1. Rice Networks Group http://www.ece.rice.edu/networks Ph.D. Thesis Proposal Aleksandar Kuzmanovic Edge-based Inference and Control in the Internet

2. Aleksandar Kuzmanovic Motivation l Applications and clients demand new services in the Internet –Differentiation of performance –Robustness l IP and network core are not extensible and are slowly evolving: –IPv6 (10 years) –IP Multicast (domain dependent) Goal: Achieve advanced functionality and services via endpoint mechanisms and protocols

3. Aleksandar Kuzmanovic Approach l Network as a black box

4. Aleksandar Kuzmanovic Thesis Objectives l Infer network and server QoS elements from endpoints –Infer static multi-class elements and their parameters l Create service differentiation via endpoints (without network support) –Infer and utilize available bandwidth to achieve low-priority service l Prevent Denial of Service (DoS) attacks via robust endpoint protocol design –Prevent malicious endpoint behavior

5. Aleksandar Kuzmanovic Outline

6. Aleksandar Kuzmanovic Background l Network QoS elements and mechanisms –Policing  Ex. Dorm traffic is often rate limited –Priority queues  Ex. VoIP traffic has priority over other traffic l Web Server/Cluster QoS policies –CPU resource sharing –Listen queue differentiation –Load balancing –Machine migration Goal:Develop tools for network clients to assess the networks and servers QoS capabilities

7. Aleksandar Kuzmanovic Inverse QoS Problem l Is a class rate limited? l What is the inter-class relationship? –Fair/weighted fair/strict priority l Is resource borrowing fully allowed or not? l Is the service’s upper bound identical to its lower bound? l What are the service’s parameters?

8. Aleksandar Kuzmanovic Applications l Service Level Agreement validation –Is it fulfilled? l Capacity planning –What is the relationship among classes? l Performance Monitoring and Resource Management –Estimate a class’ net “guaranteed rate”

9. Aleksandar Kuzmanovic System Model and Problem Formulation l Two stage server –Non-work conserving elements –Multi-class scheduler l Observations –Arrival and departure times –Class ID –Packet size

10. Aleksandar Kuzmanovic “Off-Line” Solution is Simple l Consider a router with unknown QoS mechanisms

11. Aleksandar Kuzmanovic “On-Line” Case: Operational Network l Undesirable to disrupt on-going services –High rate probes to detect inter-class relationships would degrade performance l Impossible to force other classes to be idle –… to detect policers

12. Aleksandar Kuzmanovic l Inter-class resource sharing theory [QK99]: l Key technique: –Passively monitor arrivals and services at edges –Devise hypothesis tests to jointly:  Detect the most likely hypothesis  Estimate unknown parameters Strategy

13. Aleksandar Kuzmanovic Empirical Service Distributions l Theory (WFQ): l Practice (WFQ and SP): WFQ (400 ms) SP (400 ms)

14. Aleksandar Kuzmanovic Parameter Estimation and Scheduler Inference l Determine MLE parameters for each scheduler l Choose the most likely scheduler for each time scale l Apply majority rule over all time scales

15. Aleksandar Kuzmanovic Detection and Estimation l Detection –Correctness ratio  True EDF  100%  True WFQ  94% l Estimation –WFQ weights  Fluid vs. packet model –Rate limiters  Ex. FQ, r=1Mb/s  Probability decreases with time scale Unified framework for incorporating phenomena relevant at different time scales

16. Aleksandar Kuzmanovic Outline

17. Aleksandar Kuzmanovic Motivation l Service differentiation is an important goal of the future Internet l Our approach: –Low priority service  End-point based solution l Applications –Low priority bulk data transfer  Corporate networks  Overlay networks  Internet

18. Aleksandar Kuzmanovic Applications (cont’d) l Peer-to-peer file sharing –Often rate-limited –Isolation vs. sharing l Server Selection –Find the “best” server

19. Aleksandar Kuzmanovic Problem Formulation

20. Aleksandar Kuzmanovic Problem Formulation

21. Aleksandar Kuzmanovic Problem Formulation

22. Aleksandar Kuzmanovic Algorithm Design Objectives l TCP transparency –Non-intrusiveness l Aggressiveness –Send at the “excess/available” capacity l Fair-share of the available bandwidth  Current techniques (e.g., Delphi, Pathload): »Send in probes and interpret results  TCP-LP: »Transmitting at the rate of available bandwidth »Infer the fair-share vs. total available bandwidth

23. Aleksandar Kuzmanovic TCP-LP: The Key Concepts l Early congestion indication –TCP-LP uses a tight control loop  One-way packet delays ( RFC1323 ) vs. packet losses RFC1323 l TCP-transparent congestion avoidance policy – parameters

24. Aleksandar Kuzmanovic TCP-LP Sample Path

25. Aleksandar Kuzmanovic TCP vs. TCP-LP l TCP alone 49.7% l TCP vs. TCP-LP 49.3% vs. 7.3% TCP-LP is invisible for TCP traffic!

