A First Look at QUIC in the Wild

For the first time since the establishment of TCP and UDP, the Internet transport layer is subject to a major change by the introduction of QUIC. Initiated by Google in 2012, QUIC provides a reliable, connection-oriented low-latency and fully encrypted transport. In this paper, we provide the first broad assessment of QUIC usage in the wild. We monitor the entire IPv4 address space since August 2016 and about 46% of the DNS namespace to detected QUIC-capable infrastructures. Our scans show that the number of QUIC-capable IPs has more than tripled since then to over 617.59 K. We find around 161K domains hosted on QUIC-enabled infrastructure, but only 15K of them present valid certificates over QUIC. Second, we analyze one year of traffic traces provided by MAWI, one day of a major European tier-1 ISP and from a large IXP to understand the dominance of QUIC in the Internet traffic mix. We find QUIC to account for 2.6% to 9.1% of the current Internet traffic, depending on the vantage point. This share is dominated by Google pushing up to 42.1% of its traffic via QUIC

Discovery of Flow Splitting Ratios in ISP Networks with Measurement Noise

Network telemetry and analytics is essential for providing highly dependable services in modern computer networks. In particular, network flow analytics for ISP networks allows operators to inspect and reason about traffic patterns in their networks in order to react to anomalies. High performance network analytics systems are designed with scalability in mind, and can consequently only observe partial information about the network traffic. Still, they need to provide a holistic view of the traffic, including the distribution of different traffic flows on each link. It is impractical to monitor such fine-grained telemetry, and in large, heterogeneous networks it is often too complex and error-prone, if not impossible, to access and maintain all technical specifications and router-specific configurations needed to determine e.g. the load balancing weights used when traffic is split onto multiple paths. The ratios by which flows are split on the possible paths must be derived indirectly from the measured flow demands and link utilizations. Motivated by a case study provided by a major European ISP, we suggest an efficient method to estimate the flow splitting ratios. Our approach, based on quadratic linear programming, is scalable and robust to the measurement noise found in a typical network analytics deployment. Finally, we implement an automated tool for estimating the flow splitting ratios and document its applicability on real data from the ISP

