IP Header Research Articles

Classifying IP Spoofing Requests Using Heuristic Fuzzy Computer Network Approach

Distributed Denial of Service (DoS) Attack This represents a serious problem for Internet communications. This problem is exacerbated if an attacker tampers with the data. Source IP address. Attackers can easily change the source IP address leads to unauthorized access to network resources. Many solutions are available. Please identify this issue in your research community. In this paper, we proposed a detection method that takes data flow into account. Metric. An attacker can change any field in the IP, so expect a packet hop count field. In this article, he will introduce one. A Heuristic Fuzzy Logic Approach to Spoofing Detection package. Effective implementation of fuzzy rules the two member functions HC and PTT are the Receive IP header. The classification of forged packets is as follows: Identify changes up close Hop count and packet transmission time due to fuzzy Membership function using fuzzy triangles Membership features.

R1DIT: Privacy-Preserving Malware Traffic Classification With Attention-Based Neural Networks

With the advances in deep learning techniques and the increase in the volume of network traffic data, deep neural networks trained directly with the raw traffic data have become more popular and successful for malware traffic classification without explicit feature extraction. However, most of the existing studies raises privacy concerns when using the payload data and ignore the generalization of the model to the newly emerged traffic such as DDoS detection on TLS 1.3. To overcome these limitations, we introduce a malware traffic classification system, Residual 1-D Image Transformer (R1DIT) model. We first leverage network domain knowledge by carefully parsing IP, HTTP, DNS, and unencrypted TLS record headers as sequences of bytes for input without interfering with IP addresses, port numbers and the payload. Then, we apply raw data transform and attention-based modules in our deep model to classify different malware types and benign traffic. Our results on NetML dataset show that the proposed model delivers 0.972 F1 score, nearly 0.3 higher than the feature-based methods and outperforms state-of-the-art models with 0.9999 F1 score for multi-class malware classification task using CICIDS2017 dataset. The generalization of this model has been proven using the TLS 1.3 traffic obtained from CICDDoS2019 dataset with the detection rate 0.9897 using meta-learning.

Modelo Diffserv (Qor S) in a real traffic environment to evaluate the behavior of QoS parameters on cisco and mikrotik equipment

This document presents the evalua tion d the behavior of the parameters of bandwidth, latency, packet loss, jitter and cpu, by implementing a real traffic environment on two scenarios of Mikrotik and Cisco equipment. The generation of real traffic was implemented using the TRex tool creating an environment of traffic of clients and servers focused on the Streaming and Web service, through a virtual machine, with two network cards. Routing between client-servers was established using static routes. The implementation of the DiffServ Quality of Service model was carried out through the identification stages using the Omnipeek tool, marking in the DSCP field of the IP header and establishing policies for traffic treatment. For the analysis of results, the T-Student test was used comparing the parametersbetween both brands before and after applying the DiffServ Quality of Service model. Based on the results obtained, there is a difference in bandwidth, latency and packet loss between the average values 0.1502 Mbps, 39.56 ms and 14.4352% respectively before applying the model and 0.0844 Mbps, 0.162 ms after applying it.

An End-to-End IP Header Compressed Packet Forwarding Framework for Bandwidth-Constrained Networks

IP header compression technologies such as Robust Header Compression (ROHC) are well-known to improve bandwidth efficiency strategy using resource-constrained communication links. However, ROHC is a point-to-point approach so it must be maintained by the per-flow and per-hop, which is disadvantageous for bandwidth constrained networks (BCNs) featured by multi-hops transmission. In order to solve this problem, an efficient end-to-end IP header compressed packet forwarding framework for BCNs is proposed in this paper. Firstly, an end-to-end ROHC tunnel is established through the multi-hop transmission scheme. Then, based on the offer/answer model, a fast negotiation mechanism is established to ensure the context identifier (CID) is globally unique. Finally, the intermediate forwarder determines the next hop forwarding path according to CID. Therefore, besides reducing the transmission bandwidth and time consumption of compression and decompression per hop, it can also speed up forwarding the packets among BCNs. The simulation results show that the proposed framework improves forwarding efficiency and reduces end-to-end delivery latency and node power consumption in a BCN, which is independent of the channel conditions and the bit error rate.

