06. Routing - 网络安全攻防实践

Router components

Control Plane: “slow path” operations.
- Software process that is responsible for tasks that require calculation and decision-making.
- Running routing protocols (like OSPF or BGP) to build the routing table.
- Processing management traffic.
Data Plane (Forwarding Plane): “fast path” operations.
- Implemented in specialized high-speed hardware (ASICs).
- Only job is to take an incoming packet, look up the destination IP in the forwarding table (provided by the control plane), and switch the packet to the correct output port at line speed.

IP Address Classes (Historical)

_Attachments/Pasted image 20250707021256 IPv4 addresses were divided into classes based on their first few bits.

Class A: a few huge networks.
Class B: medium networks.
Class C: many small networks. This system was inflexible and wasteful.

Private IP Ranges (RFC 1918)

Certain ranges are reserved for use within private networks and are not routable on the public internet.

10.0.0.0/8, 172.16.0.0/12, and 192.168.0.0/16.

Classless Inter-Domain Routing (CIDR)

The modern system, which replaces classes with a prefix length (e.g., /24).

Before sending a packet: “Is the destination local or remote?”
Answered with: $\text{IP Address} \mathbin{\&} \text{Subnet mask}$ .

11000000.10101000.00000011.00001010 (192.168.3.10)
        &
11111111.11111111.11111111.00000000 (255.255.255.0)
----------------------------------- 11000000.10101000.00000011.00000000 (192.168.3.0) <- Network ID

Client IP (192.168.3.10).
Subnet mask: 255.255.255.0 (/24, meaning 24 1s in the mask; represents how many digits of the IP address are used to determine the network “location”). If the resulting network IDs match, the destination is local; otherwise, it’s remote, and the packet is sent to the default gateway (usually the router).

Misconfigured Subnet Mask (Triangular Routing)

Classic issue where a client (192.168.3.10/28) pings a server (192.168.3.200/24). The client's narrow /28 mask causes it to incorrectly calculate that the server is on a remote network, so it sends the packet to the gateway. The correctly configured server knows the client is local and replies directly, creating an inefficient triangular path: Client -> Gateway -> Server -> Client.