Exam in Computer Networks
Date
Course code
Exam time
Problems
Teacher
Phone
Aid
2004-01-07
1DT131 (DV) / 1DT633 (MN)
5 hours
10, Total 100 points
Lars-Åke Larzon
018-4712781, 070-5228109
English dictionary
You must answer the questions instructively. Only one problem/sheet.
If details needed to solve a problem have been left out, make reasonable assumptions and present
them in your solution.
You may answer in English or Swedish.
Exams will be graded before January 16th.
After the exam, answers will be posted at:
http://www.it.uu.se/edu/course/homepage/datakomDVNV/exams/
Suggested solutions in Red
Good luck!
1. The Internet protocol stack
a) Draw a picture of the Internet protocol stack and name each layer.
(2p)
The five layers are - from top to bottom: Application, Transport, Network, Link and Physical
layer (the Physical layer can be skipped).
b) For each of the following protocols, specify what the protocol is used for and in which layer
it operates:
(8p)
HTTP
Used for web requests/answers (application layer)
PPP
Used for point-to-point link layers (link layer)
IP
Provides best-effort datagram delivery over a hierarchical global address space (network layer)
UDP
Provides process multiplexing on top of IP (transport layer)
2. TCP
a) From an application’s point of view - when is it suitable to choose TCP rather than UDP as
transport protocol?
(3p)
When the application is such that reliable delivery is preferred over low delay.
b) TCP continuously collects RTT samples from incoming ACK:s. What are these samples used
for?
(2p)
To calculate a RTT estimate used to set the timeout timer for outgoing segments.
c)
What is the difference in objectives between flow control and congestion control, i.e, what
problem does each of the control mechanisms address?
(3p)
Flow control aims at avoiding overflow at the receiver, while congestion control aims at avoiding overflow in the intermediate network.
d) What event in TCP will cause a fast recovery to take place?
(2p)
Reception of three duplicate ACK:s, i.e., the same ACK value received for the fourth time in
a row.
3. Security
a) Nonce values are used to circumvent a specific type of attack. Name and describe this type
of attack, and explain how the use of nonce values circumvents it.
(4p)
Nonce values circumvent replay attacks. Since nonce values are only used once in a session,
a replayed nonce value will indicate that there is an intruder rather than a ”live” session at
the other end.
b) Explain the difference between symmetric and asymmetric encryption.
(2p)
In symmetric encryption algorithms, the same key is used for encryption and decryption. In
asymmetric algorithms, different keys are used.
c)
Present two usage scenarios for cryptographic hash functions
(2p)
Cryptographic hashing of passwords, as a signature mechanism ...
d) Describe how Public Key algorithms can be used for encryption and authentication respectively.
(2p)
When encrypting, the public key of the receiver is used for encryption so that it can only be decrypted by him/her. If encrypting with a private key, anyone with access to the corresponding
public key can authenticate the sender.
4. Routing
a) What is the difference between routing and forwarding?
(2p)
Routing is the process of building a map of the network using a routing protocol. Forwarding
is the process of forwarding individual packets using the map built by the routing protocol.
b) Without referring to specific routing protocols, illustrate the differences between link-state
and distance-vector routing algorithms in terms of:
(6p)
When are routing messages sent out?
L-S: When something changes plus periodically (not that often). D-V: Periodically, typically
twice a minute.
To what nodes are the routing messages sent?
L-S: To all routers in the domain, using reliable flooding. D-V: Only to the directly connected
neighbors.
What information is included in the routing messages?
L-S: A complete map of the domain. D-V: A picture of how the network is experienced from
the router sending the message.
c)
Illustrate with a figure what a routing loop is.
(2p)
A figureless example using (router, destination, nexthop) notation: (A, D, B) , (B, D, C), (C,
D, A)
5. Ethernet
a) What is the reason for requiring an Ethernet frame to be at least 64 bytes long?
(3p)
To avoid that transmission of a frame finished before the frame have filled a maximum-sized
Ethernet.
b) Before each Ethernet frame, there is a 64-bit preamble. What is the purpose of this preamble?
(3p)
To alert receivers that a frame is about to be sent, and to synchronize the clocks so that the
bits are received correctly.
c)
How does Ethernet react when a collision is detected? You answer must include all actions
taken until next retransmission attempt.
(4p)
First of all, a 48-bit jamming signal is sent out. Then, it enters the exponential backoff phase
where a value K is randomly chosen in the interval [0..2m − 1] is chosen for m = min(n, 10)
where n is the number of collisions in a row for the frame. The adapter then waits for K ×512
bit times before trying to transmit again.
6. Short answers
The statements below describe a property of different protocols, terms or mechanisms in the Internet
architecture. Identify the corresponding protocols/terms/mechanisms by simply giving their name.