Ethernet Packet to USB Data Transfer Bridge ASIC with Modbus Transmission Control Protocol Based on FPGA Development Kit

This paper proposes an Ethernet packet transformation and transmission architecture between Modbus transmission control protocol (Modbus TCP) and universal serial bus (USB) 3.0 developed with a field-programmable gate array (FPGA) development kit. The proposed architecture is used to complete packet transformation and transmission between Ethernet and USB 3.0 for application in induction motor (IM) control. The Ethernet receiver receives and analyses Modbus TCP packets and sends the source address, destination address, IP header, and Modbus TCP header to the register to verify the correctness of the packet. The Modbus TCP packet is stored in static random access memory and awaits access through a USB 3.0 module. An FPGA development kit (Intel DE10-Standard) is used for functional verification. The measured results show that the latency, throughput, and dynamic power are 18.845 μs, 950.31 Mbps, and 142.17 mW, respectively, at a voltage of 1.8 V and an operating frequency of 125 MHz. The main advantage is that the proposed Ethernet and USB bridge performs high throughput and short latency with FPGA development kit and that an application specific integrated circuit (ASIC) is provided with low power consumption. The robustness and convenience of the proposed ASIC are especially advantageous. The motivation is to resolve an existing problem that Ethernet and USB operate on different platforms.

Detection and Mitigation of Known and Unknown DDoS Attacks on Advanced Metering Infrastructure Systems in the Nigeria Using Hybrid Machine Learning (Ai) Techniques

The enormous rise of network traffic and its diversity on the Internet have posed new and serious obstacles for detecting network attack activity. Distributed denial of service (DDoS) attack is designed to restrict genuine users from accessing a service for an extended period of time. In this attack, the attacker attempts to compromise a large number of hosts to transmit a large volume of traffic to genuine users. Detecting DDoS attacks is difficult and complicated, primarily different DDoS attacks do not common characteristics through which they can be detected. DDoS attacks are very difficult to fight or trace due to their distributed nature, and automated software tools for conducting DDoS attacks are freely available. This paper proposed a DDoS detection model based on hybrid machine learning technique on AMI systems in the Nigeria Utility Business. It has been discovered that detecting unknown DDoS attacks is difficult to analyze as sometimes the IP packets and header are encrypted. This study proposed a combination of Support Vector Machine (SVM) and Artificial Neural Network (ANN) to detect unknown attacks. The AES 256 algorithm has been employed to decrypt the encrypted IP header. Keywords: ANN, SVM, DDoS attack, AES algorithm, AMI DOI: 10.7176/NCS/13-04 Publication date: May 31 st 2022

Implementation of Site to Site IPsec VPN Tunnel between Routers

Today, security is very important in the communication system over through the Internet. The Transmission control protocol and Internet protocol (TCP/IP) protocol suite is used in the Internet communication that it includes five layers in which it is construct IPSec VPN Tunnel between two routers at the network layer. IPsec have two protocols that it is authentication header and encapsulation security payload (ESP) in which two protocols is shown simulation and then it is give encryption, authentication and confidentiality in which for packets at the IPSec layer within network layer and adds new IP header at the network layer. IPSec is designed to provide security at the network layer that it protects the entire IP packets. It takes an IP packet and then it includes the header, applies IPSec security methods to the entire packet and adds a new IP header. The system purpose is known use router devices at the network layer and then this layer is built IPSec VPN tunnel between routers that when it is known how does command line. IPsec VPN tunnel is built based on ACL (access list), crypto isakmp (internet security association and key management protocol) policy, transform set and crypto map and then the system is aimed to know it facts configuration and then to know used routers at the network layer and is built IPSec VPN tunnel between two routers. This system is simulated using packets tracer software 7.1.

