TCP Connections Research Articles

SLICOTS: An SDN-Based Lightweight Countermeasure for TCP SYN Flooding Attacks

Software defined networking (SDN) is a novel networking paradigm which decouples control plane from data plane. This separation facilitates a high level of programmability and manageability. On the other hand, it makes the SDN controller a bottleneck and hence vulnerable to control plane saturation attack. One of the key mechanism to achieve control plane saturation is via TCP SYN flooding attack. This is one of the most effective and popular denial of service attack, in which the attacker produces many half-open TCP connections on the targeted server in order to degrade its availability. Furthermore, when applied to SDN, TCP SYN flooding attack also introduces control plane saturation attack . In particular, the attacker generates a significant number of TCP SYN packets and imposes data plane switches to forward them to the controller. As a result, the performance of the controller degrades and the controller will not be able to respond genuine requests in acceptable time. In this paper, we propose SLICOTS, an effective and efficient countermeasure to mitigate TCP SYN flooding attack in SDN. SLICOTS takes the advantage of dynamic programmability nature of SDN to detect and prevent attacks. SLICOTS is implemented in the controller, it surveils ongoing TCP connection requests, and blocks malicious hosts. We implemented SLICOTS as an extension module of OpenDayLight controller and evaluated it under different attack scenarios. The experimental results confirm that, compared to the state-of-art, SLICOTS reduces the response time overhead up to some 50%, while ensuring the same level of protection.

SIMULACIÓN EN NS3 DEL PROBLEMA DENOMINADO CUELLO DE BOTELLA COMPARTIDO QUE SE PRESENTA EN EL PROTOCOLO MP-TCP

MP-TCP (MultiPath-TCP) is a protocol that allows the sending of data through multiple paths in devices that have several network interfaces. An MP-TCP connection is divided into several TCP connections called subflows, in this way the effective connection rate and the fault resistance can be increased. However, in a scenario where MP-TCP is used with a client and a server, each with a single network interface, you can have the created subflows follow the same path even if several are available; this generates the problem called shared bottleneck. The article describes the development of the C ++ code to simulate the shared bottleneck problem in the NS3 network simulator. The simulation is developed with the DCE (Direct Code Execution) infrastructure for NS3 in such a way that an existing implementation of MP-TCP installed in a Linux kernel can be used. With the developed implementation, tests are performed and the results obtained are presented and discussed, which makes it possible to complement the study and analysis of this problem that MP-TCP suffers from. Among the results, the estimation of the effective transfer rate obtained by varying the number of subflows and roads in scenarios in which the shared bottleneck problem occurs is highlighted.

The Satellite Reliable Distribution Protocol (SRDP)

The Satellite Reliable Distribution Protocol (SRDP) is proposed and discussed. SRDP is designed for satellite-based data broadcasting and aims at transmitting reliably multicast via satellite Internet applications’ data in an efficient and scalable way. SRDP operates in three steps, called phases. In phase 1 the sender transmits a file through the satellite internet adding a reasonable degree of redundancy. In phase 2 the sender retransmits a set of new redundant packets to recover some packets that were lost during phase 1. Phase 3 allows each receiver to request all its missing packets by a TCP connection to the sender. In order to evaluate the performance of the SRDP, we have considered two different types of loss behaviours: random and burst. Our results show how to choose the amount of redundancy in order to optimize the performance of the SRDP.

On the Split-TCP Performance over Real 4G LTE and 3G Wireless Networks

The global mobile traffic is growing exponentially, and currently more than 90 percent of the internet traffic depends on TCP for reliable transmission. However, it is well known that TCP performs quite poorly over unreliable wireless networks, while its dynamic TCP flow control is sensitive to congestion events and tends to underutilize the available network capacity. Despite these known limitations, the industry believes that significant network performance enhancement can be achieved through TCP optimization, and in particular through solutions centered on Split-TCP. In this article we share a sample of TCP throughput performance measurements after implementing Split-TCP on commercial 4G LTE and 3G networks. Experimental results show that Split-TCP provides average TCP throughput gains on the order of 60 percent over a 4G LTE network and on the order of 5 percent over a 3G network. Furthermore, TCP throughput gains superior to 200 percent were measured for individual TCP connections over the 4G LTE network. We expect such throughput gains to be even greater when advanced radio technologies, such as 5G, are deployed. For these reasons, Split-TCP has the potential to be widely deployed in both current and next generation networks.

