Incoming Packets Research Articles

N-FIB: Scalable, memory efficient name-based forwarding

Named Data Networking (NDN) is a promising future Internet which retrieves the content using their names. Content names composed of strings separated by ‘/’ are stored in the NDN Forwarding Information Base (FIB) to forward the incoming packets further. Though NDN has several benefits over traditional IP-based Internet, storing names instead of IP addresses has two major bottlenecks. While it consumes significantly large memory, it incurs higher search and update time. Another issue is the fast growth of routing table size through which FIB will not fit in existing routers’ line-card memory. Moreover, frequent updates to the FIB can degrade the packet delivery performance. In this paper, we propose a scalable and memory efficient Patricia trie based name forwarding scheme (called, N-FIB) for FIB. N-FIB supports FIB aggregation to significantly minimize the impact of large FIB size and high FIB update cost. Extensive experiment results show that the N-FIB scheme can reduce memory consumption by 68.18% compared to the BP scheme for 29 million named dataset. Moreover, N-FIB is reducing routers’ computation and memory overhead, while supporting strong forwarding correctness.

Flow Fair Sampling Based on Multistage Bloom Filters

Network traffic distribution is heavy-tailed. Most of network flows are short and carry very few packets, and the number of large flows is small. Traditional random sampling tends to sample more large flows than short ones. However, many applications depend on per-flow traffic other than just large flows. A flow fair sampling based on multistage Bloom filters is proposed. The total measurement interval is divided into n child time intervals. In each child time interval, employ multistage Bloom filters to query the incoming packet’s flow whether exists in flow information table or not, if exists, sample the packet with static sampling rate which is inversely proportional to the estimation flow traffic up to the previous time interval. If it is a new flow’s first packet, create its flow information and insert it into the multistage Bloom filters. The results show that the proposed algorithm is accurate especially for short flows and easy to extend.

Virus control

Internet technology has become an important part of our daily lives, meaning that monitoring and identifying abnormal behaviours in network traffic are both crucial for proper operation and cybersecurity countermeasures. Moreover, the proliferation of computer networks has lead to an ever-increasing demand for bandwidth of 100Gbps and more. Thus, the scaling of monitoring and measuring capabilities for collecting accurate statistics has become a challenging issue. The group explained that their work is suitable for anomaly detection for high-speed networking and security applications Professor Yu-Kuen Lai, the lead author on this paper, spoke to us about what he's been working on: “We have developed a filtering scheme to assist superspreader [i.e., a host that infects disproportionally more secondary contacts than other hosts also infected with the same virus] detection in high-speed network traffic. Specifically, we use bitmap sketch data structures to filter out most of the non-superspreader sources from the network traffic with high probability”. It is known that in most of the network devices, the space of fast memory (SRAM) is limited. Therefore, by using this scheme, the memory space required by the measurement module to track the source IP in the network traffic can be reduced while achieving acceptable accuracy. The prototype implementation can process network traffic at a throughput of 27Gbps. Owing to the high speed of internet traffic, tracking all packets and flows to enable complex analysis in real-time is difficult. This is due to limited processing time and memory space. Sketch, an alternative to packet sampling, is a compact data structure capable of shortening substantial numbers of data elements. It relies on probabilistic properties to guarantee the accurate estimation of various attributes of the network traffic. Consequently, it is widely used in high-speed network measurement and monitoring applications. In addition to the superspreader detection application presented in this paper, Sketch algorithms are commonly used for various types of applications, such as distinct flow estimation, heavy hitter identification, traffic change detection, entropy estimation, and so on. Lai also talked to us about the limitations of this method of packet sampling: ‘as discussed in this paper, the sketch-guided filtering works by using a bitmap sketch, which is updated for each incoming packet during an observation period of measurement. When the number of bits set is approaching the number of bits in the bitmap, the filter performance decreases. This scheme is dependent on a predefined threshold parameter and the observation period length. This is a common problem when using a bitmap data structure in this kind of traffic monitoring application. To avoid this problem, we can set the length of an observation period to a small number, or increase the bitmap size, which in turn, increases the memory requirement.’ Sketch-guided filtering can reduce the total memory requirement in the hardware implementation of superspreader detection systems. However, compared to those which use a large amount of memory to count all sources and exact fan-out, it comes at the cost of a slight decrease in detection accuracy and the fan-out estimation. Counting the fan-out of each source in high-speed network traffic is prohibitively expensive in term of processing time and memory space. Most of the previous works of the superspreader detection focused on the detection algorithm and the fan-out estimation accuracy without filtering the sources of low fan-out. The proposed Sketch-guided filtering scheme first eliminates the low fan-out sources, and counts only the fan-out of spreader sources. It can be used in high-speed network systems with a lower memory requirement as compared to previous approaches. Professor Lai hopes that ‘in the short term these results can lead to more ideas and research on how to remove the unnecessary sources efficiently, so that the monitoring process can identify the anomalies accurately. In the long term, we expect that the sketch-guided filtering scheme can be used in real application on network devices for assisting superspreader detection. However, before reaching that stage, more works need to be done to verify the performance of the filter. Furthermore, an intelligent threshold setting, and a method to handle the filter “saturation” problem should be developed.’ The main innovation of the proposed system is to use the sketch-guided filtering mechanism to remove sources with potentially low fanout

