Long-duration UAV missions are limited by battery capacity, which forces agents to leave the formation and jeopardizes mission continuity. We propose a fully decentralized, communication-centric multi-agent system that enables persistent formation flight by allowing UAVs to autonomously replace depleted members and to hand over leadership without any central controller. The approach is implemented in ROS using the ALICA coordination framework and evaluated in Gazebo simulations that demonstrate resilient formation maintenance and seamless leader/follower handovers.

Internet Exchange Points facilitate traffic exchange through Route Servers that use BGP for path selection without considering latency. This paper presents LARS, the first system to enable latency-aware path optimization at IXP route servers. It requires no changes to BGP and no bilateral coordination among members, thus directly enabling latency-aware routing for all IXP members. LARS continuously probes the route-server RIB, annotates routes with RTT-derived BGP communities, and enables members to (i) enforce a configurable latency radius that suppresses high-latency routes and (ii) prefer lower-latency alternatives when multiple paths exist. We evaluate LARS at a very large IXP using a production-level prototype that demonstrates stable latency estimation, effective tail-latency control via selective redistribution, and potential to optimize BGP best paths.

Industrial networks are undergoing a radical shift from closed, static OT environments towards open networks that integrate IT and OT. This shift applies IT operation principles to OT environments, such as virtualizing Programmable Logic Controllers and using Artificial Intelligence to increase production and process efficiency. While there is a huge effort to integrate IT principles, this paper demonstrates that IT/OT convergence remains an underexplored area of research, leaving out critical research opportunities for future networking systems. We identify three core challenges: timing constraints, service availability, and changing network traffic characteristics. For each challenge, we provide a concrete use case that demonstrates early findings and opens up new avenues for research within SIGCOMM.

South Africa's frequent electricity outages—both planned and unplanned—not only disrupt daily life but also impact Internet infrastructure in this critical regional connectivity hub. This study analyses the relationship between power outages and Internet resilience by correlating end-user performance metrics, amateur radio activity, and BGP routing data with detailed outage records. We find that network performance degrades only during unplanned outages, revealing heightened vulnerability during unexpected events. Amateur radio activity shows a weak negative correlation with both planned and unplanned outages, while BGP announcement patterns vary, showing both positive and negative correlations depending on the month. These results show how outage types shape connectivity and give us a deeper insight into the resilience of the Internet in South Africa.

Traditional Internet measurements rely heavily on IP-based vantage points to assess large-scale disruptions, overlooking less conventional but informative data sources. This leaves critical gaps in our understanding of how crises affect specific regions and alternative communication systems. Using PSKReporter's amateur radio data, we present two case studies where distinct signals of crisis events were captured, even when IP-based measurements alone may fall short. During the LA wildfires, PSKReporter spots dropped by 36%, with no comparable decline in IP-based data. For Hurricanes Milton and Helene, spot declines appeared several days earlier than IP-based indicators. These insights open new avenues for studying the resilience of diverse infrastructures during emergencies.

During the first days of the 2022 Russian invasion of Ukraine, Russia's media regulator blocked access to many global social media platforms and news sites, including Twitter, Facebook, and the BBC. To bypass the information controls set by Russian authorities, pro-Ukrainian groups explored unconventional ways to reach out to the Russian population, such as posting war-related content in the user reviews of Russian businesses available on Google Maps or Tripadvisor. This paper provides a first analysis of this new phenomenon by analyzing the unconventional strategies used to avoid state censorship in the Russian Federation during the conflict. Specifically, we analyze reviews posted on these platforms from the beginning of the war to September 2022. We measure the channeling of war-related messages through user reviews on Tripadvisor and Google Maps. Our analysis of the content posted on these services reveals that users leveraged these platforms to seek and exchange humanitarian and travel advice, but also to disseminate disinformation and polarized messages. Finally, we analyze the response of platforms in terms of content moderation and their impact.

Modern websites are complex and fetch content from a multitude of different servers or domains. When measuring the complexity of the modern web, an open question is how content that is fetched from these domains contribute to the rendered output of the website. In this poster, we present the Web Dependency Analyzer, a tool that is designed to automatically infer the domains that a website depends on and further analyze the impact of each domain on the rendered output of the site. Our Web Dependency Analyzer instructs a headless web browser to infer the resource dependencies from a large set of input domains and outputs the visual impact of the unavailability of each domain.

Motivated by the impressive but diffuse scope of DDoS research and reporting, we undertake a multistakeholder (joint industry-academic) analysis to seek convergence across the best available macroscopic views of the relative trends in two dominant classes of attacks - direct-path attacks and reflection-amplification attacks. We first analyze 24 industry reports to extract trends and (in)consistencies across observations by commercial stakeholders in 2022. We then analyze ten data sets spanning industry and academic sources, across four years (2019-2023), to find and explain discrepancies based on data sources, vantage points, methods, and parameters. Our method includes a new approach: we share an aggregated list of DDoS targets with industry players who return the results of joining this list with their proprietary data sources to reveal gaps in visibility of the academic data sources. We use academic data sources to explore an industry-reported relative drop in spoofed reflection-amplification attacks in 2021-2022. Our study illustrates the value, but also the challenge, in independent validation of security-related properties of Internet infrastructure. Finally, we reflect on opportunities to facilitate greater common understanding of the DDoS landscape. We hope our results inform not only future academic and industry pursuits but also emerging policy efforts to reduce systemic Internet security vulnerabilities.

