「我國IPv6建置發展計畫」 92年度期中成果報告 研究發展分項計畫

Slides:



Advertisements
Similar presentations
Rfc3315 Dynamic Host Configuration Protocol for IPv6 (DHCPv6) 組員: 蔡承翰 A 陳鈺璋 A 翁菘㠙 A 指導老師 吳俊興.
Advertisements

第 8 章 IP 基礎與定址.
第 12 章 UDP 與 TCP.
第 4 章 网络层 数学科学学院 冯世斌.
第 4 章 网络层.
计算机网络教程(第 2 版) 第 7 章 网络互连 课件制作人:谢希仁.
IPv6介绍 中科院高能所计算机中心 杨泽明 2003年1月.
快速換手FMIPv6之擷取路由預測機制 指 導 教 授:童 曉 儒 博 士 學 生:宋 仁 誠.
因特网 TCP/IP协议 IP路由技术 Internet接入技术 Internet服务.
企業升級 IPv6 注意事項與 雲端 IPv6 實務演練
Chapter 12 UDP 與 TCP.
数据转发过程.
Foundations of Computer Science Chapter 6 電腦網路
NetGuru 創新 網路通訊實驗教學解決方案 PART I TCP/IP通訊協定深入剖析/以NetGuru實作
Netman Linux 的防火牆設計與應用 Netman
The security implications of IPv6
Socket.
Group multicast fanOut Procedure
NAT-PT (Network Address Translation-Protocol Translation)
第 12 章 UDP 與 TCP.
Chapter 4 Network Layer (網路層).
David liang 数据通信安全教程 防火墙技术及应用 David liang
IPv6 技術與服務 台東大學 電算中心 郭俊賢 技術師.
NTPC D-Link產品教育訓練 D-Link Taiwan 友訊科技台灣分公司 TTSS 電信技術支援課 Name:
基於OpenWSN之無線感測網路系統的實作
(C) Active Network CO., Ltd
计算机网络原理 计算机与信息工程分院 周文峰.
臺東縣中小學資訊教育校園網路管理暨資訊安全防護計畫研習
第六章 差错与控制报文 (ICMP).
IPv6原理与应用 技术培训中心
網路伺服器應用 Linux Server Andres, Wen-Yuan Liao
Internet Protocol (IP)
32 bit destination IP address
附錄 通訊協定堆疊.
P2P通信之 ——UDP穿越NAT方案的讨论
第4章 网络互联与广域网 4.1 网络互联概述 4.2 网络互联设备 4.3 广域网 4.4 ISDN 4.5 DDN
在一定程度上 人类的思维产生于 简单个体之间的相互作用 ——Marvin Minsky.
5.3 IP地址与域名 IP地址 子网划分 IPv 域名机制 域名解析.
網路探測:路徑、延遲 與流量統計 Instructor: Teaching Assistant:.
江西财经大学信息管理学院 《组网技术》课程组
第七讲 网际协议IP.
NS2 – TCP/IP Simulation How-Wei Wu.
校園網路架構介紹與資源利用 主講人:趙志宏 圖書資訊館網路通訊組.
第5讲 网络层 本讲目的: 概述: 理解网络层服务原理: 因特网的实现实例 网络层的服务 路由选择原理 分层的路由选择 IP协议
第 12 章 UDP 與 TCP 著作權所有 © 旗標出版股份有限公司.
第十三章 TCP/IP 與 Internet 網路連結技術
TANet PROTOCOL ANALYSIS - WIRESHARK - 350.
Web Server 王宏瑾.
Westmont College 网络应用软件 第一讲 (客户-服务器 概念, 协议端口的使用, 套接字API)
第13章 IPv6协议.
Advister: Quincy Wu Speaker: Chenglin Tsai Date:3/26
滕小玲 北京大学计算中心 IPv6技术讲座 现有Internet的基础是IPv4,到目前为止有近20年的历史了。由于Internet的迅猛发展,据统计平均每年Internet的规模就扩大一倍。IPv4的局限性就越来越明显。个人电脑市场的急剧扩大、还有个人移动计算设备的上网、网上娱乐服务的增加、多媒体数据流的加入、以及出于安全性等方面的需求都迫切要求新一代IP协议的出现。
實驗5 IP協定分析 明瞭IP(Internet Protocol;Internet協定)的基礎觀念
中国科学技术大学计算机系 陈香兰 2013Fall 第七讲 存储器管理 中国科学技术大学计算机系 陈香兰 2013Fall.
虚 拟 仪 器 virtual instrument
傳輸控制協議 /互聯網協議 TCP/IP.
Source: Journal of Network and Computer Applications, Vol. 125, No
NAT技术讲座 主讲:周旭 大唐电信科技股份有限公司光通信分公司 数据通信部.
Speaker : Chang Kai-Jia Date : 2010/04/26
NASA雜談+電腦網路簡介 Prof. Michael Tsai 2015/03/02.
Distance Vector vs Link State
第8章 網際網路協定IPv6介紹與設定 蕭志明老師 CCNA教學.
Chapter 10 Mobile IP TCP/IP Protocol Suite
Mobile IPv4.
IP Layer Basics, Firewall, VPN, and NAT
Distance Vector vs Link State Routing Protocols
RHCE.
Homework 3.
第 4 章 网络层.
Presentation transcript:

「我國IPv6建置發展計畫」 92年度期中成果報告 研究發展分項計畫 子計畫二:6TANET 台灣IPv6網路轉換環境技術研究 子計畫二:6TANET 台灣IPv6網路轉換環境技術研究 「我國IPv6建置發展計畫」 92年度期中成果報告 研究發展分項計畫 子計畫二:6TANET 台灣IPv6網路轉換環境技術研究

子計畫二:6TANET 台灣IPv6網路轉換環境技術研究 東華大學 趙涵捷 1 IPv6 第四層以上相關協定分析 交通大學 陳懷恩 2 超高速乙太網路 IPv6/IPv4 轉換器之研製 台灣大學東華大學 郭斯彥 陳俊良 3 可穿越 NAT 的 IPv6 Tunnel 吳坤熹 4 以 IPv6 為基礎的隱匿型網路偵測管理 台灣科技大學 黃忠偉 張瑞雄

IPv6 第四層以上相關協定分析 陳懷恩 Research Assistant Professor Department of CSIE, NCTU Email: wechen@mail.nctu.edu.tw TEL: 886-3-5731924

計畫目標 分析常見的第四層以上通訊協定,在由 IPv4 演進到 IPv6 時所需要改變的差異性 提供廠商移植IPv6軟體時之參考,以加速國內IPv6軟硬體研發,實現國內IPv6網際網路環境,促使我國儘速邁入IPv6資訊網路新紀元

計畫工作重點 研讀並分析相關通訊協定 製作IPv6通訊協定分析器雛形 設計廠商升級IPv4程式到IPv6程式的機制 網路應用協定、網路路由協定、網路管理協定 SIP-based VoIP相關協定 製作IPv6通訊協定分析器雛形 製作通訊協定分析器雛形 分析第二、三層封包(e.g., Ethernet, IPv4, IPv6) 分析SIP-based VoIP相關協定(e.g., SIP, SDP, RTP, RTCP) 設計廠商升級IPv4程式到IPv6程式的機制 提供廠商修改Socket程式的方法 設計v4/v6轉換之中介軟體

計畫成果 提供IPv4程式轉換為IPv6程式之方法 提供IPv6協定分析器 設計主機端轉換之中介軟體(Middleware) 第四層以上之程式多由socket撰寫而成 本計畫提供如何將現有IPv4程式修改成IPv6的方法 提供IPv6協定分析器 提供開發程式、教育訓練時之輔助 設計SIP-based VoIP專屬的分析器 設計主機端轉換之中介軟體(Middleware) 修改現有程式需要時間、人力、金錢 提供廠商在不修改程式的情況下快速轉換程式為IPv6的方法 以Bump-In-the-Stack (BIA)為基礎 設計應用層(Application-Level)轉換機制