Implementation of Network Address Translation Using TCP/IP Model In Internet Communication System

Nowadays, many people will be used internet that for their work, communication, education, economic and organization necessary that is used today. Network address translation (NAT) is a method of remapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. A network is a system of hardware and software, put together for the purpose of communication and resource sharing. A network includes transmission hardware devise to interconnect transmission media and to control transmissions and software to decode and format data. The Internet protocol suite is the computer networking model and set of communications protocols used on the Internet and similar computer networks. Knowledge on how the internet is able to communicate with internet users is a mystery to some people. Internet communication need to be TCP/IP protocol which means that TCP is Transmission Control Protocol, or what is sometimes simply used to refer to Internet Protocol, is the basic unit for communication on the internet. This can also be applied to private internet, like Ethernet and so on. Despite TCP and IP being used interchangeably, there is a slight difference between the two in relation to the roles they play IP is directly responsible for obtaining internet addresses and then it is the work of TCP to deliver the data obtained to the addresses achieved by IP. TCP/IP provides end-to-end connectivity specifying how data should be packetized, addressed, transmitted, routed and received at the destination. This paper aim is described operation and models of TCP-IP suite in data communication network.

Design of a Low Latency and High Throughput Packet Classification Module on FPGA Platform

The Packet classification method plays a significant role in most of the Network systems. These systems categories the incoming packets in various flows and takes suitable action based on the requirements. If the size of the network is vast and complexity will arise to perform the different operations, which affects the network performance and other constraints also. So there is the demand for high-speed packet classifiers to reduce the network complexity and improve the network performance. In this article, The Bit vector Packet classifier (BV-PC) Module is designed to improve the network system performance and overcome the existing limitation of Packet classification approaches on FPGA. The BV-PC Module contains Packet generation Unit (PGU) to receive the valid incoming packets, Memory Unit (MU) to store valid packets, Header Extractor Unit (HEU) extracts the IP Header address information from the Valid packets, The BV-Based Source and Destination Address (BV-SA, BV-DA) unit receives the IP packet header Information and Process with BV based rule set and aggregates the BV-SA and BV-DA outputs, Priority Encoder encodes the Highest priority BV Rule for the generation of Classified output. The BV-PC utilizes <2% Chip area (slices), works at 509.38MHz, and consumed Less 0.103 W of total Power on Artix-7 FPGA. The BV-PC operates with a latency of 5 clock cycles and works at 815.03Mpps throughput. The BV-PC is compared with existing approaches and provides Better improvements in Hardware constraints.

Requet

As video traffic dominates the Internet, it is important for operators to detect video quality of experience (QoE) to ensure adequate support for video traffic. With wide deployment of end-to-end encryption, traditional deep packet inspection--based traffic monitoring approaches are becoming ineffective. This poses a challenge for network operators to monitor user QoE and improve upon their experience. To resolve this issue, we develop and present a system for RE al-time QU ality of experience metric detection for <underline> E </underline>ncrypted T raffic— Requet —which is suitable for network middlebox deployment. Requet uses a detection algorithm that we develop to identify video and audio chunks from the IP headers of encrypted traffic. Features extracted from the chunk statistics are used as input to a machine learning algorithm to predict QoE metrics, specifically buffer warning (low buffer, high buffer), video state (buffer increase, buffer decay, steady, stall), and video resolution. We collect a large YouTube dataset consisting of diverse video assets delivered over various WiFi and LTE network conditions to evaluate the performance. We compare Requet with a baseline system based on previous work and show that Requet outperforms the baseline system in accuracy of predicting buffer low warning, video state, and video resolution by 1.12×, 1.53×, and 3.14×, respectively.

