog slučajnog prolaznika?
7. I da, što ako živite 100km ili više dalje od benzinske gdje vam daju privjesak, a eto slučajno ste se zatekli tu u prolaz? Mislim, na temelju čega znaju gdje otprilike živite kako bi znali da li ste blizu? Registracija ZG ne govori puno, a ZG je velik! I pogotovo kako bi to znali stranci, u ovom slučaju rumunji?
8. I otkud znaju da doma nemate čopor djece, djeda, babu, nezaposlenu ženu (muža) ne znam koga tko je stalno doma?
9. I koliko uopće košta ta oprema koju bi vam dali? I u stvari, putem čega taj "daljinski" šalje signal i kako daleko? Više od par km sigurno ne može "dobaciti" pa kako će ga oni hvatati? Jel' tako što će vas slijediti? Zašto su vam onda to dali ako vas slijede? Mislite da šalju UTMS-om? Pa to znači da moraju kupiti Tele2/Simpa paket za svaki taj odašiljač. Uglavnom, ovo razmišljanje ne vodi nikuda.
10. Što uopće znači "novi način provaljivanja"? Da li vam možda stvari odnose teleportacijom? To bi bilo nešto novo...
11. Brzi google prve rečenice pokazuje da je dotični mail - u identičnom obliku - raširen na sve strane po cijeloj ex. Yu, ali, nigdje ne piše da je netko to doista i vidio, o slici neću ni pričati! I niti jedan od tih "hitova" nije nešto što bi se bar približno moglo nazvati "službenim".

Uglavnom, mislim da više ne treba o tome uopće razmišljati, a kamo li raspravljati...