An emerging class of applications for enterprise wireless LANs (WLAN) is voice over IP (VoIP) applications, which impose a stringent requirement on end-to-end delay. Because access points on an enterprise WLAN tend to be associated with different IP subnets, support for network-layer handoff is indispensable. Moreover, the handoff frequency is expected to be much higher for WLANs than for cellular networks because the coverage of a WLAN access point is much smaller. Although mobile IP is a mature solution to the network-layer handoff problem, no known mobile IP implementation on IEEE 802.11 WLANs can reduce the handoff latency below 100 msec, a nominal requirement for VoIP applications. This paper describes a novel Ethernet-over-IP overlay network architecture that completely does away with network-layer handoff, and thus reduces the end-to-end handoff delay to that of link-layer handoff, which is supported by WLAN hardware directly. In addition, the proposed wireless overlay network (WON) architecture, which has been implemented in a commercial WLAN access point, represents the first mobility solution that allows a mobile device to maintain its network connections while roaming across different IP subnets without requiring any modification on the mobile device. As a result, the proposed architecture can automatically provide seamless network-layer handoff to a wide variety of mobile devices (such as PDA, portable, cell phone) running on different operating systems, as long as they are equipped with 802.11 network interface.

Bulk file access is a read access to a large number of files in a file system. Example applications that use bulk file access extensively are anti-virus (AV) scanner, file-level data back-up agent, filesystem defragmentation tool, etc. This paper describes the design, implementation, and evaluation of an optimization to modern file systems that is designed to improve the read efficiency of bulk file accesses. The resulting scheme, called DAFT (disk geometry-aware file system traversal), provides a bulk file access application with individual files while fetching these files into memory in a way that respects the disk geometry and thus is as efficient as it can be. We have successfully implemented a fully operational DAFT prototype, and tested it with commercial AV scanners and data back-up agents. Empirical measurements on this prototype demonstrate that it can reduce the elapsed time of enumerating all files in a file system by a factor of 5 to 15 for both fragmented and non-fragmented file systems on fast and slow disks.

An emerging killer application for enterprise wireless LANs (WLANs) is voice over IP (VoIP) telephony, which promises to greatly improve the reachability and mobility of enterprise telephony service at low cost. Most commercial IEEE802.11 WLAN-based VoIP products cannot support more than ten voice conversations over a single IEEE 802.11b channel, even though its peak transmission rate is more than two orders of magnitude higher than an individual VoIP connection's bandwidth requirement. There are two main reasons why these VoIP systems' effective capacity is lower than expected: stringent latency requirement and substantial per-WLAN-packet overhead. Time-Division Multiple Access (TDMA) is a well-known technique that provides per-connection QoS guarantee as well as maximizes the radio channel utilization efficiency. This paper presents a software-based TDMA (STDMA) protocol that is designed to support VoIP applications and successfully works on commodity IEEE802.11 WLAN interfaces. The resulting STDMA prototype can support more than 50 two-way G.729 voice conversations over a single IEEE 802.11b channel.

The exponential increase in the deployment of IEEE 802.11-based wireless LAN (WLAN) technology has transformed it into an essential building block of the networking infrastructure of commercial enterprises. How to effectively manage these WLAN networks and stop malicious intruders are the two main barriers for further spread of this technology. At the same time, the enormous economies of scale behind IEEE 802.11-based WLAN products also result in rapid technological advances and astounding pricing efficiencies. Today, the street price of a low-end 802.11g access point is as low as $50 USD, with an estimated manufacturing cost of less than $25. In this paper, we describe the design, implementation, and evaluation of a scalable wireless LAN traffic monitoring system called wireless network sentry (Wintry), which provides real-time visibility of the usage of an enterprise's wireless links in a way that is completely transparent to the monitored WLAN networks. Moreover, Wintry is able to leverage low-cost programmable WLAN access points and reduce the total hardware cost to the minimum. A key feature of Wintry is an accurate radio channel busy time estimation algorithm that correctly takes into account both back-off delay and corrupted packets in WLAN traffic load computation without requiring any modification to monitored WLAN devices.

Buffer overflow attack is the main attack method that most if not all existing malicious worms use to propagate themselves from machine to machine. Although a great deal of research has been invested in defense mechanisms against buffer overflow attack, most of them require modifications to the network applications and/or the platforms that host them. Being an extension work of CTCP, this paper presents a network-based low performance overhead buffer overflow attack detection system called Nebula 1 NEtwork-based BUffer overfLow Attack detection, which can detect both known and zero-day buffer overflow attacks based solely on the packets observed without requiring any modifications to the end hosts. Moreover, instead of deriving a specific signature for each individual buffer overflow attack instance, Nebula uses a generalized signature that can capture all known variants of buffer overflow attacks while reducing the number of false positives to a negligible level. In addition, Nebula is built on a centralized TCP/IP architecture that effectively defeats all existing NIDS evasion techniques. Finally, Nebula incorporates a payload type identification mechanism that reduces further the false positive rate and scales the proposed buffer overflow attack detection scheme to gigabit network links.

