Intermediate Routers Research Articles

A rate-based TCP traffic model to accelerate network simulation

Traditional discrete-event simulation of large-scale networks at the packet level is computationally expensive. This article presents a fast rate-based transmission control protocol (RTCP) traffic model designed to reduce the time and space complexity for simulating network traffic whilst maintaining good accuracy. A distinct feature of the proposed model is that the transmission control protocol (TCP) congestion control behavior is represented using analytical models that describe the send rate at the traffic source as a function of the round-trip time and the packet loss rate at different phases of a TCP connection. Rather than modeling at the granularity of individual packets visiting the intermediate routers, the model approximates traffic flows as a series of rate windows, each consisting of a number of packets considered to possess the same arrival rate. The model calculates the queuing delays and the packet losses as these rate windows traverse the individual network queues along the flow path. The proposed RTCP model is able to achieve a performance advantage over other TCP models, by integrating analytical solutions and aggregating traffic using rate windows. Empirical results show that the RTCP model can correctly capture the overall TCP behavior and achieve a speedup of more than two orders of magnitude over the corresponding detailed packet-oriented simulation.

Analysis of CHOKe-Family Active Queue Management

In the article we study a model of network transmissions with Active Queue Management in an intermediate IP router. We use the OMNET++ discrete event simulator to model the varies variants of the CHOKe algoithms. We model a system where CHOKe, xCHOKe and gCHOKe are the AQM policy. The obtained results shows the behaviour of these algorithms. The paper presents also the implementation of AQM mechanisms in the router based on Linux.

Active and Passive Monitoring and Analysis of IP Option Header Transparency from Covert Channel Point of View

In a context of network covert channels, unused header fields in communication protocols are vulnerable to embed secret data. An IP Option field in the IP header is considered as one of useful spaces for constructing the Internet-wide network covert channels. On the other hand, IP packets with IP Option have been said non-transparent on the global Internet. This paper investigates how an IP packet with IP option can be going through over the Internet by active and passive monitoring methods. At first, we investigated AS border traffic in an academic AS and a commercial IX. The result was that only four types of IP Options, Route Record (RR), Time Stamp (TS), No Operation (NOP) and End of Option List (EOOL), were observed. Then, we preliminary evaluated transparency of these four types IP Options over the global Internet by probing from ten Planetlab nodes on six countries against 5,000 randomly chosen destination IP addresses and 11,251 intermediate routers. Both destination addresses and intermediate routers were included in 1,132 intermediate ASes. As the active measurement result, 57% routers replied to IP packets with the RR Option, that is, the RR Option was transparent in 914 intermediate ASes on this experiment. On the other hand, 41% of intermediate routers replied probe packets with the TS option, that is, the TS Option was transparent in 811 intermediate ASes on this experiment.

Securing Mobile Ad hoc Networks: Key Management and Routing

Secure communication between two nodes in a network depends on reliable key management systems that generate and distribute keys between communicating nodes and a secure routing protocol that establishes a route between them. But due to lack of central server and infrastructure in Mobile Ad hoc Networks (MANETs), this is major problem to manage the keys in the network. Dynamically changes in network's topology causes weak trust relationship among the nodes in the network. In MANETs a mobile node operates as not only end terminal but also as an intermediate router. Therefore, a multi-hop scenario occurs for communication in MANETs; where there may be one or more malicious nodes in between source and destination. A routing protocol is said to be secure that detects the detrimental effects of malicious node(s in the path from source to destination). In this paper, we proposed a key management scheme and a secure routing protocol that secures on demand routing protocol such as DSR and AODV. We assume that MANETs is divided into groups having a group leader in each group. Group leader has responsibility of key management in its group. Proposed key management scheme is a decentralized scheme that does not require any Trusted Third Party (TTP) for key management. In proposed key management system, both a new node and group leader authenticates each other mutually before joining the network. While proposed secure routing protocol allows both communicating parties as well as intermediate nodes to authenticate other nodes and maintains message integrity

Detect DDoS Attack using Border Gateways and Edge Routers

The system is design to implement an identification and classification algorithm for tracing DDoS attack and multicast attack information to a edge router using cyclical deterministic packet marking (CDPM) method. Edge router registry stores the received packet IP source address and mark the packet. An Identification and classification algorithm implemented on Border gateway. An algorithm based on received packet and path variation. Border gateways analyze the packet path and number of request received from particular source address. And classify the packet if attacker multicast the attack packet information to edge router and intermediate router or if legitimate packet the border gateway allow to use server. Finally edge router can update their registry and block the attacker IP source address from home network itself. In our proposed model we identify an attack source and multicast the information to an edge router.