OMASS: One Memory Access Set Separation

In many applications, there is a need to identify to which of a group of sets an element $x$ belongs, if any. For example, in a router, this functionality can be used to determine the next hop of an incoming packet. This problem is generally known as set separation and has been widely studied. Most existing solutions make use of hash-based algorithms, particularly when a small percentage of false positives is allowed. A known approach is to use a collection of Bloom filters in parallel. Such schemes can require several memory accesses, a significant limitation for some implementations. We propose an approach using Block Bloom Filters, where each element is first hashed to a single memory block that stores a small Bloom filter that tracks the element and the set or sets the element belongs to. In a naive solution, when an element $x$ in a set $S$ is stored, it necessarily increases the false positive probability for finding that $x$ is in another set $T$ . In this paper, we introduce our One Memory Access Set Separation (OMASS) scheme to avoid this problem. OMASS is designed so that for a given element $x$ , the corresponding Bloom filter bits for each set map to different positions in the memory word. This ensures that the false positive rates for the Bloom filters for element $x$ under other sets are not affected. In addition, OMASS requires fewer hash functions compared to the naive solution.

H‐LCFST: a hash lowest cost first search tree for flexible packet classification

SummaryPacket classification (PC) categorizes incoming packets into multiple forwarding classes in a router based on predefined filters. It is one of the most important enabling technologies for next generation network services, for example, firewall, quality of service routing, load balancing, and virtual private network. IPv6 technology has posed a great challenge on the wire‐speed router for the PC because of its longer IP addresses. In this paper, we propose a new algorithm to support both IPv4 and IPv6, called hash lowest cost first search tree (H‐LCFST) for the PC. The H‐LCFST combines the advantages of the hash tree and a novel LCFST to achieve a better lookup performance. More important, the H‐LCFST algorithm is able to utilize the features of distinct IPv4 and IPv6 classifiers and design corresponding data structure for different characteristics of the classifiers, with which it is able to avoid the performance degrade because of the longer address of the IPv6. The experiment results show that our proposed algorithm has only approximately seven times of memory accesses for the IPv4/IPv6 PC, which make it to be the fastest PC solutions so far. Moreover, it occupies extremely small memory and supports incremental update at the same time. Copyright © 2016 John Wiley & Sons, Ltd.