The Domain Name System (DNS) is a critical element of the Internet infrastructure. Even a small part of the DNS infrastructure being unavailable for a very short period of time could potentially upset the entire Internet and is thus totally unacceptable. Unfortunately, because DNS queries and responses are mostly UDP-based, it is vulnerable to spoofing-based denial of service (DoS) attacks, which are difficult to defeat without incurring significant collateral damage. The key to thwart this type of DoS attacks is spoof detection, which enables selective discarding of spoofed DNS requests without jeopardizing the quality of service to legitimate requests. This paper presents spoof detection strategies for protecting DNS servers from DoS attacks. These strategies create some form of cookies for a DNS server to check if each incoming request is indeed from where the request packet says it is from. We have implemented them as a firewall module called DNS guard. Measurements on the current DNS guard prototype show that it can deliver up to 80K requests/sec to legitimate users in the presence of DoS attacks at the rate of 250K requests/sec.

Many fault-tolerant and intrusion-tolerant systems require the ability to execute unsafe programs in a realistic environment without leaving permanent damages. Virtual machine technology meets this requirement perfectly because it provides an execution environment that is both realistic and isolated. In this paper, we introduce an OS level virtual machine architecture for Windows applications called Feather-weight Virtual Machine (FVM), under which virtual machines share as many resources of the host machine as possible while still isolated from one another and from the host machine. The key technique behind FVM is namespace virtualization, which isolates virtual machines by renaming resources at the OS system call interface. Through a copy-on-write scheme, FVM allows multiple virtual machines to physically share resources but logically isolate their resources from each other. A main technical challenge in FVM is how to achieve strong isolation among different virtual machines and the host machine, due to numerous namespaces and interprocess communication mechanisms on Windows. Experimental results demonstrate that FVM is more flexible and scalable, requires less system resource, incurs lower start-up and run-time performance overhead than existing hardware-level virtual machine technologies, and thus makes a compelling building block for security and fault-tolerant applications.

As the number of system vulnerabilities multiplies in recent years, vulnerability assessment has emerged as a powerful system security administration tool that can identify vulnerabilities in existing systems before they are exploited. Although there are many commercial vulnerability assessment tools in the market, none of them can formally guarantee that the assessment process never compromises the computer systems being tested. This paper proposes a featherweight virtual machine (FVM) technology to address the safety issue associated with vulnerability testing. Compared with other virtual machine technologies, FVM is designed to facilitate sharing between virtual machines but still provides strong protection between them. The FVM technology allows a vulnerability assessment tool to test an exact replica of a production-mode network service, including both hardware and system software components, while guaranteeing that the production-mode network service is fully isolated from the testing process. In addition to safety, the vulnerability assessment support system described in this paper can also automate the entire process of vulnerability testing and thus for the first time makes it feasible to run vulnerability testing autonomously and frequently. Experiments on a Windows-based prototype show that Nessus assessment results against an FVM virtual machine are identical to those against a real machine. Furthermore, modifications to the file system and registry state made by vulnerability assessment runs are completely isolated from the host machine. Finally, the performance impact of vulnerability assessment runs on production network services is as low as 3%.

With the enormous economies of scale of wireless LAN (WLAN) hardware, the price of commodity WLAN access points has dropped to the level that is even cheaper than some WLAN adapters. In this paper we propose to put together an array of off-the-shelf access points, each operating at a different radio frequency, to build a super access point that can both scale up the overall sustained throughput and improve the robustness of WLAN connectivity in the presence of failures and denial-of-service attacks. The key enabling technology for the proposed access point array architecture is a dynamic load balancing mechanism that can adaptively adjust the association between stations and access points so as to distribute the traffic load among the array's channels. We have successfully developed such a load balancing mechanism and used it to build a working access point array prototype. Measurements on this prototype show that the proposed load balancing scheme can indeed improve the overall throughput and mitigate performance impacts due to misbehaving stations. In addition, the prototype requires no modification to either the access points or the stations, making it a technology readily applicable to existing wireless LAN environments.

The growing popularity of consumer broadband connection technology, in particular cable TV and ADSL, has started a quiet revolution that will reshape the Internet connectivity solutions for commercial enterprises. One emerging theme is the replacement of dedicated lines based on frame relay or ISDN technologies with multiple inexpensive ADSL/cable TV links each of which potentially is subscribed from a different ISP. The key enabling technology for this revolution is multihoming load balancing, which spreads an enterprise's Internet traffic among multiple access links to increase the aggregate throughput, and diverts traffic away from non-functional links when they fail. Although there exist several commercial multihoming load balancing products in the marketplace, very little is published about the design tradeoffs and their performance implications. We describe the design space of multihoming load balancing systems, discuss the tradeoffs involved in load balancing and fail-over implementation strategies, and present quantitative performance measurements collected on a commercial multihoming load balancing system.

Content replication and distribution is an effective technology to reduce the response time for Web accesses and has been proven quite popular among large Internet content providers. However, existing content distribution systems assume a store-and-forward delivery model and is mostly based on static content. This paper describes the design, implementation, and initial evaluation of a network resource management system for real-time Internet content distribution called Sago, which provides facilities to provision and allocate network resources so that multiple bandwidth-guaranteed and fault-tolerant multicast connections can be multiplexed on a single physical network. Sago includes a novel network resource mapping algorithm that takes into account both physical network topology and dynamic traffic demands, a network-wide fault tolerance mechanism that supports both node-level and link-level fault tolerance, and a hierarchical network link scheduler that provides performance protection among multicast connections sharing the same physical network link. Moreover, Sago does not require any IP multicasting support from underlying network routers because it performs application-level multicasting. The technologies underlying Sago are important building blocks for real-time content distribution networks, end-to-end quality of service guarantee over global corporate intranets, and application-specific adaptation of wide-area network services.