An adaptive probabilistic marking scheme for fast and secure traceback

IP traceback can be used to find direct generator(s) and path(s) of attacking traffic. Probabilistic marking schemes, as one type of IP traceback technologies, have been most studied, but they are difficult to fast reconstruct attacking path(s) and defend against spoofed marks generated by attacking source(s). In this paper, we present Adaptive Probabilistic Marking scheme (APM). In APM, when each packet enters the first-hop router, its TTL value is set to a uniform value, and when it is forwarded by routers in the network, each intermediate router decreases the TTL value by one. Consequently, each intermediate router may infer the router-level hop number that each packet has already traveled, and then correspondingly marks the packet with the probability inversely proportional to the router-level hop number. APM is focused on the probability with which a router marks a packet, and APM can cooperate with other probabilistic marking schemes. NS2 simulation experiments prove that, in APM, the time for the victim to receive necessary marks for the path reconstruction is reduced by more than 20% compared with existing probabilistic marking schemes, and spoofed marks cannot reach the victim and influence the traceback process.

A Practical Hybrid IP Traceback Method under IPv6

Recently, Distributed Denial of Service (DDoS) attacks have been threatening the Internet severely. Tracing IP packets back to their origins is an efficient and important part of the defense against those attacks. Currently two major kinds of IP traceback methods have been used for IP traceback in IPv6: packet marking and packet logging. IP traceback based on packet marking requires routers to write their identifiable information into the forwarded packets. It incurs little overhead on routers but needs a large number of packets to construct the complete attack path. IP traceback based on packet logging requires routers to store the digests of the forwarded packets. It only needs a few packets to construct the attack path but causes high storage overhead in routers. In this paper, we present a practical hybrid IP traceback method under IPv6 (PHIT-IPv6) which integrates packet marking and packet logging so as to obtain both of their advantages. We improved the practicality of DDoS traceback in that our method requires a less number of packets to conduct the traceback progress and reduces the storage overload of the intermediate routers for packet logging. We present both mathematical analysis and simulation of our method. The results show that our method can reduce the storage overhead by almost fifty percent and can also significantly decrease the number of packets for attack path construction.

P2P 스트리밍 시스템을 위한 TTL 기반 피어 그룹핑 기법

본 논문에서는 P2P 기반의 IPTV 시스템에서 TTL을 이용해서 지역성을 반영하는 피어 그룹핑 기법을 제안한다. 이 기법은 두 피어 사이의 경유 라우터 수를 최소화하도록 이웃 피어를 선정하여 중간 라우터들이 전송해야 하는 데이터 양이 감소한 만큼 네트워크 대역폭을 절약할 수 있다. 또한 본 논문에서 제안하는 TTL 기반의 피어 그룹핑 기법이 기존의 RTT 기반의 기법에 비해 성능이 향상되는 것을 보이기 위해 다양한 시뮬레이션 시험을 수행하였다. 실험 결과는 본 논문에서 제안하는 TTL 기반의 피어 그룹핑 기법이 전체 라우터들이 전송하는 데이터 및 제어패킷 용량뿐만 아니라 지터 비율도 감소시킬 수 있다는 것을 보인다. In this paper, we propose a new peer grouping scheme to consider locality among peers using TTL values in P2P-based IPTV systems. This scheme can select neighbor peers to minimize the number of intermediate routers between each pair of peers. Thus, it can save the network bandwidth as much as the amount of data that the reduced number of routers should transmit In addition, we have conducted various simulation experiments to show that our proposed TTL-based peer grouping scheme can outperform the conventional RTT-based grouping scheme. The experimental results show that our proposed scheme can reduce the jitter ratio as well as the number of data and control packets that all routers should transmit.