Pattern Discovery in Internet Background Radiation

Internet Background Radiation (IBR) is observed in empty network address spaces. No traffic should arrive there, but it does in overwhelming quantities, gathering evidences of attacks, malwares and misconfigurations. The study of IBR helps to detect spreading network problems, common vulnerabilities and attack trends. However, network traffic data evolves quickly and is of high volume and diversity, i.e., an outstanding big data challenge. When used to assist network security, it also requires the online classification of dynamic streaming data. In this paper, we introduce an AGgregation & Mode (AGM) vector to represent network traffic. The AGM format characterizes IP hosts by extracting aggregated and mode values of IP header fields, and without inspecting payloads. We performed clustering and statistical analysis to explore six months of IBR from 2012 with the AGM mapping. The discovered patterns allow building a classification of IBR, which identifies phenomena that have been actively polluting the Internet for years. The AGM representation is light and tailored for monitoring and pattern discovery. We show that AGM vectors are suitable to analyze large volumes of network traffic: they capture permanent operations, such as long term scanning, as well as bursty events from targeted attacks and short term incidents.

On the utility of unregulated IP DiffServ Code Point (DSCP) usage by end systems

DiffServ was designed to implement service provider quality of service (QoS) policies, where routers change and react upon the DiffServ Code Point (DSCP) in the IP header. However, nowadays, applications are beginning to directly set the DSCP themselves, in the hope that this will yield a more appropriate service for their respective video, audio and data streams. WebRTC is a prime example of such an application. We present measurements, for both IPv4 and IPv6, of what happens to DSCP values along Internet paths after an end system has set them without any prior agreement between a customer and a service provider. We find that the DSCP is often changed or zeroed along the path, but detrimental effects from using the DSCP are extremely rare; moreover, DSCP values sometimes remain intact (potentially having an effect on traffic) for several AS hops. This positive result motivates an analysis of the potential latency impact from such DSCP usage, for which we present the first measurement results. We find that routers at approximately 3% of more than 100,000 links differentiate between the WebRTC DSCP values (EF, AF42 and CS1) and consistently reduce delay in comparison with probes carrying a zero value (CS0) under congestion. In contrast, routers at around 2% of these links increase the delay by a comparable amount under congestion, uniformly for EF, AF42 and CS1.

A low complexity mechanism for congestion notification in rural IPSec‐enabled heterogeneous backhaul networks

SummaryManagement in wireless backhaul networks is a challenging task, especially in rural and isolated environments. In these scenarios, the backhaul network usually consists of a set of heterogeneous wireless links that provide limited and variable bandwidth to the access networks, often 3G/4G small cells. Because of the highly constrained nature of this type of backhaul network, intelligent and joint management in both the backhaul network and the access network is crucial in order to avoid performance degradation caused by traffic congestion. In order to avoid the saturation in the backhaul network, access networks should consider the backhaul state when taking decisions in the admission control and scheduling procedures. However, no standardized mechanisms currently exist for sharing management information between both networks. In this work, we propose to use the Explicit Congestion Notification (ECN) bit in the outer IP headers present in the Iuh 3GPP IPSec‐enabled interfaces in order to notify the backhaul congestion state to the access network. We analyze for the referred scenario, compatibility and security details, validating our approach by running numerically simulations and implementing the notification mechanism. Our low complexity approach offers 2% accuracy and backhaul update latency lower than 10 ms during 80% of the time, which makes the solution appropriate for admission control and scheduling intervals in small cells.