Kooperative Internetinhaltsauslieferung

Der heutige Internetverkehr wird von Content Distribution Infrastructures (CDI), z.B. Content Distribution Networks, Hyper-Giants und One-Click-Hostern, dominiert. Um das rasante Wachstum der Daten zu bewältigen, betreiben CDIs massive Infrastrukturen. Aber mit deren Größe wachsen auch die operativen Herausforderungen. Hier erweist es sich als schwierig, die Server-zu-User Zuweisung aktuell zu halten, da dem CDI die Netzwerktopologie, deren aktueller Zustand und die genaue Netzwerkposition des Users nicht bekannt sind. Zur gleichen Zeit sehen sich Netzwerkbetreiber, genannt Internet Service Provider (ISP), mit dem stark wachsenden und immer unberechenbarer werdenden Verkehrsverhalten der CDIs ausgesetzt, ohne darauf entsprechend reagieren zu können. Diese Schwierigkeiten zwischen ISPs und CDIs resultieren aus dem fehlenden Mechanismus der ISPs ihr Netzwerkwissen an die CDIs zu kommunizieren. Um das Server-zu-User Zuweisungsproblem zu lösen, beschäftigen wir uns zuerst mit IP-Geolocation. Hier legen wir den Fokus auf zwei Ansätze: a) das Auswerten von GPS Koordinaten, die von Usern selbst bereitgestellt werden und b) eine generelle Studie von IP-Geolocation Datenbanken. In beiden Fällen wird deutlich, dass IP- Geolocation nur sehr begrenzt helfen kann. Besonders in mobilen Datennetzen ist IP-Geolocation keine Hilfe. Als nächstes wenden wir uns dem Problem der Netzwerk- und Topologieunkenntnis von CDIs zu. Unsere Lösung dieses Problems beruht auf Kooperation zwischen CDIs und ISPs. Hierzu beschreiben, entwickeln und implementieren wir das Provider-aided Distance Information System (PaDIS), welches von ISPs betrieben wird und es CDIs ermöglicht, aktuelle Netzwerkinformationen zu beziehen. Dazu benutzt PaDIS Information aus dem operativen Betrieb einer ISP um CDIs den besten Server, basierend auf verschiedenen Metriken, wie Auslastung, Hops oder Latenz, vorzuschlagen. Außerdem wird durch PaDIS auch das Server-zu-User Zuweisungsproblem gelöst, was mit IP-Geolocation nicht möglich war. Unsere Auswertung zeigt dabei, dass PaDIS die Zeiten zum Herunterladen von Dateien um einen Faktor von Vier verkürzen kann. Davon profitieren nicht nur CDIs, sondern auch die User. ISPs ziehen aus dem Einsatz von PaDIS den Vorteil, dass sie die Zuweisung von Server-zu-User mitsteuern können. Wir entwerfen das Konzept des Content-aware Traffic Engineering (CaTE), welches den Verkehr von CDIs dynamisch an die aktuelle Last von Netzwerken anpasst. Im Ergebnis wird die Zuordnung von Server-zu-User deutlich verbessert, was sich sowohl positiv für das CDI als auch die User auswirkt. Weiterhin erlangen ISP die Fähigkeit, Datenströme auf Netzwerkpfade mit wenig Belastung zu legen. Unsere Auswertung von CaTE, welche auf operativen Daten einer ISP beruht, zeigt, dass sowohl die Pfadlängen als auch die Latenz zwischen Server und User signifikant verringert werden, während die ISPs ihren Datenverkehr gleichmäßiger verteilen können und dadurch die Gesamtlast des Netzwerks senken.Today, a large fraction of Internet traffic is originated by Content Distribution Infrastructures (CDIs), such as content distribution networks, hyper-giants and One-Click-Hosters. To cope with the increasing demand for content, CDIs deploy massive centralized or distributed infrastructures. For CDIs, the operation of their infrastructures is challenging, as they have to dynamically map end-users to appropriate servers without being fully aware of the end-users’ network locations. Apart from CDIs, the operational overhead of Internet Service Providers (ISPs) is growing increasingly complex, due to content delivery traffic caused by CDIs. In fact, the difficulties ISPs have with regards to engineering their traffic, stem from the fact that CDIs have limited knowledge about network conditions and infrastructures, while ISPs cannot communicate their insight about networks to CDIs. To solve the mapping challenges CDIs face, we studying the applicability of IP-Geolocation to optimize CDI operation in terms of end-user to server mapping. We base the study on two different approaches: a) an evaluation of end-user submitted GPS coordinates and b) a general study of IP-Geolocation databases. We find that in both cases, IP-Geolocation is only of limited help to select servers close to end-users. Especially in mobile environments, we find that IP-Geolocation is unable to solve the mapping problem. We broaden the scope and tackle CDIs’ general lack of awareness with regards to ISP networks. We argue that the challenges CDIs and ISPs face today can be turned into an opportunity when enabling collaboration between the two. We propose, design and implement a solution, where an ISP offers a Provider-aided Distance Information System (PaDIS) as an interface for CDIs. PaDIS uses information available only to the ISP to rank any client-host pair, based on up-to-date network information, such as delay, bandwidth or number of hops. By extension, this approach also implicitly solves the mapping problem IP-Geolocation was unable to resolve. Experiments with different CDIs show that improvements in download times of up to a factor of four are possible. Furthermore, we show that deploying PaDIS not only benefits CDIs, but also end-users. With regards to the benefits for ISPs, we show that by offering PaDIS to CDIs, ISPs are able to partly reclaim control of the traffic induced by CDIs. We design the concept of Content-aware Traffic Engineering (CaTE), which dynamically adapts the traffic demand for content hosted on CDIs by utilizing PaDIS during their server selection process. As a result, CDIs enhance their end-user to server mapping and improve end-user experience. In addition, ISPs gain the ability to partially influence traffic demands within their networks. Our evaluation, based upon operational data from a large tier-1 ISP, shows improvements minimizing the path length as well as delay between end-user and assigned CDI server, significant reduction in network-wide traffic and in maximum link utilization