TPSS: A Flexible Hardware Support for Unicast and Multicast on Network-on-Chip

Multicast is an important traffic mode that runs on multi-core systems, and an efficient hardware support for multicast can greatly improve the performance of the whole system. Most multicast solutions use the dimension-order routing to generate the mutlicast trees, which are neither bandwidth nor power efficient. This article presents a synthesizable router for network-on-chip (NoC) which supports arbitrarily shaped multicast path based on a mesh topology. In our scheme, incremental setup is adopted to simplify the process of multicast tree construction. For each sub-path setup, we present a novel scheme called two period sub-path setup (TPSS). TPSS is divided into two periods: routing to a predeterminate intermediate router, and updating lookup tables from the intermediate router to destination. This novel setup makes it feasible to support arbitrarily shaped path setup. In our case study, Optimized tree algorithm (OPT) and Left-XY-Right-Optimized tree algorithm (LXYROPT) are proposed for power-efficient path searching, but they need to be pre-configured for the reason of high computation cost. Moreover, Virtual Circuit Tree Multicasting (VCTM) is also supported in our scheme for dynamic construction of multicast path, which needs no computation in path searching. The performance is evaluated by using a cycle accurate simulator developed in SystemC, and the hardware overhead is estimated by using a synthesizable HDL model. Compared to VCTM (without FIFO, multicast table and network adapter), the area overhead of implementing our router is negligible (less than 0.5%).

Distributed Denial of Service (DDOS) Attacks Detection Mechanism

Pushback is a mechanism for defending against Distributed Denial-of-Service (DDoS) attacks. DDoS attacks are treated as a congestion-control problem, but because most such congestion is caused by malicious hosts not obeying traditional end-to-end congestion control, the problem must be handled by the routers. Functionality is added to each router to detect and preferentially drop packets that probably belong to an attack. Upstream routers are also notified to drop such packets in order that the router's resources be used to route legitimate traffic hence term pushback. Client puzzles have been advocated as a promising countermeasure to DoS attacks in the recent years. In order to identify the attackers, the victim server issues a puzzle to the client that sent the traffic. When the client is able to solve the puzzle, it is assumed to be authentic and the traffic from it is allowed into the server. If the victim suspects that the puzzles are solved by most of the clients, it increases the complexity of the puzzles. This puzzle solving technique allows the traversal of the attack traffic throughout the intermediate routers before reaching the destination. In order to attain the advantages of both pushback and puzzle solving techniques, a hybrid scheme called Router based Pushback technique, which involves both the techniques to solve the problem of DDoS attacks is proposed. In this proposal, the puzzle solving mechanism is pushed back to the core routers rather than having at the victim. The router based client puzzle mechanism checks the host system whether it is legitimate or not by providing a puzzle to be solved by the suspected host.

