Benjamin Hesmans

Revealing middlebox interference with tracebox

Middleboxes such as firewalls, NAT, proxies, or Deep Packet Inspection play an increasingly important role in various types of IP networks, including enterprise and cellular networks. Recent studies have shed the light on their impact on real traffic and the complexity of managing them. Network operators and researchers have few tools to understand the impact of those boxes on any path. In this paper, we propose tracebox, an extension to the widely used traceroute tool, that is capable of detecting various types of middlebox interference over almost any path. tracebox sends IP packets containing TCP segments with different TTL values and analyses the packet encapsulated in the returned ICMP messages. Further, as recent routers quote, in the ICMP message, the entire IP packet that they received, tracebox is able to detect any modification performed by upstream middleboxes. In addition, tracebox can often pinpoint the network hop where the middlebox interference occurs. We evaluate tracebox with measurements performed on PlanetLab nodes. Our analysis reveals various types of middleboxes that were not expected on such an experimental testbed supposed to be connected to the Internet without any restriction.

Are TCP extensions middlebox-proof?

Besides the traditional routers and switches, middleboxes such as NATs, firewalls, IDS or proxies have a growing importance in many networks, notably in entreprise and wireless access networks. Many of these middleboxes modify the packets that they process. For this, they to implement (a subset of) protocols like TCP. Despite the deployment of these middleboxes, TCP continues to evolve on the endhosts and little is known about the interactions between TCP extensions and the middleboxes. In this paper, we experimentally evaluate the interference between middleboxes and the Linux TCP stack. For this, we first propose MBtest, a set of Click elements that model middlebox behavior. We use it to experimentally evaluate how three TCP extensions interact with middleboxes. We also analyzes measurements of the interference between Multipath TCP and middleboxes in fifty different networks.

A First Analysis of Multipath TCP on Smartphones

Multipath TCP is a recent TCP extension that enables multihomed hosts like smartphones to send and receive data over multiple interfaces. Despite the growing interest in this new TCP extension, little is known about its behavior with real applications in wireless networks. This paper analyzes a trace from a SOCKS proxy serving smartphones using Multipath TCP. This first detailed study of real Multipath TCP smartphone traffic reveals several interesting points about its behavior in the wild. It confirms the heterogeneity of wireless and cellular networks which influences the scheduling of Multipath TCP. The analysis shows that most of the additional subflows are never used to send data. The amount of reinjections is also quantified and shows that they are not a major issue for the deployment of Multipath TCP. With our methodology to detect handovers, around a quarter of the connections using several subflows experience data handovers.

Observing real smartphone applications over multipath TCP

A large fraction of smartphones have both cellular and WiFi interfaces. Despite this, smartphones rarely use them simultaneously because most of their data traffic is controlled by TCP, which can only use one interface at a time. Multipath TCP is a recently standardized TCP extension that solves this problem. Smartphone vendors have started to deploy Multipath TCP, but its performance with real smartphone applications has not been studied in detail yet. To fill this gap, we port Multipath TCP on Android smartphones, and propose a framework to analyze the interactions between real network-heavy applications and this new protocol. We use eight popular Android applications and analyze their usage of the WiFi and cellular networks (especially 4G/LTE).

SMAPP: towards smart multipath TCP-enabled applications

Multipath TCP was designed and implemented as a backward compatible replacement for TCP. For this reason, it exposes the standard socket API to the applications that cannot control the utilisation of the different paths. This is a key feature for applications that are unaware of the multipath nature of the network. On the contrary, this is a limitation for applications that could benefit from specific knowledge to use multiple paths in a way that fits their needs. As the specific knowledge of an application can not be known in advance, we propose a Multipath TCP path manager that delegates the management of the paths to the applications. This path manager enables applications to control how the different paths are used to transfer data. We implement this path manager above the Linux Multipath TCP kernel. It is composed of a kernel part that exposes events and commands to an userspace application that controls the key functions of Multipath TCP such as the creation/suppression of subflows or reactions to retransmissions. We demonstrate the benefits of this path manager on different use cases.