Multi-Gbps HTTP traffic analysis in commodity hardware based on local knowledge of TCP streams

In this paper we propose and implement novel techniques for performance evaluation of web traffic (response time, response code, etc.), with no reassembly of the underlying TCP connection, which severely restricts the traffic analysis throughput. Furthermore, our proposed software for HTTP traffic analysis runs in standard hardware, which is very cost-effective. Besides, we present sub-TCP connection load balancing techniques that significantly increase throughput at the expense of losing very few HTTP transactions. Such techniques provide performance evaluation statistics which are indistinguishable from the single-threaded alternative with full TCP connection reassembly.

Performance evaluation and implementation of IP and robust header compression schemes for TCP and UDP traffic in static and dynamic wireless contexts

Modern cellular networks utilising the long?term evolution (LTE) set of standards face an ever?increasing demand for mobile data from connected devices. Header compression is commonly employed to minimise the overhead for IP?based cellular network traffic. In this paper, we evaluate the three header compression implementations used by these networks with respect to their potential throughput increase and complexity for different mobile service scenarios over wireless IP networks. Specifically, we consider header compression as defined by (i) IP Header Compression (RFC 2507), (ii) Robust Header Compression version 1 (RFC 3095), and (iii) the recently updated Robust Header Compression version 2 (RFC 5225) with TCP/IP profile (RFC 6846). The contribution of this article is the performance evaluation of IP Header Compression (IPHC) for UDP and TCP, as well as its evaluation in contrast to the Robust Header Compression (RoHC) methods in a comparative overview for real?world mobile scenarios. Our results show that all implementations have great potential for saving bandwidth in IP?based wireless networks, even under varying channel conditions. While both RoHC versions generally provide more reliable results than IPHC, we find that on a unidirectional channel IPHC could perform better. However, if a TCP connection is prone to packet reordering (e.g., by retransmissions), IPHC?s performance drops drastically, while RoHC?s does not exhibit any significant performance reduction.

Design and implementation of Ad-Hoc collaborative proxying scheme for reducing network energy waste

Network devices are equipped with low power states but they are rarely activated due to their inability of maintaining network connectivity. Recently, Network Connectivity Proxy (NCP) concept has been proposed in literature as an effective mechanism to exploit full potential of low power features on network devices by impersonating their virtual presence. However, the NCP concept faces several open issues and challenges especially related to proxying of TCP connections and majority of daily used proprietary closed-source applications. This paper presents a new approach for reducing network energy waste through intelligent collaboration among daily used devices (e.g., desktop computers, laptops, tablets, smartphones, etc). It guarantees to run applications on only and only one user device that is under active use at that specific moment. To reduce energy waste and allow idle devices to sleep, our approach also takes benefit from a light-weight home gateway proxy with very basic practically realizable functionalities. The proposed system not just reduces energy waste of fixed devices but also enables mobile devices to significantly improve their battery life. Our developed software prototypes allow devices to autonomously and seamlessly collaborate with each other without requiring any configuration or user input. Further, this paper also presents the basic performance evaluation of developed prototypes in real networking environments.

Design of feedback controller for TCP/AQM networks

In this paper, we propose a novel proportional-differential-type feedback controller called Novel-PD as new active queue management (AQM) to regulate the queue length with small oscillation. It measures the current queue length and uses the current queue length and differential error signals to adjust packet drop probability dynamically. We provide control theoretic analysis of system stability and develop guidelines to select control gain parameters of Novel-PD. The design of Novel-PD for TCP/AQM system is given in details. NS2 is used for conducting extensive simulation. The proposed controller is compared with random early detection (RED), random exponential marking (REM), proportional integrator (PI) and proportional derivative (PD) controller. Result shows that, Novel-PD is stable and achieves faster response in dynamic environments where number of TCP connections, bottleneck capacity, round trip time (RTT) keeps changing. The proposed controller outperforms other AQM schemes.