提供轉換IPv4程式到IPv6之方法 介紹IPv4與IPv6之不同 不用轉換的Socket API 需要轉換的Socket API 需要轉換的資料結構

IPv4/IPv6位址長度不同 Numerical addresses IPv4, 32 bit address 32 bits IPv4 IPv6 128 bits

不需要轉換的Socket API (依序) Server端的程式碼 Client端的程式碼 socket open a socket bind bind local address to the socket listen listen on a port accept wait for the connection read/write if TCP recvfrom/sendto if UDP Client端的程式碼 socket open a socket connect connect to a server read/write if TCP recvfrom/sendto if UDP

轉換需要改變的部分 有一些與IP位址相關的Socket API與參數需要修改 程式部分有運用到IP位址的部分 位址轉換函式 位址複製函式 位址比較函式 位址相關之記憶體指派與變數宣告

API與資料結構的轉換 參數名稱轉換 IPv4 IPv6 inaddr6_any AF_INET AF_INET6 PF_INET

API與資料結構的轉換 資料結構轉換 IPv4 IPv6 in_addr in6_addr sockaddr sockaddr_in6

API與資料結構的轉換 資料結構參數轉換 IPv4 IPv6 sin_len sin6_len sin_family sin6_family sin_port sin6_port sin_addr sin6_addr s_addr s6_addr

API與資料結構的轉換 函式轉換 IPv4 IPv6 inet_aton() inet_addr() inet_pton() Name-to_address Functions inet_ntoa() inet_ntop() getipnodebyname() getipnodebyaddr() getnameinfo() getaddrinfo() gethostbyname() gethostbyaddr() Address conversion Functions

設計主機端轉換之中介軟體 可是要將應用程式升級成IPv6會有以下問題 例子:SIP-based VoIP User Agent 需要改用新的 API 需要改用新的 Data structure 例子:SIP-based VoIP User Agent 共有約200行Socket API、資料結構需要轉換 約有600行位址相關函式、變數、記憶體指派需要修改 短期內將程式升級IPv6不容易 需要改的函式、變數需要追蹤修訂 程式版本升級時,亦需隨之修訂 提出一個轉換v4/v6的中介軟體,以 BIA為基礎,設計應用層轉換機制

轉換中介軟體系統架構

轉換中介軟體之設計 依不同程式所需 設計ALG 原BIA之架構

提供IPv6相關協定分析器 提供Windows XP/2003上通訊協定分析 可協助本計畫之開發 未來可協助廠商開發相關應用 可分析以下協定: Ethernet, ARP, ICMP/ICMPv6, IPv4/IPv6 DNS, HTTP, FTP SIP, SDP, RTP, RTCP 可協助本計畫之開發 未來可協助廠商開發相關應用 可提供教育訓練(如:通訊改進教育計畫)使用

WinPCap Protocol Driver / NPF IPv6通訊協定分析軟體架構與介面 封包分析軟體 libpcap Interface WinPCap winpcap.dll Packet Interface Device IO Control WinPCap packet.dll WinPCap Protocol Driver / NPF Windows NDIS Physical NICs

IPv6通訊協定分析軟體之設計 Packet Module 負責封包收送 Parsing Package負責第二、三層封包解析 IPv6 Module Transport Module SIP RTP RTCP Parsing Package Packet Module

IPv6通訊協定分析軟體之雛形系統 選取介面 封包分析

計畫結論 目前已有IPv6相關Socket程式,建議廠商開發軟體時,可以考慮撰寫IPv4/IPv6共存之應用程式。 目前設計之應用層轉換以工研院SIP-based UA作為實際v4/v6轉換的例子,若需要進一步資料,歡迎會後與本子計畫聯繫。 本子計畫將繼續v4/v6轉換之研究,以期能幫助國內廠商在節省人力、時間與金錢的情況下,快速升級至IPv6 ready。