Detecting where traffic enters a network enhances network operation, but poses a complex measurement problem that requires analyzing a continuous traffic stream from all border routers---a challenging task for ISPs in the absence of a scalable approach.

Website Fingerprinting (WFP) attacks infer the websites or webpages a user is visiting from encrypted traffic. To date, it remains uncertain if WFP can attack many users from a central location in an online scenario. We close this gap with PROFI, a WFP attack that detects websites based on the initial TLS connection from the client to the server using at most the connection’s first 30 packets. PROFI achieves a precision and recall of 86.51% and 85.35% in a closed-world, and 68.90% and 78.71% in an open-world scenario, which is competitive to state-of-the-art (SoA) WFP attacks, while taking a fraction of the time of SoA attacks to classify a webpage. Further, we implement PROFI as a micro service-based prototype and evaluate the attack in an online scenario with real traffic traces. We show that PROFI can monitor up to 100 websites at 10 G, corresponding to up to 424 webpages per second. We also show that PROFI has the potential to interfere with a victim’s webpage access.

Time-Sensitive Networking (TSN) disrupts realtime communication technology by making IEEE Ethernet realtime-capable. For time-triggered, hard realtime traffic, TSN provides standardized mechanisms to reserve communication paths as well as individual transmission time slots for data frames. By leveraging these means in a precomputed network schedule, TSN allows for bounded end-to-end delays and minimal jitter. Not being part of the IEEE standard, corresponding scheduling algorithms are an active field of research. Unfortunately, due to differing model assumptions, evaluation setups, and key metrics, a fair comparison of schedulers is impossible so far. In this paper, we present a systematic and reproducible approach to benchmark TSN schedulers. First, we provide a scheduler taxonomy that enables to cluster schedulers by their characteristics. Second, we analyze interactions of input parameters and scheduler results to derive a benchmarking parcour for quantitative comparisons. Finally, we use the approach to benchmark existing schedulers and show subtle interaction effects. This way, our approach enables—for the first time-comparability between schedulers, fueled by the public availability of our benchmarking scenarios.

A subset of massively multiplayer online games (MMOG) feature long-term game rounds in which players interact for months or even years. The player experience of such long-term games cannot be entirely captured by current study methods, in particular not at scale assessing large player populations. To address this challenge, we posit that long-term, round based games such as Tribal Wars (browser-based) enable a data-driven perspective on long-term game dynamics and experience. In a preliminary study, we monitor and characterize the entire longitudinal game state of a Tribal Wars round that was played by 16k players for 1.5 years, enabling us to investigate behavioral patterns of all active players. We identify features that capture in-game success and relate to the player experience; showing only successful players keeping up playing. We open source our dataset [1] enabling reproducibility & future research.

Distributed Denial of Service (DDoS) attacks are among the most critical cybersecurity threats, jeopardizing the stability of even the largest networks and services. The existing range of mitigation services predominantly filters at the edge of the Internet, thus creating unnecessary burden for network infrastructures. Consequently, we present IXP Scrubber, a Machine Learning (ML) based system for detecting and filtering DDoS traffic at the core of the Internet at Internet Exchange Points (IXPs) which see large volumes and varieties of DDoS. IXP Scrubber continuously learns DDoS traffic properties from neighboring Autonomous Systems (ASes). It utilizes BGP signals to drop traffic for certain routes (blackholing) to sample DDoS and can thus learn new attack vectors without the operator's intervention and on unprecedented amounts of training data. We present three major contributions: i) a method to semi-automatically generate arbitrarily large amounts of labeled DDoS training data from IXPs' sampled packet traces, ii) the novel, controllable, locally explainable and highly precise two-step IXP Scrubber ML model, and iii) an evaluation of the IXP Scrubber ML model, including its temporal and geographical drift, based on data from 5 IXPs covering a time span of up to two years.

We compare exact and approximate performance evaluation methods of the Least Recently Used (LRU) caching strategy, which is widely applied in local caches and in distributed web cache architectures in core and edge networks. Based on the independent reference model (IRM), the LRU startup behaviour and convergence time (CT) is derived. The result is related to hit ratio approximations by Fagin and Che et al. We evaluate the precision of the approximations by identifying maximum errors, which are shown to decrease with the cache size. For different object sizes, we extend the analytical LRU hit ratio formula, which is tractable for small caches. The Che and CT approximations are subject to larger deviations for high variability of the object sizes and small caches due to partially unused cache space. We propose an estimation scheme for the fraction of unused LRU cache space, which is shown to improve the accuracy.