Towards Collaborative Internet Content Delivery

Der heutige Internetverkehr wird von Content Distribution Infrastructures (CDI), z.B. Content Distribution Networks, Hyper-Giants und One-Click-Hostern, dominiert. Um das rasante Wachstum der Daten zu bewältigen, betreiben CDIs massive Infrastrukturen. Aber mit deren Größe wachsen auch die operativen Herausforderungen. Hier erweist es sich als schwierig, die Server-zu-User Zuweisung aktuell zu halten, da dem CDI die Netzwerktopologie, deren aktueller Zustand und die genaue Netzwerkposition des Users nicht bekannt sind. Zur gleichen Zeit sehen sich Netzwerkbetreiber, genannt Internet Service Provider (ISP), mit dem stark wachsenden und immer unberechenbarer werdenden Verkehrsverhalten der CDIs ausgesetzt, ohne darauf entsprechend reagieren zu können. Diese Schwierigkeiten zwischen ISPs und CDIs resultieren aus dem fehlenden Mechanismus der ISPs ihr Netzwerkwissen an die CDIs zu kommunizieren. Um das Server-zu-User Zuweisungsproblem zu lösen, beschäftigen wir uns zuerst mit IP-Geolocation. Hier legen wir den Fokus auf zwei Ansätze: a) das Auswerten von GPS Koordinaten, die von Usern selbst bereitgestellt werden und b) eine generelle Studie von IP-Geolocation Datenbanken. In beiden Fällen wird deutlich, dass IP- Geolocation nur sehr begrenzt helfen kann. Besonders in mobilen Datennetzen ist IP-Geolocation keine Hilfe. Als nächstes wenden wir uns dem Problem der Netzwerk- und Topologieunkenntnis von CDIs zu. Unsere Lösung dieses Problems beruht auf Kooperation zwischen CDIs und ISPs. Hierzu beschreiben, entwickeln und implementieren wir das Provider-aided Distance Information System (PaDIS), welches von ISPs betrieben wird und es CDIs ermöglicht, aktuelle Netzwerkinformationen zu beziehen. Dazu benutzt PaDIS Information aus dem operativen Betrieb einer ISP um CDIs den besten Server, basierend auf verschiedenen Metriken, wie Auslastung, Hops oder Latenz, vorzuschlagen. Außerdem wird durch PaDIS auch das Server-zu-User Zuweisungsproblem gelöst, was mit IP-Geolocation nicht möglich war. Unsere Auswertung zeigt dabei, dass PaDIS die Zeiten zum Herunterladen von Dateien um einen Faktor von Vier verkürzen kann. Davon profitieren nicht nur CDIs, sondern auch die User. ISPs ziehen aus dem Einsatz von PaDIS den Vorteil, dass sie die Zuweisung von Server-zu-User mitsteuern können. Wir entwerfen das Konzept des Content-aware Traffic Engineering (CaTE), welches den Verkehr von CDIs dynamisch an die aktuelle Last von Netzwerken anpasst. Im Ergebnis wird die Zuordnung von Server-zu-User deutlich verbessert, was sich sowohl positiv für das CDI als auch die User auswirkt. Weiterhin erlangen ISP die Fähigkeit, Datenströme auf Netzwerkpfade mit wenig Belastung zu legen. Unsere Auswertung von CaTE, welche auf operativen Daten einer ISP beruht, zeigt, dass sowohl die Pfadlängen als auch die Latenz zwischen Server und User signifikant verringert werden, während die ISPs ihren Datenverkehr gleichmäßiger verteilen können und dadurch die Gesamtlast des Netzwerks senken. Today, a large fraction of Internet traffic is originated by Content Distribution Infrastructures (CDIs), such as content distribution networks, hyper-giants and One-Click-Hosters. To cope with the increasing demand for content, CDIs deploy massive centralized or distributed infrastructures. For CDIs, the operation of their infrastructures is challenging, as they have to dynamically map end-users to appropriate servers without being fully aware of the end-users’ network locations. Apart from CDIs, the operational overhead of Internet Service Providers (ISPs) is growing increasingly complex, due to content delivery traffic caused by CDIs. In fact, the difficulties ISPs have with regards to engineering their traffic, stem from the fact that CDIs have limited knowledge about network conditions and infrastructures, while ISPs cannot communicate their insight about networks to CDIs. To solve the mapping challenges CDIs face, we studying the applicability of IP-Geolocation to optimize CDI operation in terms of end-user to server mapping. We base the study on two different approaches: a) an evaluation of end-user submitted GPS coordinates and b) a general study of IP-Geolocation databases. We find that in both cases, IP-Geolocation is only of limited help to select servers close to end-users. Especially in mobile environments, we find that IP-Geolocation is unable to solve the mapping problem. We broaden the scope and tackle CDIs’ general lack of awareness with regards to ISP networks. We argue that the challenges CDIs and ISPs face today can be turned into an opportunity when enabling collaboration between the two. We propose, design and implement a solution, where an ISP offers a Provider-aided Distance Information System (PaDIS) as an interface for CDIs. PaDIS uses information available only to the ISP to rank any client-host pair, based on up-to-date network information, such as delay, bandwidth or number of hops. By extension, this approach also implicitly solves the mapping problem IP-Geolocation was unable to resolve. Experiments with different CDIs show that improvements in download times of up to a factor of four are possible. Furthermore, we show that deploying PaDIS not only benefits CDIs, but also end-users. With regards to the benefits for ISPs, we show that by offering PaDIS to CDIs, ISPs are able to partly reclaim control of the traffic induced by CDIs. We design the concept of Content-aware Traffic Engineering (CaTE), which dynamically adapts the traffic demand for content hosted on CDIs by utilizing PaDIS during their server selection process. As a result, CDIs enhance their end-user to server mapping and improve end-user experience. In addition, ISPs gain the ability to partially influence traffic demands within their networks. Our evaluation, based upon operational data from a large tier-1 ISP, shows improvements minimizing the path length as well as delay between end-user and assigned CDI server, significant reduction in network-wide traffic and in maximum link utilization

