Proceedings of the 2013 conference on Internet measurement conference最新文献

Demystifying the dark side of the middle: a field study of middlebox failures in datacenters 揭开中间的黑暗面:对数据中心中间箱故障的实地研究

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504737

Rahul Potharaju, Navendu Jain

{"title":"Demystifying the dark side of the middle: a field study of middlebox failures in datacenters","authors":"Rahul Potharaju, Navendu Jain","doi":"10.1145/2504730.2504737","DOIUrl":"https://doi.org/10.1145/2504730.2504737","url":null,"abstract":"Network appliances or middleboxes such as firewalls, intrusion detection and prevention systems (IDPS), load balancers, and VPNs form an integral part of datacenters and enterprise networks. Realizing their importance and shortcomings, the research community has proposed software implementations, policy-aware switching, consolidation appliances, moving middlebox processing to VMs, end hosts, and even offloading it to the cloud. While such efforts can use middlebox failure characteristics to improve their reliability, management, and cost-effectiveness, little has been reported on these failures in the field. In this paper, we make one of the first attempts to perform a large-scale empirical study of middlebox failures over two years in a service provider network comprising thousands of middleboxes across tens of datacenters. We find that middlebox failures are prevalent and they can significantly impact hosted services. Several of our findings differ in key aspects from commonly held views: (1) Most failures are grey dominated by connectivity errors and link flaps that exhibit intermittent connectivity, (2) Hardware faults and overload problems are present but they are not in majority, (3) Middleboxes experience a variety of misconfigurations such as incorrect rules, VLAN misallocation and mismatched keys, and (4) Middlebox failover is ineffective in about 33% of the cases for load balancers and firewalls due to configuration bugs, faulty failovers and software version mismatch. Finally, we analyze current middlebox proposals based on our study and discuss directions for future research.","PeriodicalId":155913,"journal":{"name":"Proceedings of the 2013 conference on Internet measurement conference","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-10-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128285283","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 137

AS relationships, customer cones, and validation AS关系、客户锥和验证

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504735

M. Luckie, B. Huffaker, A. Dhamdhere, V. Giotsas, K. Claffy

{"title":"AS relationships, customer cones, and validation","authors":"M. Luckie, B. Huffaker, A. Dhamdhere, V. Giotsas, K. Claffy","doi":"10.1145/2504730.2504735","DOIUrl":"https://doi.org/10.1145/2504730.2504735","url":null,"abstract":"Business relationships between ASes in the Internet are typically confidential, yet knowledge of them is essential to understand many aspects of Internet structure, performance, dynamics, and evolution. We present a new algorithm to infer these relationships using BGP paths. Unlike previous approaches, our algorithm does not assume the presence (or seek to maximize the number) of valley-free paths, instead relying on three assumptions about the Internet's inter-domain structure: (1) an AS enters into a provider relationship to become globally reachable; and (2) there exists a peering clique of ASes at the top of the hierarchy, and (3) there is no cycle of p2c links. We assemble the largest source of validation data for AS-relationship inferences to date, validating 34.6% of our 126,082 c2p and p2p inferences to be 99.6% and 98.7% accurate, respectively. Using these inferred relationships, we evaluate three algorithms for inferring each AS's customer cone, defined as the set of ASes an AS can reach using customer links. We demonstrate the utility of our algorithms for studying the rise and fall of large transit providers over the last fifteen years, including recent claims about the flattening of the AS-level topology and the decreasing influence of tier-1 ASes on the global Internet.","PeriodicalId":155913,"journal":{"name":"Proceedings of the 2013 conference on Internet measurement conference","volume":"4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-10-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128335150","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 262

Scap: stream-oriented network traffic capture and analysis for high-speed networks Scap:用于高速网络的面向流的网络流量捕获和分析

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504750

A. Papadogiannakis, M. Polychronakis, E. Markatos

{"title":"Scap: stream-oriented network traffic capture and analysis for high-speed networks","authors":"A. Papadogiannakis, M. Polychronakis, E. Markatos","doi":"10.1145/2504730.2504750","DOIUrl":"https://doi.org/10.1145/2504730.2504750","url":null,"abstract":"Many network monitoring applications must analyze traffic beyond the network layer to allow for connection-oriented analysis, and achieve resilience to evasion attempts based on TCP segmentation. However, existing network traffic capture frameworks provide applications with just raw packets, and leave complex operations like flow tracking and TCP stream reassembly to application developers. This gap leads to increased application complexity, longer development time, and most importantly, reduced performance due to excessive data copies between the packet capture subsystem and the stream processing module. This paper presents the Stream capture library (Scap), a network monitoring framework built from the ground up for stream-oriented traffic processing. Based on a kernel module that directly handles flow tracking and TCP stream reassembly, Scap delivers to user-level applications flow-level statistics and reassembled streams by minimizing data movement operations and discarding uninteresting traffic at early stages, while it inherently supports parallel processing on multi-core architectures, and uses advanced capabilities of modern network cards. Our experimental evaluation shows that Scap can capture all streams for traffic rates two times higher than other stream reassembly libraries, and can process more than five times higher traffic loads when eight cores are used for parallel stream processing in a pattern matching application.","PeriodicalId":155913,"journal":{"name":"Proceedings of the 2013 conference on Internet measurement conference","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-10-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129349531","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 19

