52854658
Adaptive bandwidth control for efficient aggregate QoS provisioning
Internet links operate at high speeds, and past trends predict that these speeds will continue to increase rapidly. Routers and Intrusion Detection Systems that operate at up to OC-768 speeds (40 Gigabits/second) are currently being developed. In this paper we address a basic function common to several security and measurement applications running at line speeds: counting the number of distinct header patterns (flows) seen on a high speed link in a specified time period. For example one can detect port scans by counting the number of connections opened by the suspected port scanner and one can ascertain that a denial of service attack is in progress by counting the number of distinct (fake) source addresses that send packets to the suspected victim. We provide algorithms solving the flow counting problem using extremely small amounts of memory. This can translate into savings of scarce fast memory (SRAM) for hardware implementations. It can also help systems that use cheaper DRAM to allow them to scale to larger instances of the problem. The reduction in memory is particularly important for network security applications such as detecting port scans and DoS attacks that need to run a separate instance of the algorithm for each suspected attacker or victim. Our algorithms can be implemented in hardware at wire speeds (8 nsec per packet for OC-768) using simple CRC based hash functions, multiplexers and SRAM. They access at most one or two memory locations per packet. We expose the behavior of simple building blocks and provide a family of customizable counting algorithms that can be adapted to the requirements of various applications. This allows our algorithms to use less memory than the best known counting algorithm, probabilistic counting, to provide the same accuracy. • Virtual bitmap is well suited for triggers (which need only be accurate around a threshold value) such as detecting DoS attacks, and uses 292 bytes to achieve an error of 2.619% compared to 5,200 bytes for probabilistic counting. • Our “no assumptions” counting algorithm, multiresolution bitmap algorithms uses only 2143 bytes to count up to 100 million flows with an average error of 3%. Its accuracy is slightly better when the number of flows is small, while the accuracy of probabilistic counting using the same memory is much worse. • Our adaptive bitmap that exploits stationarity in the number of flows can count the number of distinct flows on a link that contains anywhere from 0 to 100 million flows with an average error of less than 1 % using only 2 Kbytes of memory. Probabilistic counting needs eight times more memory to achieve the same accuracy. • We used our triggered bitmap to replace the port scan detection component of the popular intrusion detection system Snort. Doing so reduced the memory usage from 89 Mbytes to 6.4 Mbytes (with an average error of 13.5%) as measured on a 10 minute trace. Probabilistic counting uses 23 Mbytes. This work was made possible by a grant from NIST for the Sensilla Project. King: Estimating Latency between Arbitrary Internet End Hosts ∗ Krishna P. Gummadi, Stefan Saroiu, Steven D. Gribble Department of Computer Science & Engineering University of Washington Seattle, WA, USA, 98195-2350 {tzoompy,gummadi,gribble}@cs.washington.edu The ability to estimate network latencies accurately between arbitrary Internet end hosts would enable wide-area measurement studies and applications, such as investigating routing path inefficiencies on a wide-scale [1] or constructing topologically sensitive overlay networks. In this poster we present King [2], a tool that accurately, quickly and cheaply estimates the latency between arbitrary end hosts by using existing DNS infrastructure in a novel way. Our approach is inspired by tools like Sting [3] and TBIT [4], which show that it is possible to use existing protocols in unanticipated ways to obtain results that were previously intractable. Our technique relies on two observations. First, given a pair of end hosts to be measured, in most cases it is possible for King to find their authoritative DNS name servers that are topologically close to the end hosts. Second, given a pair of DNS name servers, King can accurately estimate the latency between them using recursive DNS queries. Thus, King is able to use the measured latency between the name servers as an estimate of the latency between the end hosts. Although this estimate will inevitably suffer from inaccuracies, our extensive evaluation demonstrates that this estimation error is small (less than 20% error in over three-quarters of generated estimates). Compared to previous approaches like IDMaps [5] and GNP [6], King has two primary advantages (1) deployability and (2) accuracy. 1. Deployability: Unlike IDMaps, King does not require the deployment of additional infrastructure, and unlike GNP, King does not require end hosts to agree upon a single set of landmarks or share the coordinates with other end hosts. Because King uses existing DNS infrastructure, it scales naturally in terms of the number hosts that could be measured. Our evaluation indicates that King can be used to estimate latencies between arbitrary IP hosts more than 75% of time in the Internet today. 2. Accuracy: Unlike IDMaps and GNP the accuracy of King is not affected by the placement of measurement points (tracers or landmarks) in the Internet. King’s estimates are based on direct online measurements rather than extrapolation from latencies This work was supported by National Science Foundation under ITR grant No. CCR-0121341. Any opinions, findings, and conclusions or recommendations expressed in this material are those of the authors and do not necessarily reflect the views of the National Science Foundation. of a subset of paths measured offline. Our evaluation shows that the error in King latency estimates between end hosts is significantly smaller than that of IDMaps, while the error in its estimates between name servers is negligible. Further, we show that King can identify those of its own estimates that are likely to be inaccurate. These characteristics make King an ideal tool for a number of wide-area measurement studies that involve measuring latencies accurately between a large number of geographically distant end hosts. King is also fast and lightweight requiring the generation of only a few packets to produce an estimate. Our evaluation also demonstrates that (a) King preserves order among its latency estimates; a feature useful in identifying a close server from a group of server replicas and (b) authoritative name servers are located topologically close to their end hosts in a majority of scenarios (i.e., latencies as measured from a far away host to both the end host and its name server are very similar); this explains the high accuracy of King. Finally, we test the feasibility of using King for measurement studies by performing Detour study [1] on a larger scale. The results we obtained are consistent with the earlier Detour study. We were able to obtain our results with far greater ease as, unlike the previous study, we were not restricted to the publicly available traceroute servers and their usage policies. We also believe that the simplicity of our King tool will enable researchers to use it in myriads of unanticipated ways like the more popular Ping tool.
