Analyzing the jitter-attacks against TCP flows Mentors: Dr. Imad Aad, Prof. Jean-Pierre Hubaux Moumbe Arno Patrice 09 february 2005

2 Outline How does TCP work? Different kinds of attacks on TCP Our goal Different methods of Jitter Attack Simulation Results Discussion Conclusion

3 How does TCP work? RTT (Round Trip Time ) is the time elapsed between sending a packet and receiving its Acknowledgement RTO (Retransmission Time Out) is the time after which the packet is sent again if there is no ACK SenderReceiver RTT ACK Packet RTO Figure 1: TCP

4 according to RFC2988 SRTT(k+1) = a * SRTT(k) + (1-a) * RTT(k+1) (SRTT = Smoothed Round Trip Time) is the average of RTT estimator. RTTVAR = (1 - β) * RTTVAR + β* |SRTT - RTT| RTTVAR is the smoothed RTT deviation estimator. α =1/8 and β =1/4 RTO = max (minRTO, SRTT+ max (G, 4 RTTVAR)) (RTO = Retransmission Time Out) is the time that elapses after a packet has been sent until the sender considers it lost and therefore retransmits it. G <= 100 msec 3 sec How does TCP work

5 Outline How does TCP work? Different kinds of attacks on TCP Our goal Different methods of Jitter Attack Simulation Results Discussion Conclusion

6 JellyFish Drop JellyFish reorder JellyFish Jitter Differents kinds of attacks on TCP

7 JellyFish Drop JellyFish reorder JellyFish Jitter Differents kinds of attacks on TCP

8 Outline How does TCP work? Different kinds of attacks on TCP Our goal Different methods of Jitter Attack Simulation Results Discussion Conclusion

9 Our goal Find the best way to drop the throughput of TCP by using Jitter Attack We simulated several methods, and present the performance of three of them We will emphasize on the best one

10 Outline How does TCP work? Different kinds of attacks on TCP Our goal Different methods of Jitter Attack Simulation Results Discussion Conclusion

11 Figure 2: first method of jitter attack Figure 3: RTT increase First Method

12 Second Method Figure 4: RTT increase (second method)

13 Third Method Figure 5: RTT increase

14 Third Method (cont’d) Figure 6: δRTT to be added to RTT of a packet

15 Comparison of Methods two and three Figure 7: comparison of throughput of two methods Attack starts at second 100

16 Comparison of Methods two and three Figure 8: difference of throughputs of methods two and three Th = Th_Method3 – Th_Method2

17 We have three parameters to use in our implementation Number of Hops The Period T (s) tp (s) Third Method (cont’d) Figure 9: presentation of parameters

18 Outline How does TCP work? Different kinds of attacks on TCP Our goal Different methods of Jitter Attack Simulation Results Discussion Conclusion

19 Simulation Results Figure 10: Throughput over 2 hops, T=1 s, t p = 0,1 s Figure 11: Throughput over 8 hops, T = 1 s, t p = 0,1 s (Number of Hops)

20 Simulation Results (cont’d) Figure 12: Comparison of throughputs for two periods (T) Period T (s)

21 Simulation Results (cont’d) Figure 13 : throughputs vs t p t p (s)

22 Outline How does TCP work? Different kinds of attacks on TCP Our goal Different methods of Jitter Attack Simulation Results Discussion Conclusion

23 Discussion Effect of the Jitter First we compute the average additional delay introduce by the Jitter implementation We build a new implementation where we shift all the packets by d0 RTT1 = RTT2 = … = RTTn = d0 Therefore, for two implementations, we have the same average delay Jitter approach delay approach

24 Discussion (cont’d) Figure 14: Comparison of the throughputs of the delay and Jitter approaches For 2 and 4 hops

25 Discussion (cont’d) Figure 15: Comparison of the throughputs of the delay and Jitter approaches For 6 and 8 hops

26 Discussion (cont’d) Table 1: equivalence of percent / average for each number of hops

27 Discussion (cont’d) Figure 16: Comparison of difference of throughput between Jitter and Delay

28 Discussion (cont’d) Using Table 1 and Figure 16, we can say that to have a good throughput drop using the Jitter attack, (without caring about the number of hops): Number of hops = don’t care T = 1 s 0,1 < t p < 0,5 (with a good result for tp = 0.3 s) Possibility to automate the drop of the throughput (by trying several values of t p )

29 Outline How does TCP work? Different kinds of attacks on TCP Our goal Different methods of Jitter Attack Simulation Results Discussion Conclusion

30 Conclusion We derived the good parameters that drop the throughput of TCP, regardless of the number of hops. Period = T = 1 second Percent = tp = 0.3 second We also showed that the Jitter attack may drop very few throughput if throughput is low

31 Thanks you for your attention