In order to achieve new performance gains, network protocols are constantly being improved. One of the important novel developments is the new generation transport protocol QUIC. Although QUIC includes many advanced options, it suffers from performance degradation compared to TCP. One of the reasons is the larger number of acknowledgments (ACK). In practice ACK thinning by middleboxes is widespread for TCP. However, this is not possible for QUIC due to encrypted header and payload. The previous works aimed at solving this issue propose static and dynamic solutions. However, they cannot completely solve this problem, since the static approach cannot fit all network configurations and our previous solution requires a modification of the short QUIC packet header. In this work we propose an ACK optimisation mechanism for QUIC which is able to find the optimum value for delaying acknowledgements, can readapt it to the changing network environments and does not require any modification of the QUIC packet header.

The 2020 Corona pandemic has shown that on-line real-time multimedia communication is of vital importance when regular face-to-face meetings are not possible. One popular choice for conducting these meetings is the open standard WebRTC which is implemented in every major web browser. Even though this technology has found widespread use, there are still open issues with how different congestion control (CC) algorithms of Media- and DataChannels interact. In 2018 we have shown that the issue of self-inflicted queuing delay can be mitigated by introducing a CC coupling mechanism called FSE-NG. Originally, this solution was only capable of linking DataChannel flows controlled by TCP-style CCs and MediaChannels controlled by NADA CC. Standardization has progressed and along with NADA, IETF has also standardized the RTP CC SCReAM. This work extends the FSE-NG algorithm to also incorporate flows controlled by the latter algorithm. By means of simulation, we show that our approach is capable of drastically reducing end-to-end delays while also increasing RTP throughput and thus enabling WebRTC communication in scenarios where it has not been applicable before.

This work examines the behavior and impact of key protocol features like acknowledgment policy, different congestion control algorithms and the two levels of flow control on performance of the novel transport protocol QUIC. Each of the aforementioned protocol components adds significant complexity to the logic for sending and processing packets. Specific, suboptimal network conditions bring up new unsolved issues and can significantly lower the throughput of QUIC. One of the open issues is how to adapt the acknowledgment policy to a wide variety of network conditions. The ACK frequency frame scheme is a protocol extension proposed by Iyenguar et al. aiming at improving this mechanism by dynamically adapting the ACK ratio. To validate this proposal, we extended our existing QUIC implementation in OMNET++/INET, specifically by adding alternative congestion control algorithms as well as an implementation of the ACK frequency frame proposal. This paper presents a comparative evaluation of the ACK frequency frame proposal with a proposal, which we already introduced in previous work. Furthermore, it assesses the performance impact of this extension on the processing of the New Reno and Cubic congestion controls. It introduces simulation results how integration of Flow Control, ACK delay timer and PING frame influence an efficient ACK processing strategy, affecting the QUIC protocol performance.

RACK for TCP is a loss detection and recovery algorithm which relies on the notion of time instead of counting packet losses. The algorithm has been integrated in Microsoft Windows, Linux and FreeBSD as a full-featured alternative to the existing TCP loss recovery algorithms. Cheng et al. claim that the algorithm offers a significant improvement, especially for tail losses and cases with packet reordering within the network. We adopted RACK for the SCTP protocol and improved its mechanisms by utilizing built-in SCTP specific features. To evaluate the benefits and drawbacks of RACK and our modifications to the algorithm, we integrated RACK in the SCTP model of the OMNeT++/INET simulation environment. Our simulations show a positive impact in common networking scenarios regarding loss recovery and reordering tolerance.

QUIC is a novel transport protocol developed to solve some of the well-known problems in Internet data transfer. QUIC can separately manage data of multiple distinct flows (streams) within a QUIC connection. In contrast to other protocols, like e.g. SCTP, it also uses data Flow Control (FC) on the stream as well as the connection level. The QUIC FC uses a credit-based scheme on both levels. In order to evaluate the QUIC performance in detail, we implemented a QUIC simulation model featuring Congestion Control (CC) and FC according to the current standard [11]. During our evaluation, we observed suboptimal behavior of the credit-based FC algorithm, resulting in a significant degradation of the throughput of the entire connection and the goodput of each stream in the QUIC data transfer. In this paper, we propose some modifications to the credit-based FC scheme and show by means of simulation that these modifications completely mitigate the issues and enable achieving the optimum performance in FC-limited scenarios. We further show that the improved FC correctly cooperates with Congestion Control and Retransmission mechanisms and has no negative impact on the protocol performance in cases where the latter mechanisms dominate the protocol behavior.