Analysis of multiple flows using different high speed TCP protocols on a general network

We develop analytical tools for performance analysis of multiple TCP flows (which could be using TCP CUBIC, TCP Compound, TCP New Reno) passing through a multi-hop network. We first compute average window size for a single TCP connection (using CUBIC or Compound TCP) under random losses. We then consider two techniques to compute steady state throughput for different TCP flows in a multi-hop network. In the first technique, we approximate the queues as M/G/1 queues. In the second technique, we use an optimization program whose solution approximates the steady state throughput of the different flows. Our results match well with ns2 simulations.

Analysis of ECN/RED and SAP-LAW with simultaneous TCP and UDP traffic

Internetworking often requires a large amount of users to share a common gateway to obtain connectivity to the Internet. Congestion avoidance mechanisms are used to prevent the saturation of the gateway which represents a bottleneck of the system. The most popular congestion avoidance mechanisms are the Explicit Congestion Notification (ECN) and the Random Early Detection (RED). Recently, a new method for the congestion avoidance has been proposed: the Smart Access Point with Limited Advertised Window (SAP-LAW). The main idea is to hijack the acknowledge packets in the TCP connections in order to artificially reduce the advertised destination window according to some bandwidth allocation policy. Therefore, the flux control mechanism is artificially exploited to control the congestion at the bottleneck. The advantage of this approach is that it does not require any modification in the TCP implementations at the clients. In this paper, we propose stochastic models for the ECN/RED and SAP-LAW mechanisms in order to compare their performances under different scenarios. The models are studied in mean field regime, i.e., under a great number of TCP connections and UDP based transmissions. Augmenting previous work on ECN/RED, we consider the presence of UDP traffic with bursts, and short lived TCP connections. The models for SAP-LAW are totally new. The comparison is performed in terms of different performance indices including average queue length, system throughput and expected queuing time.

Performance Enhancement of Multipath TCP for Wireless Communications With Multiple Radio Interfaces

Multipath transmission control protocol (MPTCP) allows a TCP connection to operate across multiple paths simultaneously and becomes highly attractive to support the emerging mobile devices with various radio interfaces and to improve resource utilization as well as connection robustness. The existing multipath congestion control algorithms, however, are mainly loss-based and prefer the paths with lower drop rates, leading to severe performance degradation in wireless communication systems, where random packet losses occur frequently. To address this challenge and improve the performance of MPTCP in wireless networks, this paper proposes a new mVeno algorithm, which makes full use of the congestion information of all the subflows belonging to a TCP connection in order to adaptively adjust the transmission rate of each subflow. Specifically, mVeno modifies the additive increase phase of Veno so as to effectively couple all subflows by dynamically varying the congestion window increment based on the receiving ACKs. The weighted parameter of each subflow for tuning the congestion window is determined by distinguishing packet losses caused by random error of wireless links or by network congestion. We implement mVeno in a Linux server and conduct extensive experiments both in test bed and in real WAN to validate its effectiveness. The performance results demonstrate that compared with the existing schemes, mVeno increases the throughput significantly, achieves load balancing, and can keep the fairness with regular TCP.

A Drop Aware TCP Rate Control Algorithm for Heterogenic Internet Access

In this paper, an end-to-end TCP throughput control mechanism called DARCA has been presented. DARCA controls TCP throughput through introducing extra packet drop rate or round trip time. The extra packet drop rate and round trip time are calculated from Throughput Control Mode. It provides single point control of end-to-end TCP throughput even if some of the bottlenecks are remote. DARCA identifies remotely bottlenecked TCP connections and provide polices of excess bandwidth redistribution. Further, per class control mechanism is used to reduce the overhead of rate enforcement. Simulation results show that DARCA gives good policy-based throughput control performance for both homogeneous and heterogeneous TCP connections.

