2 research outputs found
Threats and Surprises behind IPv6 Extension Headers
The concept of Extension Headers, newly introduced with IPv6, is elusive and enables new types of threats in the Internet. Simply dropping all traffic containing any Extension Header — a current practice by operators-seemingly is an effective solution, but at the cost of possibly dropping legitimate traffic as well. To determine whether threats indeed occur, and evaluate the actual nature of the traffic, measurement solutions need to be adapted. By implementing these specific parsing capabilities in flow exporters and performing measurements on two different production networks, we show it is feasible to quantify the metrics directly related to these threats, and thus allow for monitoring and detection. Analysing the traffic that is hidden behind Extension Headers, we find mostly benign traffic that directly affects end-user QoE: simply dropping all traffic containing Extension Headers is thus a bad practice with more consequences than operators might be aware of
Checking-in on Network Functions
When programming network functions, changes within a packet tend to have
consequences---side effects which must be accounted for by network programmers
or administrators via arbitrary logic and an innate understanding of
dependencies. Examples of this include updating checksums when a packet's
contents has been modified or adjusting a payload length field of a IPv6 header
if another header is added or updated within a packet. While static-typing
captures interface specifications and how packet contents should behave, it
does not enforce precise invariants around runtime dependencies like the
examples above. Instead, during the design phase of network functions,
programmers should be given an easier way to specify checks up front, all
without having to account for and keep track of these consequences at each and
every step during the development cycle. In keeping with this view, we present
a unique approach for adding and generating both static checks and dynamic
contracts for specifying and checking packet processing operations. We develop
our technique within an existing framework called NetBricks and demonstrate how
our approach simplifies and checks common dependent packet and header
processing logic that other systems take for granted, all without adding much
overhead during development.Comment: ANRW 2019 ~ https://irtf.org/anrw/2019/program.htm