We propose xRAC to permit users to run special applications on managed hosts and to grant them access to protected network resources. We use restricted application containers (RACs) for that purpose. A RAC is a virtualization container with only a selected set of applications. Authentication verifies the RAC user’s identity and the integrity of the RAC image. If the user is permitted to use the RAC on a managed host, launching the RAC is authorized and access to protected network resources may be given, e.g., to internal networks, servers, or the Internet. xRAC simplifies traffic control as the traffic of a RAC has a unique IPv6 address so that it can be easily identified in the network. The architecture of xRAC reuses standard technologies, protocols, and infrastructure. Those are the Docker virtualization platform and 802.1X including EAP-over-UDP and RADIUS. Thus, xRAC improves network security without modifying core parts of applications, hosts, and infrastructure. In this paper, we review the technological background of xRAC, explain its architecture, discuss selected use cases, and investigate on the performance. To demonstrate the feasibility of xRAC, we implement it based on standard components with only a few modifications. Finally, we validate xRAC through experiments. We publish the testbed setup guide and prototypical implementation on GitHub [1].

With increasing network bandwidths, stateful firewalls are likely to become communication bottlenecks in networks. To mitigate this problem, we propose to bypass selected traffic around firewalls using software-defined networking (SDN). We discuss various approaches and elaborate the following concept. A controller samples outgoing packets at the firewall using sFlow to detect congestion. In case of congestion, flows already admitted by the firewall are identified and offloaded at an appropriate rate by installing flow-specific bypass rules on an OpenFlow-capable switch. We suggest two different algorithms to select appropriate flows and provide a proof-of-concept implementation in a network testbed using the Ryu controller framework. Experimental results illustrate the system behavior at different load levels with and without offloading. We provide an analytical system model to predict the offloading performance for other system parameters than experimentally evaluated and validate the model with our experimental results. A parameter study suggests that the offloaded traffic rate may be a multiple of the firewall's capacity if the switch supports sufficient flow rules or is able to match for TCP flags.

Network control systems based on identities allow fine-grained access control for users. They require a network-wide session database containing information about active authenticated and authorized users. We propose an authentication and authorization (AA) module (AAM) as a controller application for software-defined networking to establish a network-wide session database and provide a prototypical implementation with OpenFlow. End systems issue authentication requests and the switch redirects them to the AAM. The AAM either relays them to a RADIUS server as in legacy 802.1X (pass-through mode) or processes them based on directly attached AA resources (authentication server mode). After successful authentication, the AAM authorizes the requesting user and maintains a network-wide session database of authenticated and authorized identities. As the AAM interfaces to end systems and AA resources through existing protocols, i.e., EAP and RADIUS, its use is compatible with current infrastructures. Through implementation as distributed network functions, the AAM can be scaled so that high rates of authentication requests can be supported.

This paper gives a simple introduction to Network Calculus (NC), a theory to calculate end-to-end delay bounds for packet-switched communication networks. It illustrates how various networking parameters affect delay bounds when flows are multiplexed. Various algorithms for the calculation of end-to-end delay bounds are revisited and their performance is compared under different conditions. The framework is applicable to feedforward networks and useful to determine delay bounds for flows in Ethernet networks.

This demo presents a testbed for computer networking education. It leverages hardware virtualization to accommodate 6 PCs and 2 routers on a single testbed host to reduce costs, energy consumption, space requirements, and heat emission. The testbed excels by providing dedicated physical Ethernet and USB interfaces for virtual machines so that students can interconnect them with cables and switches like in a non-virtualized testbed

There are two major approaches to wireless LAN-based indoor localization. One is based on received signal strength indication (RSSI). The other one measures the time of flight (TOF), i.e. the time a network frame needs for propagation in space. To both methods multipath effects pose a significant problem. A well-known mitigation approach for RSSI-based methods is location fingerprinting. This paper investigates the application of fingerprinting to TOF-based localization. In addition, we provide a comparison of RSSI-and TOF-based approaches by applying the same algorithms under the same conditions. Finally, we demonstrate that finger-printing improves TOF-based localization accuracy and even allows for a RSSI-TOF-hybrid approach with low additional effort.

Wireless LAN devices can be used for two-way time of arrival (TOA) measurements even with off-the-shelf hardware that has only a measurement resolution of 1 μs. However, to get a good locating and tracking performance the send and arrival times as well as the durations of IEEE 802.11 MAC packets must be measured precisely. In this paper, we calculate a cross-correlation between the received and sampled signal and a time continuous Barker code sequence to determine the TOA. Our adaptive sampling offset algorithm helps to efficiently obtain a subsample resolution. We implemented our algorithm and an IEEE 802.11 receiver as a Software-Defined-Radio (SDR) program. In our experiments, the algorithm needs fewer observations in comparison to previously published approaches that measure the time of flight between two WLAN devices.