Johannes Naab, Patrick Sattler, Johannes Zirngibl, Stephan M. Günther, G. Carle
{"title":"Gotta Query 'Em All, Again!: Repeatable Name Resolution with Full Dependency Provenance","authors":"Johannes Naab, Patrick Sattler, Johannes Zirngibl, Stephan M. Günther, G. Carle","doi":"10.1145/3606464.3606478","DOIUrl":"https://doi.org/10.1145/3606464.3606478","url":null,"abstract":"Common DNS resolvers are optimized for query latency but are not designed to expose the internal dependencies and structures within the DNS. This makes it difficult to investigate DNS setups, detect errors and misconfigurations, and determine their impact on users. In order to reliably track the internal, potentially cyclic dependencies within the DNS, we propose to split the dependency graph into strongly connected components. By querying all authoritative servers and considering differences in order and timing for repeated runs, we are able to resolve domain names in a repeatable and traceable manner. We validate this approach by introducing a test methodology that allows re-running the resolver against previously recorded data. This data can be used to further study various aspects of global DNS deployments. We provide an example scan with 1.6 M domains on https://tcb-resolve.github.io/.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2023-07-22","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130446236","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards cross-layer telemetry","authors":"J. Iurman, F. Brockners, B. Donnet","doi":"10.1145/3472305.3472313","DOIUrl":"https://doi.org/10.1145/3472305.3472313","url":null,"abstract":"This paper introduces Cross-Layer Telemetry (Clt), a way to combine in-band telemetry (based on In-Situ Oam) and Application Performance Management (APM, based on distributed tracing) into a single monitoring tool providing a full network stack observability. Using Clt, APM traces are correlated with network telemetry information, providing a better view and faster root cause analysis in case of issue. In this paper, we describe the Clt implementation and discuss a use case demonstrating its efficiency. All Clt source code is available as open source.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"151 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122447320","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Tools for disambiguating RFCs","authors":"Jane Yen, R. Govindan, B. Raghavan","doi":"10.1145/3472305.3472314","DOIUrl":"https://doi.org/10.1145/3472305.3472314","url":null,"abstract":"For decades, drafting Internet protocols has taken significant amounts of human supervision due to the fundamental ambiguity of natural language. Given such ambiguity, it is also not surprising that protocol implementations have long exhibited bugs. This pain and overhead can be significantly reduced with the help of natural language processing (NLP). We recently applied NLP to identify ambiguous or under-specified sentences in RFCs, and to generate protocol implementations automatically when the ambiguity is clarified. However this system is far from general or deployable. To further reduce the overhead and errors due to ambiguous sentences, and to improve the generality of this system, much work remains to be done. In this paper, we consider what it would take to produce a fully-general and useful system for easing the natural-language challenges in the RFC process.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"385 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133273103","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Porapat Ongkanchana, Romain Fontugne, H. Esaki, J. Snijders, E. Aben
{"title":"Hunting BGP zombies in the wild","authors":"Porapat Ongkanchana, Romain Fontugne, H. Esaki, J. Snijders, E. Aben","doi":"10.1145/3472305.3472315","DOIUrl":"https://doi.org/10.1145/3472305.3472315","url":null,"abstract":"As the key component of Internet's inter-domain routing, BGP is expected to work flawlessly. However, a recent study has revealed the presence of BGP zombies: Withdrawn prefixes that are still active in routing tables and that can cause routing issues. That study used experimental prefixes with scheduled withdrawals (BGP beacons). In this study we aim at detecting BGP zombies for any prefixes announced on the Internet. To that end we study characteristics of withdrawn messages, and devise a method to differentiate withdraw messages corresponding to local topological changes to those standing for prefixes withdrawn by their origin AS. Based on this classification we study the occurrence of zombies in the wild in six years of BGP data. We find over 6.5 millions zombies, among those we confirm that 94% report incoherent states and caused 468 potential routing loops. Our study also reveals that noisy prefixes, long AS paths, and ASes announcing a large number of prefixes are more prone to zombies.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"43 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131907924","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Simon Bauer, Benedikt Jaeger, Fabian Helfert, Philippe Barias, G. Carle
{"title":"On the evolution of internet flow characteristics","authors":"Simon Bauer, Benedikt Jaeger, Fabian Helfert, Philippe Barias, G. Carle","doi":"10.1145/3472305.3472321","DOIUrl":"https://doi.org/10.1145/3472305.3472321","url":null,"abstract":"The ongoing evolution of technologies and network services on the Internet indicates ongoing changes in traffic and flow characteristics. Since the analysis of flow characteristics, like duration, size, and rate, has been a frequently studied topic before, results on the evolution of flow characteristics are rare. This paper surveys how flow characteristics have changed over time and whether there are significant trends in such characteristics. We present a long-term study of TCP flow characteristics based on traffic captures taken between 2008 and 2019. We apply different methods to analyze the distribution of characteristics, the relevance of heavy hitters, and correlations between characteristics. Our analysis shows significant trends in the 99th percentiles of flow characteristics, persistent dominance by heavy hitters regarding transmitted data, and increasing relevance of so-called big-fast flows.