i-Path : Network Transparency Project 14th JSPS/NRF Core University Program Seminar on Next Generation Internet i-Path : Network Transparency Project Shigeki Goto* Akihiro Shimoda*, Ichiro Murase* Dai Mochinaga**, and Katsushi Kobayashi*** * Waseda University ** Mitsubishi Research Institute Inc., *** National Institute of Advanced Science and Technology (AIST)

Agenda Introduction Overview of i-Path More Applications Conclusion Background and Motivation Applications Overview of i-Path Data Collection New Software More Applications Conclusion Acknowledgement

The Goal of i-Path project Accessible Information between the hosts Observing the information disclosure policy of all stakeholders along the path

Background Growing demand for backbone bandwidth Introduction Background Growing demand for backbone bandwidth Network performance fluctuation (e.g. throughput) Routers keep rich information Routing table, Link utilization Temperature, Location, Contact point, Supply voltage etc. Not easy to collect right information and to utilize information along the path Because of … Observe the information disclosure policy Status of network depends on variety of factors

Introduction Motivation Disclosing information leads to improved End-to-End visibility End-to-End visibility provides benefit to end hosts and operators Monitoring network status Reporting events and troubleshooting Reduction in operational cost Providing transparency of underlying networks

Applications Enhanced Congestion Control Best peer selection in Introduction Applications Enhanced Congestion Control Best peer selection in P2P communication applications Adjust optimal bit rate in VoD Dynamic network configuration (e.g. according to Time zones) Selection of the appropriate path (e.g. Not violating policies related to content management)

Data Collection Explicit Network Information Collection Along a Path Overview Data Collection Explicit Network Information Collection Along a Path SIRENS *(Simple Internet Resource Notification Scheme) Based on the cross layer approach Bottleneck bandwidth Interface queue capacity Corruption losses etc. Scalable network information measurement * K. Nakauchi and K. Kobayashi. An explicit router　feedback framework for high bandwidth-delay product　networks. Computer Networks, 51(7):1833–1846, 2007.

Structure of shim-header Overview Structure of shim-header Inserted between the network and transport headers

Information Disclosure Overview Information Disclosure Prohibit to access some Information on routers Unwilling to disclose inside network status Security Cost Each ISP has a disclosure policy End hosts have their disclosure policy Negotiation: requests and responses OK to Disclose? OK to Disclose? OK to Disclose?

Observing Information Disclosure Policies Selective requests and responses Policy: Alice & Bob allow to disclose beyond 3rd hop router. Implementation: Alice does not send req. for her neighbor & the next neighbor routers, i.e.,1st & 2nd hops. Bob does not send back res. same as Alice, i.e., 6th & 7th hops. Results: Alice obtains 3-5 hops data. Bob obtains 3-7 hops data

New Software Tools Receiver Sender i-Path Router (a) Send a SIRENS request packet TCP Data TCP Data TCP Data TCP Data (b) Receive the request packet and reply Receiver Sender i-Path Router (c) Receive the reply packet and make xml files TCP Data TCP Data Developed software xml

Snapshot of the Visualization Tool Dark colored (Blue) routers Data Collection: Enabled Gray colored routers Data Collection: Not enabled or Not Exist

Network Threat Detection More applications Network Threat Detection S.Nogami, A.Shimoda and S.Goto, Detection of DDoS attacks by i-Path flow analysis, (in Japanese, to appear) 72nd National Convention of IPSJ, Mar. 2010. DDoS Packets destination: TARGET Source IP Address: Spoofed IP Address TARGET IP address : X.X.X.X Internet Back　Scatter Packets destination: Spoofed IP Address Source: TARGET Attackers extraneous hosts/servers

NAT traversal Different kind of NATs: More applications Different kind of NATs: full cone, restricted cone, port restricted cone, symmetric K.Tobe, A.Shimoda and S.Goto, NAT traversal with transparent routers, (in Japanese, to appear) 72nd National Convention of IPSJ, Mar. 2010 Symmetric NAT Symmetric NAT is the most difficult NAT of all. In a symmetric NAT, any request from an internal IP address and a port number to some destination IP address and port number is mapped to a unique external IP address and a unique port number. If the same host sends a packet from the same source address and the same port number but to a different destination, a different mapping is used. Only the external host that receives a packet from an internal host can send a UDP packet back to the internal host. Symmetric NATs are used when high security communication is required. And Symmetric NATs are installed as routers in business enterprises and also as high-end routers for home use. symmetric NAT

Current Status and Future Plans i-Path project wiki http://i-path.goto.info.waseda.ac.jp/trac/i-Path/ Dai Mochinaga, Katsushi Kobayashi, Shigeki Goto, Akihiro Shimoda, and Ichiro Murase, Collecting Information to Visualize Network Status, 28th APAN Network Research Workshop, pp.1—4, 2009. Network application utilizing collected information Demonstration on R&D testbed: JGN in Japan Demonstration at SC09, Portland, OR, Nov. 2009

Conclusion We proposed new method disclosing network information i-Path Offering end-to-end visibility, transparency Observing privacy protection Respecting disclosure policy

Acknowledgement This project is supported by National Institute of Information and Communications Technology (NICT), Japan.