Computer Networks - Final ExamProf. Argyraki

December 20, 2013

Duration: 3:00 hours, closed book.

• This is a closed-book exam.

• Please write your answers on these sheets in a readable way, in English or in French.

• Please do not use a red pen.

• You can use extra sheets if necessary (don’t forget to put your name on them).

• The total number of points is 300.

• This document contains 29 pages.

• Good luck!

Full Name (Nom et Prenom):

SCIPER No:

Division: 2 Communication Systems 2 Computer Science2 Other (mention it): . . . . . . . . .

Year: 2 Bachelor Year 2 2 Bachelor Year 32 Other (mention it): . . . . . . . . .

1 Short questions (30 points)

For each question, please circle a single best answer.

1. Many households are connected to the Internet through phone lines or cablebecause these kinds of infrastructure:

(a) were already available when the Internet emerged.

(b) enable the highest-quality communication that is possible today.

(c) enable the most secure communication that is possible today.

(d) All of the above.

2. The Internet, in general, relies on packet switching (PS) as opposed to “connection switching”because PS:

(a) results in lower packet loss and smaller delays.

(b) results in more efficient use of the network resources.

(c) can provide better security and privacy guarantees.

(d) This is a trick question. The Internet relies on “connection switching.”

3. Alice and Bob are connected through a single communication link. They are running a dis-tributed application that requires them to exchange a very small packet every few seconds.Which of the following may significantly reduce the delay experienced by these packets?

(a) Replacing the link between Alice and Bob with one that has lower propagation delay.

(b) Replacing the link between Alice and Bob with one that has a higher transmission rate.

(c) Adding a second link between Alice and Bob with the same characteristics as the first one.

(d) None of the above would have any impact on the delay.

4. HTTP cookies are used:

(a) by web servers to associate multiple HTTP requests to the same web client.

(b) by web clients to encrypt multiple HTTP requests to the same web server.

(c) by Internet users to protect their privacy from content providers.

(d) All of the above.

5. You type in your web client “http://www.epfl.ch” and you get an “Unable to connect to theInternet” error. Then you type “http://128.178.50.12” (which is the IP address of www.epfl.ch)and you get the right response. The reason for the error may be:

(a) The link that connects your computer to the Internet is down.

(b) The web server www.epfl.ch is down.

(c) The local DNS server that you are using is down.

(d) None of the above.

2

6. When we say that peer-to-peer (P2P) file distribution “scales better” than client/server (CS) filedistribution we mean that:

(a) P2P applications can provide better security guarantees than CS applications.

(b) Obtaining a file from a P2P network is always faster than obtaining it from a web server.

(c) Obtaining multiple files from a P2P network is always faster than obtaining themfrom a web server.

(d) P2P file distribution time increases sub-linearly with the number of peers,whereas CS file distribution time increases linearly with the number of clients.

7. The following is true about acknowledgments (used for reliable data delivery):

(a) They are rarely used in practice because they introduce a lot of traffic overhead.

(b) They indicate to the sender which packet(s) have been correctly received.

(c) They are issued when packets are lost, but not when packets are corrupted.

(d) All of the above.

8. Pipelining (sending multiple unacknowledged packets) is preferable to stop-and-wait, in prac-tice, because it:

(a) increases the throughput from a sender to a receiver

(b) reduces the round-trip time (RTT) between a sender and a receiver.

(c) reduces the loss rate of the communication between sender and receiver.

(d) All of the above.

9. When we say that TCP does “self-clocking” we mean that:

(a) The sender uses the receiver’s acknowledgments (ACKs) to adjust its clock.

(b) The sender sends a new packet only when an ACK is received, which is done at themaximum rate that does not introduce congestion in the network.

(c) The sender uses the receiver’s ACKs to estimate the round-trip time (RTT) between senderand receiver.

(d) All of the above.

10. The network layer of the Internet always relies on virtual circuits because:

(a) They enable the network layer to provide in-order delivery.

(b) They enable the network layer to provide minimum throughput and maximum latencyguarantees.

(c) Both of the above.