HTTP 적응적 스트리밍을 위한 TCP 인지형 세그먼트 스케줄링 기법

HTTP Adaptive Streaming (HAS) is a technique that adapts its video quality to network conditions for providing Quality of Experience. In the HAS approach, a video content is encoded at multiple bitrates and the encoded video content is divided into several video segments. A HAS player estimates the network bandwidth and adjusts the video bitrate based on estimated bandwidth. However, the segment scheduler in the conventional HAS player requests video segments periodically without considering TCP. If the waiting duration for the next segment request is quite long, the TCP connection can be initialized and it restarts slow-start. Slow-start causes the reduction in TCP throughput and consequentially leads to low-quality video streaming. In this study, we propose a TCP-aware segment scheduling scheme to improve performance of HAS service. The proposed scheme adjusts request time for the next video request to prevent initialization of TCP connection and also considers the point of scheduling time. The simulation proves that our scheme improves the Quality of Service of the HAS service without buffer underflow issue.

Analysis of Link State Resource Reservation Protocol for Congestion Management in Smart Web Hotspot Environments

With the wide spread of WiFi hotspots, concentrated traffic workload on Smart Web (SW) can slow down the network performance. This paper presents a congestion management strategy considering real time activities in today’s smart web. With the SW context, cooperative packet recovery using resource reservation procedure for TCP flows was adapted for mitigating packet losses. This is to maintain data consistency between various access points of smart web hotspot. Using a real world scenario, it was confirmed that generic TCP cannot handle traffic congestion in a SW hotspot network. With TCP in scalable workload environments, continuous packet drops at the event of congestion remains obvious. This is unacceptable for mission critical domains. An enhanced Link State Resource Reservation Protocol (LSRSVP) which serves as dynamic feedback mechanism in smart web hotspots is presented. The contextual behaviour was contrasted with the generic TCP model. For the LS-RSVP, a simulation experiment for TCP connection between servers at the remote core layer and the access layer was carried out while using selected benchmark metrics. From the results, under realistic workloads, a steady-state throughput response was achieved by TCP LS-RSVP to about 3650Bits /secs compared with generic TCP plots in a previous study. Considering network service availability, this was found to be dependent on fault-tolerance of the hotspot network. From study, a high peak threshold of 0.009 (i.e. 90%) was observed. This shows fairly acceptable service availability behaviour compared with the existing TCP schemes. For packet drop effects, an analysis on the network behaviour with respect to the LS-RSVP yielded a drop response of about 0.000106 bits/sec which is much lower compared with the case with generic TCP with over 0.38 bits/sec. The latency profile of average FTP download response was found to be 0.030secs, but with that of FTP upload response, this yielded about 0.028 sec. The results from the study demonstrate efficiency and optimality for realistic loads in Smart web contexts.

Statistical network monitoring: Methodology and application to carrier-grade NAT

When considering to passively collect and then process network traffic traces, the need to analyze raw data at several Gbps and to extract higher level indexes from the stream of packets poses typical BigData-like challenges. In this paper, we engineer a methodology to extract, collect and process passive traffic traces. In particular, we design and implement analytics that, based on a filtering process and on the building of empirical distributions, enable the comparison between two generic collections, e.g., data gathered from two different vantage points, from different populations, or at different times. The ultimate goal is to highlight statistically significant differences that could be useful to flag to incidents for the network manager.After introducing the methodology, we apply it to assess the impact of Carrier-Grade NAT (CGN), a technology that Internet Service Providers (ISPs) deploy to limit the usage of expensive public IP addresses. Since CGN may introduce connectivity issues and performance degradation, we process a large dataset of passive measurements collected from an ISP using CGN for part of its customers. We first extract detailed per-flow information by processing packets from live links. Then, we derive higher level statistics that are significant for the end-users, e.g., TCP connection setup time, HTTP response time, or BitTorrent average download throughput. At last, we contrast figures of customers being offered public or private addresses, and look for statistically significant differences. Results show that CGN does not impair quality of service in the analyzed ISP deployment. In addition, we use the collected data to derive useful figures for the proper dimensioning of the CGN and the configuration of its parameters in order to avoid impairments on end-users’ experience.