WebRTC is the upcoming W3C and IETF standard for peer to peer real time communication in web browsers. It allows users to simultaneously transfer audio and video material via the Real Time Transport Protocol (RTP) as well as arbitrary data via the Stream Control Transmission Protocol (SCTP). These two transport protocols provide Quality of Service (QoS) features which are mutually exclusive in networks without Active Queue Management (AQM): RTP tries to maintain low end-to-end delays, while SCTP tries to maximize its throughput. This contradiction leads to a poor user experience for real-time flows due to excessive queuing delay caused by SCTP's loss based Congestion Control (CC). We overcome this issue by extending the Flow State Exchange (FSE) approach by Islam et at. to also support flows with loss based CC. By means of simulation, we show that our approach keeps end-to-end delays minimal while also allowing the enforcement of different flow rate priorities.

Voice over IP (VoIP) gains more and more attractiveness by large companies as well as private users. Therefore, the risk increases that VoIP systems get attacked by hackers. In order to effectively protect VoIP users from misuse, researchers use, e.g., honeynets to capture and analyze VoIP attacks occurring in the Internet. Global VoIP security threats are analyzed by studying several millions of real-world attacks collected in independent VoIP honeynet solutions with different capture mechanisms over a long period of time. Due to the validation of results from several honeynet designs we have achieved a unique, much broader view on large scale attacks. The results show similar attacker behavior, confirm previous assumptions about attacks and present new insights in large scale VoIP attacks, e.g., for toll fraud.

VoIP systems, based on the Session Initiation Protocol (SIP), are becoming more and more widespread in the Internet. However, this creates security issues and opens up new opportunities for misuse and fraud. The most widespread threat are multi-stage attacks to commit Toll Fraud. To devise effective countermeasures, it is crucial to know how attacks on these systems are performed in reality. In this paper, we introduce a novel distributed monitoring system with Sensor nodes located in Norway, Germany and China that allow to detect SIP-based attacks from the Internet. Based on experiences from experiments spanning several years, we propose a new setup which allows simple and straightforward addition of new remote observation points. We have deployed this setup in the NorNet testbed and highlight its advantages compared to a previous setup with physically distributed Sensors. We also present results from a 45 day field test with 13 observation points. These results confirm the advantages of a widely distributed monitoring setup and give some new insights into the behavior of the attackers.

The market penetration of access devices with multiple network interfaces has increased dramatically over the last few years. As a consequence, there is a strong interest to use all of the available interfaces concurrently to improve data throughput. Corresponding extensions of established Transport protocols are receiving considerable attention within research and standardization. Currently two approaches are in the focus of the IETF: The Multipath TCP (MPTCP) extension for TCP and the Concurrent Multipath Transfer extension for SCTP (CMT-SCTP). This paper evaluates and compares implementations of these two loadsharing protocols by using both lab measurements and intercontinental testbed realized via the Internet between Europe and China. The experiments show that some performance critical aspects have not been taken into account in previous studies. Furthermore, they show that the simple scenario with two disjoint paths, which is typically used for evaluation, does not sufficiently cover the real Internet environment. Based on these insights, we highlight that the different path management strategies of the two protocols have a significant impact on their performance in real Internet scenarios.

Security issues like service misuse and fraud are well-known problems of SIP-based networks. To develop effective countermeasures, it is important to know how these attacks are launched in reality. For gathering the required data, a specialized SIP Honeynet System has been running since January 2009 and has recorded over 58 million SIP messages. The analyses have shown that SIP-based misuse is typically performed as a multistage attack and the IP address of the attacker changes before the actual Toll Fraud calls. To be able to correlate all attack stages despite intermediate changes of the attacker's IP address we developed the new Dynamic Honeynet System (DHS), which reacts according to the attackers' behaviour and uses a dynamic Honeypot configuration in real-time to significantly improve the detection efficiency. We present the architecture and new features such as dynamic reconfiguration and demonstrate its attack correlation capabilities. We developed a Sensor component to realize this system. The Sensor provides active monitoring based on signatures to detect attacks in real-time and controls the dynamic Honeypot.

Today, a steadily growing number of devices contains multiple network interfaces. For example, nearly all smartphones are equipped with at least W-LAN as well as 3G/4G interfaces. In consequence, there is a rising demand for so-called multi-path transfer, which utilizes all of these interfaces simultaneously in order to maximize the payload throughput of applications. Currently, this so-called multi-path transfer is very actively discussed by the IETF, in form of the Multi-Path TCP (MPTCP) extension for TCP as well as the Concurrent Multi-path Transfer extension for SCTP (CMT-SCTP). Their larger-scale deployment in the Internet is expected for the near future. A key issue that prevents the standardization of these approaches is the fairness to concurrent TCP flows. A multi-path transfer should behave “TCP-friendly”, i.e. cause no harm to the performance of the very widely deployed TCP-based applications. In this paper, we first extend the notion of “fairness” from single-path transport to multi-path transport. Furthermore, we introduce the relevant congestion control approaches in the IETF context for single-path as well as multi-path transfer. We simulatively analyze these approaches in a couple of interesting network configuration scenarios, in order to show their behavior with special regard to the fairness definitions. Particularly, we also point out items of further discussion which are the result of the current approaches.