40446138
A distributed hierarchical management framework for heterogeneous WANs
The scope of network management is expanding in multiple dimensions. Local area networks (LANs) have more nodes than ever before, enterprise networks span national boundaries, wide area networks (WANs) cover the globe, and administrators want to manage their LANs all the way down to a PC’s network interface and application software. In order to centrally manage these networks, the network manager faces the complexity of heterogeneous management tools and the difficulty of managing vast amount of data generated by network elements.
14976055
A new token passing distributed mutual exclusion algorithm
Eliminating interference between concurrently executing activities through mutual exclusion is one of the most fundamental problems in computer systems. The problem of mutual exclusion in a distributed system is especially interesting owing to the lack of global knowledge in the presence of variable communication delays. In this paper, a new token-based distributed mutual exclusion algorithm is proposed. The algorithm incurs approximately three messages at high loads, irrespective of the number of nodes N in the system. At low loads, it requires approximately N messages. The paper also addresses failure recovery issues, such as token loss.
25726525
A survey of TCP-friendly router-based AQM schemes
Although the majority of the traffic over the Internet is still TCP-based, applications such as voice over IP and video-conferencing are changing this very rapidly. While TCP-based applications react to network congestion, UDP-based streaming applications usually do not have any type of flow and congestion control mechanisms. UDP, the transport layer protocol used by audio and video streaming applications, does not react to network congestion thus stealing bandwidth from the responsive TCP-based connections. Several solutions have been suggested to combat this TCP-friendliness problem, mostly applied either in the end systems (end-to-end) at the transport layer of the protocol stack or inside the network (routers) at the network layer. This article surveys the state-of-the-art in router-based mechanisms to address the TCP-friendliness problem and presents a description of the most important algorithms, design issues, advantages and disadvantages, and a performance evaluation. The article also describes ways to estimate the number of active flows traversing a core router and points to further sources on this subject, which is widely used by many mechanisms, including several described in this survey.
13442653
Establishing virtual enterprises by means of mobile agents
Electronic commerce is expanding from the simple notion of electronic stores to the notion of virtual enterprises (VE), where existing enterprises dynamically form temporary alliances, joining their businesses in order to share their costs, skills and resources in supporting certain activities. Two fundamental problems in VE are: (1) how a VE is established, and (2) how information is shared among the VE participants in a controlled and efficient manner. Currently, existing enterprises are using workflows to automate their operations by integrating their information systems and human resources. Thus, in this paper, we view the establishment of a VE as a problem of dynamically expanding and integrating workflows in decentralized, autonomous and interacting workflow management systems. The focus is on the idea of mobile agents called "adlets" and their use in establishing VEs that involves advertising, negotiating and exchanging control information and data as well as its management.
30095382
Performance Analysis of Generalized Selective Packet Discarding Schemes
Selective packet discarding schemes have been mostly developed and analyzed in the context of ATM networks. However, similar schemes could be applied to non-ATM or more general networks. The analysis of selective packet discarding schemes in a general packet switching environment has been limited to the basic dropping schemes, i.e., Partial Packet Discard (PPD) and Early Packet Discard (EPD), and for only the single traffic source case. In this paper, we extend the mathematical analysis of PPD and EPD for multiple sources and include simulation results to verify the analytical results. Finally, to place the performance of the generalized EPD and PPD in the context of other packet dropping schemes, we also provide simulation results of the Drop from Front (DfF), and preemptive Partial Packet Discard (pPPD) schemes.
