Prerequisites:
Solid understanding of the Network Layer Data Plane (Chapter 4):
forwarding tables, IPv4 addressing, and router architecture.
1. Introduction: Network Control
Plane
Recall from Chapter 4: the network layer has two core functions.
Forwarding is the local, per-router data-plane action
of moving a packet from an input link to the appropriate output link.
Routing is the network-wide control-plane process of
determining the end-to-end path that packets follow from source to
destination.
Per-Router Control (Traditional)
Individual routing algorithm components run in
each and every router. Routers exchange messages with one
another in the control plane to compute forwarding tables. Examples:
OSPF, BGP running distributedly on each router.
SDN Control (Logically Centralized)
A remote controller computes and installs
forwarding tables in routers. The data plane (switching hardware) is
decoupled from the control plane (software controller).
Communication occurs via protocols like OpenFlow.
Key Insight: The
control plane is the "brain" that populates the forwarding tables; the
data plane is the "muscle" that executes the forwarding decisions at
line speed.
Graph Abstraction & Link Costs
Routing protocols operate on a graph abstraction of the network: \(G =
(N, E)\), where \(N\) is the set of routers (nodes) and \(E\) is the set
of links (edges). Each link \((x, y)\) has an associated cost
\(c_{x,y}\). The goal is to find the least-cost path between sources and
destinations.
Cost may always be 1 (hop count), inversely related to bandwidth, or
inversely related to congestion.
If \(x\) and \(y\) are not directly connected, \(c_{x,y} = \infty\).
Routing Algorithm Classification
Dimension
Category A
Category B
Information source
Global (Link-State): all routers know complete
topology and link costs
Decentralized (Distance-Vector): routers know
only neighbors' costs and local estimates
Dynamics
Static: routes change slowly over time (manual
updates)
Dynamic: routes change automatically in response
to traffic/topology changes
Load sensitivity
Load-sensitive: link costs vary with current
congestion
Load-insensitive: link costs do not reflect
current congestion (most common today)
2. Link-State Routing: Dijkstra's
Algorithm
Link-State (LS) algorithms use global knowledge: each
router stores the complete network topology and all link costs,
typically obtained via link-state broadcast. Dijkstra's
algorithm computes the least-cost path from a source node to all other
nodes.
Algorithm Overview
Each node maintains:
\(D(v)\): current estimate of least-cost path from source to
destination \(v\)
\(p(v)\): predecessor node along the current least-cost path to \(v\)
\(N'\): set of nodes whose least-cost path is definitively known
Dijkstra's Algorithm (pseudocode):
Initialization:
N' = {u}
for all nodes v:
if v adjacent to u: D(v) = c(u,v)
else: D(v) = ∞
Loop:
find w not in N' such that D(w) is minimum
add w to N'
update D(v) for all v adjacent to w and not in N':
D(v) = min( D(v), D(w) + c(w,v) )
until all nodes in N'
Network Graph for the Example
Graph for Dijkstra's example: compute least-cost paths from source
u to all other nodes. Edge costs are
corrected to match the trace table (x-y = 1, y-z =
2).
Step-by-Step Trace Table (Corrected)
The table below shows the correct Dijkstra trace for the graph above,
with all values populated at every step. The ordering of node additions
follows the standard algorithm: at each step, the node with the smallest
tentative distance is selected.
Step
\(N'\)
\(D(v), p(v)\)
\(D(w), p(w)\)
\(D(x), p(x)\)
\(D(y), p(y)\)
\(D(z), p(z)\)
0
u
2, u
5, u
1, u
\(\infty\)
\(\infty\)
1
ux
2, u
5, u
1, u
2, x
5, x
2
uxy
2, u
3, y
1, u
2, x
4, y
3
uxyv
2, u
3, y
1, u
2, x
4, y
4
uxyvw
2, u
3, y
1, u
2, x
4, y
5
uxyvwz
2, u
3, y
1, u
2, x
4, y
Key
Corrections Applied:
Step 1: \(D(z)\) corrected from \(\infty\) to \(5,
x\) (path u → x → z, cost 1 + 4 = 5).
