UDP Flows Research Articles

A Semantics-Aware Approach to the Automated Network Protocol Identification

Traffic classification, a mapping of traffic to network applications, is important for a variety of networking and security issues, such as network measurement, network monitoring, as well as the detection of malware activities. In this paper, we propose Securitas, a network trace-based protocol identification system, which exploits the semantic information in protocol message formats. Securitas requires no prior knowledge of protocol specifications. Deeming a protocol as a language between two processes, our approach is based upon the new insight that the n-grams of protocol traces, just like those of natural languages, exhibit highly skewed frequency-rank distribution that can be leveraged in the context of protocol identification. In Securitas, we first extract the statistical protocol message formats by clustering n-grams with the same semantics, and then use the corresponding statistical formats to classify raw network traces. Our tool involves the following key features: 1) applicable to both connection oriented protocols and connection less protocols; 2) suitable for both text and binary protocols; 3) no need to assemble IP packets into TCP or UDP flows; and 4) effective for both long-live flows and short-live flows. We implement Securitas and conduct extensive evaluations on real-world network traces containing both textual and binary protocols. Our experimental results on BitTorrent, CIFS/SMB, DNS, FTP, PPLIVE, SIP, and SMTP traces show that Securitas has the ability to accurately identify the network traces of the target application protocol with an average recall of about 97.4% and an average precision of about 98.4%. Our experimental results prove Securitas is a robust system, and meanwhile displaying a competitive performance in practice.

A TCP-friendly AQM algorithm to mitigate low-rate DDoS attacks

Although the existing robust random early detection RRED algorithm can preserve normal TCP throughput under various low-rate distributed denial-of-service LDDoS attacks, it fails to maintain the fairness among TCP flows and counter large-scale LDDoS attacks or address-spoofing LDDoS attacks. In contemporary network, it is much easier to launch UDP-based LDDoS attacks that achieve severer attack effect with much lower effort than to launch TCP-based attacks. Based on this observation, this paper proposes fair robust random early detection FRRED algorithm, a TCP-friendly AQM algorithm to improve the performance in terms of throughput and fairness. The key idea of FRRED algorithm is the 'protocol-based hash partitioning' that segregates the records of UDP and TCP flows maintained in a counting bloom filter which is space-efficient and well-designed. Theoretical analysis and simulation results show that FRRED algorithm can effectively preserve TCP throughput and significantly improve fairness among TCP flows to mitigate various LDDoS attacks.

Traffic differentiation and QoS provisioning for IEEE 802.11e wireless LAN

In 802.11e wireless local area network WLAN, MAC protocol is very much essential for offering multimedia quality of service QoS to WLAN users in terms of metrics like throughput, data drop, fairness and medium access delay. In addition, MAC protocol must be suitable for both user datagram protocol UDP and transmission control protocol TCP flows. In this paper, we propose a traffic differentiation and QoS provisioning technique based on DiffServ architecture for IEEE 802.11e WLAN. When a new flow arrives, it is initially provisioned with QoS using DiffServ engine. The output is fed to traffic differentiator that differentiates the traffic frames as UDP flows or TCP flows. If the distinguished traffic frame is UDP, then its contention window CW will be adjusted according to number of active uplink and downlink flows. If the distinguished traffic frame belongs to TCP, then CW will be adjusted according to the number of idle slots between two consecutive transmissions. Results indicate fair resource allocation and improved performance when compared to the other existing system.

Fluid flow approximation of time-limited TCP/UDP/XCP streams

Abstract This article presents the use of fluid flow approximation to model interactions between a set of TCP, UDP and XCP flows in the environment of IP routers using AQM (Active Queue Management) algorithms to control traffic congestion. In contrast to other works, independent UDP and TCP streams are considered and the model allows to start and end data transmissions in TCP, UDP and XCP streams at any time moment. It incorporates several Active Queue Management mechanisms: RED, NLRED, CHOKe.

