Dead Gateway Detection

Select Certification Bootcamp :
MCSE MCSE+Security CCNA CCNP RHCE Register Course Fees Home

Leading MCSE, CCNA, CCNP Certification boot camp training provider in India, USA, UK.

Dead Gateway Detection

Microsoft NT supports dead gateway detection when using TCP/IP. This means a machine can have more than one default gateway defined in its IP configuration. If, for some reason, the first default gateway is not responding, TCP/IP can switch to other default gateways to try to find a path to a particular destination. Dead gateway detection works only through the TCP protocol, so a utility such as ping does not initiate dead gateway detection when trying to communicate. A utility such as FTP, on the other hand, tries to establish a TCP connection and detects dead gateways.

When TCP sends out data and no acknowledgments are received, it retransmits this data. But it only tries to retransmit data so many times before giving up on the connection. This number of times is defined by the registry entry called TcpMaxData Retransmissions. When TCP reaches half of this value (default = 5), it asks IP to switch from the original default gateway, and to try to establish communication using the next default gateway configured on the machine. Dead gateway detection does not have to be turned on by the user; it is on automatically.

After multiple default gateways are configured, dead gateway detection is initiated for any TCP connection, and the entries for the default gateways are placed in the routing table. The registry where you can configure this manually is as follows:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters

Remember that by default, this selection is on. The only reason to edit this parameter would be if you do not want to use dead gateway detection. For more information on the exact registry entries and parameters, see Microsoft’s online knowledge base.

After a machine determines where to send a packet destined for either a local or remote address, all other networking processes discussed earlier have to take place. Take a closer look at the packets that are created during these two processes, local and remote. The first example illustrates a command issued to a local machine and the second example illustrates the same for a remote machine. Both examples use Figure 5.15, and the route table in Figure 5.14 is the default route table for machine A on the network.

The first step is for machine A to use its subnet mask to determine whether this IP address is local or remote. After determining that the IP address is local, it consults the route table. Even though the destination is local, the machine still needs to figure out what interface to use to send out the data. Although this may seem somewhat trivial, keep in mind that a machine may have more than one IP address bound to a network card, or more than one network card attached to two networks. Either scenario provides a machine with more than one local interface to physical network segments. After the machine establishes the IP address of the interface, ARP is instructed to find the physical address of the local machine. A sample ARP broadcast for this address is shown in Figure 5.16.

Once the destination address responds with its physical address, ARP relays this information to IP so that IP can formulate the directed packet shown in Figure 5.17. Notice both the destination’s physical address and IP address are used in the creation of this directed packet. After this packet is transmitted on the wire, only machine B’s Network Interface layer responds to the physical address identified.

In this way, local communications are initiated. Observe the subtle differences between communicating with a local machine versus a remote machine.

The first step is for machine A to use its subnet mask to determine whether this IP address is local or remote. After determining that the IP address is remote, it consults the route table to determine where to send packets destined for this IP address. After consulting the default table, the machine does not find any entries specific to network 3. It does, however, have a default gateway defined at 131.107.32.1.

Therefore, any packets destined for networks this machine does not know about should be sent to the default gateway at 131.107.32.1. IP asks ARP to find the physical address of the default gateway because that is where this packet will have to be sent. ARP consults the ARP cache and either returns a physical address stored in memory or initiates an ARP broadcast for the router. Figure 5.18 illustrates this ARP packet. There does not appear to be anything special about this packet except for the address that ARP is looking for.

Once ARP locates the physical address of the router, it returns this physical address to IP so that IP can formulate the packet that will be sent. Figure 5.19 illustrates the packet that IP formulates. Take a close look at the destination physical address and the destination IP address.

Notice how cleverly IP handles the routing of the packet. IP has to keep the destination IP address the same as that issued by the ping command, but send the packet in such a way that it can be forwarded by the router. It does this by creating a packet destined for the original IP address at the Internet layer, but sending the packet to the physical address of the router at the network interface layer. IP knows that the router is the only machine that will respond to a packet destined for this physical address, but that once the router passes this packet up to the IP layer, the router will be responsible for forwarding this packet to its destination.

After the packet resides on the router, the router has to go through the same process as any other host or machine on the network. The router must use its subnet mask to determine whether the packet’s IP address is local or remote, access its route table to find the best possible route to the destination, and utilize ARP to find physical addresses to send the packet(s) to.

If this example had more routers and network segments, the first router would be responsible for figuring out the best route to the destination network. After it determined the best route, it would forward this data on to its next hop or router. This second router would go through the same motions, figuring out the best path to send the data along to its final destination.

Of course, discussion up to this point has focused on how the local machine gets a packet from itself to the first router along the path to a packet’s destination. Both routers and machines keep a routing table. On a machine, this table is usually relatively short and simply defines the network that the machine is currently on and the machine’s interface (IP address) to that network. On routers, these tables can be long and complex, but by default, a router knows only about the networks to which it has a physical interface. For instance, in Figure 5.16, the router only knows about networks 1, 2, and 3, because it has a physical interface to each.

Vibrant Advantage :

No Prestudy
Longest Duration Camp
Chalk Talk Training
Highest Passing Rate
Bootcamp since 1999
Guaranteed Certification ...

Testimonials :

MCSE Certification boot camp

The instructor taught real world experience and did not just teach us to pass the test. He knew the subject well and was encouraging. His lectures were very well delivered....

Colver Dennis, USA