Step 2: \(D(w)\) updated to \(3, y\) (u → x → y →
w, cost 1 + 1 + 1 = 3) and \(D(z)\) updated to \(4, y\) (u → x → y →
z, cost 1 + 1 + 2 = 4).
Steps 3–5: All columns are now fully populated with
the correct values.
Node ordering: v (D=2) is added before w (D=3) at
step 3, following standard Dijkstra's rule of selecting the smallest
tentative distance first. The table now correctly shows
uxyv at step 3 and uxyvw at step
4.
Resulting Forwarding Table in
u:
Destination v → outgoing link \((u,v)\) (direct,
cost 2)
Destination x → outgoing link \((u,x)\) (direct,
cost 1)
Destination y → outgoing link \((u,x)\) (via x,
cost 1 + 1 = 2)
Destination w → outgoing link \((u,x)\) (via x → y,
cost 1 + 1 + 1 = 3)
Destination z → outgoing link \((u,x)\) (via x → y,
cost 1 + 1 + 2 = 4)
Notice how \(D(w)\) was updated from 5 (direct) to 3 via x and y.
Complexity & Oscillations
Time complexity: \(O(n^2)\) for the basic
implementation; \(O(n \log n)\) with efficient priority queues.
Message complexity: Each router broadcasts its link
state to all \(n\) routers, requiring \(O(n^2)\) total link crossings.
Oscillations: When link costs depend on traffic
volume, routers may continuously shift traffic to the "least
congested" path, causing oscillations where no stable routing is ever
reached.
3. Distance-Vector Routing:
Bellman-Ford
Distance-Vector (DV) algorithms are decentralized and
iterative. Each router knows only the costs to its directly attached
neighbors and maintains a vector of estimates to all destinations. The
algorithm is based on the Bellman-Ford equation:
where the \(\min\) is taken over all neighbors \(v\) of \(x\). The node
achieving the minimum is the next hop on the estimated least-cost path
to destination \(y\).
Key Properties
Iterative: Each node recomputes its distance vector
whenever it receives an update from a neighbor.
Asynchronous: Nodes do not operate in lockstep;
updates trigger local computations.
Self-stopping: If no updates arrive and no local DV
changes, a node remains silent (no unnecessary messages).
Distributed: No node has global knowledge;
information diffuses hop-by-hop.
Simple Example: Three Nodes
Consider nodes \(x\), \(y\), \(z\) with link costs \(c(x,y)=2\),
\(c(x,z)=7\), \(c(y,z)=1\). Suppose \(y\) and \(z\) know their costs to
\(z\): \(D_y(z)=1\) and \(D_z(z)=0\).
The path via \(y\) (cost 3) is preferred over the direct link (cost 7).
Similarly, \(D_x(y) = \min\{2+0, 7+1\} = 2\).
Link Cost Changes: Count-to-Infinity
Good News Travels Fast
When a link cost decreases, the affected node updates its
DV and notifies neighbors. The correct information propagates
quickly (within a few iterations).
Bad News Travels Slow
When a link cost increases significantly (or fails), the
count-to-infinity problem occurs. A node may
believe it can still reach the destination via a neighbor, not
realizing that neighbor's path depends on itself. Costs increment
slowly toward infinity.
Count-to-Infinity Example: Suppose \(y\) detects its
direct link to \(x\) now costs 60, but \(z\) advertises \(D_z(x)=5\).
\(y\) computes \(D_y(x) = \min\{60, 1+5\} = 6\) via \(z\). Then \(z\)
sees \(y\) advertising 6, so \(z\) computes \(D_z(x) = \min\{50, 1+6\} =
7\) via \(y\). This ping-pong continues: 6, 7, 8, 9 … until infinity.
Solutions: Poison Reverse (advertise \(\infty\) back to
the neighbor you use) and defining a maximum hop count.