On the Transient Behavior of CHOKe

CHOKe is a simple and stateless active queue management (AQM) scheme. Apart from low operational overhead, a highly attractive property of CHOKe is that it can protect responsive TCP flows from unresponsive UDP flows. Particularly, previous works have proven that CHOKe is able to bound both bandwidth share and buffer share of (a possible aggregate) UDP traffic (flow) on a link. However, these studies consider, and pertain only to, a steady state where the queue reaches equilibrium in the presence of many (long-lived) TCP flows and an unresponsive UDP flow of fixed arrival rate. If the steady state conditions are perturbed, particularly when UDP traffic rate changes over time, it is unclear whether the protection property of CHOKe still holds. Indeed, it can be examined, for example, that when UDP rate suddenly becomes 0 (i.e., flow stops), the unresponsive flow may assume close to full utilization in sub-RTT scales, potentially starving out the TCP flows. To explain this apparent discrepancy, this paper investigates CHOKe queue properties in a transient regime, which is the time period of transition between two steady states of the queue, initiated when the rate of the unresponsive flow changes. Explicit expressions that characterize flow throughputs in transient regimes are derived. These results provide additional understanding of CHOKe, and give some explanation on its intriguing behavior in the transient regime.

Migrate to IPv6 on 6PE with MPLS-TE: Questions on Feasibility and Reluctance in Deployment?

Due to the exhaustion of IPv4 addresses, the transition to IPv6 has already begun using various transition mechanisms. In this paper comparison between two transition mechanism 6PE and 6to4 tunneling over MPLS (Multiprotocol Label Switching) based network has been performed. The experimental platform used is based on GNS3/Dynagen using emulated routers on which multiple TCP and UDP flows were generated between separated IPv6 network traversing through IPv4 based core. Traffic were generated using both transition mechanism and are compared to native IPv4 based MPLS network. Performance metric used are end-to-end delay, jitter and throughput, these parameters are also analyzed statistically using ANOVA, F-Test and T-Test to support a conclusion. Further, MPLS Traffic-Engineering (TE) using RSVP-TE signalling is applied, describing the implementation and performance test and analysis of TE tunnels on 6PE for IPv6 traffic. The same test-bed is used to implement and observe MPLS-TE behavior and throughput of 6PE based MPLS-TE to that of native IPv4 based MPLS-TE. Concluding, throughput of 6PE and 6to4 is around 99% and 96%, respectively, as compared to that of native IPv4.

Analyzing the Effect of TCP and Server Population on Massively Multiplayer Games

Many Massively Multiplayer Online Role-Playing Games (MMORPGs) use TCP flows for communication between the server and the game clients. The utilization of TCP, which was not initially designed for (soft) real-time services, has many implications for the competing traffic flows. In this paper we present a series of studies which explore the competition between MMORPG and other traffic flows. For that aim, we first extend a source-based traffic model, based on player’s activities during the day, to also incorporate the impact of the number of players sharing a server (server population) on network traffic. Based on real traffic traces, we statistically model the influence of the variation of the server’s player population on the network traffic, depending on the action categories (i.e., types of in-game player behaviour). Using the developed traffic model we prove that while server population only modifies specific action categories, this effect is significant enough to be observed on the overall traffic. We find that TCPVegasis a good option for competing flows in order not to throttle the MMORPG flows and that TCP SACK is more respectful with game flows than other TCP variants, namely,Tahoe, Reno,andNew Reno. Other tests show that MMORPG flows do not significantly reduce their sending window size when competing against UDP flows. Additionally, we study the effect of RTT unfairness between MMORPG flows, showing that it is less important than in the case of network-limited TCP flows.

Delay Dependent Antiwindup for AQM in TCP/IP Routers

AbstractA dynamic antiwindup compensator for input saturating linear systems with input and state delays is applied to active queue management of a congested TCP/IP router subjected to TCP and UDP flows. Its synthesis is based on the Lyapunov‐Krasovskii functional, the Finsler lemma, linear matrix ineqality conditions and minimization of the of the disturbance to the system output.