(d) This is a trick question. The network layer of the Internet does not, in general, use virtualcircuits.

3

11. A router forwards a packet with destination IP address 1.10.10.45. The following could be true:

(a) The packet matches a forwarding entry with destination prefix 1.10.10.45/32.

(b) The packet matches a forwarding entry with destination prefix 1.10.10.0/24.

(c) The packet matches a forwarding entry with destination prefix 0.0.0.0/0.

(d) All of the above could be true.

12. The following is true about Internet routing:

(a) Each Autonomous System (AS) may run its own intra-AS and inter-AS routing protocols.

(b) Each AS may run its own intra-AS routing protocol, but they all run the same inter-ASrouting protocol (BGP).

(c) All Internet routers run exactly one routing protocol (BGP).

(d) None of the above.

13. Alice and Bob communicate over an established Secure Sockets Layer (SSL) connection.They should expect that when Alice sends a message:

(a) Nobody can read and understand the message other than Bob.

(b) Bob can verify that the message is indeed coming from Alice.

(c) Bob can verify that the message was not altered by an adversary.

(d) All of the above.

14. How many ARP queries will be initiated by a link-layer switch whenever it has to forward apacket?

(a) Exactly 0.

(b) Exactly 1: ARP query for the destination MAC address.

(c) Exactly 2: ARP query for the destination MAC address and source MAC address.

(d) We cannot say exactly, it all depends on the contents of its ARP table.

15. Whenever a collision is detected, the Ethernet protocol requires the nodes to:

(a) increase the transmission rate to reduce the chance of another collision.

(b) retransmit the frame using the exponential backoff mechanism.

(c) take no action, because Ethernet is a best effort protocol.

(d) This is a trick question. Collisions cannot happen in Ethernet because it is a “taking-turns”protocol.

4

FEDCA B

R1

R2R3

R7

R4

R5

R6

R8

R9

4

2 5

3

3

211

20

11

13

5

11

5

DNS

WEBwww.epfl.ch

S2S1 a

a

a

b

b

c

cd

3

10

1

Figure 1: The network topology used in Problem A

Note: A second copy of this figure is provided in the last page, which you can rip off for convenience.

5

2 Problem A (120 points)

Consider an enterprise network, as depicted in Figure 1, which consists of six hosts, A through F , aDNS server, two switches, S1 and S2, an internal router, R1, and a gateway router, R2, which connectsthe enterprise’s network to the rest of the network. Assume the following:

• DNS is the local DNS server of hosts A through F .

• All hosts have access to the outer network via port a of router R2.

Question 1 (20 points): Assign network addresses and network masks to all interfaces listed inTable 1 with the following constraints:

• All addresses must be allocated from 8.0.1.0/28. In other words, they should have binaryformat 00001000.00000000.00000001.0000xxxx.

• You should follow the basic rules for allocating IP addresses that you have learned in class.

• You should allocate the smallest possible range of IP addresses to each subnet.

• For each host, the assignment use the following format: a.b.c.d/x.

• You may ignore the IP addresses for the network and broadcast address.

Answer by completing Table 1 and justify all your answers.

Host Network Address & MaskExample 1.2.3.4/24

A

B

C

D

E

F

DNS

R1aR1bR1cR2a

Table 1: Network address space of the enterprise’s subnets of Figure 1

6

Explain your reasoning for Question 1:

7

Question 2 (25 points): Host F wishes to retrieve webpage index.html from www.epfl.ch (IP:7.1.0.1). Describe all messages that will be sent and received by host F , until its browser retrievesand displays the webpage. For each message, you should specify (if applicable):

a. The source and destination MAC address.

b. The source and destination IP address.

c. The transport layer protocol (“Proto”).

d. The source and destination ports.

e. The message content: “Request: . . . ” or “Answer: . . . ”

Notes: (i) Assume that index.html does not refer to any other objects (e.g., pictures or videos).(ii) Assume that all hosts and routers have just been rebooted, i.e., all caches are empty. (iii) Allhosts have been statically configured with an IP address, a netmask, a DNS and a default gateway IPaddress. (iv) You may ignore any TCP connection establishment messages. (v) For any port otherthan the “well-known” ports, you may use any port number, as long as it remains consistent betweenyour answers. (vi) Some fields in Table 2 may not be applicable in certain cases; if so, indicate with a“–”.

