The Error Channel

Time: 30 min

Needs: A2's topology

GNS3 project: w04-next-hop (continue)

Predict first

1. You are on PC1 and are attempting to ping a destination for which it has no route. How many packets leave PC1? ___
2. You sent a request to a remote service that isn't running. What comes back, and from whom? ___
3. You sent a packet to a host that is switched off. You get back a "host unreachable" error. Who sent it? ___

Do this — locate the source of the error messages

Start a capture on the PC1 cable.

Fill out the following table based on your observations:

Everything below is run on PC1, unless indicated otherwise

Case 1: no route on host

nmcli con mod eth0 ipv4.gateway ""
nmcli con up eth0

ping -c1 203.0.113.1

Case 2: no route on the router

nmcli con mod eth0 ipv4.gateway 192.168.100.1
nmcli con up eth0

ping -c1 203.0.113.1

Case 3: the route exists, but the host is switched off or absent

ping -c1 192.168.200.99

Case 4: the host exists, but the requested service isn't running

echo hello | ncat -u -w1 192.168.200.10 9999

Case 5: low link capacity

On R2 (find the interface connected to SW2. Here it's assumed to be eth0:

ip link set dev eth0 mtu 500

On PC1:

ping 192.168.200.10 -M do -s 1000 -c1

On R2, restore the original MTU:

ip link set dev eth0 mtu 1500

Case 6: traceroute

On PC1:

traceroute -I -q 1 -N 1 192.168.200.10

What just happened

• Case 1: Network is unreachable. PC1 never sent anything. It found no route to the destination and simply refused to transmit. Thus, "Network is unreachable" in this case is a local error.
• Case 2: Destination net Unreachable. The error was reported by R1 which was the first place where the lack of a route to the destination was detected.
• Case 3: Destination Host Unreachable. Only R2 could discover that the host was absent after ARP timed out. This is why it took longer than the previous two errors
• Case 4: Port Unreachable. Note that this error appears in the capture but not in the terminal. Up to now the errors were handled by the kernel. Errors at the Transport layer are handled by the originating process.
• Case 5: Fragmentation needed. The packet was sent with the DF (Don't fragment) bit set. R2 was unable to forward it and instead notified the sender about it. The error header contains a MTU of next hop field letting PC1 know exactly how to size the packets on next attempt
• Case 6: Time to live exceeded in transit. The TTL parameter controls how far a packet can go on the internet. Each router the packet transit through decrements its value and when it reaches 0, the packet is droped and a notification is sent back to the sender. traceroute "abuses" this to discover the entire path to any destination on the internet.

Do this — Examine ICMP error contents

Pick any of the Type 3 messages in Wireshark and expand it fully.

What just happened

• Every ICMP error carries the original IP header plus at least the first 8 bytes of the datagram that caused it.
• For TCP and UDP, the first 8 bytes contain the source and destination ports. This is what enables the host receiving the error to attribute it to a specific socket.
• The ICMP header totals 8 bytes, one byte each for the type and code, 2 bytes for the checksum. The remaining 4 bytes are type-dependent are unused, with a few exceptions, in error types.
• Error types are 3, 4, 5, 11, and 12, 3 (undeliverable) being the most common
• Other notable types include 0 (Echo Reply) and 8(Echo Request), 13 and 14 (Timestamp/Timestamp Reply), etc
• ICMP codes narrow a message type to a specific reason. A packet can fail to be delivered for various reasons, including absence of a route, host absent, unavailable service, insufficient link capacity, etc.

Record

If it went wrong