Transparent network-assisted flow mobility for multimedia applications in IMS environments

Cellular network operators are striving to solve the problem caused by the increasing volume of traffic over their networks. Given the proliferation of multi-interface devices, offloading part of the traffic to available access networks (e.g., WiFi or 3G access networks, even from other operators) seems to be a promising alternative. Here, we propose an IMS-compatible solution for flow mobility between access networks that exhibits two key features: flow mobility is transparent to both local applications at mobile nodes and their communication peers (e.g., multimedia content servers), and mobility operations are assisted by the network, so the home network supports the terminal in the process of access network discovery, and provides the terminal with policies that meet visited and home operators¿ roaming agreements while optimizing the use of their networks. The proposed solution has been validated using a real IMS testbed with Ethernet and WiFi access networks, where the mobility of UDP and TCP flows has been tested.

The Study and Design of a UDP Flow Measurement System

Proposed a way to UPD flow and UPD system ideology. The system is considered the one-way characteristics of UDP flow in the backbone of the network, used the WinPcap packet capture technology. The system including network packet captures module, packet replay module, packets spell flow module, UDP analysis module, while using the map template classes in stl, improved the performance of UDP packets through a comparison function with efficient custom;Contrast to the data characteristics under the complex network environment, the system adopts the step-by-step small tools design way to facilitate the system to expand new analysis function. Through the three sets of data : a backbone data sets and two DARPA1999 data sets, it can be seen that the overall development of UDP data flow is expanding the network bandwidth , and small UDP flows is more.The quicker network bandwidth development, the shorter the UDP flows average time.

Investigation of TCP and UDP multiple-flow traffic in wireless mobile ad-hoc networks

In this paper, we deal with congestion control for multi-flow traffic in wireless mobile ad-hoc networks MANET. For simulations, we used NS-3 open source network simulator considering Ad-hoc On-Demand Distance Vector AODV and Optimized Link State Routing OLSR routing protocols. We present the MANET performance considering random waypoint mobility model for different number of nodes and different area sizes, by sending multiple UDP or TCP flow traffic in the network. We investigate and compare the packet delivery fraction PDF and throughput. Simulation results show that the performance of the network is high when the number of nodes is 20 and maximum speed is 6 m/s for multiple flows. We found that coupling congestion control mechanisms between multiple flows have problems in some cases.

A Novel AQM Algorithm Based on the PI Controller with Minimum ISTE

To overcome the weakness of existing AQM algorithms based on the control theory,a novel AQM algorithm called ISTE-PI is designed by not ignoring the time delay term in the TCP/AQM model,introducing short lived TCP flows and UDP flows as the disturbance and using the integral of time-weighted squared error optimization criteria.The ISTE-PI can be used in large delay networks and has the property of fast response,anit UDP flows disturbance and robustness.Since the Internet traffic consists of long lived TCP flows,short lived TCP flows and UDP flows with large time delay,the ISTE-PI algorithm can be better used in the Internet environment.

A simulation study of a new rate‐and‐queue‐based active queue management algorithm

PurposeNowadays, e‐queues are built up everywhere where customer online service is necessary such as in banks' e‐service, enterprises' e‐business, etc. In order to enhance quality of service (QoS), active queue management (AQM) algorithms are frequently employed due to their efficiency in congestion avoidance as well as the differentiated forwarding of packets. This paper aims at developing a novel AQM algorithm to better QoS in terms of congestion prediction, queuing delay, packet loss and link utility, etc.Design/methodology/approachUpon the traditional designs of AQM, this paper establishes a new integrated AQM scheme (RQ‐AQM) by employing input rate and current queue length to calculate the packet dropping/marking probability. In this way, the rate feedback control enables to rapid response to congestion, decreasing the packet loss from buffer overflow. Meanwhile, the queue length feedback control stabilizes the queue length around a given target, achieving predictable queuing delay and lower delay jitter. Thus, the main feature of the design is to use coefficients of both proportional rate control and proportional‐integral queue length control, and to simplify parameter setting, the control parameters were scaled by the link capacity C to normalize the rate and by the bandwidth‐delay product BDP to normalize the queue length, respectively.FindingsThe stability performance of RQ‐AQM was tested via simulation under several conditions. The results proved that it is able to maintain the queue length around the given target. Also, the comparison results with other AQM schemes, including RED, ARED, PI controller, AVQ and REM, demonstrated the superiority of RQ‐AQM in low packet loss, faster convergence to target queue length and closest to the target queue length.Research limitations/implicationsThe main limitation of this study is that all the simulations were merely under a single bottleneck network topology. Furthermore, the system stability was examined under just a few cases. Other cases like TCP connections mixed with HTTP connections, or UDP flows, etc. can also be tested. Furthermore, the multiple bottleneck scenarios should be covered in the future work with more parameters set to enhance the proved results.Practical implicationsThe paper sets clear but ideal conditions for the performance of proposed algorithm; so the simulation results can only be used as a rough reference instead of an exact practical one. But the concepts the paper attempted to advocate could be considered seriously.Social implicationsThe scope of the paper is within the general theory of AQM. So it can be referred to any specific field that employs AQM technology, no matter locally or globally.Originality/valueThere are not much new brand contents in the paper. The main contribution is on some extension of the known related work.

