CSCI 5273 Computer Networks An Overview of IPv6

1
CSCI 5273Computer NetworksAn Overview of IPv6

• Dirk GrunwaldAssoc. ProfessorDept. of Computer
  ScienceUniversity of Colorado, Boulder

2
IPv6 Design Goals

• IPv4 was very successful, but the limited
  addresses pose problems
• Experience had shown that aspects of IPv4 were
  problematic option headers, fragements
• Simplifications for IPv6
• Move to 128-bite addresses
• Assign a fixed format to all headers
• Remove the header checksum
• Use extension headers rather than options
• Remove the hop-by-hop segmentation procedure

3
IPv4 Header
Version
Hdr Lth
Type of Svc
Total length (in bytes)
16-bit Packet Identification
Flags
Fragment Offset
Time To Live
Protocol
Header Checksum
Source IP Address
Destination IP Address
... (options, if any)...
Data
4
IPv6 Header
Version
Flow Label
Class
Payload Length
Next Header
Hop Limit
5
IPv6 Header

• Version -- 6
• Class -- used for to assign service class for
  real time networking
• Flow -- used to identify packets that are in a
  flow, or which should the same routing behavior
  at intermediate points (not a virtual circuit
  identifier or specifier!)
• Payload Length -- Only include payload (not 20
  byte header) 16 bit, Packets lt 64K
• Next Header -- the type of the next header (e.g,
  TCP, UDP or one of the extension headers)
• Hop limit -- TTL renamed for honesty

6
(non) Coexistence

• The original intent was to have IPv4 and IPv6
  deployed concurrently over the same network
  fabric
• That idea has been pitched.
• IPv6 has been assigned an Ethernet Content Type
  of 0x86DD vs. the 0x8000 for IPv4
• The 6BONE provides a virtual IPv6 network using
  IPv4 encapsulation akin to MBONE.

7
Fragments

• Lesson Unit of transmission should be unit of
  control
• No fragments create enroute in IPv6
• If message gt MTU, you get ICMP message and should
  use PMTU
• However, there is a way to fragment a datagram,
  but its done in an end-to-end fashion.

8
From Options To Extension Headers
IPv6 HeaderNext Header TCP
TCP Header Payload
IPv6 HeaderNext Header Routing
Routing HeaderNext Header TCP
TCP Header Payload
9
Extension Headers

• Goal Intermediate routers dont need to look at
  the headers. Unless we tell them to.
• Extension Headers Protocols (e.g. TCP) share
  the same 256-entry name space, so limited number
  of extensions
• Current IPv6 Extension Headers
• Routing Header
• Fragment Header
• Destination Options Header
• Hop-by-Hop Options Header
• Authentication Header
• Encrypted Security payload

10
Routing Extension Header
Next Header
Hdr Ext Len
Routing Type0
Segments Left
Reserved
...
11
Routing Extension Header

• Plays same role as source routing header
• Basic ideaWhen a datagram reaches a
  destination, the destination checks for a routing
  header. If there is at least one segment left,
  that address is copied from the routing header
  and the packet is forwarded to that
  address.Otherwise, the routing header is
  removed and the next routing header is processed.
• You can have multiple routing headers if the
  8-bit header length causes a problem.
• You can specify other source routing modes using
  type

12
Fragment Header
Next Header
Reserved
Fragment Offset (13 bits)
M
RES
Identification

• Each fragement routed independently
• identification identifies the original packet
  that was fragmented
• The offset is the offset within the fragment
• The M field is a more fragments bit and is
  set to 1 for all but last fragment

13
Destination Options Header
Next Header
Reserved
Options
Options
Option Type
Opt Data Len
Option Data
00 - Skip01 - Discard, no ICMP10 - Discard,
send ICMP11 - Discard, send ICMP if not mcast
Option Type
A
C
Change enroute

• When a packet reaches its final destination (or
  at least when all prior routing extensions have
  been processed), the destination options header
  is processed
• Unknown options are (optionally) discarded

14
Hop-by-Hop Options Header
Next Header
Reserved
Options
Options

• Hop-by-hop options are processed at each hop
• Example Jumbo payload header. IP header length
  is zero and the jumbo option encodes the true
  length as a 32-bit value
• Also used to mark spanning trees for multicast
  and realtime protocols, where information needs
  to be deposited on each intermediate router

15
Extension Header Order

• Extension headers are removed processed like an
  onion peel
• Suggested order
• IPv6 Header
• Hop-by-Hop
• Destination options header (1)
• Routing Header
• Fragment Header
• Authentication Header
• Destination Options Header (2)
• Upper-layer header (e.g. TCP or UDP)

16
Peeling Extension Headers
IPHeader
RoutingHeader
AuthHeader
RoutingHeader
RoutingHeader
TCP
Payload
IPHeader
AuthHeader
RoutingHeader
RoutingHeader
TCP
Payload
IPHeader
AuthHeader
RoutingHeader
TCP
Payload
IPHeader
RoutingHeader
TCP
Payload
IPHeader
TCP
Payload
17
Naming - Aggregatable GlobalUnicast Addresses
001
TLA(13)
NLA(32)
SLA(16)
Interface ID

• Move away from provider-based to routing based
  IDs
• Top Level Aggregation -- essentially a
  hierarchical organization reflecting the current
  internet architecture
• Next Level Aggregator
• Site Level Aggregator -- allocated to a link
  within a site
• The interface ID is based on EUI-ID (an extension
  of the ethernet MAC address)

18
Other Address

• Unspecified addresses - 16 null bytes
• Loopback 00000001
• Site local
• Last 80 bits same as the normal address, but
  specified independently of the TLA/SLA
• Link local
• Multicast
• Anycast

19
Security Associations

• Authentication encryption requires that senders
  and receivers agree on
• A key
• An authentication or encryption algorithm
• Set of ancillary parameters such as the lifetime
  of the key or details about the algorithm
• This is a security association

20
Authentication Headers
Next Header
Len
Reserved
Security Parameters Index
Sequence Number Field
Authentication Data (variable)

• The SPI is selected by the receiver and is used
  to describe the security association normally
  negotiated during the key exchange

21
Encrypted Security Payload
IPv6
ExtHeader
ESPHeader
EncryptedData
AuthenticationData
Encrypted

• Last (unencrypted) header in the chain
• ESP header also includes authentication to
  prevent tampering with the encrypted data

22
Key Distribution

• SKIP - like Diffie-Hellman, but each network
  entity must pick a static secret and publicize gj
  in a directory
• The key between two hosts Kij gij is static,
  which means you could crack it with enough time
• SKIP only uses the static key in the key exchange
  phase, and then combines it with a time-varying
  field. The resulting key is used to encrypt the
  actual session key
• ISAKMP-OAKLEY
• Internet security association and key management
  protocol