An approach to support traffic engineering in IPv6 networks based on IPv6 facilities

IPv6 is an Internet protocol with the ability to provide a large number of addresses to allow the connectivity of each existing thing to the global network. It also allows the deployment of many technologies and services of the next generation. One of the major changes that occurred in the IP header with this new version is the addition of the IPv6 flow label field, which was created with the intention of labeling packets that belong to a particular flow to provide an appropriate treatment by routers. However, this field has not been widely exploited yet, and it is being set to zero in almost all IPv6 packets. The main Internet routing problem is that said routing is based on the shortest path algorithm, which leads to the possibility of some paths being congested while others are underused. To solve the congestion problem, many solutions aiming at traffic engineering support have been proposed, but this topic remains an open issue. This paper describes a new solution to support traffic engineering based on the usage of the IPv6 flow label for providing fast packet switching, which we have called PSA-TE6. In this document, we present the PSA-TE6 operation and evaluation regarding the label space reduction, label stacking cost and its minimization. The results show that PSA-TE6 is cheaper compared to the IP/MPLS solution when there is no label stacking, and that PSA-TE6 also outperforms IP/MPLS when the stacking is enabled until achieving a 40% presence of tunnels for encapsulation levels greater than 1.

CWND: A Coarse, But Simple, Efficient Metric to Reduce Short Flow Completion Time in Data Centers

Reducing the delay-sensitive Short Flows Completion Time (SFCT) is a hot topic in data center networks, and prioritizing the short flows is an effective way to do that. However, precisely identifying a short flow is still a challenge, which makes many proposed schemes unfeasible in commodity switch. The short flows often have a small Congestion Window (CWND) due to their small flow sizes, and thus CWND can be used as a coarse metric to identify short flows. Based on this idea, Low Delay Data Center Transport Control Protocol (LD-DCTCP) is proposed. When transferring a data packet whose CWND is less than the CWND threshold, LD-DCTCP sender marks the high priority field in the IP header of the packet. Then, switches can prioritize the high priority packets by a priority-based queue schedule. By simply prioritizing the packets which have small CWND, short flows, in a high probability, can be prioritized, and as well, SFCT can be effectively reduced. Since CWND can be easily obtained from TCP/IP header, LD-DCTCP is implementable in data center networks. The NS2 simulation results show that the average flow completion time of short flows in DCTCP can be reduced by 26%-40% in normal cases. Furthermore, due to the coarseness of CWND metric, some cases in which CWND-based judgment could be wrong are also discussed in the paper, and the simulation results show that no severe problem occurs after using LD-DCTCP.

Оцінка пропускної здатності бездротового каналу стандартів IEEE802.11 за використання протоколів IPv4 та IPv6

Transmission of data through wireless communication channels is carried out by the TCP / IP protocol stack. This stack of protocols should be hardware-independent, that is, applied regardless of which operating systems it operates, which communication channels are used. It provides universality to data transfer systems, however, it can negatively affect the operation of transmission channels, in particular wireless networks that have a limited data rate. Increasing redundancy in the formation of data packets may reduce the bandwidth of the channel and, accordingly, the speed of the channel. For wireless communication channels, IEEE802.11 standards achieve high speeds through the use of MIMO spatial multiplexing technology and channel bandwidth expansion through the use of 2.4 GHz and 5 GHz bands, which also use packet data and various types of IP addressing. Systems with different types of IP addressing can use Dynamic Host Configuration (DHCP) protocols, which allow to automatically receiving the required parameters for network operation. According to protocol specification, IP addressing will affect the dimension of packets and the order of its formation. Estimating the performance of using protocols of various versions is possible with the help of maximum and average values of delta, maximum and average jitter (as variation of delay), packet delays, and bandwidth. The analysis of possible options for improving network parameters, when applying a certain network architecture, including a two-stacked network, is a transition technology in which IPv4 and IPv6 work in tandem with a general or dedicated link; tunneling to create an overlay network that tunnels one protocol by another, encapsulating IPv6 packets in IPv4 packets and IPv4 packets in IPv6 packets; Broadcasts that facilitate the exchange of data between hosts and networks only for IPv6 and only for IPv4 by executing an IP header and converting addresses between two groups of addresses, domain name mapping, and IP addresses of the DNS protocol. The purpose of this article is to study changes in the characteristics of the information parameter of the wireless communication channel IEEE802.11 standards when using IPv4 and IPv6 protocols of different types.

