Catálogo de publicaciones - libros

Periodically in the transport protocol research community, the idea of introducing a is voiced. In this paper we assess the prevalence and implications of bursts in the context of real TCP traffic in order to better inform a decision on whether TCP’s congestion control algorithms need to incorporate some form of burst suppression. After analyzing traffic from three networks, we find that bursts are fairly rare and only large bursts (of hundreds of segments) cause loss in practice.

We study the burstiness of TCP flows at the packet level. We aggregate packets into entities we call “flights”. We show, using a simple model of TCP dynamics, that delayed-acks and window dynamics would potentially cause flights at two different timescales in a TCP flow— the lower at the order of 5-10 ms (sub-RTT) and the higher at about 10 times this value (order of an RTT seen by the flow). The model suggests that flight sizes would be small at the lower timescale, regardless of the network environment. The model also predicts that the network conditions required for the occurrence of flights at the larger timescale are either large buffers or large available bandwidths — both of which result in a high bandwidth delay product environment. We argue that these two conditions indicate that the TCP flow does not operate in a congestion control region , either because the source of traffic is unaware of congestion or because there is so much bandwidth that congestion control is not required. We verify our model by passive Internet measurement. Using the trace files obtained, we collect statistics on flights at the two timescales in terms of their frequency and size. We also find the dependence of the sizes and frequency of flights on the Internet environment in which they occurred. The results concur strongly with our hypothesis on the origins of flights, leading us to the conclusion that flights are effective indicators of excess resource in the Internet.

While the Internet offers a single best-effort service, we remark that (i) core backbones are in general over provisioned, (ii) end users have increasingly faster access and (iii) CDN and p2p solutions can mitigate network variations. As a consequence, the Internet is to some extent already mature enough for the deployment of multimedia applications and applications that require long and fast transfers, e.g. software or OS updates. In this paper, we devise a tool to investigate the stationarity of long TCP transfers over the Internet, based on the Kolomogorov-Smirnov goodness of fit test. We use BitTorrent to obtain a set of long bulk transfers and test our tool. Experimental results show that our tool correctly identify noticeable changes in the throughput of connections. We also focus on receiver window limited connections to try to relate the stationarity observed by our tool to typical connection behaviors.

Well-known port numbers can no longer be used to reliably identify network applications. There is a variety of new Internet applications that either do not use well-known port numbers or use other protocols, such as HTTP, as wrappers in order to go through firewalls without being blocked. One consequence of this is that a simple inspection of the port numbers used by flows may lead to the inaccurate classification of network traffic. In this work, we look at these inaccuracies in detail. Using a full payload packet trace collected from an Internet site we attempt to identify the types of errors that may result from port-based classification and quantify them for the specific trace under study. To address this question we devise a classification methodology that relies on the full packet payload. We describe the building blocks of this methodology and elaborate on the complications that arise in that context. A classification technique approaching 100% accuracy proves to be a labor-intensive process that needs to test flow-characteristics against multiple classification criteria in order to gain sufficient confidence in the nature of the causal application. Nevertheless, the benefits gained from a content-based classification approach are evident. We are capable of accurately classifying what would be otherwise classified as unknown as well as identifying traffic flows that could otherwise be classified incorrectly. Our work opens up multiple research issues that we intend to address in future work.

Pure P2P applications are widely used nowadays as a file sharing system. In the overlay networks, music and video files are the main items exchanged, and it is known that the traffic volume is much larger than that of classical client/server applications. However, the current status of the P2P application traffic is not well known because of their anonymous communication architectures. In particular, in cases where the application does not use the default service port, and the communication route and the shared file are also encrypted, the identification traffic has not been feasible. To solve this problem, we have developed an identification method for pure Peer-to-Peer communication applications, especially for traffic for Winny, the most popular Peer-to-Peer application in Japan, by using server/client relationships among the peers. We will give some evaluation results for our proposed identification method.

Peer-to-Peer (P2P) applications now generate the majority of Internet traffic, particularly for users on ADSL because of flatrate tarification. In this study, we focus on four popular P2P systems to characterize the utilization, the performance and the evolution of P2P traffic in general. We observe and compare the influence of each P2P application over the traffic, and we evaluate the evolution of these P2P systems over a year. Our analysis is based on ADSL traffic captured at TCP level on a Broadband Access Server comprising thousands of users. Thus, we characterize the P2P traffic and users, and we draw interesting results on connectivity and cooperation between peers, localization of sources, termination of connections and performance limitations. The evolution of the traffic over the year allows us to see the dynamics of the use of P2P systems. The difference between week days and week-end days informs us about the behavior of P2P users.

(COI) have been applied in a variety of environments ranging from characterizing the online buying behavior of individuals to detecting fraud in telephone networks. The common thread among these applications is that the historical COI of an individual can be used to predict future behavior as well as the behavior of other members of the COI. It would clearly be beneficial if COIs can be used in the same manner to characterize and predict the behavior of hosts within a data network. In this paper, we introduce a methodology for evaluating various aspects of COIs of hosts within an IP network. In the context of this study, we broadly define a COI as a collection of interacting hosts. We apply our methodology using data collected from a large enterprise network over a eleven week period. First, we study the distributions and stability of the size of COIs. Second, we evaluate multiple heuristics to determine a stable core set of COIs and determine the stability of these sets over time. Third, we evaluate how much of the communication is not captured by these core COI sets.

Monitoring systems that can detect path outages and periods of degraded performance are important for many distributed applications. Trivial pair-wise probing systems do not scale well and cannot be employed in large networks. To build scalable path monitoring systems, two different approaches have been proposed in the literature. The first approach [1], which we call the continuous or analogue model, takes real measurement values and infers the performance metrics of unmeasured paths using traditional (+,×) algebra. The second approach [2], which we call the Boolean model, takes binary values from measurements (e.g., whether the delay/loss of an end-to-end path is above a given threshold) and infers the performance quality of unmeasured paths using Boolean algebra. Both approaches exploit the fact that end-to-end paths share network links and hence that the measurements of some paths can be used to infer the performance on others. In this work, we are only interested in detecting whether the performance of a path is below an acceptable level or not. We show that when the number of (nodes that can send probes and collect monitoring information) is small, the Boolean model requires fewer direct measurements; whereas for a large number of beacons the continuous model requires fewer direct measurements. When the number of beacons is significantly large, however, there is no difference in terms of the number of paths that we need to measure directly in both models. We verify the results by simulations on inferred network topologies and on real measurement data.

In both active and passive network Internet measurements, the IP packet has a number of important header fields that have played key roles in past measurement efforts, e.g., IP source/destination address, protocol, TTL, port, and sequence number/acknowledgment. The 16-bit identification field (IPID) has only recently been studied to determine what information it might yield for network measurement and performance characterization purposes. We explore several new uses of the IPID field, including how it can be used to infer: (a) the amount of internal (local) traffic generated by a server; (b) the number of servers in a large-scale, load-balanced server complex and; (c) the difference between one-way delays of two machines to a target computer. We illustrate and validate the use of these techniques through empirical measurement studies.

We propose two methods to passively measure and monitor changes in round-trip times (RTTs) throughout the lifetime of a TCP connection. Our first method associates data segments with the acknowledgments (ACKs) that trigger them by leveraging the TCP timestamp option. Our second method infers TCP RTT by observing the repeating patterns of segment clusters where the pattern is caused by TCP self-clocking. We evaluate the two methods using both emulated and real Internet tests.