# Src MAC Dst MAC Src IP Dst IP Proto Ports Message- MAC of X MAC of Y 1.0.0.10 2.0.0.20 TCP 4200→ 10 . . .1

2

Table 2: Packets sent and received by host F in Question 2

8

Question 3 (5 points): Provide the contents of forwarding table of switch S2, after the events ofQuestion 2 have taken place, in the order they were generated.

Table 3: Forwarding table of switch S2 in Question 3

9

Question 4 (30 points): Link-state algorithm. Consider the network topology and the associated linkcosts in Figure 1. Compute the least-cost paths from router R2 to every other router in the network,using Dijkstra’s algorithm. Use the following table or any other representation as long as you clearlyillustrate all the steps of the algorithm.

visited visited visited visited visited visited visited visited visitednode in node in node in node in node in node in node in node in node inStep 1 Step 2 Step 3 Step 4 Step 5 Step 6 Step 7 Step 8 Step 9R2

cost, cost, cost, cost, cost, cost, cost, cost, cost,Dest. 1st hop 1st hop 1st hop 1st hop 1st hop 1st hop 1st hop 1st hop 1st hopR1 1, R1

R3

R4

R5

R6

R7

R8

R9

Table 4: The least-cost path from router R2 to every other router.

10

Question 5 (10 points): Consider switch S1 and hosts A and B from Figure 1. A wants to sendmessage m to B. Mallory, a malicious adversary, has taken control of S1 and wants to read and/ormodify message m. A knows this and tries to send message m to B in a way that guarantees thefollowing properties:

(i) confidentiality, i.e., Mallory cannot read the content of m.

(ii) authenticity and data integrity, i.e., B can verify that it was A that indeed generated m, and thatMallory has not modified m.

For each of the following cases, identify if confidentiality and/or authenticity and data integrity hold,and explain why.

a. A sends: Ks{m}

b. A sends: m, Ks{m}

c. A sends: K+A{m}

d. A sends: m, K+B{m}

e. A sends: K−A{K

+B{m}}

where:

• Ks is a symmetric shared key between A and B

• K+A , K−

A is A’s public and private key respectively

• K+B , K−

B is B’s public and private key respectively

11

Question 6 (15 points): In Question 2, host F retrieves webpage index.html from www.epfl.ch.Host F assumes authenticity and data integrity for the file it receives, i.e., it assumes that the responsewas indeed generated by www.epfl.ch and has not been modified by any other entity. For eachof the following cases, identify which network element(s) host F needs to trust when it makes suchan assumption. In your answers, you should justify why each of the identified elements needs to betrusted.

a. Host F and www.epfl.ch communicate without using any security mechanism.

b. Host F and www.epfl.ch communicate over SSL.

c. Routers R2 and R5 have established an IPsec tunnel between them.

Notes: Make the following assumptions: (i) Host F and switch S2 are rebooted, i.e., all caches areempty, just before the moment F attempts to retrieve the webpage. (ii) Host F is statically configuredwith its IP address, a netmask, the default DNS server and the default gateway.

12

Question 7 (15 points): Bob uses host F and is trying to access the webpage index.html fromwww.epfl.ch without applying any security mechanism. An adversary, Eve, who has taken con-trol of workstation E, is trying to trick Bob into getting a fake version of the index.html webpage.Describe two different attacks that Eve can launch which will result in Bob viewing Eve’s version ofthe index.html webpage. Assume that all devices have been just rebooted (all caches are empty), andthat all hosts have been statically configured with their IP address, a netmask, the DNS and the defaultgateway’s IPs.

13

3 Problem B (30 points)

Consider the topology in Figure 2, which contains two workstations (A and B), one web server(Sweb) and one web proxy (Sproxy). The propagation delay and transmission rate characteristics ofthe network links are given in Table 5.