11368060
Packet classifiers in ternary CAMs can be smaller
Serving as the core component in many packet forwarding, differentiating and filtering schemes, packet classification continues to grow its importance in today's IP networks. Currently, most vendors use Ternary CAMs (TCAMs) for packet classification. TCAMs usually use brute-force parallel hardware to simultaneously check for all rules. One of the fundamental problems of TCAMs is that TCAMs suffer from range specifications because rules with range specifications need to be translated into multiple TCAM entries. Hence, the cost of packet classification will increase substantially as the number of TCAM entries grows. As a result, network operators hesitate to configure packet classifiers using range specifications. In this paper, we optimize packet classifier configurations by identifying semantically equivalent rule sets that lead to reduced number of TCAM entries when represented in hardware. In particular, we develop a number of effective techniques, which include: trimming rules, expanding rules, merging rules, and adding rules. Compared with previously proposed techniques which typically require modifications to the packet processor hardware, our scheme does not require any hardware modification, which is highly preferred by ISPs. Moreover, our scheme is complementary to previous techniques in that those techniques can be applied on the rule sets optimized by our scheme. We evaluate the effectiveness and potential of the proposed techniques using extensive experiments based on both real packet classifiers managed by a large tier-1 ISP and synthetic data generated randomly. We observe significant reduction on the number of TCAM entries that are needed to represent the optimized packet classifier configurations.
2109931
MobiStream: Error-Resilient Video Streaming in Wireless WANs Using Virtual Channels
We present MobiStream— a video streaming system that exploits the perceptual value in the video content and the characteristics of link layer and physical layer channels to enable error-resilient video streaming over wireless wide-area networks (WWANs). The key building block in MobiStream is the use of link layer based, but application-controlled, virtual channels (ViCs) abstraction. Each virtual channel in MobiStream offers a different level of reliability and statistical loss gaurantee using ‘awareness’ of the link layer and physical layer channels. Video applications can dynamically instantiate new virtual channels, control their loss behavior, and/or flexibly switch video transmission across channels. MobiStream achieves fine-grained error-resilience by partitioning video frames into number of small, independently decodable, blocks of data (called ‘slices’) and assigns priority to each such individual slice based on its perceptual (visual) usefulness. MobiStream augments a number of other enhancements for errorresilience: multiple description video coding, perceptual slicestructured coding, low-delay inter-frame and intra-frame slice interleaving, dynamic unequal error protection, and priority-based video-data scheduling to enable efficient and error-resilient video streaming over wireless wide-area links. MobiStream has been implemented and evaluated using loss distributions from tests conducted over a commercial wide-area wireless (CDMA2000 3G) network. Results show that, MobiStream, in the face of burst packet losses can improve video picture quality by at least 4 dB. We conclude that significant benefits to end-user experience can be obtained by deploying such a video streaming system.
2137839
Implementation of a Scalable Context-Aware Computing System
Context-aware computing involves the automatic tailoring of information and services based on the current location of the user. In this paper, we describe our experience in implementing Rover, a system that enables location-based services, as well as the traditional time-aware, user-aware and device-aware services. To achieve system scalability to very large client sets, Rover servers are implemented in an “action-based” concurrent software architecture that enables fine-grained application-specific scheduling of tasks. We have demonstrated its feasibility through implementations for both outdoor and indoor environments on multiple platforms.
3351438
Scalable application layer multicast
We describe a new scalable application-layer multicast protocol, specifically designed for low-bandwidth, data streaming applications with large receiver sets. Our scheme is based upon a hierarchical clustering of the application-layer multicast peers and can support a number of different data delivery trees with desirable properties.We present extensive simulations of both our protocol and the Narada application-layer multicast protocol over Internet-like topologies. Our results show that for groups of size 32 or more, our protocol has lower link stress (by about 25%), improved or similar end-to-end latencies and similar failure recovery properties. More importantly, it is able to achieve these results by using orders of magnitude lower control traffic.Finally, we present results from our wide-area testbed in which we experimented with 32-100 member groups distributed over 8 different sites. In our experiments, average group members established and maintained low-latency paths and incurred a maximum packet loss rate of less than 1% as members randomly joined and left the multicast group. The average control overhead during our experiments was less than 1 Kbps for groups of size 100.
36956169
Segmentation and classification of meetings using multiple information streams
We present a meeting recorder infrastructure used to record and annotate events that occur in meetings. Multiple data streams are recorded and analyzed in order to infer a higher-level state of the group's activities. We describe the hardware and software systems used to capture people's activities as well as the methods used to characterize them.