Secure On-Chip Communication Architecture for Reconfigurable Multi-Core Systems

Security is becoming the primary concern in today’s embedded systems. Network-on-chip (NoC)-based communication architectures have emerged as an alternative to shared bus mechanism in multi-core system-on-chip (SoC) devices and the increasing number and functionality of processing cores have made such systems vulnerable to security attacks. In this paper, a secure communication architecture has been presented by designing an identity and address verification (IAV) security module, which is embedded in each router at the communication level. IAV module verifies the identity and address range to be accessed by incoming and outgoing data packets in an NoC-based multi-core shared memory architecture. Our IAV module is implemented on an FPGA device for functional verification and evaluated in terms of its area and power consumption overhead. For FPGA-based systems, the IAV module can be reconfigured at run-time through partial reconfiguration. In addition, a cycle-accurate simulation is carried out to analyze the performance and total network energy consumption overhead for different network configurations. The proposed IAV module has presented reduced area and power consumption overhead when compared with similar existing solutions.

OARE: Overhearing-Aided Redundancy Elimination in Multirate WLANs

In general, an access point (AP) in wireless local area networks (WLANs) can be easily congested since all related data traffic goes through it. To satisfy the quality-of-service (QoS) requirement for its customers, a protocol-independent redundancy elimination (RE) technique can effectively mitigate the congestion at the AP by reducing redundant data traffic. In this paper, we propose an overhearing-aided RE (OARE) scheme for multirate WLANs by leveraging the broadcast nature of a wireless medium. In OARE, the AP estimates overhearing probabilities of partially sliced chunks from an incoming packet for a destination mobile terminal by considering an adaptive modulation and coding technique. Then, the original packet is encoded by means of RE to minimize its transfer time to the destination, depending on the estimated overhearing probabilities. Extensive simulation results demonstrate that OARE can reduce the packet transfer time by 7.8%–23.2%, compared with non-RE (or nonencoded) transmissions.

Event-Driven Approach for Flow-to-Core Mapping by NICs in Multicore Systems

In exploiting multiple cores for packet processing, steering incoming packets to the same core on which its application resides is important for the performance issue. One of the key components for this is flow-to-core mapping table, which is used by NIC to steer incoming packets to right cores. To acquire the information required for flow-to-core table, we propose an event-driven approach unlike existing technologies, which take per-packet-based approach and thus cause non-negligible overhead. In addition, exploiting standard Linux utility to manipulate flow-to-core table of NIC, we realize NIC-independent approach unlike existing technologies, which require specific NICs.

A Review on Network Intrusion Detection System Using Open Source Snort

In the present scenario most of the organization depends on the internet for their communication, storage and protection of their valuable data and other internal resources from the unauthorized access as the importance of internet is increasing rapidly the chances of attacks also increases in the ratio. Intrusion Detection System plays a very important role in network security. Its main role in the network is to help computer system to create and deal with network attacks. An IDS acts as a key component to ensuring the safety of any network or system on which it runs. IDS works on the concept of investigating all the incoming packets for the detection of any malicious activity. This is a survey paper on the various enhancements over the decades on IDS. Snort is a lightweight and open source software which used signature based IDS. In the survey, we used BASE for providing graphical interface for displaying the result. Its used world widely in Intrusion Detection and Prevention.

Runtime Tunable Transmitting Power Technique in mm-Wave WiNoC Architectures

Emerging on-chip communication technologies, like wireless networks-on-chip (WiNoCs), have been recently proposed as candidate solutions for addressing the scalability limitations of conventional multihop network on chip (NoC) architectures. In a WiNoC, a subset of network nodes, namely, radio hubs, are equipped with a wireless interface that allows them to wirelessly communicate with other radio hubs. Thus, long-range communications, which would involve multiple hops in a conventional wireline NoC, can be realized by a single hop through the radio medium. Unfortunately, the energy consumed by the RF transceiver into the radio hub (i.e., the main building block in a WiNoC), and in particular by its transmitter, accounts for a significant fraction of the overall communication energy. In order to alleviate such contribution, this paper presents a runtime tunable transmitting power technique for improving the energy efficiency of the transceiver in WiNoC architectures. The basic idea is tuning the transmitting power based on the physical location of the recipient of the current communication. Specifically, based on the destination address of the incoming packet, the radio hub tunes its transmitting power to a minimum level, but high enough to reach the destination antenna without exceeding a certain bit error ratio. The proposed technique is general and can be applied to any WiNoC architecture. Its application on different representative WiNoC architectures results in an average energy reduction up to 50% without any impact on performance and with a negligible overhead in terms of silicon area.