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"56 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114842226","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"DNS-over-TCP considered vulnerable","authors":"Tianxiang Dai, Haya Shulman, M. Waidner","doi":"10.1145/3472305.3472884","DOIUrl":"https://doi.org/10.1145/3472305.3472884","url":null,"abstract":"The research and operational communities believe that TCP provides protection against IP fragmentation attacks and recommend that servers avoid sending DNS responses over UDP but use TCP instead. In this work we show that IP fragmentation attacks also apply to servers that communicate over TCP. Our measurements indicate that in the 100K-top Alexa domains there are 393 additional domains whose nameservers can be forced to (source) fragment IP packets that contain TCP segments. In contrast, responses from these domains cannot be forced to fragment when sent over UDP. Our study not only shows that the recommendation to use TCP instead of UDP in order to avoid attacks that exploit fragmentation is risky, but it also unveils that the attack surface due to fragmentation is larger than was previously believed. We evaluate IP fragmentation-based DNS cache poisoning attacks against DNS responses over TCP.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"195 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131411901","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Said Jawad Saidi, A. Mandalari, H. Haddadi, Daniel J. Dubois, D. Choffnes, Georgios Smaragdakis, A. Feldmann
{"title":"Detecting consumer IoT devices through the lens of an ISP","authors":"Said Jawad Saidi, A. Mandalari, H. Haddadi, Daniel J. Dubois, D. Choffnes, Georgios Smaragdakis, A. Feldmann","doi":"10.1145/3472305.3472885","DOIUrl":"https://doi.org/10.1145/3472305.3472885","url":null,"abstract":"Internet of Things (IoT) devices are becoming increasingly popular and offer a wide range of services and functionality to their users. However, there are significant privacy and security risks associated with these devices. IoT devices can infringe users' privacy by ex-filtrating their private information to third parties, often without their knowledge. In this work we investigate the possibility to identify IoT devices and their location in an Internet Service Provider's network. By analyzing data from a large Internet Service Provider (ISP), we show that it is possible to recognize specific IoT devices, their vendors, and sometimes even their specific model, and to infer their location in the network. This is possible even with sparsely sampled flow data that are often the only datasets readily available at an ISP. We evaluate our proposed methodology [1] to infer IoT devices at subscriber lines of a large ISP. Given ground truth information on IoT devices location and models, we were able to detect more than 77% of the studied IoT devices from sampled flow data in the wild.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"15 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128862461","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Zsolt Krämer, M. Kühlewind, Marcus Ihlar, A. Mihály
{"title":"Cooperative performance enhancement using QUIC tunneling in 5G cellular networks","authors":"Zsolt Krämer, M. Kühlewind, Marcus Ihlar, A. Mihály","doi":"10.1145/3472305.3472320","DOIUrl":"https://doi.org/10.1145/3472305.3472320","url":null,"abstract":"Multiplexed Application Substrate over QUIC Encryption (MASQUE) is a new protocol mechanism that is currenty under standardization in the IETF. MASQUE defines an extension to the HTTP CONNECT method in order to support QUIC-based tunneling and forwarding of UDP and IP traffic. In this paper we discuss use cases for a MASQUE-based proxy setup that addresses challenges in performance optimization in cellular networks. The presented use cases realize different services based on the supported level of cooperation between the three involved parties, i.e., the client, the proxy, and the target server.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"102 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133050680","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Manus manum lavat: media clients and servers cooperating with common media client/server data","authors":"A. Begen","doi":"10.1145/3472305.3472886","DOIUrl":"https://doi.org/10.1145/3472305.3472886","url":null,"abstract":"The newly rectified CTA standard --- Common Media Client Data (CMCD) --- allows content providers to get insights into the performance of their large-scale streaming operations. Its sister standard --- Common Media Server Data (CMSD) --- is in the works and will allow servers to send hints to other servers and clients. The CMCD/CMSD combo is the long-awaited upgrade to HTTP adaptive streaming systems.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121228220","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Meta-peering: towards automated ISP peer selection","authors":"P. K. Dey, Shahzeb Mustafa, M. Yuksel","doi":"10.1145/3472305.3472325","DOIUrl":"https://doi.org/10.1145/3472305.3472325","url":null,"abstract":"We introduce meta-peering, a term that encompasses the set of tools needed to ease and automate the Internet Service Provider (ISP) peering process; starting with identifying a list of ISPs that are likely to peer, generating respective BGP configurations, and monitoring these sessions for outages or peering agreement violations. In this paper, we describe how existing tools can be leveraged to implement meta-peering and focus on instrumenting the automation of peer selection process. Utilizing PeeringDB and CAIDA datasets to identify possible peering points for requester and candidate ISPs, we estimate candidate ISP's traffic matrix and consider ISPs' internal policies to generate acceptable peering contracts.","PeriodicalId":147697,"journal":{"name":"Proceedings of the Applied Networking Research Workshop","volume":"32 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-07-24","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123165907","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}