IP Flow Research Articles

On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets

Denial of service (DoS) attack on the Internet has become a pressing problem. In this paper, we describe and evaluate route-based distributed packet filtering (DPF), a novel approach to distributed DoS (DDoS) attack prevention. We show that DPF achieves proactiveness and scalability, and we show that there is an intimate relationship between the effectiveness of DPF at mitigating DDoS attack and power-law network topology.The salient features of this work are two-fold. First, we show that DPF is able to proactively filter out a significant fraction of spoofed packet flows and prevent attack packets from reaching their targets in the first place. The IP flows that cannot be proactively curtailed are extremely sparse so that their origin can be localized---i.e., IP traceback---to within a small, constant number of candidate sites. We show that the two proactive and reactive performance effects can be achieved by implementing route-based filtering on less than 20% of Internet autonomous system (AS) sites. Second, we show that the two complementary performance measures are dependent on the properties of the underlying AS graph. In particular, we show that the power-law structure of Internet AS topology leads to connectivity properties which are crucial in facilitating the observed performance effects.

Enhanced weighted round robin schedulers for accurate bandwidth distribution in packet networks

Weighted round robin (WRR) schedulers constitute a popular solution for differentiating the bandwidth guarantees of heterogeneous IP flows, mostly because of their minimal implementation cost. However, the existing WRR schedulers are not sufficient to satisfy all the requirements of emerging quality-of-service frameworks. Flexible bandwidth management at the network nodes requires the deployment of hierarchical scheduling structures, where bandwidth can be allocated not only to individual flows, but also to aggregations of those flows. With currently available WRR schedulers, the superimposition of a hierarchical structure compromises the simplicity of the basic scheduler. WRR schedulers are also known for their burstiness in distributing service, which exposes the scheduled flows to higher packet-loss probability at downstream nodes. By construction, WRR schedulers distribute bandwidth proportionally to the service shares allocated to the individual flows. For best-effort (BE) flows, having no specified bandwidth requirements, existing WRR schedulers typically allocate arbitrary service shares. This approach conflicts with the intrinsic nature of BE flows and reduces the availability of bandwidth for the allocation of guaranteed-bandwidth (GB) flows. We present three enhancements for WRR schedulers that solve these problems. In the first enhancement, we superimpose a “soft” scheduling layer on the basic WRR scheduler by simply redefining the computation of the flow timestamps. The second enhancement substantially reduces the service burstiness of the WRR scheduler with only marginal impact on its implementation cost. Finally, the third enhancement allows the smooth integration of GB and BE flows, with efficient management of the available bandwidth and total compliance with the nature of BE flows.

Performance comparison of layer 3 switches in cases of flow- and topology-driven connection setup

The layer 3 switch enables us to transmit IP datagrams fast using the cut-through technique. There are mainly two cases in establishing connections; one is the flow-driven case and the other is the topology-driven one. In this paper, we analyze the cut-through rate, the datagram waiting time and the mis-order rate as performance measure of both cases and compare these performances. In the analysis, by using interrupted Bernoulli process (IBP), we model the arrival process of IP flow and IP datagram from each source. Furthermore, we investigate impacts of the arrival rate and the average IP flow length on the performance.

Load-sensitive routing of long-lived IP flows

Internet service providers face a daunting challenge in provisioning network resources, due to the rapid growth of the Internet and wide fluctuations in the underlying traffic patterns. The ability of dynamic routing to circumvent congested links and improve application performance makes it a valuable traffic engineering tool. However, deployment of load-sensitive routing is hampered by the overheads imposed by link-state update propagation, path selection, and signaling. Under reasonable protocol and computational overheads, traditional approaches to load-sensitive routing of IP traffic are ineffective, and can introduce significant route flapping, since paths are selected based on out-of-date link-state information. Although stability is improved by performing load-sensitive routing at the flow level, flapping still occurs, because most IP flows have a short duration relative to the desired frequency of link-state updates. To address the efficiency and stability challenges of load-sensitive routing, we introduce a new hybrid approach that performs dynamic routing of long-lived flows, while forwarding short-lived flows on static preprovisioned paths. By relating the detection of long-lived flows to the timescale of link-state update messages in the routing protocol, route stability is considerably improved. Through simulation experiments using a one-week ISP packet trace, we show that our hybrid approach significantly outperforms traditional static and dynamic routing schemes, by reacting to fluctuations in network load without introducing route flapping.

Buffer management schemes for supporting TCP in gigabit routers with per-flow queueing

There has been much interest in using active queue management in routers in order to protect users from connections that are not very responsive to congestion notification. An Internet draft recommends schemes based on random early detection for achieving these goals, to the extent that it is possible, in a system without state. However, a stateless system with first-in/first-out (FIFO) queueing is very much handicapped in the degree to which flow isolation and fairness can be achieved. Starting with the observation that a stateless system is but one extreme in a spectrum of design choices and that per-flow queueing for a large number of flows is possible, we present active queue management mechanisms that are tailored to provide a high degree of isolation and fairness for TCP connections in a gigabit IP router using per-flow queueing. We show that IP flow state in a router can be bounded if the scheduling discipline used has finite memory, and we investigate the performance implications of different buffer management strategies in such a system. We show that merely using per-flow scheduling is not sufficient to achieve effective isolation and fairness, and it must be combined with appropriate buffer management strategies.

A parameterizable methodology for Internet traffic flow profiling

We present a parameterizable methodology for profiling Internet traffic flows at a variety of granularities. Our methodology differs from many previous studies that have concentrated on end-point definitions of flows in terms of state derived from observing the explicit opening and closing of TCP connections. Instead, our model defines flows based on traffic satisfying various temporal and spatial locality conditions, as observed at internal points of the network. This approach to flow characterization helps address some central problems in networking based on the Internet model. Among them are route caching, resource reservation at multiple service levels, usage based accounting, and the integration of IP traffic over an ATM fabric. We first define the parameter space and then concentrate on metrics characterizing both individual flows as well as the aggregate flow profile. We consider various granularities of the definition of a flow, such as by destination network, host-pair, or host and port quadruple. We include some measurements based on case studies we undertook, which yield significant insights into some aspects of Internet traffic, including demonstrating (i) the brevity of a significant fraction of IP flows at a variety of traffic aggregation granularities, (ii) that the number of host-pair IP flows is not significantly larger than the number of destination network flows, and (iii) that schemes for caching traffic information could significantly benefit from using application information. >

Extending the IP internet through address reuse

The two most compelling problems facing the IP Internet are IP address depletion and scaling in routing. This paper discusses the characteristics of one of the proposed solutions---address reuse. The solution is to place Network Address Translators (Nat) at the borders of stub domains. Each Nat box has a small pool of globally unique IP addresses that are dynamically assigned to IP flows going through Nat. The dynamic assignment is coordinated with Domain Name Server operation. The IP addresses inside the stub domain are not globally unique---they are reused in other domains, thus solving the address depletion problem. The pool of IP addresses in Nat is from a subnet administered by the regional backbone, thus solving the scaling problem. The main advantage of Nat is that it can be installed without changes to any existing systems, although FTP will fail in some but not all cases. This paper presents a preliminary design for Nat, and discusses its pros and cons.