Same protocol/term/mechanism can occur multiple times.
(10p)
a) Byte-oriented transport protocol.
TCP
b) Translates from IP addresses to link layer addresses.
ARP
c)
DNS
Distributed service that translates from hostnames to IP addresses.
d) Used for IP-related error reports and queries.
e)
Old routing protocol where the infinity is 16.
f)
Retransmission of TCP segments before a timeout has occurred.
ICMP
RIP
Fast retransmit
g) Application-level protocol often used for real-time sessions.
RTP
h) Used by HTTP to ensure reliable data transmission.
TCP
i)
Delivery of IP datagrams to multiple receivers (not necessarily in the same LAN). Multicast
j)
Link layer technology used for data over copper cables.
ADSL
7. Error detection
CRC-style checksums are used by many link layers technologies due to its error detection properties
in contrast to the Internet checksum that is present in IP, UDP and TCP.
a) Illustrate a scenario in which there is an error that the Internet checksum can not detect. (4p)
As an example, the occurrence of two inverted bits positioned at n×16 bits distance from each
other, where n is an even multiplier of 16. This can be generalized to an even number of bit
errors where all the distances between two adjacent bit errors are an even multiple of 16 bits.
b) Given that checksums are present in most link layers, why is there a checksum in IP/TCP/UDP
at all?
(3p)
The basic assumption that IP makes about lower layers does not include error detection.
c)
How expensive is it in terms of complexity to implement CRC and the Internet checksum in
normal hardware and software respectively?
(3p)
CRC is cheap in hardware, expensive in software. The Internet checksum is cheap in software,
expensive in hardware.
8. DNS
In October 2002, the first large-scale attack against the DNS system took place. For a period of
time, 7 out of 13 root nodes were overloaded. Since then, there have been several attacks on the
DNS system, all with increasing complexity.
a) Assuming that an attack would succeed in bringing down all of the root servers in the DNS
system, what implications would that have to the operation and usability of the Internet?
(3p)
Routing and forwarding would continue to operate, but it would be hard to resolve IP addresses
of hostnames that are not cached in either the endnodes or local DNS servers.
b) Suggest two ”fixes” to the DNS system that would reduce the vulnerability compared to
today’s design.
(4p)
Increased caching of top domains in local DNS servers. Non-hierarchical design, possibly
influenced by CDN:s. ...
c)
Assume you knew what no one else knew - that the current DNS system was about to go down
in 24 hours. How would you prepare yourself to reduce the problems for yourself? (You’re
not allowed to tell anyone else about the upcoming problem)
(3p)
Lookup and cache the IP addresses of the most interesting web sites and mail exchangers for
myself, maybe cache as much as possible from a root node
9. Wireless networks
a) In wireless networks, the hidden node problem can occur. Explain what causes the problem
and how it normally is solved in wireless networks.
(4p)
Imagine three nodes; A, B and C. B can communicate directly with both A and C, but A and
C can not hear each other. While A is transmitting to B, C can not hear that and try to
transmit at the same time. The transmissions will interfere, causing neither of them to reach
B. This is normally solved with a RTS-CTS scheme where you request to send before each
transmission and stay silent during the time period indicated by all CTS messages you hear.
b) Describe how TCP will be affected by a low-speed wireless link with frequent bit errors if
there is no retransmission of damaged frames in the link layer.
(3p)
Damages frames will cause segments to be dropped at the receiver. TCP will therefore see a
larger number of duplicate ACK:s that will affect its congestion control mechanism.
c)
Describe how TCP will be affected by a low-speed wireless link with frequent bit errors is
there is retransmission of damaged frames in the link layer.
(3p)
The link layer retransmissions will cause larger variations in the RTT, which will affect the
timeout settings. It will be much harder to set the timeout values properly, which is likely to
reduce the performance of the connection.
10. Network programming
In this problem, socket programming in the C programming language is used. It is enough to only
name the system calls involved rather than using the exact syntax of them.
a) Outline how you set up a non-forking TCP server. Illustrate what system calls are used in
the right order.
(5p)
First, use socket() to create a server socket, then bind() to bind it to an address/port and
listen() to start listening to the socket. The blocking accept() call will wait until an connection
and then return a client socket that you can read() from and write() to. When the session is
finished, close() the client socket and go back to accept(). When you want to finish the entire
program, close() the server socket.
b) Imagine that you are using a computer that have several IP addresses. How do you ensure
that your TCP server will accept incoming TCP connections to the same port number on
any of these IP addresses?
(3p)
Use the INADDR ANY constant when specifying the server address in the data structure.
c)
Why is it so important to remember the htons(), htonl(), ntohs() and ntohl() system calls,
even if they are NULL-declared in your programming environment?
(2p)
Because if you want to compile the program in another environment, they might not be NULLdeclared...