Finding the biased-shortest path with minimal congestion in networks via linear-prediction of queue length

In this paper, we propose a biased-shortest path method with minimal congestion. In the method, we use linear-prediction to estimate the queue length of nodes, and propose a dynamic accepting probability function for nodes to decide whether accept or reject the incoming packets. The dynamic accepting probability function is based on the idea of homogeneous network flow and is developed to enable nodes to coordinate their queue length to avoid congestion. A path strategy incorporated with the linear-prediction of the queue length and the dynamic accepting probability function of nodes is designed to allow packets to be automatically delivered on un-congested paths with short traveling time. Our method has the advantage of low computation cost because the optimal paths are dynamically self-organized by nodes in the delivering process of packets with local traffic information. We compare our method with the existing methods such as the efficient path method (EPS) and the optimal path method (OPS) on the BA scale-free networks and a real example. The numerical computations show that our method performs best for low network load and has minimum run time due to its low computational cost and local routing scheme.

Multiple scattering induced negative refraction of matter waves

Starting from fundamental multiple scattering theory it is shown that negative refraction indices are feasible for matter waves passing a well-defined ensemble of scatterers. A simple approach to this topic is presented and explicit examples for systems of scatterers in 1D and 3D are stated that imply negative refraction for a generic incoming quantum wave packet. Essential features of the effective scattering field, densities and frequency spectrum of scatterers are considered. Additionally it is shown that negative refraction indices allow perfect transmission of the wave passing the ensemble of scatterers. Finally the concept of the superlens is discussed, since it is based on negative refraction and can be extended to matter waves utilizing the observations presented in this paper which thus paves the way to ‘untouchable’ quantum systems in analogy to cloaking devices for electromagnetic waves.

VLSI Based Robust Router Architecture

Through this paper our attempt is to give a onetime networking solution by the means of merging the VLSI field with the networking field as now a days the router is the key player in networking domain so the focus remains on that itself to get a good control over the network, Networking router today are with minimum pins and to enhance the network we go for the bridging loops which effect the latency and security concerns. The other is of multiple protocols being used in the industry today. Through this paper the attempt is to overcome the security and latency issues with protocol switching technique embedded in the router engine itself. This paper is based on the hardware coding which will give a great impact on the latency issue as the hardware itself will be designed according to the need. In this paper our attempt is to provide a multipurpose networking router by means of Verilog code, by this we can maintain the same switching speed with more secured way of approach we have even the packet storage buffer on chip being generated by code in our design in the so we call this as the self-independent router called as the VLSI Based router. This paper has the main focus on the implementation of hardware IP router. The approach here is that router will process multiple incoming IP packets with different versions of protocols simultaneously and even it is going to hold true for the IPv4 as well as for IPv6. With the approach of increasing switching speed of a routing per packet for both the current trend protocols. This paper thus is going to be a revolutionary enhancement in the domain of networking.

Равномерное распределение нагрузки аппаратно-программного ядра в UNIX-системах

In this article we consider the problem of maximizing the capacity of the network stack to the interaction of hardware and software core to ensure the stability of the physical server. The algorithms and program codes are proposed to optimize the load capacity of the CPU by core parallelization. The paper also considers statistics of improved power of distributed attacks affecting the network infrastructure. It proved the impact of any application with access to the external global network to the production of the physical server presented in the form of physical resources. With the help of the developed and implemented the algorithm (in the language of «BASH»), produced by the distribution of the load capacity of the physical server cores, to further reduce the load capacity on the processing power of the CPU is provided. Showcased flowcharts, as well as the final test results of each stage of development, are discussed. Implemented network optimization mode «AF_PACKET», which has given the opportunity to accept external network packets without any locks that, in turn, increases the efficiency of achievement of the set goals (upon request from the server to the client). The possibility of taking up to ten million incoming network packets by software physical server, which allows for stable processing of information for the smooth operation under DDoS-attacks «SYN-flood who realized the possibility of overload multimillion network packets. A similar number of incoming network packets provides an opportunity to fill the external network channel, with a consequent increase in the load capacity of the network TCP / IP stack that covers the remote control area physical server as soon as possible. Also adversely affect the performance of the working environment.