L3

L4

L5

L1

L2A

B

SwebSproxy

Figure 2: The network topology used in Problem B.

Link Propagation delay Transmission rateL1, L5 dprop R

L2, L4dprop2 2×R

L3dprop2 R

Table 5: Link characteristics used in Problem B.

Question 1 (15 points): A requests the index.html file which is hosted on Sweb. After A finishesdisplaying the webpage, B requests the same file. Make the following assumptions:

• index.html does not reference any other object, has size F bytes, and fits in a single packet.Packets which contain no data (e.g. ACKs) have negligible size.

• The web cache of Sproxy is initially empty, and Sproxy needs to create a new connection to Sweb

for each web request it handles.

• Hosts A and B do not have an established connection with any other host in the network.

• Each host knows the IP address and MAC address of every other host in the network.

a. Calculate how much time it takes for A and B to display the webpage if neither host is using aweb proxy. (e.g. it takes x seconds for A and y seconds for B in order to display the webpage)

b. Calculate how much time it takes for A and B to display the webpage if both hosts are usingSproxy as a web proxy, and the cache of the proxy is initially empty.

14

15

Question 2 (15 points): The administrator of Sweb wants to make the hello.html webpage display adifferent message to visitors depending on whether they have previously requested hello.html. To doso, the administrator configures Sweb to record the visitors’ IP addresses.

Whenever a machine with an unknown IP address accesses hello.html for the first time, Sweb savesthe IP address in a local database and responds with a version of webpage hello.html that contains thetext “Greetings”. Otherwise, if the IP address already exists in the local database, Sweb responds witha version of hello.html that contains the text “Welcome back”.

a. Provide a sequence of HTTP requests and responses such that:

• A gets “Greetings” the second time it accesses hello.html, and

• B gets “Welcome back” the first time it accesses hello.html.

Justify your answer.

b. Propose a different way for Sweb to track its users which does not rely on IP addresses.

c. Suppose that the user of A does not want Sweb to know that she has accessed hello.html before.Advise the user on how to defend against the measures that you and the administrator of Sweb

have proposed, which will help her remain anonymous.

16

4 Problem C (120 points)

Question 1 (30 points): Two hosts A and B are connected through a physical link with round-triptime RTT . Host A opens a TCP connection to host B and sends a file with size S = 16MSS bytes(where MSS is the maximum segment size).

Consider the two following scenarios:

a. No packets are dropped.

b. The 4-th packet containing file data is dropped.

For each of these two scenarios, you need to complete a sequence diagram which shows:

- All packets exchanged by host A and host B.

- The sequence numbers sent by A and the acknowledgement numbers sent by B.

- Is the congestion control algorithm of host A in the slow-start or congestion-avoidance state?

- The size of the congestion window, cwnd, of host A, in bytes.

- The value of ssthresh of host A, in bytes.

Make the following assumptions:

- Host A has Fast Retransmit and Fast Recovery disabled (i.e., it uses TCP Tahoe).

- The retransmission timer of host A has a fixed duration equal to 2× RTT .

- All the TCP segments have the same size: MSS bytes.

- An acknowledgement is sent for every packet received.

Note: if you make a mistake or need more space, there are two extra blank figures on the last sheet ofpaper of the exam.

17

SYN, SEQ = 0

SYN, ACK = 1

A B

cwndA[bytes]

ssthreshA[bytes]

State of the congestion

control algorithm for host A

Sequence number diagram

1 MSS ∞ —

Sequence number

Acknowledgement number

Figure 3: Sequence diagram to be completed for Question 1.a

18

SYN, SEQ = 0

SYN, ACK = 1

A B

cwndA[bytes]

ssthreshA[bytes]

State of the congestion

control algorithm for host A

Sequence number diagram

1 MSS ∞ —

Sequence number

Acknowledgement number

Figure 4: Sequence diagram to be completed for Question 1.b

19

Question 2 (15 points): Consider the topology shown in Figure 5. Links A-R, B-R and C-R haveidentical characteristics, and have a higher transmission rate than link R-D. Transmitting hosts A, Band C all have to share the same link to send data to host D.

