Monitoring Network Bias Gergely Biczok, Whitney Young, and Aleksandar Kuzmanovic Northwestern Networks Group (http://networks.cs.northwestern.edu) Supported by NSF CAREER Award No. 0746360 Motivation Other probes DNS hijacking of mistyped web addresses Blocking HTTP download of *.torrent files Can add newly discovered probes modularly Net Neutrality Openness vs. managing traffic Debate in public, struggle in legislation, war in the Internet ISPs are already installing middleboxes capable of degrading/changing/blocking popular applications We do not take sides… …but want to facilitate network accountability System Design Goal Develop an end-host based measurement system for detecting and exposing biased network behavior Methodology Main idea Collect reported/possible types of discriminatory ISP practices/middleboxes Reverse-engineer their operation to create probes that will likely trigger them (approximately emulate desired traffic pattern) Detect and locate biased network elements Filtering Port-based Signature-based Signature database compiled from open source tools, web search and packet traces Flow-pattern-based Spatial and temporal correlation of UDP and TCP flows specific to p2p applications Shaping Extensive shaping reported for p2p and encrypted traffic Compare HTTP/FTP data rates to SSL and BitTorrent (emulated) rates Back-to-back minute-long experiments Significant and consistent (across hosts from the same ISP) difference in data rates indicate the presence of shapers Locating middleboxes (filters and shapers) Repeat the same measurements between the same end-host and multiple specifically selected PlanetLab nodes Select servers that are “geographically” far away from each other minimizing the common segment of the paths If same phenomena are observed, middlebox is in the shared path segments Central Server Serves the main website Selects multiple PL nodes for given end-host Coordinates probing PL nodes Handles incoming reports and generate feedback to users PlanetLab Node If selected serves the Java applet to a Client Sends and receives probes to/from a Client via applet Sends a report to Central Server at the end of every measurement session Client Runs an applet in a web browser Sends and receives probes from multiple PL nodes Sends reports to PL nodes Displays results to the user in a browser Results and Future Work Implementation is ongoing Functions partly tested manually on small scale Experienced BT shaping on well seeded torrents (D/U: 30 KBps/5 KBps) vs. HTTP download (200 KBps) at a given ISP Signature-based filtering probes validated with open-source filtering software in a testbed Large-scale live measurement in the near future Upon collecting sufficient data we can draw a global map of biased network behavior