Comparison: LS vs. DV
Characteristic
Link-State (Dijkstra)
Distance-Vector (Bellman-Ford)
Message complexity
\(O(n^2)\) messages (broadcast to all)
Exchanges only between neighbors; convergence varies
Speed of convergence
\(O(n^2)\) computations; may oscillate
Varies; may suffer routing loops & count-to-infinity
Robustness
A router can advertise incorrect link costs only
A router can advertise incorrect path costs, causing
black-holing; errors propagate
Scalability
Requires more memory (full topology)
Requires less memory (only neighbor vectors)
4. Intra-AS Routing: OSPF
An Autonomous System (AS) is a collection of routers
under a single administrative domain.
Intra-AS routing protocols determine how packets are
routed within one AS. The most widely deployed is
OSPF (Open Shortest Path First) (RFC 2328).
OSPF Characteristics
Open: Publicly available standard.
Link-State: Each router floods OSPF link-state
advertisements (LSAs) to all other routers in the AS.
Transport: LSAs are sent directly over IP
(protocol 89), not over TCP or UDP.
Multiple metrics: Link costs can reflect
bandwidth, delay, or a composite metric.
Security: All OSPF messages are authenticated to
prevent malicious intrusion.
Hierarchical OSPF
To improve scale, OSPF uses a two-level hierarchy:
Local area: Routers flood LSAs only within their
area, reducing overhead.
Backbone (Area 0): Connects all areas.
Area Border Routers (ABRs): Summarize distances
to destinations in their own area and advertise summaries into the
backbone.
Backbone routers: Run OSPF limited to the
backbone.
Why hierarchy? In a flat network with \(n\) routers,
\(O(n^2)\) LSAs may be flooded. With hierarchical OSPF, flooding is
confined to areas, dramatically reducing routing update traffic and CPU
load.
Reference: RFC 2328.
5. Inter-AS Routing: BGP
BGP (Border Gateway Protocol) - RFC 4271 is the de
facto inter-domain routing protocol—the "glue that holds the Internet
together." It allows ASes to advertise reachability information and
apply administrative policies.
eBGP vs. iBGP
Type
Scope
Purpose
eBGP
Between gateway routers of different ASes
Obtain reachability info from neighboring ASes
iBGP
Among routers within the same AS
Propagate external reachability info to all internal routers
BGP Messages & Path Attributes
BGP peers exchange messages over a semi-permanent
TCP connection (port 179). Key message types:
OPEN: Opens TCP connection and authenticates the
peer.
UPDATE: Advertises a new path or withdraws an old
one.
KEEPALIVE: Keeps the connection alive in the absence
of UPDATES.
NOTIFICATION: Reports errors or closes the
connection.
A BGP route is a prefix plus path attributes:
AS-PATH: List of ASes the advertisement has traversed
(loop detection & policy).
NEXT-HOP: The specific internal router leading to the
next-hop AS.
BGP Route Selection & Policies
When multiple routes exist, a BGP router selects the best path using
this decision process:
Local Preference: Policy-based value set by the AS
admin.
Shortest AS-PATH: Fewer AS hops preferred.
Closest NEXT-HOP (Hot Potato): Prefer the exit point
with the lowest intra-domain cost.
Additional tie-breakers (e.g., router ID).
Hot Potato Routing Example
Consider router 2d in AS2 learning paths to X via
2a (cost 10 internal OSPF) and
2c (cost 50 internal OSPF). Even if 2a has a longer
AS-PATH, 2d will choose 2a because it gets the
packet out of AS2 faster.
Policy-Based Routing
An ISP may refuse to carry transit traffic between other ISPs. Using
import and export policies, an AS
can decline certain paths or choose not to advertise them, shaping
global traffic flow based on business relationships.
Real-World Application: BGP Anycast
(DNS Root Servers)
Google Public DNS (8.8.8.8) uses BGP Anycast. The same
IP prefix is advertised from multiple locations worldwide. BGP's
shortest AS-PATH and hot potato routing naturally direct each user to
the topologically nearest server, dramatically reducing
latency and providing fault-tolerance. When one site fails, BGP
converges and routes traffic to the next closest site.
