Vasaka Visoottiviseth

An empirical study on achievable throughputs of IEEE 802.11n devices

The empirical performance studies on the emerging IEEE 802.11n technology by an independent and vendor-neutral party have not really been explored. In this paper, we conduct performance measurements for the IEEE 802.11n network using a mixture of commercially available IEEE 802.11n devices from various manufacturers. With the same standard 20-MHz channel width configuration, the results demonstrate that IEEE 802.11n significantly outperforms the IEEE 802.11g network. The performance improvements of IEEE 802.11n are measured to be roughly about 85% for the downlink UDP traffic, 68% for the downlink TCP traffic, 50% for the uplink UDP traffic, and 90% for the uplink TCP traffic. We also observe that the UDP throughputs are largely imbalanced for the uplink and downlink traffics in most test networks, while the downlink and uplink TCP throughput results are quite balanced for all test networks. In addition, the 40-MHz channel configurations only provide marginal performance improvements. Unlike other existing work, here we also capture and analyze the IEEE 802.11n packets transferred during the performance tests in order to technically explain the measured performance results. It is observed that when the frame aggregation and block acknowledgement mechanisms are utilized, the superior performance results are achieved. However, the decisions on how and when to use these mechanisms are very hardware dependent.

Lightweight Detection of DoS Attacks

Denial of service (DoS) attacks have continued to evolve and impact availability of the Internet infrastructure. Many researchers in the field of network security and system survivability have been developing mechanisms to detect DoS attacks. By doing so they hope to maximize accurate detections (true-positive) and minimize non-justified detections (false-positive). This research proposes a lightweight method to identify DoS attacks by analyzing host behaviors. Our method is based on the concept of BLINd Classification or BLINC: no access to packet payload, no knowledge of port numbers, and no additional information other than what current flow collectors provide. Rather than using pre-defined signatures or rules as in typical Intrusion Detection Systems, BLINC maps flows into graphlets of each attack pattern. In this work we create three types of graphlets for the following DoS attack patterns: SYN flood, ICMP flood, and host scan. Results show that our method can identify all occurrences and all hosts associated with attack activities, with a low percentage of false positive.

Performance Comparison of ISATAP Implementations on FreeBSD, RedHat, and Windows 2003

The intra-site automatic tunnel addressing protocol (ISATAP) is one of the transition mechanisms used for gradually IPv6 migration. Since many ISATAP implementations exist, to answer which one is the most preferable, we experimentally deploy IPv6 testbeds and compare the performance of ISATAP implementations on three popular operating systems including Windows 2003, FreeBSD 5.3 with KAME IPv6 protocol stack, and RedHat 9.0 with USAGI IPv6 protocol stacks. We also compare the performance of IPv4, IPv6, and ISATAP protocols on these operating systems by using iperf program to generate both TCP and UDP traffic with different payload sizes and with different number of packets per second (pps). For each condition, we measure the maximum data throughput and also the maximum number of pps before a router begins dropping packets. Experimental results show that ISATAP implementation on RedHat 9.0 gains better performance than those on FreeBSD 5.3 and Windows 2003, respectively.

Sender-initiated multicast forwarding scheme

We propose a sender-initiated multicast (SIM), specifically designed for small group communications such as teleconferencing and file distribution. Contrary to traditional IP multicast, SIM reduces the cost of allocating a global multicast address by attaching receiver addresses to the packet header. SIM routers route packets according to these addresses; therefore, the cost of the control traffic between routers can be lessened by applying the existing unicast routing table. The key feature of SIM is its preset mode, which uses SIM forwarding information base (FIB) entries on routers to achieve cost-efficient packet forwarding. Another feature is an automatically created SIM tunnel, which provides the ability to maintain SIM FIB only on routers that act as multicast branching points. We describe the SIM mechanism in detail, and present results evaluated through simulations. We show how SIM can achieve low cost in maintaining state information, cost-efficient packet forwarding, and incremental deployment.

Adaptive wireless bandwidth allocation for per-station fairness

In IEEE 802.11 wireless LAN, the bandwidth cannot be fairly allocated among stations. To resolve this problem, we propose a novel adaptive wireless bandwidth allocation for per-station fairness. The proposed scheme can fairly allocate the bandwidth to each wireless station based on the maximum capacity of the wireless link and number of wireless stations. When there is a remaining bandwidth in the network, the remaining bandwidth can be flexibly allocated to greedy stations. The experiment results on a real testbed reveal that this scheme can improve the per-station fairness. Furthermore, the proposed scheme can be implemented on wireless access router. Hence, in order to support legacy wireless clients, our solution can be efficiently used.