Understanding the super-sized traffic of the super bowl 了解超级碗的超大流量

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504770

Jeffrey Erman, Kadangode K. Ramakrishnan

{"title":"Understanding the super-sized traffic of the super bowl","authors":"Jeffrey Erman, Kadangode K. Ramakrishnan","doi":"10.1145/2504730.2504770","DOIUrl":"https://doi.org/10.1145/2504730.2504770","url":null,"abstract":"Large events like the Super Bowl, where almost 75K attendees congegrate for several hours, poses a significant challenge in the planning, design and deployment of wireless networks. This was one of the first events where the LTE cellular network was available widely, in addition to almost 700 WiFi free hotspots. The Super Bowl in 2013 was also unprecedented because of a stadium-wide power outage for over half an hour. This study is the first to look in-depth at the user behaviours and traffic demand of a large ISP's celluar network at such an unique event. The findings of this study can be used to guide the design of the communication networks of large venues in the future. There are several key insights from our study of the data collected. First, LTE speeds enable subscribers at venues to stream high-quality video and this can be a signficant source of traffic. Second, the configuration of the uplink for such events is key, and a thoughtful approach to the design of applications that use the cloud for storing user data can substantially mitigate the congestion on the resource constrained uplink. Further, while it is tempting to take advantage of multicast on the cellular network (e.g., deploying technologies such as eMBMS in a venue), our results indicate that there is a need to combine multicast with caching to remove the strict requirement of overlap of requests from users to derive that benefit.","PeriodicalId":155913,"journal":{"name":"Proceedings of the 2013 conference on Internet measurement conference","volume":"04 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-10-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127267961","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 85

From Paris to Tokyo: on the suitability of ping to measure latency 从巴黎到东京:关于ping测量延迟的适用性

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504765

C. Pelsser, L. Cittadini, Stefano Vissicchio, R. Bush

引用次数: 73

Network fingerprinting: TTL-based router signatures 网络指纹:基于http协议的路由器签名

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504761

Yves Vanaubel, Jean-Jacques Pansiot, P. Mérindol, B. Donnet

引用次数: 42

A method for identifying and confirming the use of URL filtering products for censorship 一种识别和确认使用URL过滤产品进行审查的方法

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504763

Jakub Dalek, Bennett Haselton, Helmi Noman, A. Senft, Masashi Crete-Nishihata, Phillipa Gill, Ronald J. Deibert

{"title":"A method for identifying and confirming the use of URL filtering products for censorship","authors":"Jakub Dalek, Bennett Haselton, Helmi Noman, A. Senft, Masashi Crete-Nishihata, Phillipa Gill, Ronald J. Deibert","doi":"10.1145/2504730.2504763","DOIUrl":"https://doi.org/10.1145/2504730.2504763","url":null,"abstract":"Products used for managing network traffic and restricting access to Web content represent a dual-use technology. While they were designed to improve performance and protect users from inappropriate content, these products are also used to censor the Web by authoritarian regimes around the globe. This dual use has not gone unnoticed, with Western governments placing restrictions on their export. Our contribution is to present methods for identifying installations of URL filtering products and confirming their use for censorship. We first present a methodology for identifying externally visible installations of URL filtering products in ISPs around the globe. Further, we leverage the fact that many of these products accept user-submitted sites for blocking to confirm that a specific URL filtering product is being used for censorship. Using this method, we are able to confirm the use of McAfee SmartFilter in Saudi Arabia and the United Arab Emirates (UAE) and Netsweeper in Qatar, the UAE, and Yemen. Our results show that these products are being used to block a range of content, including oppositional political speech, religious discussion and gay and lesbian material, speech generally protected by international human rights norms.","PeriodicalId":155913,"journal":{"name":"Proceedings of the 2013 conference on Internet measurement conference","volume":"39 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2013-10-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124958419","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 45

A fistful of bitcoins: characterizing payments among men with no names 一把比特币:匿名男子之间的支付特征

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504747

S. Meiklejohn, Marjori Pomarole, Grant Jordan, Kirill Levchenko, Damon McCoy, G. Voelker, S. Savage

引用次数: 361

Next stop, the cloud: understanding modern web service deployment in EC2 and azure 下一站，云:了解在EC2和azure中的现代web服务部署

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504740

Keqiang He, Alexis Fisher, Liang Wang, Aaron Gember, Aditya Akella, T. Ristenpart

引用次数: 93

AS-level topology collection through looking glass servers 通过镜像服务器收集应用服务器级拓扑

Proceedings of the 2013 conference on Internet measurement conference Pub Date : 2013-10-23 DOI: 10.1145/2504730.2504758

Akmal Khan, Taekyoung Kwon, Hyunchul Kim, Yanghee Choi

引用次数: 37