High Speed Networks Laboratory @ Budapest University of Technology and Economics High Speed Networks Laboratory Monitoring Network

High Speed Networks Laboratory@ Budapest University of Technology and Economics

http://hsnlab.tmit.bme.hu

High Speed Networks Laboratory

Monitoring Network Bias

A joint project with Prof. Aleksandar Kuzmanovic (Northwestern University)Supported by NSF CAREER Award No. 0746360

Gergely BiczókPhD Candidate

[email protected]

High Speed Networks Laboratoryhttp://hsnlab.tmit.bme.hu

| 2008-06-29 | FuturICT 20092

Outline

• Motivation: network neutrality• Internet Audit• System design• Implementation• Future work


| 2008-06-29 | FuturICT 20093

Net neutrality: basics

• “… a network free of restrictions on equipment, modes of communication allowed, on content, sites, and platforms and where communication is not unreasonably degraded by other communication streams …” – Wikipedia

• Own definition: you get what you asked/paid for • not less (e.g. blocking some websites)• not more (e.g. ISP-embedded content to websites)

• Debate in public, struggle in legislation, war in the Internet• Pro net neutrality: content providers (e.g., Google) and

freedom activists• www.savetheinternet.com

• Anti net neutrality: Internet Service Providers (with infrastructure, e.g., AT&T)• http://www.handsoff.org/blog/


| 2008-06-29 | FuturICT 20094

Net Neutrality: incentives and history

• (Access) ISPs have incentives to violate NN• “Resource management” (Comcast)• Potential side deals with content providers (AT&T)• Larger profit through own proprietary services (blocking Skype in favor of

own VoIP service)

• 2005: FCC enforcing net neutrality involving Madison River Communications that blocked Vonage VoIP

• 2006: China using Narus middleboxes to block Skype• 2007: Comcast actively poisoning BitTorrent uploads• 2008: YouTube outage, routing black hole caused by Pakistani ISP’s

regulatory policy• 2009: BitTorrent portals are blocked around the world

• 2005-: Rogers (Canada) blocks/shapes P2P, shapes all encrypted (!) traffic, forces users to its own SMTP servers, embed own content (!) into third-party webpages, …• http://ihaterogers.ca


| 2008-06-29 | FuturICT 20095

Internet Audit

• Goal: not to take sides in the net neutrality debate, but rather to design a system capable of making the Internet more transparent

• A distributed system to enable network accountability:• What happened, where did it happen, and who is responsible?

• Challenges:• Non-repudiable identification of discriminating network elements• Detect unfair service favoring, e.g., content provider/ISP alliances• Explore a range of threat models

• from open DoS attacks to using network policies in destructive ways

• First step: monitoring biased network behavior• provide the users with information


| 2008-06-29 | FuturICT 20096

Monitoring network bias

• An active measurement system which is• Distributed• Large-scale• For all end-users• Targeting access ISPs

• Capable of• Detecting DPI, blocking, shaping, DNS hijacking, …• Locating the discriminatory network element• Finding out the subtype of biased behavior (e.g., shaping based on

DPI vs. shaping)

• Provides an online service for end-users• With feedback


| 2008-06-29 | FuturICT 20097

System overview


| 2008-06-29 | FuturICT 20098

Measurement methodology

• Collect reported/possible means of discrimination applied by ISPs

• Create active probes that likely trigger these mechanism• We mostly emulate application/protocols

• e.g., BitTorrent-like traffic pattern without implementing a client• Minimal user action is required

• Filtering• Shaping (HTTP, FTP, SSL, BitTorrent)• WWW bias (DNS hijacking, torrent portal blocking, …)

• Locating middleboxes• By executing probes from multiple vantage points to the same

end-host• Correlating results• Vantage point selection is critical (IP/geo, iPlane)


| 2008-06-29 | FuturICT 20099

Filtering details

• Port-based• Sending packets with random payload to well-defined ports

• Signature-based• Deep Packet Inspection• List of byte signatures for applications/protocols• We derived a list based on

• open-source DPI: ipp2p, l7-filter• protocol definitions• own packet traces

• Flow-pattern based for P2P applications• Header inspection plus spatial correlation of flows• Random payload• Data exchange: Parallel TCP connections from the same IP to several others

in a port range• Control: Parallel UDP connections from the same IP to different IPs to the

same port

• With the correct order of probes the subtype can be determined


| 2008-06-29 | FuturICT 200910

Implementation issues

• PlanetLab is widely used• De facto standard test network• Lot of users, slice-based access, ~20 active slices on one node• Nodes go down at times

• M-Lab: dedicated to network transparency research• Founded by: Open Technology Institute, Google, PlanetLab

Consortium and researchers• Administered by PlanetLab• Limited number of users, ~1 slice per CPU core• Ideal for active probing

• We are deploying our system to both platforms currently


| 2008-06-29 | FuturICT 200911

• Conduct a large-scale measurement campaign• Evaluate and draw the global map of biased network behavior

More on the Internet Audit project athttp://networks.cs.northwestern.edu/internet-audit/

NetBias tool will be available at the M-Lab website soonhttp://www.measurementlab.net/

Future work

Thank you for your attention!

Documents

High Speed Networks Laboratory @ Budapest University of Technology and Economics High Speed Networks Laboratory Monitoring Network