1. TCP Behavior Inference Tool Jitendra Padhye, Sally Floyd Presented by Songjie Wei

2. CISC856 Fall 20052 Overview Motivation Sample application: initial congestion window TBIT architecture Application 1: time wait duration Application 2: congestion control algorithm Summary

3. CISC856 Fall 20053 Motivation TCP carries most of the Internet traffic TCP is a complex protocol with many parameters and variations Understanding TCP behaviors is important for:  OS vendors and customers  Internet-related researchers  Application developers

4. CISC856 Fall 20054 Testing TCP Behavior of Web Servers The overall congestion control behavior of the Internet is heavily influenced by TCP implementation in web servers Web servers are easy to test  No special privileges required to request information from web servers

5. CISC856 Fall 20055 Example of TBIT Application Initial value of the congestion window (ICW)  Number of bytes sent in a burst after three-way handshaking, before receiving any ACKs RFC2581: at most 2*MSS bytes RFC2414: min(4*MSS, max(2*MSS, 4380)) Some TCP are found to send 8000+ bytes with MSS of 512 Large bursts of packets: buffering problems, loss, delay, etc.

6. TBIT Architecture

7. Using TBIT to Determine ICW Web server SYN “GET / HTTP/1.0” with ACK SYN+ACK TCP-PDU n TCP-PDU 1 RST Timeout TBIT TCP-PDU 3 TCP-PDU 2 No ack to these TPDUs What is the ICW size measured ?

8. CISC856 Fall 20058 Difficulties in Measuring ICW Web page too small to fill cwnd  Use smaller MSS  Use URL of bigger object TPDUs get lost  Repeat test multiple times Multiple computers answer to the same IP address  Repeat test multiple times  Non-repeatable results? Machine to test has no web server  no solution AB SYN “GET / HTTP/1.0” + ACK SYN+ACK TCP-PDU n TCP-PDU 1 RST Timeout

9. CISC856 Fall 20059 Using TBIT to Determine Time-wait Duration What is Time-wait?  2 MSL time-wait can avoid the port-reuse problem  Server should retain sufficient state information about the connection during the time-wait Many major web servers use a smaller value of MSL 2 MSL Time-wait ClientServer Closed FIN FIN + ACK ACK Data Transfer

10. Using TBIT to Determine Time-wait Duration TBIT Web Server 2 MSL Closed FIN FIN + ACK ACK SYN SYN + ACK RST Data Transfer Estimated time-wait duration Should this constant time be a big or small value ? How about the sequence number of these SYNs?

11. CISC856 Fall 200511 Review of TCP Congestion control Tahoe  slow start, congestion avoidance, fast rtx (dupacks) Reno  Tahoe + fast recovery (new acks) New Reno  Reno + modified fast recovery (partial acks)

12. Using TBIT to Test TCP Congestion Control TBITWeb Server Three-way handshake rwnd=5 MSS Initial cwnd=2 MSS TPDU 1 TPDU 2 TPDU 3 TPDU 4 TPDU 5 TPDU 6 TPDU 7 TPDU 8 TPDU 9 TPDU 10 TPDU 11 TPDU 12 TPDU 13 TPDU 14 TPDU 15 TPDU 16 TPDU 17 ACK 1 ACK 2 ACK 3 ACK 4 ACK 5 ACK 6 ACK 7 ACK 8 ACK 9 ACK 10 ACK 11 ACK 12 What happens now ? “GET /HTTP/1.0”

13. CISC856 Fall 200513 TCP without Fast Retransmit

14. CISC856 Fall 200514 Tahoe No retransmit timeout before the retransmission of packet 13 Unnecessary retransmission of packet 17

15. CISC856 Fall 200515 Reno Fast retransmit for packet 13, a retransmit timeout for packet 16 No unnecessary retransmission of packet 17

16. CISC856 Fall 200516 NewReno Fast retransmit for packet 13, no additional fast retransmits or retransmit timeout No unnecessary retransmission of packet 17

17. CISC856 Fall 200517 Characteristics of TCP Variations under TBIT Tests TCP without fast retransmission  No fast retransmission  Timeout for packet 13 Tahoe  No retransmit timeout before retransmission of packet 13  Necessary retransmission of packet 17 Reno  Fast retransmit of packet 13  Retransmit timeout for packet 16  No unnecessary retransmission of packet 17 NewReno  Fast retransmit of packet 13  No additional fast retransmit or retransmit timeout  No unnecessary retransmission of packet 17

18. CISC856 Fall 200518 Sample Testing Result (I) Aug 31, 2003  Total: 439  Error:27  www.joins.com uses 0 www.joins.com  www.cnn.com uses 1 www.cnn.com  www.stoo.com uses 10 www.stoo.com Initial windowCount 04 1293 287 317 410 1

19. CISC856 Fall 200519 Sample Testing Result (II) Experimental results obtained by testing 84394 web servers (27914 classified):  NewReno76%  Tahoe 4%(w/o Fast Retransmit)  Reno15%  Other 1%  Tahoe 4% Source: Medina, Allman, and Floyd, “Measuring the Evolution of Transport Protocols in the Internet”, May 2004

20. CISC856 Fall 200520 Summary TBIT is presented for characterizing the TCP behaviors TBIT can be used to check any web server without special privileges, in a non- disruptive manner More information are obtained by TBIT about the congestion control mechanisms Source code and detailed results at:  http://www.aciri.org/tbit

21. CISC856 Fall 200521 References Jitendra Padhye and Sally Floyd,Identifying the TCP Behavior of Web Servers. June 2001, In Proceedings of SIGCOMM 2001 Alberto Medina, Mark Allman, and Sally Floyd, Measuring Interactions Between Transport Protocols and Middleboxes. Internet Measurement Conference 2004, August 2004 Sourabh Ladha, Paul D. Amer, Armando Caro, Jr., Janardhan R. Iyengar, On the Prevalence and Evaluation of Recent TCP Enhancements. Globecom 2004, Dallas TX, November 2004 Alberto Medina, Mark Allman, and Sally Floyd, Measuring the Evolution of Transport Protocols in the Internet. To appear in Computer Communications Review, April 2005

22. CISC856 Fall 200522 TBIT Homework (due on Nov 22) Design a TBIT test for both of the following:  Whether a web server supports TCP SACK  Value and increase of the persistence timer Requirements  Describe the test step by step  Draw time time diagram to show what are expected to happen during the test  Consider any possible difficulties in the test, such as lost/duplicate/reordered packets, etc.  State clearly any assumptions made for the local host, the web server, or the network  You don’t really need to install and run TBIT for this homework