On Intelligent Hierarchical F-PMIPv6 based Mobility Support for Industrial Mobile Networks

In this paper, we propose a new mobility management network scheme which is called i2FP (Industrial Intelligent Fast Proxy IPv6) to solve the existing problem and improve the signaling efficiency for industrial networks such as smart factory networking. To enable MN (Mobile Node) to move other network in one domain, i2FP employs three network entities which are SFA (Smart Factory Anchor), FAG (Factory Access Gateway) and MN from PMIPv6 (Proxy Mobile IPv6) with extension concept. In i2FP, The three network entities can reduce the handover delay time of MNs. Also, i2FP uses an IP header swapping mechanism to avoid the traffic overhead and improve the throughput of network. To evaluate the performance of i2FP, we measure new framework of i2FP, HMIPv6(Hierarchical Mobile IPv6) and PMIPv6 which are legacy protocols of local mobility management. Therefore, we show the i2FP has good performance than other network schemes in terms of the total cost.

Defensive Mechanism Against DDoS Attack to Preserve Resource Availability for IoT Applications

The major challenge of Internet of Things (IoT) generated data is its hypervisor level vulnerabilities. Malicious VM deployment and termination are so simple due to its multitenant shared nature and distributed elastic cloud features. These features enable the attackers to launch Distributed Denial of Service attacks to degrade cloud server performance. Attack detection techniques are applied to the VMs that are used by malicious tenants to hold the cloud resources by launching DDoS attacks at data center subnets. Traditional dataflow-based attack detection methods rely on the similarities of incoming requests which consist of IP and TCP header information flows. The proposed approach classifies the status patterns of malicious VMs and ideal VMs to identify the attackers. In this article, information theory is used to calculate the entropy value of the malicious virtual machines for detecting attack behaviors. Experimental results prove that the proposed system works well against DDoS attacks in IoT applications.

Loop-Free Convergence With Unordered Updates

This paper studies the feasibility of minimizing convergence delay and forwarding disruption without carrying any additional bits in the IP header, to provide high availability despite link failures in traditional IP networks. Previously proposed mechanisms achieve two of these three objectives by trading off the other objective. For instance, the ordered forwarding information base updates approach may prolong the convergence delay, whereas the SafeGuard scheme requires carrying the path cost in the IP header. As a better alternative, we propose a scheme called fast convergence with fast reroute (FCFR), which combines the features of IP fast rerouting and interface-specific forwarding. We show that FCFR can achieve minimal convergence delay, while ensuring loop-free delivery during convergence, after a single non-partitioning failure in an IP network, without altering the IP header format, making it amenable for immediate deployment.

Performance evaluation and implementation of IP and robust header compression schemes for TCP and UDP traffic in static and dynamic wireless contexts

Modern cellular networks utilising the long?term evolution (LTE) set of standards face an ever?increasing demand for mobile data from connected devices. Header compression is commonly employed to minimise the overhead for IP?based cellular network traffic. In this paper, we evaluate the three header compression implementations used by these networks with respect to their potential throughput increase and complexity for different mobile service scenarios over wireless IP networks. Specifically, we consider header compression as defined by (i) IP Header Compression (RFC 2507), (ii) Robust Header Compression version 1 (RFC 3095), and (iii) the recently updated Robust Header Compression version 2 (RFC 5225) with TCP/IP profile (RFC 6846). The contribution of this article is the performance evaluation of IP Header Compression (IPHC) for UDP and TCP, as well as its evaluation in contrast to the Robust Header Compression (RoHC) methods in a comparative overview for real?world mobile scenarios. Our results show that all implementations have great potential for saving bandwidth in IP?based wireless networks, even under varying channel conditions. While both RoHC versions generally provide more reliable results than IPHC, we find that on a unidirectional channel IPHC could perform better. However, if a TCP connection is prone to packet reordering (e.g., by retransmissions), IPHC?s performance drops drastically, while RoHC?s does not exhibit any significant performance reduction.