Classification of audio and video traffic over HTTP protocol

A widely use of the Internet introduces various online services such as online game, radio online, music online, TV online and video clips, which communicate over Hyper Text Transfer Protocol (HTTP). In this work, we aim to classify an audio and a video traffic from normal web traffic to reduce the misuse of bandwidth consumption. We propose a classification method based on flow information. Our classification use a combination of keyword matching technique and statistical behavior profiles. Keywords are pre-defined by observing from both audio and video traffic. Behavior profiles consist of three attributes, which are the average received packet size, a ratio of number of server-client packets, and the flow duration. Each attribute have an independent threshold of mean (μ) and standard deviation (σ). The experimental results show that our method can classify an audio traffic, a video traffic and normal web traffic with a high precision and recall.

Diffserv Conditionalized Handover for HMIPv6

As mobile devices and wireless network are become popular, real-time and data streaming applications on mobile network gain more attention from application developers and users. These kinds of applications all need seamless mobility and QoS provisioning in order to guarantee the service. Hierarchical Mobile IPv6 (HMIPv6) was proposed in order to improve mobile performance by reducing latency during the handoff period. In this paper, we propose a mechanism to control network resources on mobile access routers by extending Differentiated Services (Diffserv) to HMIPv6 architecture. Our framework includes a Diffserv edge function and extending router advertisement daemon (radvd) to advertise current resource available on an Access Router (AR). Whenever multiple access routers exist in the same area, Mobile Node (MN) can select to handover to a new access router with the best QoS condition. We implement and evaluate our proposed work on the Linux kernel, and also extend new ICMPv6 options on Neighbor Discovery message.

Evaluation studies of three intrusion detection systems under various attacks and rule sets

This paper investigates the performance and the detection accuracy of three popular open-source intrusion detection systems: Snort, Suricata and Bro. We evaluate all systems using various attack types including DoS attack, DNS attack, FTP attack, Scan port attack, and SNMP attack. The experiments were run under different traffic rates and different sets of active rules. The performance metrics used are the CPU utilization, the number of packets lost, and the number of alerts. The results illustrated that each attack type had significant effects on the IDS performance. But, Bro showed better performance than other IDS systems when evaluated under different attack types and using a specific set of rules. The results also indicated the drop of the accuracy when the three IDS tools activate the full rule set.

On the performance of MIPv6 and FMIPv6 based on real IPv6 applications over IEEE 802.11g testbeds

Mobility support in IPv6 networks (MIPv6) and Fast Handovers for Mobile IPv6 (FMIPv6) are already released as RFCs for many years. While the former focuses on maintaining the network connections when a mobile node handovers across subnets, the latter is built based on the former concept, but focuses on reducing the packet loss and latency inherent to the handover process. Performance study of both protocols was conducted, but most of them are based on simulations or numerical analysis. Therefore, in this paper we present a set of experiments with real implementations of MIPv6 and FMIPv6 for Linux operating system, and their performance evaluation based on real applications. We create a real IEEE 802.11g wireless testbed and run real IPv6 applications, such as FTP and the video streaming. Jperf measurement tool is also used to measure the UDP performance as well. Performance metrics we observe are throughput, jitter, and handover latency. For video streaming, the Mean Opinion Scores (MOS) is used to evaluate.

A virtual machine consolidation framework for CloudStack platforms

Virtual machine (VM) consolidation is an emerging solution for energy saving in cloud data centers. An appropriate VM consolidation policy must change accordingly, depending on the situation. To easily deploy a VM consolidation solution, this paper proposes a VM consolidation framework for Apache CloudStack, which is a popular open source cloud platform software suite. We separate the VM consolidation mechanism from the policy used to decide which VMs should be moved to somewhere more appropriate to run. This framework is a modular architecture that combines various resource monitoring systems, power control mechanisms, and VM packing algorithms. Using the proposed framework, we have demonstrated that a Web application can consolidate and deconsolidate VMs so as to balance the load of CPU utilization among physical machines in response to the number of physical machines in operation. Experimental results reveal the proposed framework is preliminary, but provides the required functionality.