Quality based Bottom-up-Detection and Prevention Techniques for DDOS in MANET

distributed denial of service attack(DDoS) is a major threat to current internet security in MANET. Although the DDoS mechanism is widely understood, its detection is a very hard task because of the similarities between normal traffic and useless packet, sent by compromising host to their victims. Quality reducing attack is a new style of Distributed Denial of Service (DDoS) attack. The goodput and delay performance of TCP or UDP flows are very sensitive to such Quality reducing attacks. . In this paper a bottom up detection and prevention techniques for DDoS in MANET has been proposed thereby achieving an efficient quality of services provisioning. Our method relies on the use of monitoring and measurement techniques to evaluate the impact of SYN flooding attacks.

DSASync: Managing End-to-End Connections in Dynamic Spectrum Access Wireless LANs

Wireless LANs (WLANs) have been widely deployed as edge access networks that provide the important service of Internet access to wireless devices. Therefore, performance of end-to-end connections to/from such WLANs is of great importance. The advent of Dynamic Spectrum Access (DSA) technology is expected to play a key role in improving wireless communication. With DSA capability, WLANs opportunistically access licensed channels in order to improve spectrum-usage efficiency and provide better network performance. In this paper, we identify the key issues that impact end-to-end connection performance when a DSA-enabled WLAN is integrated with the wired cloud. We propose a new network management framework, called DSASync, to mitigate the identified performance issues. DSASync achieves this objective by managing the connections at the transport layer as a third-party supervisor and targets both TCP streams and UDP flows. DSASync requires no modifications to the network infrastructure or the existing network stack and protocols while ensuring transport protocol (TCP or UDP) semantics to be obeyed. It mainly consists of a combination of buffering and traffic-shaping algorithms to minimize the adverse side-effects of DSA on active connections. DSASync is evaluated using a prototype implementation and deployment in a testbed. The results show significant improvement in end-to-end connection performance, with substantial gains on QoS metrics like goodput, delay, and jitter. Thus, DSASync is a promising step toward applying DSA technology in consumer WLANs.

On the Impact of TCP and Per-Flow Scheduling on Internet Performance

Internet performance is tightly related to the properties of TCP and UDP protocols, jointly responsible for the delivery of the great majority of Internet traffic. It is well understood how these protocols behave under first-in-first-out (FIFO) queuing and what are the network congestion effects. However, no comprehensive analysis is available when flow-aware mechanisms such as per-flow scheduling and dropping policies are deployed. Previous simulation and experimental results leave a number of unanswered questions. In this paper, we tackle this issue by modeling via a set of fluid nonlinear ordinary differential equations (ODEs) the instantaneous throughput and the buffer occupancy of N long-lived TCP sources under three per-flow scheduling disciplines (Fair Queuing, Longest Queue First, Shortest Queue First) and with longest queue drop buffer management. We study the system evolution and analytically characterize the stationary regime: Closed-form expressions are derived for the stationary throughput/sending rate and buffer occupancy, which give a thorough understanding of short/ long-term fairness for TCP traffic. Similarly, we provide the characterization of the loss rate experienced by UDP flows in the presence of TCP traffic. As a result, the analysis allows to quantify benefits and drawbacks related to the deployment of flow-aware scheduling mechanisms in different networking contexts. The model accuracy is confirmed by a set of ns2 simulations and by the evaluation of the three scheduling disciplines in a real implementation in the Linux kernel.

