What is fragmentation?

- The fragmentation technique is implemented in the IP (internet protocol) for breaking down the datagrams into smaller pieces. 

- This is done so that it becomes easy for the data packets to be passed through the link with a datagram size smaller than that of the original MTU or the maximum transmission unit. 

- The procedure for the IP fragmentation along with the procedures for reassembling and transmitting the datagrams is given in the RFC 791. 

- For determining the optimal MTU path, the IPv6 hosts are needed so that the packets can be sent. 

- If in case the PDU i.e., the protocol data unit received by the router is larger than the MTU of the next hop, then there are two options are available if IPv4 transport is being used:

Ø Dropping the PDU and sending an ICMP (internet control message protocol) message indicating that the condition packet is quite big.

Ø  Fragmenting the IP packet and then transmitting it over the link whose MTU is smaller. Any IPv6 packet with a size less than or equal to 1280 bytes can be delivered without having the need for using the IPv6 fragmentation.

- If a fragmented IP packet is received by the recipient host, its job is to reassemble the datagram and then send it over to the protocols at the higher layers. 

- The purpose of reassembling is expected to take place at the recipient’s host side but for some practical reasons it might be done by some intermediate router. 

- For example, the fragments might be reassembled by the NAT (network address translation) for translating the data streams. 

- Excessive re-transmission can result as a consequence of the IP fragmentation whenever packet loss might be encountered by the fragments. 

- It is required for all the reliable protocols (example, TCP) for re-transmitting the fragments in their correct order for recovering from the single fragment loss. 

Thus, typically two approaches are used by the senders for determining datagrams of what size should be transmitted over the network:

1. First approach: The sender must transmit an IP datagram of size as same as that of the first hop’s MTU.
2. Second approach: Running the path MTU discovery algorithm.

- Fragmentation does leave an impact on the network forwarding. 

- When there are multiple parallel paths for the internet router the traffic is split by the technologies such as the CEF and LAG throughout the links via some hash algorithms. 

- The major goal of this algorithm is to make sure that all the packets with the same flow are transmitted out on the same path for the minimization of the not so required packet reordering. 

- If the TCP or UDP port numbers are used by the hash algorithm, the fragmented packets might be forwarded through different paths. 

- This is so because the layer 4 information is contained only in the first fragment of the packet. 

- As a result of this, usually the initial fragment arrives after the non-initial fragments. 

- This condition is often treated as an error by most of the security devices in the hosts.  

- Therefore, they drop these packets.

- The fragmentation mechanism differs in IPv4 and IPv6. 

- In the former, the fragmentation is performed by the router. 

- On the other hand, in IPv6 fragments that are larger than MTU are dropped by the routers.

- Also, in both the cases there is a variation in the header format. 

- Since fragmentation is carried out using analogous fields, therefore the algorithm can be used again and again for the purpose of fragmentation and reassembling. 

- A best effort should be made by the IPv4 hosts for reassembling the datagram fragments. 

What are transport and application gateways?

- Hosts and routers are separated in TCP/IP architecture. 

- For private networks, more protection is required to maintain an access control over it. 

- Firewall is one of the components of this TCP/IP architecture. 

- Internet is separated from Intranet by this firewall.

- This means all the incoming traffic must pass through this firewall. 

- The traffic that is authorized is allowed to pass through. 

- It is not possible penetrate the firewall simply. 

Firewall has two components namely:

Ø  Filtering router and

Ø  Two types of gateways namely application and transport gateways.

- All the packets are checked by the router and filtered based up on any of the attributes such as protocol type, port numbers, and TCP header and so on. 

- Designing the rules for filtering of the packets is quite a complex task. 

- A little protection is offered by this packet filtering since with the filtering rules on one side, it is difficult to cater to the services of the users on other side.

About Application Gateways

- Application layer gateways consist of 7 layer intermediate system designed mainly for the access control. 

- However, these gateways are not commonly used in the TCP/ IP architecture. 

- These gateways might be used sometimes for solving some inter-networking issues. 

- The application gateways follow a proxy principle for supporting the authentication, restrictions on access controls, encryption and so on. 

- Consider two users A and B. 

- A generates an HTTP request which is first sent to the application layer gateway rather than being send to its destination. 

- The gateway checks about the authorization of this request and performs encryption. 

- After the request has been authorized, it is sent to user B from the gateway just at it would have been sent by A.