Security issues like service misuse and fraud are well-known problems of SIP-based networks. To develop effective countermeasures, it is important to know how these attacks are launched in reality. For gathering the required data, we have developed a monitoring and analyzing system which we call “SIP Trace Recorder (STR)”. It can be used in different scenarios and parses and stores relevant SIP information in a database. Based on the collected SIP data, the STR analysis plug-ins provide different, automatic threat analyses. It also offers a Privacy Option which can be activated in sensitive environments (e.g., productive telephone systems) to protect private data, but preserve all of its analysis functions. In this paper, we present the architecture, features and usage scenarios of the STR and demonstrate its automatic threat analysis capabilities.

The classic layered OSI reference model has reached its limits for the Internet of today. In this paper, we propose a clean-slate conceptual design of a new architecture as a contribution to the ongoing discussion on the Future Internet. We address the shortcomings of the layered model by redesigning the classical model. Our approach differs from the concepts found in prior work, which focus on special parts of the problems (such as the application, the service or the event) by staggering back a couple of steps and trying to see the requirements from a different perspective. Our concept - which is denoted as Encapsulated Responsibility-Centric Architecture Model (ERiCA) - focuses on determining the responsibilities by using different planes in addition to a partitioning of the network into different decision domains. With this partitioning, we can reduce the complexity of providing a certain service.

Current security issues like service misuse and fraud are well-known problems of SIP-based networks. To design and evolve effective countermeasures, it is important to know how these attacks are launched in reality. For gathering the required data, a specialized SIP Honeynet System has been implemented and operated since December 2009 which has recorded over 47.5 million SIP messages in total. Over time, based on our Honeypot experiences, we developed essential improvements such as global monitoring of whole subnets, clustering of SIP messages or bidirectional SIP message correlation. In this paper, we first describe these system extensions and demonstrate their benefits. Then we provide an analysis of gathered data which goes beyond pure statistical packet analysis. We identify, analyze and correlate the distinct phases of typical multistage attacks and also provide an example of a full attack sequence resulting in attempts to make Toll Fraud calls via a hijacked SIP account.

The steadily growing importance of Internet-based applications and their resilience requirements lead to a rising number of multi-homed sites. The idea of Concurrent Multipath Transfer (CMT) is to exploit the existence of multiple paths among endpoints to increase application data throughput. However, handling the congestion control of each path independently lacks of fairness against non-CMT flows. In this paper, we describe our approach of combining CMT with the idea of Resource Pooling (RP) in order to achieve a performance improvement over non-CMT transfer while still remaining fair to concurrent flows on congested links. Unlike existing approaches which adapt classic TCP to a multi-homed CMT protocol, our approach does not depend on specific characteristics of TCP. Instead, we base on already entrenched functional blocks of CMT transfer, on the example of the CMT-enabled SCTP (Stream Control Transmission Protocol). In a simulative proof-of-concept analysis, we show that our approach while relatively simple - is already quite effective.

With the deployment of more and more resilience-critical Internet applications, there is a rising demand for multi-homed network sites. This leads to the desire for simultaneously utilising all available access paths to improve application data throughput. This is commonly known as Concurrent Multipath Transfer (CMT); approaches for several Transport Layer protocols have been proposed. Combined with Resource Pooling (RP), CMT can also fairly coexist with concurrent non-CMT flows. Current approaches focus on symmetric paths (i.e. similar bandwidth, delay and error rate). However, asymmetric paths are much more likely - particularly for realistic Internet setups - and efficient CMT usage on such paths is therefore crucial. In this paper, we first show the challenges of plain as well as RP-aware CMT data transport over asymmetric paths. After that, we introduce mechanisms for efficient transport over such paths. Finally, we analyse the performance of our approaches by using simulations.

In general, the Stream Control Transmission Protocol (SCTP) delays the sending of acknowledgments. For specific cases, this results in non-optimal protocol behavior. Therefore, the protocol specification defines several exceptions that allow the receiver of an SCTP packet containing user data to send the corresponding acknowledgment without delaying it. However, all these exceptions only take the status at the user data receiver side into account and thus cannot cover all relevant situations. To overcome this limitation, the authors have proposed a generic mechanism allowing the sender of an SCTP packet containing user data to indicate, that the corresponding acknowledgment should not be delayed. This paper analyzes the benefits of using this sender side mechanism under several conditions.

