2017 Network Traffic Measurement and Analysis Conference (TMA)最新文献

How HTTP/2 is changing web traffic and how to detect it HTTP/2如何改变网络流量以及如何检测它

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-21 DOI: 10.23919/TMA.2017.8002899

Jawad Manzoor, I. Drago, R. Sadre

{"title":"How HTTP/2 is changing web traffic and how to detect it","authors":"Jawad Manzoor, I. Drago, R. Sadre","doi":"10.23919/TMA.2017.8002899","DOIUrl":"https://doi.org/10.23919/TMA.2017.8002899","url":null,"abstract":"HTTP constitutes a dominant part of the Internet traffic. Today's web traffic mostly consists of HTTP/1 and the much younger HTTP/2. As the traffic of both protocols is increasingly exchanged over encryption, discerning which flows in the network belong to each protocol is getting harder. Identifying flows per protocol is however very important, e.g., for building traffic models for simulations and benchmarking, and enabling operators and researchers to track the adoption of HTTP/2. This paper makes two contributions. First, using datasets of passive measurements collected in operational networks and Deep Packet Inspection (DPI), we characterize differences in HTTP/1 and HTTP/2 traffic. We show that the adoption of HTTP/2 among major providers is high and growing. Moreover, when comparing the same services over HTTP/1 or HTTP/2, we notice that HTTP/2 flows are longer, but formed by smaller packets. This is likely a consequence of new HTTP/2 features and the reorganization of servers and clients to profit from such features. Second, we present a lightweight method for the classification of encrypted web traffic into appropriate HTTP versions. In order to make the method practically feasible, we use machine learning with basic information commonly available in aggregated flow traces (e.g., NetFlow records). We show that a small labeled dataset is sufficient for training the system, and it accurately classifies traffic for several months, potentially from different measurement locations, without the need for retraining. Therefore, the method is simple, scalable, and applicable to scenarios where DPI is not possible.","PeriodicalId":118082,"journal":{"name":"2017 Network Traffic Measurement and Analysis Conference (TMA)","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124070789","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 11

A measurement study of congestion in an InfiniBand network InfiniBand网络拥塞的测量研究

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-21 DOI: 10.23919/TMA.2017.8002911

Fatma Alali, Fabrice Mizero, M. Veeraraghavan, J. Dennis

引用次数: 5

Push away your privacy: Precise user tracking based on TLS client certificate authentication 抛开您的隐私:基于TLS客户端证书认证的精确用户跟踪

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-21 DOI: 10.1145/3232755.3232763

M. Wachs, Quirin Scheitle, G. Carle

{"title":"Push away your privacy: Precise user tracking based on TLS client certificate authentication","authors":"M. Wachs, Quirin Scheitle, G. Carle","doi":"10.1145/3232755.3232763","DOIUrl":"https://doi.org/10.1145/3232755.3232763","url":null,"abstract":"The design and implementation of cryptographic systems offer many subtle pitfalls. One such pitfall is that cryptography may create unique identifiers potentially usable to repeatedly and precisely re-identify and hence track users. This work investigates TLS Client Certificate Authentication (CCA), which currently transmits certificates in plain text. We demonstrate CCA's impact on client traceability using Apple's Apple Push Notification service (APNs) as an example. APNs is used by all Apple products, employs plain-text CCA, and aims to be constantly connected to its backend. Its novel combination of large device count, constant connections, device proximity to users and unique client certificates provides for precise client traceability. We show that passive eavesdropping allows to precisely re-identify and track users and that only ten interception points are required to track more than 80 percent of APNs users due to global routing characteristics. We conduct our work under strong ethical guidelines, responsibly disclose our findings, and can confirm a working patch by Apple for the highlighted issue. We aim for this work to provide the necessary factual and quantified evidence about negative implications of plain-text CCA to boost deployment of encrypted CCA as in TLS 1.3.","PeriodicalId":118082,"journal":{"name":"2017 Network Traffic Measurement and Analysis Conference (TMA)","volume":"9 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124792643","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