Design of an All-Optical Network Based on LCoS Technologies

AbstractIn this paper, an all-optical network composed of the ROADMs (reconfigurable optical add-drop multiplexer), L2/L3 optical packet switches, and the fiber optical cross-connection for fiber scheduling and measurement based on LCoS (liquid crystal on silicon) technologies is proposed. The L2/L3 optical packet switches are designed with optical output buffers. Only the header of optical packets is converted to electronic signals to control the wavelength of input ports and the packet payloads can be transparently destined to their output ports. An optical output buffer is designed to queue the packets when more than one incoming packet should reach to the same destination output port. For preserving service-packet sequencing and fairness of routing sequence, a priority scheme and a round-robin algorithm are adopted at the optical output buffer. The wavelength of input ports is designed for routing incoming packets using LCoS technologies. Finally, the proposed OFS (optical flow switch) with input buffers can quickly transfer the big data to the output ports and the main purpose of the OFS is to reduce the number of wavelength reflections. The all-optical content delivery network is comprised of the OFSs for a large amount of audio and video data transmissions in the future.

AFLAS: An Adaptive Frame Length Aggregation Scheme in Vehicular Networks

Vehicular ad hoc networks (VANETs) experience large-scale high-speed mobility and volatile topology. VANETs may therefore experience intermittent connections and may occasionally be unable to guarantee end-to-end connections. This gives the medium access control (MAC) layer the opportunity to adapt its transmission strategy to the current unstable wireless connections to improve transmission efficiency. In this paper, we propose an adaptive frame length aggregation scheme (AFLAS) for VANETs, which is designed to improve transmission efficiency and increase data throughput. In our scheme, the incoming data packets from higher layers are queued separately in the MAC layer to wait for transmission opportunities. Suitable aggregation frame lengths are calculated according to the current wireless status and applied in the MAC layer at the onset of data transmissions. In this paper, we analyze and apply our AFLAS strategy to two current frame aggregation schemes in IEEE 802.11. We also report on the performance evaluation of our scheme. Our results exhibit significant improvement results in data throughput, retransmissions, overheads, and transmission efficiency in comparison with nonadaptive aggregation schemes.

Performance Evaluations of IPTables Firewall Solutions under DDoS attacks

Abstract The paper presents design, background and experimental results of the IPTables applied in IPv4 and IP6Tables applied in IPv6 network compared through several tested parameters. The experimental testbed environment is based on P2P grid utilized for DDoS attacks. IPTables tool is used for packet filtering and consequently for preventing DoS/DDoS attacks. It allows a system administrator to configure the tables, the chains and rules it stores in order to manage the incoming and outgoing packets. The packets are treated according to the rules’ results provided by the packet processing. A rule in a chain can be bound with another chain in the table etc. We employ the P2P grid environment to carry out as well as to coordinate DDoS attack on the availability of services to simulate real DDoS attack launched indirectly through many compromised computing systems. The same routing protocols as well as the same firewall rules were used for IPv4 and for IPv6 network. The main aim was to analyse pros and cons of new IP6Tables tool compared with IPTables in IPv4 networks in light of the resistance to DDoS attacks which is still one of the most significant threats in the IPv6 networks.