Teredo - Tunneling IPv6 through NATs Date: 2003-7-24 Speaker: Quincy Wu National Chiao Tung University

IPv4–to–IPv6 Transition Strategy (RFC 2893) Dual Stack Reduce the cost invested in transition by running both IPv4/IPv6 protocols on the same machine . Tunneling Reduce the cost in wiring by re-using current IPv4 routing infrastructures as a virtual link. Translation Allow IPv6 realm to access the rich contents already developed on IPv4 applications

Tunnels of IPv6 over IPv4 Transport Header IPv6 Header Data IPv6 Host IPv6 Host Dual-Stack Router Dual-Stack Router IPv4 IPv6 Network IPv6 Network Tunnels are often used in networking to overlay a non-compatible functionality over an existing network. When tunneling IPv6 traffic over an IPv4 network, one edge router encapsulates the IPv6 packet inside an IPv4 packet and then the other router decapsulates it, and vice-versa. This enables the connection of IPv6 islands without the need to also convert the backbone to IPv6. There are two issues when tunneling: The MTU is effectively decreased by 20 octets (if the IPv4 header does not contain any optional field). A tunnelled network is often difficult to troubleshoot. Tunneling is a transition technique that should be used where it is appropriate and should not be considered as a final architecture. Native IPv6 architecture should be the target architecture. Tunnel: IPv6 in IPv4 packet Transport Header IPv4 Header IPv6 Header Data Encapsulating the IPv6 packet in an IPv4 packet Tunneling can be used by routers and hosts

Manually Configured Tunnel Dual-Stack Host Dual-Stack Router IPv4 IPv4: 140.110.199.254 IPv6: 2001:288:03a1:210::3/127 IPv4: 61.218.105.10 IPv6: 2001:288:03a1:210::2/127 FreeBSD4.7# gifconfig gif0 61.218.105.10 140.110.199.254 ifconfig gif0 inet6 2001:288:03a1:210::2 2001:288:3a1:210::3 prefixlen 128 FreeBSD is IPv6-ready. You can manually configure an IPv6 tunnel with these commands.

Linux Tunnel /etc/sysconfig/network-scripts/ifcfg-sit1 ifup sit1 DEVICE=sit1 BOOTPROTO=none ONBOOT=yes IPV6INIT=yes #Remote end-ISP IPv4 addr IPV6TUNNELIPV4=140.110.199.250 #Yourself IPv6 tunnel addr from ISP IPV6ADDR=2001:288:3A1:210::2/127 ifup sit1

6to4 Tunnel (RFC 3056) 6to4 Tunnel: 6to4 Router1 6to4 Router2 IPv4 IPv6 Network IPv6 Network E0 E0 131.243.129.44 140.110.199.250 Network prefix: 2002:83F3:812C::/48 Network prefix: 2002:8C6E:C7FA::/48 = = The example shows one of the many possible 6to4 tunnel scenarios. It shows Cisco routers connecting IPv6 domains using the 6to4 mechanism. Router1 has the IPv4 address 31.243.129.44. From this IPv4 address, the site 6to4 prefix used for the internal IPv6 network is 2002:c0a8:6301::/48, which can be used subnetted in a site with many subnetworks. The router interface is configured on subnet 1 (SLA = 0x0001) so the interface is assigned the IPv6 address 2002:c0a8:6301:1::/64 with the EUI-64 interface ID. The router 6to4 tunnel interface tunnel0 has no IPv4 or IPv6 address specifically configured for it. It uses the Loopback0 IPv4 address, as the source address for the tunnel. The destination address is unspecified since it is constructed automatically. As packets are forwarded from its internal network to the 6to4 cloud, the router generates a new tunnel with the IPv4 destination used from the IPv4 address embedded inside the IPv6 address of the IPv6 packet being forwarded. The command tunnel mode ipv6ip 6to4 identifies a 6to4 tunnel. Depending on the routing domain and topology, route entries should be added. Except in special cases, the routing entry shown is generally needed to forward all 2002: packets through tunnel0. Router2 has a similar configuration for its end. router2# interface Ethernet0 ip address 140.110.199.250 255.255.255.0 ipv6 address 2002:8C6E:C7FA:1::/64 eui-64 interface Tunnel0 no ip address ipv6 unnumbered Ethernet0 tunnel source Ethernet0 tunnel mode ipv6ip 6to4 ipv6 route 2002::/16 Tunnel0 6to4 Tunnel: Is an automatic tunnel method Gives a prefix to the attached IPv6 network 2002::/16 assigned to 6to4 Requires one global IPv4 address on each site