With the growing complexity of software applications, there is an increasing demand for solutions to distribute workload into server pools. Grid Computing provides powerful - but also highly complex - mechanisms to realize such tasks. Also, there is a steadily growing number of downtime-critical applications, requiring redundant servers to ensure service availability in case of component failures. To cope with the demand for server redundancy and service availability, the IETF has recently standardized the lightweight Reliable Server Pooling (RSerPool) framework, which is a common architecture for server pool and session management. In this paper, we first introduce the concept of RSerPool and then present the modeling thoughts of RSPLIB and the underlying general groupware design. Based on RSPLIB, we will illustratively show how to easily develop applications on top of RSerPool. We will also offer an application evaluation example for a proof-of-concept setup to distribute ray-tracing computation workload into a compute pool.

The Reliable Server Pooling (RSerPool) architecture is the IETF's new standard for a lightweight server redundancy and session failover framework to support availability-critical applications. RSerPool combines the ideas from different research areas into a single, resource-efficient and unified architecture. Server pools are maintained by redundant management components, which are called registrars. Registrars monitor the availability of servers in the pool and remove them in case of failure. Furthermore, they synchronize their view of the pool with other registrars to provide information redundancy. In this paper, we first analyze the implications of registrar redundancy on the server pool performance. Furthermore, we present an optimization approach for the server pool management, which improves the system performance in case of registrar problems by hardware failures or Denial of Service attacks.

Reliable Server Pooling (RSerPool) is a light-weight protocol framework for server redundancy and session failover, currently still under standardization by the IETF RSerPool WG. While the basic ideas of RSerPool are not new, their combination into a single, resource-efficient and unified architecture is. Server redundancy directly leads to the issues of load distribution and load balancing, which are both important for the performance of RSerPool systems. Therefore, it is crucial to evaluate the performance of such systems with respect to the load balancing strategy required by the application. The goal of our paper is - after presenting a short overview of the RSerPool architecture and its application cases - to provide a quantitative, application-independent performance analysis ofRSerPool's server failure handling capabilities with respect to important adaptive and non- adaptive load balancing strategies. We will also analyse the impact of RSerPool protocol parameters on the performance of the server failure handling functionalities and the network overhead.

This paper describes the concept and implementation of the "E-mail honeypot system" (EHS) which is designed to automatically receive, categorize, analyze and archive unsolicited mails (spam). An evaluation of the various system components and the overall system in a lab environment and in a field test confirms the feasibility of the EHS concept with respect to functionality, detection accuracy and performance. In addition, some results from a field test running for over a year are provided exemplifying the potential of the EHS to provide a statistical evaluation of spam activities as well as to provide some insight into spam mechanisms.

In order to provide a generic, application- independent and resource-efficient framework for server redundancy and session failover, the IETF RSerPool WG is currently standardizing the reliable server pooling (RSerPool) framework. Server redundancy has to take load distribution and load balancing into consideration since these issues are crucial for the system performance. There has already been some research on the server selection strategies of RSerPool for different application scenarios. In particular, it has been shown that the adaptive least used selection usually provides the best performance. This strategy requires up-to-date load information of the services, which has to be propagated among distributed pool management components. But network delay (which is realistic for systems being widely distributed to achieve availability in case of regional servers failures) as well as caching of information may both lead to obsolete load information. Therefore, the purpose of this paper is to analyse and evaluate the performance of a new server selection rule to cope with update latencies. Especially, we will also analyse the impact of different workload parameters on the performance of the new server selection strategy.

Wireless sensor networks (WSN) consisting of a large number of tiny inexpensive sensor nodes are a viable solution for many problems in the field of building automation. In order to meet the energy constraints, the nodes have to operate according to an extremely low duty cycle schedule. Based on an earlier proposal for efficiently bootstrapping and configuring such a network, we show how this algorithm can be extended in order to also resolve error conditions, e.g. synchronization loss, during normal network operation and to automatically maintain an optimized network topology. Simulation studies using different error scenarios and network models show that the extended algorithm automatically adapts the network topology to the given conditions and in fact maintains an optimized network topology at reasonable energy cost.