6. SDN Control Plane
Software-Defined Networking (SDN) separates the
network's control logic from the underlying routers and switches that
forward traffic. This enables centralized, programmable network
management.
SDN Architecture: Four Planes
Data-plane switches: Fast, simple, commodity hardware
implementing generalized forwarding (e.g., OpenFlow match+action).
Flow tables are computed and installed by the controller.
SDN Controller (Network OS): Maintains network-wide
state (topology, link status), provides abstractions to apps above via
the northbound API (e.g., REST, Intent), and controls
switches below via the southbound API (e.g.,
OpenFlow, NETCONF).
Network-Control Applications: The "brains"
implementing routing, access control, load balancing, etc. These are
unbundled and can be provided by third parties.
Programmable Control: Operators specify
what they want (intent), and the controller determines
how to configure the switches.
OpenFlow Protocol
OpenFlow operates between the controller and switches over TCP. Three
message classes:
Direction
Message
Function
Controller → Switch
Features, Configure,
Modify-State,
Packet-Out
Query features, set config, add/delete flow entries, send packets
out a port
Switch → Controller
Packet-In, Flow-Removed,
Port-Status
Transfer unknown packet to controller, notify deleted flow, report
port changes
Real-World Application: Google B4 &
ORION SDN
Google's B4 WAN connects its datacenters worldwide.
Using the ORION SDN control plane, Google centrally
manages traffic engineering, achieving ~95% link utilization. The
controller uses OpenFlow to install flow tables based on application
priorities, dynamically rerouting traffic around congestion in
milliseconds rather than seconds.
7. Internet Control Message Protocol
(ICMP)
ICMP is used by hosts and routers to communicate network-level
information. It sits logically "above" IP: ICMP messages are carried
inside IP datagrams.
Common ICMP Message Types
Type
Code
Description
0
0
Echo Reply (ping)
3
0
Destination Network Unreachable
3
1
Destination Host Unreachable
3
3
Destination Port Unreachable
8
0
Echo Request (ping)
11
0
TTL Expired (traceroute)
12
0
Bad IP Header
Traceroute & ICMP
Traceroute uses ICMP to discover the route to a
destination:
The source sends UDP segments with TTL = 1, then TTL = 2, then TTL =
3, and so on.
When the \(n\)-th router receives the datagram, it decrements TTL to
0, discards the packet, and sends an ICMP
Type 11, Code 0 (TTL expired) message back to the
source.
The source records the router's IP address and the RTT.
When the UDP segment finally reaches the destination, the host returns
ICMP Type 3, Code 3 (Port Unreachable), signaling the
source to stop.
Practical Lab: Traceroute & ICMP
Analysis with Wireshark
Lab Exercise: Combined Traceroute and
Wireshark Capture
In this exercise, you will use traceroute to discover
the path to a remote host while simultaneously capturing ICMP traffic
with Wireshark to see the protocol in action.
Step-by-Step Instructions
Start Wireshark Capture: Open Wireshark and begin
capturing on your active network interface. Set the display filter
to icmp to focus only on ICMP messages.
Run Traceroute: Open a terminal (Command Prompt on
Windows) and run: traceroute 8.8.8.8 (Linux/Mac)
or tracert 8.8.8.8 (Windows).
Observe the Capture: As traceroute runs, watch the
packets appear in Wireshark. You should see:
ICMP Type 11, Code 0 (TTL expired) messages
from intermediate routers.
Finally, an ICMP Type 3, Code 3 (Port
Unreachable) from the destination host.
Analyze the Data:
For each hop, note the source IP address (the
router that sent the ICMP error) and the
RTT (time between the request and the
response).
Expand the IP header of one of the TTL-expired packets. What is
the TTL value when it arrives? Why?
Examine the ICMP payload: it contains the original IP header and
the first 8 bytes of the UDP segment that caused the error.
Discussion Questions:
Why do some routers not respond with an ICMP TTL expired message
(shown as
* * *
in traceroute)?
How does traceroute measure the RTT for each hop? (Hint: Look at
the timestamps in the capture.)
What is the significance of the final Port Unreachable message?