Dynamics of biosonar systems in Horseshoe bats

Horseshoe bats have an active ultrasonic sonar system that allows the animals to navigate and hunt prey in structure-rich natural environments. The physical components of this biosonar system contain an unusual dynamics that could play a key role in achieving the animals’ superior sensory performance. Horseshoe bat biosonar employs elaborate baffle shapes to diffract the outgoing and incoming ultrasonic wave packets; ultrasound is radiated from nostrils that are surrounded by noseleaves and received by large outer ears. Noseleaves and pinnae can be actuated while ultrasonic diffraction takes place. On the emission side, two noseleaf parts, the anterior leaf and the sella, have been shown to be in motion in synchrony with sound emission. On the reception side, the pinnae have been shown to change their shapes by up to 20% of their total length within ∼100 milliseconds. Due to these shape changes, diffraction of the incoming and outgoing waves is turned into a dynamic physical process. The dynamics of the diffraction process results in likewise dynamic device characteristics. If this additional dynamic dimension was found to enhance the encoding of sensory information substantially, horseshoe bat biosonar could be a model for the use of dynamic physical processes in sensing technology.

Modelling and analysis of rule‐based network security middleboxes

This study presents an analytical model for rule-based network security middleboxes as those of network firewalls, intrusion detection systems and email spam filters. In these systems, incoming packets carrying requests arrive at the middlebox and obtain queued for processing in multiple stages. The stages consist of first a main stage for packet processing and then subsequent stages of rulebase interrogation in which rules or conditions are checked sequentially until a match is triggered. The service at these stages is characterised to be mutually exclusive; that is, only one stage is active at any time. The authors derive useful formulas that can predict the middlebox performance, taking into account its incoming request rate, the queue size and the processing capacity of the middlebox, and thereby proper engineering capacity of the middlebox can be achieved.

성공적인 확인응답이 필요한 비디오 정보 파일에 의한 토큰버킷 자동 파라메타 설정 기법을 가진 비디오 스트리밍 수신기

비디오 스트리밍 수신기의 재생 버퍼에 있는 패킷량은 네트워크 상태에 따라 변화되며 지연 및 지터의 영향으로 인해 포화 및 고갈 현상이 일어날 수 있다. 특히, 유입되는 비디오 트래픽의 양이 재생 버퍼의 최대 양을 넘으면 버퍼 오버플로우(buffer overflow)문제가 발생된다. 버퍼 오버플로우는 화질의 열화를 발생시키고 스킵(skip) 현상으로 인해 재생의 불연속성을 발생시킨다. 또한 네트워크 혼잡으로 인하여 패킷의 유입이 늦어지면 버퍼 언더플로우(buffer underflow) 문제에 의한 버퍼링에 의해 영상의 멈춤 현상이 일어날 수 있다. 상기 문제들을 해결하기 위하여 본 논문에서는 토큰버킷(Token Bucket)의 주요 파라미터인 토큰 발생률 파라메타와 버킷의 최대 용량 파라미터를 각각의 비디오 패킷들의 패턴에 따라서 자동적으로 설정하는 토큰버킷 기법을 장착한 비디오 스트리밍 수신기를 제안한다. NS-2(Network Simulator-2)와 JSVM(Joint Scalable Video Model)을 이용하는 시뮬레이션 결과는 제안하는 토큰버킷 파라메타 자동설정 기법이 기존의 수동설정 기법보다 3개의 시험 비디오 시퀀스들에 대해 오버플로우/언더플로우 횟수와 패킷 손실 비율 및 PSNR(Peak Signal to Noise Ratio)측면에서 우수한 성능을 제공함을 확인 할 수 있었다. The amount of packets in palyout buffer of video streaming receiver can be changed by network condition, and saturated and exhausted by the delay and jitter. Especially, if the amount of incoming video traffic exceeds the maximum allowed playout buffer, buffer overflow problem can be generated. It makes the deterioration of video image and the discontinuity of playout by skip phenomenon. Also, if the incoming packets are delayed by network confusion, the stop phenomenon of video image is made by buffering due to buffer underflow problem. To solve these problems, this paper proposes the video streaming receiver with token bucket scheme which automatically establishes the important parameters like token generation rate r and bucket maximum capacity c adapting to the pattern of video packets. The simulation results using network simulator-2 (NS-2) and joint scalable video model (JSVM) show that the proposed token bucket scheme with automatic establishment parameter provides better performance than the existing token bucket scheme with manual establishment parameter in terms of the generation number of overflow and underflow, packer loss rate, and peak signal to noise ratio (PSNR) in three test video sequences.