Abstract
On April 1, 2023 we stopped monitoring the traffic on our campus Internet link, nearly 20 years to the day since we first started doing so. During these two decades, we faced a vast array of issues that affected the collection, storage, analysis and backup of our monitoring data. In this paper we share some of our experiences, so that future networking researchers have an opportunity to learn from our successes as well as our many mistakes and misfortunes.
]]>Abstract
The Internet Research Task Force (IRTF) Research Group on Decentralizing the Internet (DINRG) hosted a workshop on Centralization in the Internet on June 3, 2021. The workshop focused on painting a broad-brush landscape of the Internet centralization problem space: its starting point, its driving force, together with an articulation on what can and should be done.
]]>Abstract
End-users are concerned about protecting the privacy of their sensitive personal data that are generated while working on information systems. This extends to both the data they actively provide including personal identification in exchange for products and services as well as its related metadata such as unnecessary access to their location. This is when certain privacy-preserving technologies come into a place where Internet Engineering Task Force (IETF) plays a major role in incorporating such technologies at the fundamental level. Thus, this paper offers an overview of the privacy-preserving mechanisms for layer 3 (i.e. IP) and above that are currently under standardization at the IETF. This includes encrypted DNS at layer 5 classified as DNS-over-TLS (DoT), DNS-over-HTTPS (DoH), and DNS-over-QUIC (DoQ) where the underlying technologies like QUIC belong to layer 4. Followed by that, we discuss Privacy Pass Protocol and its application in generating Private Access Tokens and Passkeys to replace passwords for authentication at the application layer (i.e. end-user devices). Lastly, to protect user privacy at the IP level, Private Relays and MASQUE are discussed. This aims to make designers, implementers, and users of the Internet aware of privacy-related design choices.
]]>Abstract
The “Measuring Broadband America” program, run by the United States Federal Communications Commission (FCC), continually measures and releases data on the performance of consumer broadband access networks in the US. This paper presents a retrospective on the program, from its beginnings in 2010 to the present. It also reviews the underlying measurement approaches, philosophies, distinguishing features, and lessons learned over the program’s duration thus far. We focus on fixed broadband access since it is the program component with the longest history. We also discuss future directions and challenges.
]]>Abstract
Vulnerability disclosure is a widely recognized practice in the software industry, but there is a lack of literature detailing the firsthand experiences of researchers who have gone through the process. This work aims to bridge that gap by sharing our personal experience of accidentally discovering a DNS vulnerability and navigating the vulnerability disclosure process for the first time. We document our mistakes and highlight the important lessons we learned, such as the fact that public disclosure can be effective but can also be more time-consuming and emotionally taxing than anticipated. Additionally, we discuss the ethical considerations and potential consequences that may arise during each step of the disclosure process. Lastly, drawing from our own experiences, we identify and discuss issues with the current disclosure process and propose recommendations for its improvement. Our ultimate aim is to provide valuable insights to fellow researchers who may encounter similar challenges in the future and contribute to the enhancement of the overall disclosure process for the benefit of the wider community.
]]>The technical paper, Vulnerability Disclosure Considered Stressful, by Giovane C. M. Moura and colleagues, describes the authors’ experience running a Coordinated Vulnerability Disclosure (CVD) for the TSUNAME vulnerability. The process of Coordinated Vulnerability Disclosure (CVD) is widely viewed as the gold standard in the notification process that follows the discovery of a vulnerability, aiming at getting operators to patch their systems before attackers can do much harm. However, the task of setting up a CVD can be daunting because security researchers have too few guidelines and experience reports to rely on when they are faced with setting up their own process. This paper is helpful to our community as it may help anyone who may have to report vulnerabilities during their work.
Then, we have four editorial notes. In the first, Measuring Broadband America: A Retrospective on Origins, Achievements, and Challenges, Eric Burger and colleagues present a retrospective on the “Measuring Broadband America” program, run by the United States Federal Communications Commission (FCC), which continually measures and releases data on the performance of consumer broadband access networks in the US. In the second, Recent Trends on Privacy-Preserving Technologies under Standardization at the IETF, Pratyush Dikshit and colleagues present an overview of the privacy-preserving mechanisms for layer 3 (i.e. IP) and above that are currently under standardization at the IETF. The third editorial note, Report of 2021 DINRG Workshop on Centralization in the Internet, by Christian Huitema and colleagues, reports on the workshop on Centralization in the Internet hosted by the Internet Research Task Force (IRTF) Research Group on Decentralizing the Internet (DINRG), on June 3, 2021. The fourth editorial note, A Retrospective on Campus Network Traffic Monitoring, by Martin Arlitt and colleagues, shares some of the authors’ experiences about monitoring the traffic on their campus Internet link for about two decades.
