My Netwok Dictionary

Today I needed to get interested in how memory works at the IOS, so here is a quick article about it with the information I could find here and there, you might be interested.Especially the IOS commands to check the memory status of your router.

Like any OS, IOS must implement a number of basic principles:

* Process Management
* Memory Management
* Device Management

We’ll look specifically at the system memory management. Recent work with OS protected memory.A process x can not access the memory of a process y (Shared Memory, Message Queues, Pipes, Network Connections, …). For the process x process dialogue with it, they will have to use other methods (Shared Memory, Message Queues, Pipes, Network Connections, …). These methods secure processes between them, but nevertheless they work slow. The IOS does not support shared memory, all processes have access to the memory without restrictions.A process is therefore free to interact with one another in writing in the memory of the latter (Buffer Overflow = Crash).There is however a notion of memory R / W and R / W

IOS works with memory pools, the Pool Manager who is responsible.Here, a pool reserved for the procesand a pool reserved for I / O:

Router # show memory
 Head Total (b) Used (b) Free (b) Lowest (b) Largest (b)
 Processor
 653B8C20 155481056 86243592 69237464 68168948 67670028
 I/O
 EE800000 25165824 5269012 19896812 19819968 19871932

Head: beginning the pool
Total: pool size in bytes
Used: current use of the pool in bytes
Free : current free memory pool in bytes
Lowest :free memory historically the lowest in bytes
Largest :The largest contiguous block of free memory

Region Manager : These same pools belong to regions of memory managed by the Region Manager:

Router # show region

Region Manager:
Start End Size (b) Class Media Name
0×0E800000 0×0FFFFFFF iomem 25165824 R / W iomem: (iomem)
0×60000000 243269632 0×6E7FFFFF Room R / W Hand
0×6000F000 0×632FFFFF iText 53415936 R / O main: text
0×63300000 28310784 0×64DFFCFF iData R / W main: data
0×64DFFD00 0×653B8C1F IBSS 6000416 R / W main: bss
0×653B8C20 0×6E7FFFFF 155 481 056 Room R / W main: heap
0×80000000 243269632 0×8E7FFFFF Room R / W main: (main_k0)
0xA0000000 0xAE7FFFFF 243 269 632 Room R / W main: (main_k1)
0xEE800000 0xEFFFFFFF iomem 25165824 R / W iomem

The Processor memory pool is within the area hand heap. This region is part of the region starting in hand 0 × 60000000 and ends at 0 × 6E7FFFFF. The memory pool I / O is the region of iomem 0xEE800000 to 0xEFFFFFFF.

In the hand area are:

# Hand: text: contains the code for IOS R / O (iText)
# main: data: contains initialized variables R / W (iData)
# main: bss: contains uninitialized variables R / W (IBSS)
# main:heap :contains the structures of local standard memory R / W
# iomem : contains the memory devices (memory bus I / O)

It may be noted that some regions are redundant: main (main_k0) hand (main_k1) They all correspond to the same region hand. You can even find iomem two different places: 0 × 0E800000-> 0 × 0FFFFFFF and 0xEE800000-> 0xEFFFFFFF, yet it is the same memory area.

On a Cisco device to another location where you stored a particular type of memory differs.On a type of router you can find memory SRAM iomem, while in others the same area can be found in the DRAM. The Pool Manager defines memory areas regardless of type of memory used (hardware abstraction).

Returning to the Pool Manager.Using the command “show memory processor, we can notice that the memory is divided into blocks:

Router # show memory processor
Processor memory
Address Bytes Prev Next Ref Alloc PC What PrevF NextF
65A817E0 0000000084 65A8175C 65A81864 628215E8 001 ——– ——– Init
65A81864 0000001372 65A817E0 65A81DF0 001 ——– ——– 608E3218 Skinny Socket Server
65A81DF0 0000001156 65A81864 65A822A4 001 ——– ——– 608E3218 Skinny Socket Server

# Address: Start of block
# Bytes: block size
# Prev: address of previous block (linkage)
# Next: Address of next block (chaining)
# Ref: for how many processes this block is used?
# PrevF: previous free block
# NextF: Next free block
# Alloc PC: process that allocated the block
# What: name of the process holding the block

If we had the idea to create a buffer overflow in a storage area, then write more bytes than expected allocated to this memory area, we would end up overwriting the header of the next memory area and thus break the chaining memory IOS.

Unfortunately or not, the IOS constantly checks the structure of its memory and the least inconsistency, forcing a crash. So to succeed without a buffer overflow crash, it must arrange to rewrite a header consistent among the next buffer.

Chunk Manager

When we allocate memory for a process (malloc), The Pool Manager is an area of free memory and assigns it to a process.The Pool Manager is therefore a table of blocks of contiguous memory. When a process frees a memory area (free), the Pool Manager tries to concatenate the newly released memory area with its neighbors. Despite this fragmentation is unavoidable concatenation.An extremely fragmented memory can lead to errors malloc “% SYS-2-MALLOCFAIL. The Chunk Manager will help address these concerns by allocating more memory to intelligently process.

The Chunk Manager is responsible for the allocation of Chunk.A chunk contains a finite number of blocks of equal size. If we use all the blocks present in a Chunk, Chunk Manager allocates the new space (Sibling). If no more blocks of the “Sibling” is used, it is released “Freed / Trimmed.
When the process frees a block, it does in its chunk. So there is more fragmentation between different processes.