The Reliable Server Pooling (RSerPool) architecture is the IETFpsilas upcoming standard of a lightweight server redundancy and session failover framework for availability-critical applications. RSerPool combines the ideas from different research areas into a single, resource-efficient and unified architecture. Although there have already been a number of research papers on the pool management, load distribution and failover handling performance of RSerPool, the robustness against intentional attacks has not been intensively addressed yet. Therefore, the first goal of this paper is to provide a robustness analysis in order to outline the attack bandwidth necessary for a significant impact on RSerPool-based services. After that, we present our anomaly detection approach that has been designed to protect RSerPool systems against attacks. We also show the effectiveness of this approach by simulations.

This paper presents the initial evaluation of a novel network device being located in edge nodes. It provides relaxed QoS guarantees to certain flows on a congested link by focussing packet discard on selected flows. In contrast to classical IntServ solutions, our approach requires minimal signalling and therefore provides both efficiency and scalability. In this paper, we first describe the ideas of our QoS device and then provide first results of our ongoing simulative performance evaluation and optimization.

Operators of IP-based multi-service networks have to maintain increasingly complex management architectures which need tight protection as their in-band signaling and control protocols are inherently susceptible to attacks from outsiders. Operators therefore need an efficient management of local security functions distributed among network components that enforce a coherent global network security policy. In this paper, a flexible and scalable approach for the management of distributed packet filters in IP-based multi-vendor environments is presented that allows the operator to incorporate filter capability restrictions within nodes and the trade-off between operational risk and attack risk into their management decisions.

Wireless sensor networks (WSN) consisting of a large number of inexpensive sensor nodes are a viable solution for many problems in the field of building automation, especially if the expected lifetime of the network permits to synchronize the network maintenance with the schedule for routine maintenance of the building. A challenging and up to now only marginally addressed problem concerns the power-on phase and the automatic topology discovery and maintenance process of the sensor network. We suggest a simple heuristic algorithm, which permits the integration of all sensor nodes into a tree-like failure tolerant routing structure and also provides continuous adaptation of the structure to possible changes. We developed a simulation model to reproduce the problems of a realistic indoor placement of the nodes to test the proposed algorithm. Simulation results show that the suggested algorithm converges quickly to a structure with the desired properties even in the worst case.

Reliable server pooling (RSerPool) is a protocol framework for server redundancy and session failover, currently under standardization by the IETF RSerPool WG. While the basic ideas of RSerPool are not new, their combination into one architecture is. Some research into the performance of RSerPool for certain specific applications has been made, but a detailed, application-independent sensitivity analysis of the system parameters is still missing. The goal of this paper, after an application-independent, generic quantification of RSerPool systems and definition of performance metrics for both service provider and user, is to systematically investigate RSerPool's behavior on changes of workload and system parameters to give basic guidelines on designing efficient RSerPool systems

Switching systems based on the ATM principle have outgrown the experimental stage, and are already used today in private and corporate networks, as well as in public wide area networks to provide regular service. ATM has the inherent ability to provide a common basis for transmission and switching functionality in both local and wide area networks. With the potential to support all services available today as well as those envisaged for the future, ATM holds a strong promise for network operators and end customers. To fully exploit this potential, ATM switch architectures are required which provide versatility and modularity in supporting services and protocols, independent scalability of data throughput and control performance over a wide range, and also reliability features adaptable to the respective application scenario. This paper describes in some detail how the MainStreetXpress core services node, which has evolved from the prototype described by Fischer et. al. (1991) to a mature central office ATM switch, addresses these issues and provides a future-proof architecture incorporating all of the features required in the B-ISDN era.

Asynchronous transfer mode (ATM) networks, as proposed by CCITT as the solution for the future broadband ISDN, will provide high flexibility with respect to the varying bandwidth requirements of the different services. They will also support variable bit rates within a connection. The packetized information transfer, without flow control between the user and the network, in combination with the asynchronous multiplexing principle, results in a need to control the individual cell stream during the entire duration of the calls to ensure an acceptable quality of service for all coexisting calls sharing the same network resources. This kind of control will be provided by introducing a policing or usage parameter control function. Basic design objectives and requirements for such a function are described. These requirements serve as a basis for the comparison of some of the mechanisms proposed so far, namely the leaky bucket, the jumping window, the triggered jumping window, the moving window, and the exponentially weighted moving average mechanisms.>

The authors give a classification of the most common Banyan networks and outline an analysis approach for the rather general class of delta-b networks with multiple buffers. On the basis of this approach, they discuss the effects of the approximation involved and present a refined analysis algorithm for the special case of a single buffered delta-2 network. The results of both algorithms are compared with simulation results to assess their accuracy. The comparison shows clearly that the accuracy of the analysis is mainly determined by the modeling of the dependencies between consecutive clock cycles.>