I hope that you will enjoy reading this new issue and welcome comments and suggestions on CCR Online (https://ccronline.sigcomm.org) or by email at ccr-editor at sigcomm.org.
]]>Abstract
To mitigate IPv4 exhaustion, IPv6 provides expanded address space, and NAT allows a single public IPv4 address to suffice for many devices assigned private IPv4 address space. Even though NAT has greatly extended the shelf-life of IPv4, some networks need more private IPv4 space than what is officially allocated by IANA due to their size and/or network management practices. Some of these networks resort to using squat space, a term the network operations community uses for large public IPv4 address blocks allocated to organizations but historically never announced to the Internet. While squatting of IP addresses is an open secret, it introduces ethical, legal, and technical problems. In this work we examine billions of traceroutes to identify thousands of organizations squatting. We examine how they are using it and what happened when the US Department of Defense suddenly started announcing what had traditionally been squat space. In addition to shining light on a dirty secret of operational practices, our paper shows that squatting distorts common Internet measurement methodologies, which we argue have to be re-examined to account for squat space.
]]>Abstract
Packet-processing data planes have been continuously enhanced in performance over the last few years to the point that, nowadays, they are increasingly implemented in hardware (i.e., in SmartNICs and programmable switches). However, little attention is given to the slow path residing between the data plane and the control plane, as it is not typically considered performance-critical. In this paper, we show that the slow path is set to become a new key bottleneck in Software-Defined Networks (SDNs). This is due to the growth in physical network bandwidth (200 Gbps is becoming common in data centers) and topological complexity (e.g., virtual switches now span hundreds of physical machines). We present our vision of a new Domain Specific Accelerator (DSA) for the slow path at the end host that sits between the hardware-offloaded data plane and the logically-centralized control plane. We discuss open problems in this domain and call on the networking community to creatively address this emerging issue.
]]>Abstract
Throughput and latency critical applications could often benefit of performing computations close to the client. To enable this, distributed computing paradigms such as edge computing have recently emerged. However, with the advent of programmable data planes, computations cannot only be performed by servers but they can be offloaded to network switches. Languages like P4 enable to flexibly reprogram the entire packet processing pipeline. Though these devices promise high throughput and ultra-low response times, implementing application-layer tasks in the data plane programming language P4 is still challenging for an application developer who is not familiar with networking domain. In this paper, we first identify and examine obstacles and pain points one can experience when offloading server-based computations to the network. Then we present P4rrot, a code generator (in form of a library) which allows to overcome these limitations by providing a user-friendly API to describe computations to be offloaded. After discussing the design choices behind P4rrot, we introduce our proof-of-concept implementation for two P4 targets: Netronome SmartNIC and BMv2. To demonstrate the applicability of P4rrot, we investigate case studies in the context of publish-subscribe sensor data processing and real-time data streaming, supporting, in particular, MQTT-SN and MoldUDP packets.
]]>Abstract
Telecommunication operators are massively moving their network functions in small data centers at the edge of the network, which are becoming increasingly common. However, the high performance provided by commonly used technologies for data plane processing such as DPDK, based on kernel-bypass primitives, comes at the cost of rigid resource partitioning. This is unsuitable for edge data centers, in which efficiency demands both general-purpose applications and data-plane telco workloads to be executed on the same (shared) physical machines. In this respect, eBPF/XDP looks a more appealing solution, thanks to its capability to process packets in the kernel, achieving a higher level of integration with non-data plane applications albeit with lower performance than DPDK. In this paper we leverage the recent introduction of AF_XDP, an XDP-based technology that allows to efficiently steer packets in user space, to provide a thorough comparison of user space vs in-kernel packet processing in typical scenarios of a data center at the edge of the network. Our results provide useful insights on how to select and combine these technologies in order to improve overall throughput and optimize resource usage.
]]>