Video Aggregation: Delivering Videos over Wireless Smart Camera Networks

The proliferation of wireless technologies and inexpensive network-cameras has enabled low-cost and quick deployment of cameras for several surveillance applications, such as traffic monitoring and border control. Smart Camera Networks (SCNs) are networks of cameras that self configure and adapt to improve their operation and reduce the demand on human operators. However, SCNs are constrained by the ability of the underlying wireless network. Streaming video over a network requires substantial bandwidth, and strict Quality-of-Service (QoS) guarantees. In contrast, existing wireless networks have limited bandwidth, and the protocols do not guarantee QoS. Thus, for SCNs to scale beyond a small number of cameras, it is vital to design efficient video delivery protocols that are aware of the limitations of the underlying wireless network. We propose to use Video Aggregation, a technique that enables efficient delivery of video in SCNs by combining related video streams. Existing SCNs use traditional routing protocols where intermediate network routers simply forward the video packets from cameras towards the video analysis center (or base-station). This is inefficient in SCNs since multiple cameras often cover overlapping regions of interest, and video information of these regions are redundantly transmitted over the network. The proposed video aggregation protocol eliminates redundant transmissions by dynamically pruning the overlapping areas at the intermediate routers. The routers blend the received streams into one panoramic video stream with no overlaps. Aggregation also dynamically controls the streaming rate to avoid network congestion and packet drops; the routers adjust the rate of the outgoing video by estimating the available network bandwidth. Thus, base-stations receive video frames with minimal packet drops, thus improving the quality of received video. Our testbed and simulation results show that aggregation outperforms traditional routing both in terms of received video quality and network bandwidth usage. Our testbed experiments show that aggregation improves the received video quality (the Peak Signal-to-Noise-Ratio metric) by 54%. In larger networks, we observed that aggregation eliminates up to 90% of packet drops that were observed in SCNs with traditional routing. In future, we plan to develop a suite of video delivery protocols, which include SCN-aware scheduling and transport protocols.

A Reliable Transmission Protocol for ZigBee-Based Wireless Patient Monitoring

Patient monitoring systems are gaining their importance as the fast-growing global elderly population increases demands for caretaking. These systems use wireless technologies to transmit vital signs for medical evaluation. In a multihop ZigBee network, the existing systems usually use broadcast or multicast schemes to increase the reliability of signals transmission; however, both the schemes lead to significantly higher network traffic and end-to-end transmission delay. In this paper, we present a reliable transmission protocol based on anycast routing for wireless patient monitoring. Our scheme automatically selects the closest data receiver in an anycast group as a destination to reduce the transmission latency as well as the control overhead. The new protocol also shortens the latency of path recovery by initiating route recovery from the intermediate routers of the original path. On the basis of a reliable transmission scheme, we implement a ZigBee device for fall monitoring, which integrates fall detection, indoor positioning, and ECG monitoring. When the triaxial accelerometer of the device detects a fall, the current position of the patient is transmitted to an emergency center through a ZigBee network. In order to clarify the situation of the fallen patient, 4-s ECG signals are also transmitted. Our transmission scheme ensures the successful transmission of these critical messages. The experimental results show that our scheme is fast and reliable. We also demonstrate that our devices can seamlessly integrate with the next generation technology of wireless wide area network, worldwide interoperability for microwave access, to achieve real-time patient monitoring.

A novel congestion control protocol with AQM support for IP-based networks

Multimedia services (Real-time and Non real-time) have different demands, including the need for high bandwidth and low delay, jitter and loss. TCP is a dominant protocol on the Internet. In order to have the best performance in TCP, the congestion window size must be set according to some parameters, since the TCP source is not aware of the window size. TCP emphasizes more on reliability than timeliness, so TCP is not suitable for real-time traffic. In this paper an active Queue management support TCP (QTCP) model is presented. Source rate is regulated based on the feedback which is received from intermediate routers. Furthermore, in order to satisfy the requirements of multimedia applications, a new Optimization Based active Queue management (OBQ) mechanism has been developed. OBQ calculates packet loss probabilities based on the queue length, packets priority and delay in routers and the results are sent to source, which can then regulate its sending rate. Simulation results indicate that the QTCP reduces packet loss and buffer size in intermediate nodes, improves network throughput and reduces delay.

On the feasibility of bandwidth estimation in wireless access networks

Bandwidth estimation refers to the measurement of a bandwidth-related metric over a network path, performed only by the end hosts, without access to the intermediate routers. The problem of fast bandwidth estimation has been extensively studied in the wired Internet. More recently, researchers have shown that tools developed for the wired Internet cannot be used in wireless networks, due to the different characteristics of these networks which invalidate many of the assumptions made for the wired Internet. This observation has led to new tools that take into account the different characteristics of wireless networks. These tools have only been evaluated in controlled environments, under controlled settings and interferers, and only for 802.11 CSMA-based WLANs. In addition, no tool has been reported so far in the literature for cellular networks. This paper presents the first study of the feasibility of fast bandwidth estimation in wireless networks "in the wild", i.e., in deployed operational networks. We discuss the challenges associated with bandwidth measurements in operational networks in contrast to in controlled lab environments. We study the applicability of a state-of-the-art probe-based tool for 802.11 WLANs in a commercial 1 × EVDO network. In addition, we evaluate the accuracy of the tool in three different WLAN environments, i.e., lab, home, and hotspot. Our results show that bandwidth estimation using a probe-based tool can be challenging in certain WLAN environments, and practically infeasible in EVDO cellular networks, due to the short-scale dynamics in this type of networks.