6to4 Tunnel 2002:8C6E:C7FA:2::5 2002:83F3:812C:1::3 6to4 Router1 IPv4 IPv6 Network IPv6 Network E0 E0 131.243.129.44 140.110.199.250 Network prefix: 2002:83F3:812C::/48 Network prefix: 2002:8C6E:C7FA::/48 IPv4 SRC 131.243.129.44 The example shows one of the many possible 6to4 tunnel scenarios. It shows Cisco routers connecting IPv6 domains using the 6to4 mechanism. Router1 has the IPv4 address 192.168.99.1. From this IPv4 address, the site 6to4 prefix used for the internal IPv6 network is 2002:c0a8:6301::/48, which can be used subnetted in a site with many subnetworks. The router interface is configured on subnet 1 (SLA = 0x0001) so the interface is assigned the IPv6 address 2002:c0a8:6301:1::/64 with the EUI-64 interface ID. The router 6to4 tunnel interface tunnel0 has no IPv4 or IPv6 address specifically configured for it. It uses the Loopback0 IPv4 address, as the source address for the tunnel. The destination address is unspecified since it is constructed automatically. As packets are forwarded from its internal network to the 6to4 cloud, the router generates a new tunnel with the IPv4 destination used from the IPv4 address embedded inside the IPv6 address of the IPv6 packet being forwarded. The command tunnel mode ipv6ip 6to4 identifies a 6to4 tunnel. Depending on the routing domain and topology, route entries should be added. Except in special cases, the routing entry shown is generally needed to forward all 2002: packets through tunnel0. Router2 has a similar configuration for its end. IPv4 DEST 140.110.199.250 IPv6 SRC 2002:83F3:812C:1::3 IPv6 SRC 2002:83F3:812C:1::3 IPv6 SRC 2002:83F3:812C:1::3 IPv6 DEST 2002:8C6E:C7FA:2::5 IPv6 DEST 2002:8C6E:C7FA:2::5 IPv6 DEST 2002:8C6E:C7FA:2::5 Data Data Data

IPv6 tunneling problem It does not work when the IPv4 address is not globally routable B4 is a private address! IPv6 IPv6 site D E A B IPv4 C IPv4 D4 B4 6to4 Relay router E6 A6 IPv6 host 6to4 router IPv4 router IPv6 host NAT Address translation Src: B4 Dest: D4 Src: N4 Dest: D4 Src: N4 Dest: D4 Src: A6 Dest: E6 data Src: A6 Dest: E6 data D to E: IPv6 A to B: IPv6 Src: A6 Dest: E6 data Src: A6 Dest: E6 data Src: A6 Dest: E6 data B to C: IPv4 (encapsulating IPv6) C to D: IPv4 (encapsulating IPv6) A v6 IP: 2002:a02:3fe::2/48 (A6) B v6 IP: 2002:a02:3fe::1/48 (B6) B v4 IP: 10.2.3.254 (B4) E v6 IP: 2001:238:f88:4::2/64 (E6) D v6 IP: 2001:238:f88:4::1/64 (D6) D v4 IP: 140.114.1.254 (D4) NAT address: 1.2.5.6 (N4)

Teredo service To allow hosts behind NAT to access IPv6, without modifying NAT. Teredo is not a long term solution If NAT also supports IPv6 routing, the problem of NAT traversal will disappear.