26. Aleksandar Kuzmanovic Web Experiment l TCP background bulk data transfer l Web response times are normalized

27. Aleksandar Kuzmanovic Web Experiment l TCP-LP background bulk data tr. –FTP throughput  TCP: 58.2%  TCP-LP: 55.1%

28. Aleksandar Kuzmanovic Web Experiment l No background bulk data transfer l TCP-transparency!

29. Aleksandar Kuzmanovic Future Work l Implement TCP-LP in Linux l Validation –Testbed  CBR, “square wave”, and HTTP cross traffic –The Internet  What is the difference between pure excess network bandwidth utilized by TCP-LP and the available bandwidth utilized by TCP? l Related work –TCP Vegas Nice - developed in parallel

30. Aleksandar Kuzmanovic Outline

31. Aleksandar Kuzmanovic Denial of Service (DoS) l DoS is a malicious way to consume resources in a network, a server cluster or in an end host, thereby denying service to other legitimate users l Current folklore: –DoS flow is a high bit-rate flow  Attackers generate these flows  Researchers develop mechanisms to detect and throttle down these flows –Internet is stable due to TCP and its congestion control mechanisms

32. Aleksandar Kuzmanovic Problem Formulation –Send at minimum possible average rate (hard or impossible to detect) and be as intrusive as possible

33. Aleksandar Kuzmanovic Motivation l Detect and isolate fragile network/protocol mechanisms that are used as tools of a possible DoS attack l Detect and isolate network protocols that are able to generate such low bit-rate streams –Suspects: “Pathload” [JD02], Audio/Video sources

34. Aleksandar Kuzmanovic Approach l Homogeneity of cross-traffic  More than 95% of the traffic in the Internet is TCP traffic l Deterministic and predictable behavior of cross- traffic l Challenges: –Heterogeneity of TCP variants  Tahoe, Reno, New Reno, SACK... –Roundtrip times  from several ms to hundreds of ms

35. Aleksandar Kuzmanovic The Key Source of Determinism l All TCP variants: –React in the same way on bursts of packet losses (wait for RTO) –Use the same algorithm to compute the RTO value (RTO=SRTT+4*RTTVAR) l “On Estimating End-to-End Network Path Properties”, P. Allman and V. Paxson, In Proceedings of ACM SIGCOMM, Aug. 1999.On Estimating End-to-End Network Path Properties –To avoid spurious retransmissions, require minRTO = 1 sec l “RFC2988”, V. Paxson and M. Allman, Nov. 2000:RFC2988 minRT0 = 1sec l May 2001: default in ns-2

36. Aleksandar Kuzmanovic Scenario l Outage – all the TCP packets are lost –If on the order of a flow’s RTT, then TCP always enters RTO mechanism –Repeat outages on intervals of minRTO+f(RTT)

37. Aleksandar Kuzmanovic The minRTO Parameter l minRTO=1sec means –If RTT~50ms => monopolize resources for short periods (50ms/1050ms=4.7%) => low bit-rate –Deterministic response that overcomes heterogeneity of both TCP variations and roundtrip times l Approximating outages:

38. Aleksandar Kuzmanovic Single TCP Experiment l Magnitude = 2 Mbps l ON length = 70ms (max RTT ~ 120ms) l Resonant time scale ~ 1sec + RTT

39. Aleksandar Kuzmanovic Future Work l TCP variants –Reno is the most fragile, but what about Tahoe, NewReno, SACK… l TCP aggregates l Filtering: –Short-RTT vs. long-RTT flows in a heterogeneous TCP aggregate  Denial of local area traffic? –Long vs. short TCP flows  How short should a file be? –Linux vs. Windows  Incremental deployability?  Linux does not have it yet… l Perform experiments in the Internet

40. Aleksandar Kuzmanovic Conclusions l Efficient control and inference of the Internet from its edges –Multi-class service inference [KK01, KK02]  General multiple time-scale traffic and service model to characterize a broad set of behaviors within a unified framework –TCP-LP: End-point service prioritization protocol [KK03]  Low priority bulk data transfers Future work  Implementation and validation in the Internet –TCP and DoS attacks  Design and explore low bit-rate DoS streams and their relationship to TCP