A first look at real multipath tcp traffic

Multipath TCP is a new TCP extension that attracts a growing interest from both researchers and industry. It enables hosts to send data over several interfaces or paths and has use cases on smartphones, datacenters or dual-stack hosts. We provide the first analysis of the operation of Multipath TCP on a public Internet server based on a one-week long packet trace. We analyse the main new features of Multipath TCP, namely the utilisation of subflows, the address advertisement mechanism, the data transfers and the reinjections and the connection release mechanisms. Our results confirm that Multipath TCP operates correctly over the real Internet, despite the presence of middleboxes and that it is used over very heterogeneous paths.

Tracing multipath TCP connections

Multipath TCP is a new extension to TCP that enables a host to transmit the packets from a given connection by using several interfaces. We propose mptcptrace, a software that enables a detailed analysis of Multipath TCP packet traces.

An enhanced socket API for Multipath TCP

Multipath TCP is a TCP extension that enables hosts to send data belonging to a single TCP connection over different paths. It was designed as an incrementally deployable evolution of TCP. For this reason, the Multipath TCP specification assumes that applications use the unmodified socket interface. Given the growing interest in using Multipath TCP for specific applications, there is a demand for an advanced API that enables application developers to control the operation of the Multipath TCP stack. Keeping with the incremental deployment objectives of Multipath TCP, we propose a simple but powerful socket API that uses new socket options to control the operation of the underlying stack. We implement this extension in the reference implementation of Multipath TCP in the Linux kernel and illustrate its usefulness in several use cases.

Poster: Evaluating Android Applications with Multipath TCP

Smartphones are the most popular mobile multihomed devices. End-user expects that thanks to their WiFi and cellular interfaces, they are able to seamlessly use all available networks. Unfortunately, reality tells us that seamless coexistence between cellular and WiFi is not as simple as what the user expect. Several cellular/WiFi coexistence technologies have been proposed during the last years. Some of them have been deployed. Recently, Multipath TCP received a lot of attention when it was selected by Apple to support its voice recognition (Siri) application. As of this writing, Siri is the only deployed smartphone application that uses Multipath TCP. and there is no public information about the benefits of using Multipath TCP with it. Multipath TCP is a TCP extension that allows to send data from one end-to-end connection over different paths. On a smartphone, Multipath TCP allows the applications to simultaneously send and receive data over both WiFi and cellular interfaces. It achieves this objective by establishing one TCP connection, called subflow, over each interface. Once the subflows have been established, data can be sent over any of the subflows. Researchers have analyzed the performance of Multipath TCP in such hybrid networks. However, these analyses have been performed with bulk transfers between laptops and servers. As of this writing, no detailed analysis of the performance of real smartphone applications with Multipath TCP has been published. We fill this gap in this paper by proposing a framework that automates user actions on Android smartphone applications to perform network measurements. We use it to analyze how eight popular smartphone applications interact with Multipath TCP.

Observing real Multipath TCP traffic

We analyse a Multipath TCP dataset collected from multipath-tcp.org consecutively in 5 months.Multipath TCP correctly passes through a wide range of Internet paths.Current implementations of Multipath TCP try to utilise additional paths as quickly as possible.Multipath TCP could be further improved in terms of traffic overhead and path management. Multipath TCP is a recent TCP extension that enables multihomed hosts like smartphones to send and receive data over multiple interfaces. Despite the growing interest in this new extension, little is known about its behavior in real networks. We analyze a five-month trace collected on multipath-tcp.org using Multipath TCP. This first detailed study of real Multipath TCP traffic reveals several interesting points about its behavior in the wild. With packets from thousands of hosts using IPv4 and/or IPv6, we confirm that Multipath TCP correctly passes through a wide range of Internet paths. We observe long Multipath TCP connections that benefit from handovers and also connections composed of subflows having very different round-trip-times. We also analyze some inefficiencies in the current Multipath TCP implementations and quantify the importance of reinjections, i.e. the transmission of the same data over two or more subflows.