This exercise combines both the diagnostic use of traceroute and
the detailed packet-level analysis provided by Wireshark, giving you
a complete view of how ICMP operates in practice.
Homework Assignment (Theoretical, Graded)
Instructions: Answer all questions in a separate
document (PDF or Word). Submit via the learning platform. This
assignment counts towards your final grade (5%).
Part I: Short Essays (40 points)
Explain the difference between forwarding and
routing. Which function belongs to the data plane
and which to the control plane?
Trace Dijkstra's algorithm step-by-step for the graph in Section 2
of this lecture, starting from node u. Show the
contents of \(N'\) and all \(D(v)\) values at each iteration.
State the Bellman-Ford equation and explain how it
enables distributed routing. What is the
count-to-infinity problem, and how does
poison reverse mitigate it?
Compare eBGP and iBGP. Why does
BGP need both?
Describe the three main components of an
SDN architecture and the role of the OpenFlow
protocol.
Part II: True/False + Correction (30 points)
In link-state routing, each router knows only the distance vectors
of its immediate neighbors. (True / False)
OSPF floods link-state advertisements only within a local area, not
the entire AS. (True / False)
BGP is a distance-vector protocol that uses hop count as its primary
metric. (True / False)
In hot potato routing, an AS chooses the exit point with the lowest
inter-domain cost. (True / False)
ICMP messages are carried directly inside IP datagrams. (True /
False)
For each false statement, write the correct version.
Part III: Calculations & Analysis (30 points)
Given the 3-node network (\(x, y, z\)) with costs \(c(x,y)=2\),
\(c(x,z)=7\), \(c(y,z)=1\), compute the distance vectors \(D_x\),
\(D_y\), and \(D_z\) using the Bellman-Ford equation. Show that
\(D_x(z) = 3\).
Suppose an AS learns two routes to prefix \(P\): • Route A:
AS-PATH = [2, 3, 4], Local Pref = 100, NEXT-HOP cost = 5 •
Route B: AS-PATH = [5, 4], Local Pref = 100, NEXT-HOP cost = 8
Which route will BGP select and why? Explain each step of the
decision process.
A router receives an ICMP message with
Type = 3, Code = 3 while running traceroute. What
does this mean, and what action should the source host take?
Deadline: Two weeks from the lecture date.
Chapter 5 Summary
Control Plane: Computes forwarding/routing tables.
Two architectures: per-router (traditional, distributed) and SDN
(logically centralized).
Link-State (Dijkstra): Global topology knowledge,
\(O(n^2)\) complexity, uses shortest-path tree. Risk of oscillations
with load-sensitive costs.
Distance-Vector (Bellman-Ford): Decentralized,
iterative, asynchronous. Uses neighbor vectors only. Suffers from
count-to-infinity; mitigated by poison reverse.
OSPF: Intra-AS link-state protocol with hierarchical
areas, ABRs, and backbone to improve scale.
BGP: Inter-AS path-vector protocol. eBGP between
ASes; iBGP within an AS. Uses AS-PATH, NEXT-HOP, local preference, and
hot-potato routing.
SDN: Separates data and control planes. Controller
manages switches via southbound APIs (OpenFlow); applications use
northbound APIs (REST/Intent).
ICMP: Network-layer diagnostic protocol. Types
include echo request/reply (ping) and TTL expired (traceroute).
Self-Review Questions (Exam
Preparation):
• Why does OSPF use areas, and what is the role of an ABR?
• Walk through the BGP route selection process for a scenario with two
competing paths.
• How does traceroute use TTL and ICMP to map a network path?
• Compare the robustness of LS and DV algorithms when a router
advertises false information.
• What are the advantages of a logically centralized SDN controller over
per-router control?
Looking Ahead to Chapter
6: Question: How do devices on the same local
network communicate directly without involving the network layer? Answer: The Link Layer handles
node-to-node delivery over a single link, using MAC addressing, error
detection (CRC), and multiple access protocols. We will study Ethernet,
switches, VLANs, and the ARP protocol in detail.