Teredo definitions Teredo client Teredo server Teredo relay A node wants to gain access to the IPv6 Internet. Teredo server helper to provide IPv6 connectivity to Teredo clients. Teredo relay An IPv6 router that can receive traffic destined to Teredo clients and forward it to Teredo client. Teredo bubble minimal IPv6 packet, made of an IPv6 header and null payload, no Next Header. Teredo service The transmission of IPv6 packets over UDP. 1. payload type is set to 59

Operation model A client has pre-configured server location. A client gets IPv6 prefix from the Teredo server. IPv6 Teredo server Teredo relay Teredo server is stateless. Traffic goes directly between the relay router and the client. Teredo Relay announces reachability of Teredo prefix on IPv6 realm. Relay and Client maintain peer list to avoid sending Teredo message too often. IPv4 Tunnel Teredo IPv6 prefix? 1. Bubbles and list of peers ensures that data packets will always be transmitted on a direct path to another Teredo client, or on a direct path to the Teredo relay nearest from an IPv6 peer. NAT Teredo IPv6 prefix, your mapped address IPv4 Teredo client

Teredo address encoding 0 32 64 80 96 127 Prefix Server IPv4 Flags Port Client IPv4 Prefix: the 32 bit Teredo service prefix. 3FFE:831F::/32 Server IPv4: the IPv4 address of a Teredo server. Flags: a set of 16 bits that document type of address and NAT. 16 bits flag: “C00000UG00000000” C=1 if NAT is cone. UG should set to “00”. Port: the obfuscated "mapped UDP port" of the client Client IPv4: the obfuscated "mapped IPv4 address" of a client Obfuscated: XOR every bits in the field with 1, prevent over-genius NAT’s translation.

Obtaining an address(1/2) Teredo client sends a UDPv4 tunneled IPv6 Router Solicitation to the Teredo server. Teredo server replies UDPv4 tunneled IPv6 Router Advertisement with origin indication. IPv6 Teredo server Teredo relay 1.2.3.4 IPv4 9.0.0.1:4096 NAT 10.0.0.1 IPv4 UDP IPv6 RS IPv4 IPv4 UDP Origin indication IPv6 RA Teredo client 0x00 mapped port # mapped IPv4 address 10.0.0.2:1234 Origin indication format

Obtaining an address(2/2) Client get Teredo service prefix 3FFE:831F::/32 (PREF= 3FFE:831F) Client get mapped address/port from origin indication Mapped address: 9.0.0.1:4096 Generated Teredo IPv6 address 3FFE:831F:102:304::EFFF:F6FF:FFFE Already known server IP: 1.2.3.4 Address and port are obfuscated. Must keep alive address mapping on NAT Default refresh interval: 30 seconds.

Packet from Teredo node to IPv6 node (1/3) 2000::B A does not know which relay will be chosen by B. A sends ICMPv6 “echo request" toward B. S forwards “echo request” to IPv6 realm. IPv6 B Teredo Server S Teredo Relay R 1.2.3.4:3544 5.6.7.8:3544 IPv4 9.0.0.1:4096 NAT IPv6 Src. IPv6 dest. 10.0.0.1 Src. Dest. IPv4 10.0.0.2:1234 1.2.3.4:3544 PREF:102:304::EFFF:F6FF:FFFE 2000::B PREF:102:304::EFFF:F6FF:FFFE 2000::B Teredo Client A 10.0.0.2:1234 PREF:102:304::EFFF:F6FF:FFFE

Packet from Teredo node to IPv6 node (2/3) 2000::B B sends the “echo reply” back to Teredo Client. The IPv6 packet will be queued by Teredo Relay. If Teredo Client is behind a restricted NAT, a bubble must be sent to Teredo Server. IPv6 B S R IPv4 1.2.3.4:3544 5.6.7.8:3544 9.0.0.1:4096 NAT 10.0.0.1 IPv6 Src. IPv6 dest. IPv4 2000::B PREF:102:304::EFFF:F6FF:FFFE A 10.0.0.2:1234 PREF:102:304::EFFF:F6FF:FFFE