Threats and surprises behind IPv6 extension headers IPv6扩展报头背后的威胁和惊喜

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-21 DOI: 10.23919/TMA.2017.8002912

Luuk Hendriks, P. Velan, R. Schmidt, P. Boer, A. Pras

引用次数: 5

Middleboxes in the Internet: A HTTP perspective Internet中的中间件:一个HTTP视角

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-21 DOI: 10.23919/TMA.2017.8002906

Shan Huang, F. Cuadrado, S. Uhlig

引用次数: 14

HLOC: Hints-based geolocation leveraging multiple measurement frameworks HLOC:利用多个测量框架的基于提示的地理定位

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-21 DOI: 10.23919/TMA.2017.8002903

Quirin Scheitle, Oliver Gasser, Patrick Sattler, G. Carle

引用次数: 45

SOMETIME: Software defined network-basec Available Bandwidth measurement in MONROE 有时:软件定义的基于MONROE的可用带宽测量

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-21 DOI: 10.23919/TMA.2017.8002918

Giuseppe Aceto, V. Persico, A. Pescapé, G. Ventre

{"title":"SOMETIME: Software defined network-basec Available Bandwidth measurement in MONROE","authors":"Giuseppe Aceto, V. Persico, A. Pescapé, G. Ventre","doi":"10.23919/TMA.2017.8002918","DOIUrl":"https://doi.org/10.23919/TMA.2017.8002918","url":null,"abstract":"Mobile Broadband (MBB) access networks are becoming more and more used worldwide, and the devices adopted to access them are increasing in number and complexity (smartphones, mobile hotspots, vehicular infotainment systems). The highly dynamic nature of such scenarios calls for continuous monitoring and measurement of the network, and possibly cross-layer management of network applications. A recent shift in network management, Software-Defined Networking (SDN), is a promising tool to manage such evolved scenario, characterized by constraints due to HW, virtualization, and data plans. In this paper, we present the fundamental ideas and the first findings that underpin the SOMETIME research project, that aims at implementing active measurements leveraging the features provided by SDN technologies. Several platforms and tools are being presented to investigate separately MBB and SDN: we consider as a reference testbed the MONROE platform, a system offering in-the-field MBB experimenting facilities. We adopt MONROE as an use case to highlight the main issues and challenges raised by the SOMETIME vision, investigating the feasibility of SDN-based active measurements for MBB. In more details, we assess the impact of SDN on performance of active measurements, namely Available Bandwidth (ABw) estimation, an end-to-end network metric characterizing the spare capacity on a path. We also report preliminary results on achievable throughput as a first root-cause analysis for poor performance in estimating ABw in MBB scenarios. The preliminary results confirm the expected difficulties in ABw estimation over MBB but also validate the feasibility of SDN-based approaches and suggest future directions for SDN-based enhancement of ABw estimation.","PeriodicalId":118082,"journal":{"name":"2017 Network Traffic Measurement and Analysis Conference (TMA)","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2017-06-21","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122510584","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 16

Exploring DSCP modification pathologies in mobile edge networks 探索移动边缘网络中的DSCP修改病理

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-20 DOI: 10.23919/TMA.2017.8002923

A. Custura, A. Venne, G. Fairhurst

引用次数: 15

Examining cellular access systems on trains: Measurements and change detection 检查列车上的蜂窝接入系统:测量和变化检测

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-01 DOI: 10.23919/TMA.2017.8002916

Johan Garcia, Stefan Alfredsson, A. Brunström

引用次数: 6

Path transparency measurements from the mobile edge with PATHspider 路径透明度测量从移动边缘与PATHspider

2017 Network Traffic Measurement and Analysis Conference (TMA) Pub Date : 2017-06-01 DOI: 10.23919/TMA.2017.8002922

Iain R. Learmonth, Andra Lutu, G. Fairhurst, David Ros, Özgü Alay

引用次数: 9