On the Energy Efficiency of IP-over-WDM Networks

In the next years, the Internet will undergo a substantial increase of the capacity required by end-users. Since Internet currently consumes a significant fraction of the world electrical power, reducing the energy consumption of telecom networks is expected to become more and more important. In this paper, we focus on backbone transport networks. We compare three different architectures for IP packet transport based on Wavelength Division Multiplexing (WDM) over optical fiber links (IP-over-WDM networks), namely IP with no Bypass (IP-NB), IP with Bypass (IP-B) and IP with Bypass and Grooming (IP-BG), which differ in their capability of traffic aggregation (grooming) and optical switching. IP-NB performs grooming in every network node, where the traffic is electronically processed and forwarded by the IP routers. IP-B enables switching of wavelength channels directly in the optical domain, thus bypassing the IP packet processing in intermediate IP routers. The IP-BG architecture represents an intermediate solution between the previous two: it provides both grooming capabilities (as IP-NB), in order to exploit network capacity efficiently, and optical switching (as IP-B) to reduce expensive electronic processing. We compare these three solutions, showing the trade-off between the reduction of the power consumption or of the network cost, and we analyze how minimizing one of these two factors can influence the other.

A mathematical model to determine the maximum end-to-end delay bound on label switched path for real time applications over mobile IPv6

The real time applications have driven the demand for increasing and guaranteed bandwidth requirements in the network. Due to the mobility feature within a MN, mobile networks need a more sophisticated mechanism for quality of service provision. Beside, custom routing methods in a Mobile IPv6 network deliver a packet via specific tunnel this causes intermediate routers do not recognize content of a control packet due to adding headers in IPv6-in-IPv6 encapsulation. In this paper, we propose a mathematical model by using an effective envelope approach to traffic engineering and determine bound of end-to-end delay between MN and correspondent node according to ROMA solution in mobile IPv6 networks. According to this method, every transmitted flow over label switched path should have an end to end delay less than estimated end-to-end delay; otherwise, they will be ignored. This causes an improvement of the network performance and increase achievable link utilization and ultimately increasing quality of services over mobile IPv6 networks. The proposed mathematical model is applicable on label switched path which is a result of ROMA approach to quality of service provision over mobile IPv6 networks.

A cross-layer scheme for resource reservation based on multi-protocol label switching over mobile IP version6

The last decades have brought tremendous improvement in wireless internet and its technologies. This has inspired the development of a variety of new services in business and consumer markets. The real time applications such as voice over internet protocol (VOIP) and other multimedia traffic such as Internet Protocol television have driven the demand for increasing and guaranteed bandwidth requirements in the network. Due to the mobility feature within a MN, mobile networks need a more sophisticated mechanism for quality of service provision. Beside, custom routing methods in a Mobile IPv6 network deliver a packet via specific tunnel. In the tunnel, intermediate routers are incapable to retrieve necessary information for guarantee quality of service due to adding headers in IPv6-in-IPv6 encapsulation. The purpose of this paper is to propose an approach to guarantee end-to-end QoS over Mobile IPv6 networks. This research paper focuses on tunnel redundancy in routing mechanisms over Mobile IPv6. In this paper, we propose a cross layer scheme to overcome negative effect of tunneling over Mobile IPv6 networks whenever a RSVP messages traverse via tunneling.