Packet from Teredo node to IPv6 node (3/3) 2000::B R sends the queued “echo reply” to A. A knows B can be reached through address 5.6.7.8:3544. A will send all further packets directly through R. IPv6 B S R IPv4 1.2.3.4:3544 5.6.7.8:3544 9.0.0.1:4096 1. B simply follows IPv6 routing rules NAT 10.0.0.1 IPv4 Teredo Client A 10.0.0.2:1234 PREF:102:304::EFFF:F6FF:FFFE

Conclusion Many users get private IPv4 address from their service providers, such as WLAN and GPRS. These users are unable to create IPv6 tunnels. Before all NAT devices can be upgraded to support IPv6, Teredo service is useful for users behind NAT to obtain IPv6 access.

6TANET IPv6 TrAnsition Network Environment of Taiwan IPv6 / IPv4 轉換器介紹 東華大學 資訊工程學系 張耀中

Agenda IPv6 Current State Introduction Objective Schedule Conclusion

IPv6 TF Around The World

Transition Mechanisms

IPv4 to IPv6 Data Flow

IPv4 to IPv6 Data Flow

Header Translation -IPv4 to IPv6

Header Translation -IPv6 to IPv4

Checksum Modification Internet checksum use 16-bits 1’s complement checksum We adopt a 32-bits 1’s complement checksum algorithm Take advantage of the 32-bits registers in IXDP1200 Much faster and efficient 2 policies CASE Policy ARP ND (ICMP checksum) Re-Compute Algorithm IPv6 Header  IPv4 Header ICMPv4  ICMPv6 Adjustment Algorithm TCP UDP

IQ2000

Project Objective IPv4/IPv6網路通訊協定轉換機制之技術與應用 超高速乙太網路IPv6/IPv4轉換器雛型系統 適合我國GbE網路環境之轉換機制 超高速乙太網路IPv6/IPv4轉換器雛型系統 雛型系統之系統需求規格與功能訂定 雛型系統之設計與實作 雛型系統之測試

Project Schedule IPv4/IPv6轉換機制運作原理研究 IPv4/IPv6轉換機制應用現況研究 ※ GbE 網路環境轉移機制評估與設計 NP-based GbE IPv6/v4 轉換器雛形系統規格與功能訂定 雛型系統之軟體設計 雛型系統之實作與測試

Rejuvenating the Decaying Internet IPv6 is a young lady? IPv6 NAT IPv4 Global Summit IPv6 North America IPv6 State of the World - Latif Ladid

IPv6 Is Not Only Unlimited Address Space QoS Flow Bits? Reliability Simplicity ... ... Dynamic Routing Flexible Renumbering STRING Multicast v6 Transition Tool Box of Technology PERLS e2e Security Mobile IPv6 Autoconfiguration Plug & Ping End-2-end Transparency Global Summit IPv6 North America IPv6 State of the World - Latif Ladid

以 IPv6 為基礎的隱匿型 網路偵測管理

IPv6 環境下偵測管理的問題 區段內 IPv6 網址範圍巨大,逐一掃瞄 IPv6 網址以偵測上網之電腦或設備,需耗費時大量時間而變不可行 由於switch大量使用,broadcast 訊息不容易取得,增加偵測時的困難度

IPv4 - IPv6 headers 20 bytes IPv4 IPv6 40 bytes Vers = 4 Total length Type of service Identification Fragment Offset Flags IHL TTL Header Checksum Protocol Source Address Destination Address Options... Vers = 6 flow Label Traffic Class Payload Length Next Header Hop Limit IPv4 IPv6 20 bytes 40 bytes

