Richard Nelson

Application flow control in YouTube video streams

This paper presents the results of an investigation into the application flow control technique utilised by YouTube. We reveal and describe the basic properties of YouTube application flow control, which we term block sending, and show that it is widely used by YouTube servers. We also examine how the block sending algorithm interacts with the flow control provided by TCP and reveal that the block sending approach was responsible for over 40% of packet loss events in YouTube flows in a residential DSL dataset and the retransmission of over 1% of all YouTube data sent after the application flow control began. We conclude by suggesting that changing YouTube block sending to be less bursty would improve the performance and reduce the bandwidth usage of YouTube video streams.

Libtrace: a packet capture and analysis library

This paper introduces libtrace, an open-source software library for reading and writing network packet traces. Libtrace offers performance and usability enhancements compared to other libraries that are currently used. We describe the main features of libtrace and demonstrate how the libtrace programming API enables users to easily develop portable trace analysis tools without needing to consider the details of the capture format, file compression or intermediate protocol headers. We compare the performance of libtrace against other trace processing libraries to show that libtrace offers the best compromise between development effort and program run time. As a result, we conclude that libtrace is a valuable contribution to the passive measurement community that will aid the development of better and more reliable trace analysis and network monitoring tools.

Cardigan: deploying a distributed routing fabric

SDN is an active area for network research, with many organisations exploring the opportunities provided by the de-coupling of network control from packet forwarding. Previous work has suggested that a hybrid networking model will pave the way for migration towards SDN, through interoperability with legacy devices. However, questions remain over the operation of such systems in production environments. In order to build operational confidence, we built a simple distributed router using OpenFlow and deployed it at a public Internet exchange. This implementation provides insights into the challenges involved with using these technologies, and suggests the viability of mixed device environments despite the limitations of early OpenFlow implementations.

Analysis of long duration traces

This paper introduces a new set of long duration captures of Internet traffic headers. The capture is being performed on a continuous on-going basis and is approaching a year in duration. Based on the current extent of the archive some typical analyses are presented, covering protocol mix, network trip times and TCP flag analysis.

Cardigan: SDN distributed routing fabric going live at an Internet exchange

Software Defined Networking (SDN) is an active area for network research, with many organizations exploring the opportunities provided by the decoupling of network control from packet forwarding. However, questions remain over the operation of such systems in production. In order to build operational confidence, we built Cardigan -a distributed router using OpenFlow-and deployed it at a public Internet exchange. Cardigan applies a routing as a service abstraction to a RouteFlow controlled IP network in an effort to reduce operational complexity. The implementation and deployment efforts provide insights into the challenges involved with using these technologies, and suggests the viability of mixed device environments despite the limitations of early OpenFlow implementations.

Measuring the accuracy of open-source payload-based traffic classifiers using popular Internet applications

Open-source payload-based traffic classifiers are frequently used as a source of ground truth in the traffic classification research field. However, there have been no comprehensive studies that provide evidence that the classifications produced by these software tools are sufficiently accurate for this purpose. In this paper, we present the results of an investigation into the accuracy of four open-source traffic classifiers (L7 Filter, nDPI, libprotoident and tstat) using packet traces captured while using a known selection of common Internet applications, including streaming video, Steam and World of Warcraft. Our results show that nDPI and libprotoident provide the highest accuracy among the evaluated traffic classifiers, whereas L7 Filter is unreliable and should not be used as a source of ground truth.

Measuring the impact of the copyright amendment act on New Zealand residential DSL users

The Copyright (Infringing File Sharing) Amendment Act 2011 (CAA) is a New Zealand law that aims to provide copyright holders with legal recourse when content is illegally shared over the Internet. This paper presents a study of residential DSL user behaviour using packet traces captured at a New Zealand ISP before, shortly after and several months after the CAA coming into effect. We use libprotoident to classify the observed traffic based on the application protocol being used to identify and examine any changes in traffic patterns that may be a result of the new law. We find that the use of peer-to-peer applications declined significantly once the CAA was in effect, suggesting a strong correlation. We also found that there were increases in tunneling, secure file transfer and remote access traffic amongst a small segment of the user population, which may indicate an increased uptake in the use of foreign seedboxes to bypass the jurisdiction of the CAA.

Comparing Anomaly Detection Methods in Computer Networks

This work in progress outlines a comparison of anomaly detection methods that we are undertaking. We are comparing different types of anomaly detection methods with the purpose of achieving results covering a broad spectrum of anomalies. We also outline the datasets that we will be using and the metrics that we will use for our evaluation.

Extracting application objects from TCP packet traces

Network packet traces can be used to derive traffic models suitable for simulation or emulation of networks. These traces are shaped by the conditions on the original network the trace was taken from such as latency, loss, congestion and path MTU. Using a trace to derive a model can give plausible results, but the model will strongly reflect where the trace was collected. A different approach is to extract application objects and use them to derive traffic models free of network artefacts for simulation and emulation tasks. We propose a new algorithm for extracting application objects from a TCP packet trace by using non-MSS sized packets to demarcate the boundaries of objects. Unlike other object extraction methods, our approach does not require full packet capture; the TCP/IP headers are sufficient. We discuss the implementation of this algorithm and validate our algorithm against an existing object extractor that requires full payload capture.

Passive detection of TCP congestion events

Detailed passive analysis of TCP sender behaviour requires accurate identification of congestion events. Previous tools that attempt to provide such information do not incorporate the behaviour of recent operating systems and TCP features and are therefore of little use to researchers analysing contemporary TCP traffic. In this paper, we present a new tool for identifying and classifying TCP congestion events from a passive packet trace, called tcpcsm, which understands modern operating system TCP behaviour. We discuss the major problems that occur when passively identifying TCP congestion events and describe how tcpcsm solves them. We also show that tcpcsm is more accurate than previous tools using a series of controlled experiments involving a variety of operating systems.