Can we save the OPEN Internet? with focus on The Two-Port Internet Problem and what to do about it Terry Gray Designated Prophet of Doom University of Washington Deke Kassabian Resident Optimist University of Pennsylvania

AGENDA Framing the Problem --Terry Campus Solutions Discussion --Deke

Premises Problems with the current Internet are driving researchers to other alternatives, e.g. “personal lambda” networks Trends are unfavorable The “open” Internet may (have already?) become a small subset of the total Internet

Definitions Open Internet: one free of TDAs TDA = Traffic Disruption Appliance, e.g. Firewall, NAT box, or inline IPS Neutrality: no pkt fwd prefs for ISP's $$ gain 2-port Internet: the notion that you can only depend on the web ports (80 and 443) to be open between arbitrary end points Layer 2 solution: wide-area Ethernets Layer 1 solution: dedicated wavelengths

End-to-End Principle Internet technology – Keep core simple; put complexity at edges Internet policy – Keep core open; put constraints at edges Except... we didn't

Issues with current Internet Blocked or throttled ports e2e performance (esp. >1Gbps) TCP vs. UDP (congestion/performance) limits Worsening mean-time-to-diagnosis Lack of deterministic (and simple) behavior Content filtering (now in over 40 countries!) Policy enforcement surprises

Causes Security concerns led to firewalls everywhere Security+Address Autonomy led to NAT boxes Deep-Pkt-Inspection grows; limits performance TDAs add complexity, slow diagnosis

Consequences Unhappy users Flight to Layer 1 or 2 networks More apps that tunnel thru port 80 or 443 More VPNs –just to traverse firewalls Growing performance concerns Applications needing many ports may break

Out of Scope Zittrain discusses what happens when the edges become closed... and/or controlled from a central point, e.g. Tivo, X-box Jonathan Zittrain

Focus on the 2-port problem --Scenarios-- Researchers working in developing countries Researchers collaborating with other schools Researchers collaborating with industry Researchers collaborating with people at home

Where is the Problem? Research Backbones Commercial Backbones Regional R&E Nets Campus Nets Commercial Tier 2/3 Nets Enterprise & Home Nets

Solution Space Layer 1 – Dedicated point-to-point fiber – Dedicated Wavelengths – UCLPs Layer 2 – Wide-area Ethernet VLANs Layer 2.5 – Enterprise MPLS

Layer 3 Solutions Edge (Host/App) based solutions: – Virtual Private Network overlays (VPNs) – Modification of apps to tunnel over port 80/443 Network/Core-based solutions: – Reverse trend toward blocking / throttling – Consortial "open" backbone networks, with selective local access – Dynamic firewall traversal protocols – Selective bypass via NAC as an alternative to *local* port blocking – Build new L3 Internet with protocols for "trust- mediated transparency".

Technical Goals (success metrics) low friction/impedance to collaboration (Internet apps "just work") high performance (thruput, latency, jitter) low complexity (low MTBF) high diagnosability (low MTTD) low cost high scalability high security

Political metrics (Viable deployment depends on?) CIO enthusiasm and cooperation Researcher enthusiasm and cooperation Research funding agency interest Institutional network administrator cooperation National and international ISP cooperation Number and clout of researchers adversely affected by status quo

Discussion Topics Are commercial ISPs blocking ports? Is p2p important to research? How does content-blocking affect research? Impact of Ipv6? For those w/TDAs, which is more cost- effective: a general firewall bypass or MPLS deployment, or point solutions using L1 or L2 technology?