IPv6 網址 網址類型: 單一介面可以被設定多種 IPv6 網址 以 Multicast 取代 broadcast Unicast : 一對一 Global Site local Link local Multicast Anycast 單一介面可以被設定多種 IPv6 網址 以 Multicast 取代 broadcast

Address resolution Neighbor Solicitation : @ IP2 ? @MAC1 @IP2 @MAC2 Neighbor Solicitation : @ IP2 ? Neighbor advertisement : @ IP2 @ MAC2 IPv6 Packet

Configure hosts addresses IPv6 router Prefix : pf1/64 @ IPv6 : pf1::X and fe80::X IPv6 host A Pf1::Y Fe80::Y IPv6 Host B fe80::Z Router advert. Fe80::X Prefix : pf1 Router solicitation

本子計劃進行的目的 於各個 IPv6 網路區段中載入不具 IP Address 之隱匿偵測點 藉由隱匿偵測點於各網路區段中進行偵測,並建構出區段內已存在之電腦名單 主控端針對各個區段的隱匿偵測點進行蒐集,並根據蒐集結果產生整體網路拓樸架構圖,以提供管理者對整體網路規劃及評估

相關軟體設計開發 目前僅有 ActiveX 能以網路物件形式存在且具有網路封包攔截或傳遞功能 開發ActiveX隱匿偵測點物件,透過 Web 介面下載至各區段偵測點;啟動偵蒐功能以建構出區段內上網電腦清單 開發主從架構之主控管理程式,動態即時蒐集各網路區段資料後進行彙整,進而建構出網路拓樸圖

網路物件程式範例

隱匿偵測點物件動作流程 啟動 Router solicitation 開始 取得 Global Address 的Prefix 啟動 ping multicast IP 加入區段內已存在電腦名單 Y 根據區段中某電腦 Acknowledge 封包資料 是否有 acknowledge 封包回傳 建構該電腦 IPv6 Address N 結束

ping Multicast IP 根據 RFC 2461和RFC 2463,可藉由ff02::1(link-local scope all-nodes multicast address)令上網電腦回應其 link-local IPv6 網址 利用ping6 指令及 ff02::1,令上網電腦回應 link-local 網址清單 本計畫需實現 RFC 2461及RFC 2463之規範,以偵蒐區域網路內之上網電腦或設備

利用 ping6 取得 link-local 網址清單 實驗結果之部分清單 [root]# ping6 -I eth0 ff02::1 PING ff02::1(ff02::1) from fe80::280:c8ff:fe6f:abeb eth0: 56 data bytes 64 bytes from ::1: icmp_seq=1 ttl=64 time=0.108 ms 64 bytes from fe80::202:b3ff:fe8e:6af7: icmp_seq=1 ttl=64 time=0.265 ms (DUP!) 64 bytes from fe80::2d0:b7ff:fe2d:ead5: icmp_seq=1 ttl=64 time=0.304 ms (DUP!) 64 bytes from fe80::2c0:4fff:fe15:4c4a: icmp_seq=1 ttl=64 time=0.308 ms (DUP!) 64 bytes from fe80::280:c8ff:fe58:4038: icmp_seq=1 ttl=64 time=0.347 ms (DUP!) 64 bytes from fe80::200:e8ff:fe63:aa7d: icmp_seq=1 ttl=64 time=0.350 ms (DUP!) 64 bytes from fe80::2e0:29ff:fe34:be97: icmp_seq=1 ttl=64 time=0.447 ms (DUP!) 64 bytes from fe80::a00:20ff:fe93:22ca: icmp_seq=1 ttl=255 time=0.326 ms (DUP!) 64 bytes from fe80::206:29ff:fe13:3de4: icmp_seq=1 ttl=64 time=0.374 ms (DUP!) 64 bytes from fe80::202:b3ff:fe16:5c44: icmp_seq=1 ttl=64 time=0.514 ms (DUP!) .

主控程式動作流程

繪製網路拓樸圖形介面

本計畫可應用於產業界之相關研究 網管系統 網路安全