Weeding Wormhole Attack in MANET Multicast Routing Using Two Novel Techniques - LP3 and NAWA2

Adhoc Network (MANET) with its unique and special characteristics is prone to a host of security threats from within and outside the network. The MANET architecture is well suited for conducting multicast communications as this greatly reduces the number of multicast packets traversing the network. The replication of multicast packets by the intermediate downstream multicast router is demand based and is determined by the number of fresh receivers in the group. This greatly paves way for network resource optimization and a good trail of performance parameters like MPDR, Throughput, Jitter and End- to-End Delay. It is literally bogging down to construe a localized MANET as a single flat larger group. So the concept of orchestrating hierarchical group architecture within MANET dawned which led to the definition of Iolus framework. The hierarchical secure multicast distribution tree created within MANET backed by Iolus framework is prone to a array of attacks. One such prominent insider attack is wormhole attack where the two colluding adversaries conspire to short-circuit the flow of packets to a foreign network through an out-of-band high bandwidth link. The implication of this attack in unicast routing of MANET is less pronounced due to the limited number of participating entities. But this attack has a large telling effect on multicast routing as it involves multiple receivers and numerous intermediate multicast routers. The possibility of compromising the internal group node as a wormhole colluding agent is more common in multicast than in unicast. This threat marks an unprecedented intensity by divulging more faction of data thereby rendering the remedial process a huge flop. The real intent of the attacker is not to disrupt the multicast communication but in abetting the mass divulgence of multicast data to unauthorized group members. Two novel solutions viz., Limiting Packet Propagation Parameter (LP 3 ) and Neighbor Aware Wormhole Adversary Axing (NAWA 2 ) has been proposed

Routing Internet traffic in heterogeneous mesh networks: Analysis and algorithms

In practical wireless mesh networks (WMNs), gateways are subject to hard capacity limits on the aggregate number of flows (in terms of bit rate) that they can support. Thus, if traffic is routed in the mesh network without considering those constraints, as well as the traffic distribution, some gateways or intermediate mesh routers may rapidly get overloaded, and the network resources can be unevenly utilized. To address this problem, in this paper we firstly develop a multi-class queuing network model to analyze feasible throughput allocations, as well as average end-to-end delay, in heterogeneous WMNs. Guided by our analysis, we design a Capacity-Aware Route Selection algorithm ( CARS), which allocates network paths to downstream and upstream Internet flows so as to ensure a more balanced utilization of wireless network resources and gateways’ fixed connections. Through simulations in a number of different network scenarios we show that the CARS scheme significantly outperforms conventional shortest path routing, as well as an alternative routing method that distributes the traffic load on the gateway nodes to minimize its variance.

Buffer Asymptotics for Coding Over Networks

Traditionally, network buffer resources have been used at routers to queue transient packets to prevent packet drops. In contrast, we propose a scheme for large multihop networks where intermediate routers have no buffers for queueing transient packets. In the proposed scheme, network storage resources (memory) are used only at source and destination nodes to encode/decode packets using random linear coding over time. Our scheme capitalizes on the common empirical observation that for large networks with many flows through each router, if packet loss occurs in a flow path, it will very likely occur only at only a very few links on the path. Unfortunately, the location of this congested link varies with time, thereby preventing prevailing static buffer allocation strategies from exploiting this observation. We propose source coding over packets at the session layer as a means of “sharing” memory across links along a flow path. We call this spatial buffer multiplexing-where buffering and coding implemented at the source compensates for packet loss at any downstream bufferless link. First, we consider large spatial multihop networks with <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> nodes (each with finite buffer space for coding/decoding) and Θ( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> ) flows; the number of flows through each link scales as Ω( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">α</sup> ) for some α ∈ (0,1). Using many-sources large deviations analysis, we show that to obtain comparable packet drop probabilities (QoS), spatial buffer multiplexing provides an order-wise buffer gain of Ω( <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">α</sup> ) per node over traditional static buffer allocation for queueing. Next we consider the complementary case of a network with a small number of flows through a buffer, but large source buffer. Here, we provide a sufficient condition under which the packet loss probability decreases exponentially in a function that is linear in the size of the input buffer, where the function is required to meet a predetermined negative slope -δ. We express the loss effective bandwidth for coding and compare it against that for queueing.