A Modular Machine Learning System for Flow-Level Traffic Classification in Large Networks

The ability to accurately and scalably classify network traffic is of critical importance to a wide range of management tasks of large networks, such as tier-1 ISP networks and global enterprise networks. Guided by the practical constraints and requirements of traffic classification in large networks, in this article, we explore the design of an accurate and scalable machine learning based flow-level traffic classification system, which is trained on a dataset of flow-level data that has been annotated with application protocol labels by a packet-level classifier. Our system employs a lightweight modular architecture , which combines a series of simple linear binary classifiers, each of which can be efficiently implemented and trained on vast amounts of flow data in parallel, and embraces three key innovative mechanisms, weighted threshold sampling, logistic calibration , and intelligent data partitioning , to achieve scalability while attaining high accuracy. Evaluations using real traffic data from multiple locations in a large ISP show that our system accurately reproduces the labels of the packet level classifier when runs on (unlabeled) flow records, while meeting the scalability and stability requirements of large ISP networks. Using training and test datasets that are two months apart and collected from two different locations, the flow error rates are only 3% for TCP flows and 0.4% for UDP flows. We further show that such error rates can be reduced by combining the information of spatial distributions of flows, or collective traffic statistics , during classification. We propose a novel two-step model, which seamlessly integrates these collective traffic statistics into the existing traffic classification system. Experimental results display performance improvement on all traffic classes and an overall error rate reduction by 15%. In addition to a high accuracy, at runtime, our implementation easily scales to classify traffic on 10Gbps links.

One Method of Cloud Computing Bandwidth Allocation Based on Fairness

In order to solve the bandwidth allocation unfairness problem in the cloud computing network, one method uses fairness congestion control algorithm, access control list (ACL) and traffic policing and traffic shaping in the paper. The method can rationally solve the problem after analyzing the reason of cloud computing bandwidth allocation unfairness. For illustration, one network video conference example was utilized to show the method in solving bandwidth allocation unfairness problem.The experimental results show network bandwidths are fairly allocated, packet loss ratio and latency is obvious improvement. The method deals with non-adaptive UDP and TCP adaptive flow congestion and provides the end-to-end quality of service over the differentiated services networks, and the bandwidth allocation problem based on fairness in the cloud computing network is solved well. DOI: http://dx.doi.org/10.11591/telkomnika.v11i2.2059 Full Text: PDF

Stochastic TCP friendliness: Expanding the design space of TCP-friendly traffic control protocols

While the current definition of TCP friendliness has enabled a wide variety of traffic control protocols other than TCP, it still considerably restricts the design space of TCP-friendly traffic control protocols. For example, some multimedia streaming applications prefer a smooth sending rate on a time scale of tens of seconds, however, a UDP flow maintaining such a long smoothness time scale is naturally not TCP friendly by the current definition. In this paper, we propose an innovative method to relatively compare the degrees of TCP friendliness of different traffic control protocols, and use it to define a new class of TCP friendliness definitions, called stochastic TCP friendliness (STF). STF greatly expands the design space of TCP-friendly traffic control protocols, while still effectively maintaining the desired fairness of the Internet. To demonstrate the expanded design space, we also develop a new congestion control protocol, called TCP-friendly CBR-Like Rate Control (TFCBR), for multimedia streaming applications which do not require a high sending rate but prefer a smooth sending rate on a time scale of tens of seconds. TFCBR is stochastically TCP friendly, however, it is not TCP friendly by the current definition.

A Simple End-to-End Throughput Model for 802.11 Multi-Radio Multi-Rate Wireless Mesh Networks

We address the problem of estimating the end-to-end throughput of UDP flows in a multi-radio, multi-channel, and multi-rate 802.11 wireless mesh network (WMN). Estimates of the end-to-end throughput of flows in a WMN can facilitate the design of traffic-aware routing and channel assignment algorithms. We introduce a simple and intuitive model that captures key features of 802.11 WMNs such as contention, interference, and performance degradation due to links with low transmission rates. We use simulation to validate the accuracy of the proposed model in various scenarios for a network topology containing multiple transmitters and wired gateways.