1. Passive Duplicate Address Detection (DAD) Sangho Shin Andrea Forte Henning Schulzrinne Columbia University

2. Motivation (1/2) AR (Access Router) AR Layer 3 (IP Layer) Handoff Layer 2 handoff Subnet change Layer 3 handoff New IP acquisition Session update

3. Motivation (2/2) Standard DHCP procedure (RFC2131) DHCP server DHCP DISCOVER DHCP OFFER DHCP REQUEST DHCP ACK Performs Duplicate Address Detection (DAD) - Send ICMP ECHO to the IP (Broadcast) Pick an unassigned IP Wait for the response for 1 second

4. Problems of the current DAD Long waiting time Long ICMP response time in congested wireless network ISC DHCP server – 1 sec 1 second waiting time is critical for real time services Unreliable Windows XP SP2 Firewall Block ICMP echo by default Most of the windows machines do not respond to ICMP echo Possible packet loss in wireless networks

5. Basic Concept Monitor traffic constantly Collect IP usage 160.123.234.31 160.123.231.32 160.123.235.35 160.123.232.36 160.123.238.38 Update IP table 160.123.234.31 160.123.234.32 160.123.234.35 160.123.234.36 160.123.234.31 160.123.234.38 V V V V No explicit DAD Request Response

6. Architecture (1/2) Address Usage Collector (AUC) DHCP server subnet router switch

7. Architecture (2/2) DHCP server AUC Relay Agent (RA) RA

8. Example 1 AUC DHCP server Router IP:1.1.1.1 MAC:AA-BB-CC Lease table ARP query Web server MAC:AA-BB-CC IPMACExpire 1.1.1.1AA-BB-CC100 IPMAC AA-BB-CC1.1.1.1 IP address collection

9. Example 2 AUC DHCP server Router IP:1.1.1.1 IP:1.1.1.2 MAC:DD-EE-FF Lease table Web server MAC:AA-BB-CC IPMACExpire 1.1.1.1AA-BB-CC100 IPMAC AA-BB-CC1.1.1.1 IP:1.1.1.2 MAC:DD-EE-FF ARP query 1.1.1.2DD-EE-FF100 Bad IP table IPMAC DD-EE-FF1.1.1.2 Malicious user detection

10. Example 3 AUC DHCP server Router IP:1.1.1.1 MAC:00-00-00 Lease table ARP query Web server Block 00-00-00 Forward HTTP traffic MAC:AA-BB-CC IPMACExpire 1.1.1.1AA-BB-CC100 IPMAC AA-BB-CC1.1.1.1 IP:1.1.1.2 MAC:DD-EE-FF IP:1.1.1.1 MAC:00-00-00 1.1.1.2DD-EE-FF1001.1.1.1AA-BB-CC100 Bad IP table IPMAC DD-EE-FF1.1.1.2AA-BB-CC1.1.1.1 FORCE RENEW IP:1.1.1.3 IP collision detection

11. Experiments AUC Columbia CS network Columbia WLAN DHCP Server

12. Experimental results (1/4) Convergence time

13. Experimental results (2/4) DHCP server traffic load from AUC

14. Experimental results (3/4) AUC traffic load (ARP and broadcast)

15. Experimental results (4/4) CPU load of AUC

16. Conclusions It takes time to acquire an IP from DHCP server mostly because of DAD – 1 sec The current DAD does not work because of Windows XP SP2 Passive DAD performs DAD with no overhead Passive DAD detects IP address collision and illegally used IPs When a address collision is detected, Passive DAD resolves the duplicate IP problem by using DHCP Force Renew

17. Thank you!