Robust dynamic network traffic partitioning against malicious attacks

The continual growth of network traffic rates leads to heavy packet processing overheads, and a typical solution is to partition traffic into multiple network processors for parallel processing especially in emerging software-defined networks. This paper is thus motivated to propose a robust dynamic network traffic partitioning scheme to defend against malicious attacks. After introducing the conceptual framework of dynamic network traffic partitioning based on flow tables, we strengthen its TCP connection management by building a half-open connection separation mechanism to isolate false connections in the initial connection table (ICT). Then, the lookup performance of the ICT table is reinforced by applying counting bloom filters to cope with malicious behaviors such as SYN flooding attacks. Finally, we evaluate the performance of our proposed traffic partitioning scheme with real network traffic traces and simulated malicious traffic by experiments. Experimental results indicate that our proposed scheme outperforms the conventional ones in terms of packet distribution performance especially robustness against malicious attacks.

TCP Performance over Wi-Fi: Joint Impact of Buffer and Channel Losses

We propose an analytical model for a Wi-Fi network acting as a last-mile Internet access with multiple long-lived TCP connections on both the up and down links. Our model considers the joint impact of buffer losses at the access point, contention at the medium access control layer, and packet losses due to the wireless channel being erroneous. We show that the model accurately quantifies the probability of an arbitrary TCP packet being discarded, and the total throughput obtained on the up and down links. Furthermore, quantitative insights can be gained into the throughput that long-lived TCP flows achieve under the joint impact of all aforementioned types of losses. In particular, we find that the wireless channel errors and buffer overflows both lead to throughput unfairness, but that they do so in the opposite direction on the up and down links, respectively. We demonstrate that this insight can be exploited so as to significantly mitigate the throughput unfairness without compromising the total obtainable network throughput.

A proxy acknowledgement mechanism for TCP variants in mobile ad hoc networks

A sequence number checking technique is proposed to improve the performance of TCP connections in mobile ad hoc networks. While a TCP connection is initialized, a routing protocol takes the responsibility for checking the hop count between a source and destination pair. If the hop count is greater than a predefined value, the routing protocol decides to use a proxy node. The responsibility of a proxy node is to check the correctness of data packets and inform the missing packets by sending an acknowledgement from a proxy node to the source node. By doing so, the source node is able to retransmit any missing packet in advance without waiting until an end-to-end acknowledgement is received from the destination. Simulation results show that the proposed mechanism is able to increase throughput up to 55% in static network and decrease routing overhead up to 95% in mobile network.

Coupled IEEE 802.11ac and TCP performance evaluation in various aggregation schemes and Access Categories

We investigate the Throughput of a TCP connection over an IEEE 802.11ac channel using the various aggregation schemes and Access Categories defined in this standard. We present an analytical model to compute the Throughput based on a Markov chain. The model is verified by simulation. This research has several outcomes. First, it assists in defining the optimal TCP Upload and Download working points, i.e. the optimal amount of aggregation, in every Access Category. Second, it is found that the Best Effort and Video Access Categories yield the largest Throughputs. In addition, the great amount of aggregation in Two-Level aggregation cancels the priority that one side of the connection has in accessing the channel in the Video and Voice Access Categories.

Observing real Multipath TCP traffic

Multipath TCP is a recent TCP extension that enables multihomed hosts like smartphones to send and receive data over multiple interfaces. Despite the growing interest in this new extension, little is known about its behavior in real networks. We analyze a five-month trace collected on multipath-tcp.org using Multipath TCP. This first detailed study of real Multipath TCP traffic reveals several interesting points about its behavior in the wild. With packets from thousands of hosts using IPv4 and/or IPv6, we confirm that Multipath TCP correctly passes through a wide range of Internet paths. We observe long Multipath TCP connections that benefit from handovers and also connections composed of subflows having very different round-trip-times. We also analyze some inefficiencies in the current Multipath TCP implementations and quantify the importance of reinjections, i.e. the transmission of the same data over two or more subflows.