A B C

D

R

Figure 5: Topology for Question 2.

Calculate the share of the link capacity of R-D that each host gets (a long time after the connectionshave been established) in each of the following cases. You should justify your answers.

a. A, B and C are transmitting data. Each host uses a single TCP flow.

b. Only A and B are transmitting data. A uses only one TCP flow, and B uses two parallel TCPflows.

c. A, B and C are transmitting data. A and B each use one TCP flow. C uses a UDP-basedapplication which transmits data at a constant rate of 40% of the transmission rate of link R-D.

20

Question 3 (30 points): Consider the graph shown in Figure 6, which shows the window size of aTCP sender as a function of time.

0

10

20

30

40

50

0 1 2 3 4 5 6 7 8 9

Win

dow

Siz

e (

num

ber

of

pack

ets

)

Time (seconds)

Figure 6: Congestion window size graph for Question 3.

a. Identify what happens to the congestion window at the following times:(i) t = 0.5 secs, (ii) t = 3 secs, (iii) t = 3.5 secs and (iv) t = 8 secs.

In each case, you should: (i) describe the state transition (previous state and next state),(ii) identify the event that caused it, and (iii) explain how we can conclude that from the graph.

Example: at t = 2 secs the sender transitions from state u to state v because event x occurred.We can see that event x has occurred there, because the window size changes from y to z.

b. Calculate the number of packets that the TCP sender transmits between t = 6 secs and t = 8 secs.

c. Calculate the RTT of the TCP flow.

21

22

Question 4 (15 points): Two flows, flow1 (from A to C) and flow2 (from B to C) traverse the samebottleneck link, R-C, as shown in Figure 7. The end-hosts use a variant of TCP where the congestionwindow is fixed to 60 packets (i.e., the window does not adapt to network conditions). You know thatthe capacity of link R-C is 3100 packets/sec.

R

dprop = 5ms

dprop = 10ms

A

BC

dprop = 5ms

Figure 7: Topology for Question 4.

a. Suppose that the transmission delay is negligible. Compute the throughput that flow1 (Tput1)and flow2 (Tput2) would achieve if only one flow is active at a time, and no packet is everdropped. Compute ratio Tput1

Tput2.

b. You run an ns-2 simulation where both flows are active at the same time, and you get thatTput1Tput2

= 1.28. In your simulation, you have set the buffer size of router R to 1000 packets, sothat no packet is ever dropped.

Explain why the ratio between the throughput of the two flows is different from what youcomputed in the previous sub-question.

23

Question 5 (15 points): Suppose that each router in the network has infinite buffer space which canhold all packets the router has to forward, so that no packet is ever dropped. Given this setting:

a. What happens when a network link becomes congested.

b. Describe how individual TCP flows will behave.

c. Propose a modification for TCP, which will improve its behavior.

Justify your answers.

24

Question 6 (15 points): Explain what would happen if TCP flow control is disabled. Is TCP conges-tion control sufficient to control the transmission rate of a sender if it is overwhelming a receiver (i.e.,when the receiver has no more buffer space)? Justify your answers.

25

A B

cwndA[bytes]

ssthreshA[bytes]

State of the congestion

control algorithm for host A

Sequence number diagram

Sequence number

Acknowledgement number

Figure 8: Backup page, in case you need it. Indicate if you are answering Question 1.a or 1.b. and ifit is a continuation of the last figure, or a rewrite.

26

A B

cwndA[bytes]

ssthreshA[bytes]

State of the congestion

control algorithm for host A

Sequence number diagram

Sequence number

Acknowledgement number

Figure 9: Backup page, in case you need it. Indicate if you are answering Question 1.a or 1.b. and ifit is a continuation of the last figure, or a rewrite.

27

28

FEDCA B

R1

R2R3

R7

R4

R5

R6

R8

R9

4

2 5

3

3

211

20

11

13

5

11

5

DNS

WEBwww.epfl.ch

S2S1 a

a

a

b

b

c

cd

3

10

1

Figure 1: The network topology used in Problem A

29