Evaluating the Impact of Path Brokenness on TCP

Korian Edeline, Benoit Donnet

INTERNET ARCHITECTURAL GUIDELINES

UNIFORM OPERATIONS

“…in an ideal situation there should be one, and only one, protocol at the Internet

level[…]but there can be a need for gradual transition from one

version of IP to another…”

END-TO-END

“…the community believes that the goal is connectivity, the tool is the Internet Protocol, and the intelligence is end to end rather than hidden in the

network.” NO GLOBAL CONTROL

“…nobody owns the Internet, there is no centralized control[…]. Its

evolution depends on rough consensus about technical

proposals, and on running code.”

“… there is no architecture, but only a tradition, which was not written down for the first 25 years …”

RFC 1958

THE END-TO-END PRINCIPLEEnd-to-End Arguments in System Design, Saltzer, Reed & Clark, 1981

Extensibility

Dumb Networks vs. Intelligent Endpoints

Flexibility

Extensibility

Flexibility

Extensibility

Flexibility

Extensibility

Flexibility

RFC 3234

A middlebox is a computer networking device that transforms, inspects, filters, or otherwise manipulates traffic for purposes other than packet forwarding.

Extensibility

Flexibility

RFC 3234

A middlebox is a computer networking device that transforms, inspects, filters, or otherwise manipulates traffic for purposes other than packet forwarding.

Ossificationof the network infrastructure

InnovationDeployment of new TCP features and new transport protocols is crippled

by middleboxes

BACKGROUNDThe Middlebox Problem

FROM PATH CONDITIONS … A path condition is a functional description of

an action performed by an intermediary device on a packet, on a given path.

FROM PATH CONDITIONS …

feature.blocked

A path condition is a functional description of

feature.blocked

feature.blocked feature.removed

feature.blocked feature.removed feature.changed

SECURITY PERFORMANCE

PACKET MARKING

… TO PATH IMPAIRMENTS A path impairment is a middlebox-induced

connectivity issue, a decrease, or shortfall of Quality-of-Service (QoS),

on a given path

… TO PATH IMPAIRMENTS

BLOCKEDTRAFFIC

A path impairment is a middlebox-induced

on a given path

Feature not supportedTCP Normalization

BLOCKEDTRAFFIC

on a given path

BLOCKEDTRAFFIC

DISABLED FEATURE

on a given path

TCP Normalization

BLOCKEDTRAFFIC

DISABLED FEATURE

on a given path

BLOCKEDTRAFFIC

DISABLED FEATURE

NEGOTIATIONDISRUPTION

on a given path

MalconfigurationRate Limiting

BLOCKEDTRAFFIC

DISABLED FEATURE

on a given path

BLOCKEDTRAFFIC

DISABLED FEATURE

TRAFFICDISRUPTION

on a given path

Fix TCP ISN Randomness

BLOCKEDTRAFFIC

DISABLED FEATURE

TRAFFICDISRUPTION

on a given path

Path impairments in the wild

A bottom-up investigation of the transport-layer ossification, K.Edeline and B.Donnet, in Proc. IFIP Network Traffic Measurement and Analysis Conference (TMA), 2019

2% of deployed network devices are TCP/IP MBs

38.9% of networks paths are crossing middleboxes

6.5% of network paths are affected by TCP-breaking MBs

EXPERIMENTATIONPath Impairments Investigation

mmb: A VPP MIDDLEBOX

https://github.com/mami-project/vpp-mb

mmb: A VPP MIDDLEBOX VPP (Vector Packet Processing) is a high-performance kernel -

bypass framework developped by Cisco.

mmb: A VPP MIDDLEBOX

Flexible Intuitive Fast

VPP (Vector Packet Processing) is a high-performance kernel -

mmb: A VPP MIDDLEBOX VPP (Vector Packet Processing) is a high-performance kernel -

node-based processing path

mmb software architecture

CLI syntax

Flexible Intuitive Fast

IMPACT OF PATH IMPAIRMENTS ON TCP

Explicit Congestion Notification

Selective Acknowledgment

WScale

Window Scaling Parameter

WScale

How do path-impairing middleboxes affect the Quality-of-Service of TCP ?

Direct Indirect

WScale

Direct Indirect

WScale

LFNs Delay Loss Congestion

WScale

Path impairments scenarios without congestion:

ECN IP bits

Not-ECT 00

ECT(1) 01

ECT(0) 10

WScale

Disabled ECNip.ecn.changed.11 with fallback mechanism

Blocked ECNtcp.ecn.blocked

Broken ECNip.ecn.changed.11

fallback-proof

ECN IP bits

Not-ECT 00

ECT(1) 01

ECT(0) 10

WScale

fallback-proof

WScale

fallback-proof

Enabled ECN Disabled ECN

Path impairments scenarios with congestion:

WScale

fallback-proof

WScale

Broken ECN

Broken ECN slows down the connection to 1 MSS / RTT

Disabling ECN

Disabling ECN per default is not the solution

fallback-proof

WScale

Enabled SACKSACK-enabled flows

Disabled SACKtcp.opt.sackok.removed

Broken SACKtcp.seqnum.changed

Path impairments scenarios with artificial loss:

WScale

Broken SACK

Broken SACK stalls the connection when receiver generates a SACK block

Disabled SACK

Disabled SACK reduce TCP throughput for loss rates greater

than 0.09%

WScale

TCP Receive Window : [0 ; 216-1] * 2WScale

WScale

Clipped WScale

tcp.opt.wscale.changed

Path impairments scenarios with artificial delay:

Stripped WScale

tcp.opt.wscale.removed

WScale

Clipped WScale

Stripped WScale

WScale

Clipped WScale

Stripped WScale

Wscale Impairment

Clipped and Stripped Wscale have a direct impact

on maximum achievable throughput

In the future

Higher throughputs might become a problem as Higher

BDPs are not supported by TCP

CONCLUSION

Lessons Learned

CONCLUSION

Lessons Learned

Middleboxes are prevalents in today’s

Internet

CONCLUSION

Lessons Learned

Internet

Middleboxes areproblematic to

existing TCP features

CONCLUSION

Lessons Learned

Internet

Middleboxes are problematic to transport

evolution

Is it still possible to extend TCP ?, M.Honda et al., in IMC11

Measuring the Evolution of Transport Protocols in the Internet, A.Medina et al., in ACM CCR 2005

CONCLUSION

Lessons Learned

Internet

evolution

CONCLUSION

Lessons Learned

Internet

evolution

Future of path impairments

CONCLUSION

Lessons Learned

Internet

evolution

Encryption by Default

Transport-layer Encryption

CONCLUSION

Lessons Learned

Internet

evolution

Middlebox-proof TCP

e.g., MPTCP

CONCLUSION

Lessons Learned

evolution

UDP-based splitted layer transport

Middlebox-proof TCP

e.g., MPTCP

CREDITS: This presentation template was created by Slidesgo, including icons by Flaticon, and infographics & images by Freepik.

THANKS

korian.edeline@uliege.be

Normal SACK

Broken SACK (spurious retransmission)

Broken SACK (RTO)

tracebox

● RFC 792 : “The internet header plus the first 64 bits”

● RFC 1812 : “as much [...] as possible” (< 576 B)

Testbed specifications

● Intel Xeon E5-2620 2.1GHz, 16 Threads, 32GB RAM● Intel XL710 2x40GB NICs● Huawei CE6800 switch● Debian 9

Evaluating the Impact of Path Brokenness on TCP · IMPACT OF PATH IMPAIRMENTS ON TCP ECN Explicit...

Documents

Heart for Brokenness January 2014

Before & After Brokenness

PERFORMANCE ANALYSIS OF MULTI-PATH TCP NETWORK

Multipath TCP: Analysis, Design and Implementation · Coupled algorithm and still reasonably friendly to single-path TCP users. Recently, opportunistic linked increase algorithm (OLIA)

MultiPath TCP - The path to multipath

I have different parts within - cwgministries.org · Web viewHow to receive a word of knowledge to remove brokenness. Generational. Brokenness – Take the above knowledge and vocabulary

Off-Path TCP Exploits: Global Rate Limit Considered Dangerouszhiyunq/pub/sec16_TCP_pure...bility introduced in the latest TCP speciﬁcation. The two most relevant research efforts

From Radical Brokenness to Radical Resilience

PENGGUNAAN PROTOKOL ROUTING OPEN SHORTEST PATH … · PENGGUNAAN PROTOKOL ROUTING OPEN SHORTEST PATH FIRST PADA JARINGAN TCP/IP Eneng Mira¹, ... Pada simlasi ini bobotjweight merupakan

TCP-M:MultiflowTransmissionControlProtocol …TCP-ELFN protocol, neighbors take an active part and send notiﬁcations of link failure whenever a path becomes inac-tive. At this instance,

Brokenness - David's Story

Week #2 Brokenness: Facing Sins & Wounds

A Off-Path TCP Injection Attacks - BIUu.cs.biu.ac.il/~herzbea/security/14-01-tcp.pdfA Off-Path TCP Injection Attacks Yossi Giladyand Amir Herzbergz Department of Computer Science,

Old Testament Characters of Faith: Part III Jonah: Brokenness

ENHANCE TCP PERFORMANCE WITH MULTIPLE PATH ROUTINGcs.uccs.edu/~cchow/pub/master/fewatson/doc/master.pdf · 2012. 7. 12. · Enhance TCP Performance with Multiple Path Routing Thesis

Atmospheric Holiness – Part 3: Brokenness Acts 2:42-43

Enhancing TCP Congestion Control for Improved Performance ... · scratch when introduced in wireless networks [17]. Wired TCP assumes packet losses are due to congestion in the path

Off-Path TCP Exploits: Global Rate Limit Considered Dangerouszhiyunq/pub/sec16_TCP_pure_offpath.pdf · Off-Path TCP Exploits: Global Rate Limit Considered Dangerous Yue Cao, Zhiyun

Inline Path Characteristic Estimation to Improve TCP Performance in High Bandwidth-Delay Networks

Jonah: Brokenness Old Testament Characters of Faith: Part III