- B responds back with a MIME header and data which might be de-crypted or rejected by the gateway.

- If the gateway accepts, it is sent to A as if from B. 

- These gateways are designed for all the protocols of application level.

About Transport Gateways

- The working of the transport gateway is similar to application gateway but it works at the TCP connection level. 

- These gateways are not dependent up on the application code but they do need client software so as to maintain awareness about the gateway. 

- Transport gateways are intermediate systems at layer 4. 

- An example is the SOCKS gateways. 

- IETF has defined it as a standard transport gateway.

- Again, consider two clients A and B. 

- A TCP connection is opened by A to the gateway. 

- The SOCKS server port is nothing but the destination port. 

- A sends a request to this port for opening the connection to B indicating the port number of the destination. 

- After checking the request, the request for connection from A is either accepted or rejected. 

- If accepted, a new connection is opened to B. 

- The server also informs A that the connection has been established successfully. 

- The data relay between the clients is kept transparent. 

- But in actual there are two TCP connections having their own sequence numbers as well as acknowledgements. 

- The transport gateways are simpler when compared with the application layer gateways. 

- This is so because the transport gateways are not concerned with the data units at the application layer. 

- It has to act on the packets simply once the connection has been established. 

- Also, this is the reason why it also gives higher performance in comparison with the application layer gateways. 

- But it is important that the client must be aware of its presence since there is no transparency here. 

- If between the two networks the only border existing is the application gateway, it alone can act as the firewall. 

Explain the technique of admission control to control congestion in virtual circuit subnets?

- Virtual circuits can be thought of as a virtual channel in the telecommunication networks as well as computer networks. 

- Virtual circuit sub-nets represent a communication service that is connection oriented. 

- This service is used through the packet mode communication.

- A stream of data bytes can be exchanged between the two nodes only if a virtual circuit has been established between them. 

- Without the presence of the higher level protocols, data division has to be dealt with unnecessarily. 

- Therefore, the virtual circuits always allow the high level protocols. 

- There is a resemblance between the circuit switching mode and the virtual circuits because of the fact that both of them are based up on connection. 

- The packets that are transmitted through a virtual circuit sub-net consist of a circuit number and not the destination address. 

- This is why the memory requirement of the packets is less when using virtual circuits and more in the others. 

- This also makes the virtual circuit sub nets less expensive when compared to other sub nets. 

In this article we discuss about the technique for congestion control in virtual circuit sub nets. 

- One most popular technique is of the admission control. 

- Most of the congestion control methods are based up on an open loop i.e., the congestion is prevented rather than managing it after it has occurred. 

- Admission control is a dynamic method for controlling the congestion problems in the virtual circuit sub nets. 

- Admission control technique has been widely accepted for preventing the congestion problem from getting worse over the time. 

- The technique is based up on a very simple idea which is that no virtual circuit is set up until and unless the congestion problem that was detected has been resolved. 

- Therefore, any attempt that is made for establishing a new virtual connection with the transport layer is failed. 

- The things get even worse if the access is granted to more and more people. 

- Simplicity of the technique is one of its characteristic that makes it easy to be implemented. 

- The technique can be implemented in a straightforward manner. 

- The admission control technique is also used by the telephone systems for combating with the congestion problems. 

- The admission control technique is implemented whenever a switch in the network gets overloaded. 

- At this time no dial tone is heard. 

- Establishing new virtual connections represents another way of coping with this problem. 

- Here, the new connections have to be routed carefully such that there are no problems. 

Another method for eliminating the problem of congestion is to strike an agreement between the virtual circuit subnet and the host. 

- By this we mean establishing a new virtual circuit. 

- But this arrangement requires specifying how the traffic has to be shaped and what would be its volume, QoS (quality of service), other parameters and so on. 

- The virtual circuit sub net has to reserve the resources on its part of the agreement established. 

- These resources lie on the route where the virtual circuit has been established. 

- The resources might include the following:

Ø  Space in the router’s buffer.

Ø  Tables

Ø  Bandwidth of the lines and so on.

- The newly virtual circuits are less likely to experience the congestion problems. 
- This is because to them the availability of the resources has been guaranteed.
- Resources can be reserved in this way only if the existing sub nets are experiencing congestion problem or when the standard operating procedure is being followed. 
- One disadvantage of the admission control technique is that it leads to the wastage of the resources. 
- Also, sometime the bandwidth is left unused.