Stroboscope: Declarative Network Monitoring on a Budget

For an Internet Service Provider (ISP), getting an accurate picture of how its network behaves is challenging. Indeed, given the carried traffic volume and the impossibility to control end-hosts, ISPs often have no other choice but to rely on heavily sampled traffic statistics, which provide them with coarse-grained visibility at a less than ideal time resolution (seconds or minutes). We present Stroboscope, a system that enables finegrained monitoring of any traffic flow by instructing routers to mirror millisecond-long traffic slices in a programmatic way. Stroboscope takes as input high-level monitoring queries together with a budget and automatically determines: (i) which flows to mirror; (ii) where to place mirroring rules, using fast and provably correct algorithms; and (iii) when to schedule these rules to maximize coverage while meeting the input budget. We implemented Stroboscope, and show that it scales well: it computes schedules for large networks and query sizes in few seconds, and produces a number of mirroring rules well within the limits of current routers. We also show that Stroboscope works on existing routers and is therefore immediately deployable

IP Geolocation Databases: Unreliable?

The most widely used technique for IP geolocation con- sists in building a database to keep the mapping between IP blocks and a geographic location. Several databases are available and are frequently used by many services and web sites in the Internet. Contrary to widespread belief, geolo- cation databases are far from being as reliable as they claim. In this paper, we conduct a comparison of several current geolocation databases -both commercial and free- to have an insight of the limitations in their usability. First, the vast majority of entries in the databases refer only to a few popular countries (e.g., U.S.). This creates an imbalance in the representation of countries across the IP blocks of the databases. Second, these entries do not re- flect the original allocation of IP blocks, nor BGP announce- ments. In addition, we quantify the accuracy of geolocation databases on a large European ISP based on ground truth information. This is the first study using a ground truth show- ing that the overly fine granularity of database entries makes their accuracy worse, not better. Geolocation databases can claim country-level accuracy, but certainly not city-level