The majority of Web content is delivered by only a few companies that provide Content Delivery Infrastructuress (CDIss) such as Content Delivery Networkss (CDNss) and cloud hosts. Due to increasing concerns about trends of centralization, empirical studies on the extent and implications of resulting Internet consolidation are necessary. Thus, we present an empirical view on consolidation of the Web by leveraging datasets from two different measurement platforms. We first analyze Web consolidation around CDIs at the level of landing webpages, before narrowing down the analysis to a level of embedded page resources. The datasets cover 1(a) longitudinal measurements of DNS records for 166.5 M Web domains over five years, 1(b) measurements of DNS records for Alexa Top 1 M over a month and (2) measurements of page loads and renders for 4.3 M webpages, which include data on 392.3 M requested resources. We then define CDIs penetration as the ratio of CDI-hosted objects to all measured objects, which we use to quantify consolidation around CDIs. We observe that CDI penetration has close to doubled since 2015, reaching a lower bound of 15% for all .com , .net , and .org Web domains as of January 2020. Overall, we find a set of six CDIss to deliver the majority of content across all datasets, with these six CDIss being responsible for more than 80% of all 221.9 M CDI-delivered resources (56.6% of all resources in total). We find high dependencies of Web content on a small group of CDIss, in particular, for fonts, ads, and trackers, as well as JavaScript resources such as jQuery. We further observe CDIss to play important roles in rolling out IPv6 and TLS 1.3 support. Overall, these observations indicate a potential oligopoly, which brings both benefits but also risks to the future of the Web.

In September 2019, 600 armed German cops seized the physical premise of a Bulletproof Hoster (BPH) referred to as CyberBunker 2.0. The hoster resided in a decommissioned NATO bunker and advertised to host everything but child porn and anything related to terrorism while keeping servers online no matter what. While the anatomy, economics and interconnection-level characteristics of BPHs are studied, their traffic characteristics are unknown. In this poster, we present the first analysis of domains, web pages, and traffic captured at a major tier-1 ISP and a large IXP at the time when the CyberBunker was in operation. Our study sheds light on traffic characteristics of a BPH in operation. We show that a traditional BGP-based BPH identification approach cannot detect the CyberBunker, but find characteristics from a domain and traffic perspective that can add to future identification approaches.

Amplification Distributed Denial of Service (DDoS) attacks' traffic and harm are at an all-time high. To defend against such attacks, distributed attack mitigation platforms, such as traffic scrubbing centers that operate in peering locations, e.g., Internet Exchange Points (IXP), have been deployed in the Internet over the years. These attack mitigation platforms apply sophisticated techniques to detect attacks and drop attack traffic locally, thus, act as sensors of attacks. However, it has not yet been systematically evaluated and reported to what extent coordination of these views by different platforms can lead to more effective mitigation of amplification DDoS attacks. In this paper, we ask the question: "Is it possible to mitigate more amplification attacks and drop more attack traffic when distributed attack mitigation platforms collaborate?"

This tools track paper presents the design of a questionnaire methodology to assess the participants experience of virtual conferences. This survey approach consists of a preconference questionnaire assessing participation goals and expectations and a post-conference questionnaire assessing the actual participation and related experiences. It enables a data-driven investigation of participants' expectations, goals, attitudes, actual experiences, and general feedback about virtual conferences. As such, it can help to better understand how virtual conference experiences can be improved in the future and how the virtual format can become a more attractive alternative, also in non-pandemic times. The questionnaire was used at three conferences and two workshops. Despite a missing validation, we released it early to foster research on virtual conferences.

Blocklists constitute a widely-used Internet security mechanism to filter undesired network traffic based on IP/domain reputation and behavior. Many blocklists are distributed in open source form by threat intelligence providers who aggregate and process input from their own sensors, but also from third-party feeds or providers. Despite their wide adoption, many open-source blocklist providers lack clear documentation about their structure, curation process, contents, dynamics, and inter-relationships with other providers. In this paper, we perform a transparency and content analysis of 2,093 free and open source blocklists with the aim of exploring those questions. To that end, we perform a longitudinal 6-month crawling campaign yielding more than 13.5M unique records. This allows us to shed light on their nature, dynamics, inter-provider relationships, and transparency. Specifically, we discuss how the lack of consensus on distribution formats, blocklist labeling taxonomy, content focus, and temporal dynamics creates a complex ecosystem that complicates their combined crawling, aggregation and use. We also provide observations regarding their generally low overlap as well as acute differences in terms of liveness (i.e., how frequently records get indexed and removed from the list) and the lack of documentation about their data collection processes, nature and intended purpose. We conclude the paper with recommendations in terms of transparency, accountability, and standardization.

Public Key Infrastructures (PKIs) with their trusted Certificate Authorities (CAs) provide the trust backbone for the Internet: CAs sign certificates which prove the identity of servers, applications, or users. To be trusted by operating systems and browsers, a CA has to undergo lengthy and costly validation processes. Alternatively, trusted CAs can cross-sign other CAs to extend their trust to them. In this paper, we systematically analyze the present and past state of cross-signing in the Web PKI. Our dataset (derived from passive TLS monitors and public CT logs) encompasses more than 7 years and 225 million certificates with 9.3 billion trust paths. We show benefits and risks of cross-signing. We discuss the difficulty of revoking trusted CA certificates where, worrisome, cross-signing can result in valid trust paths to remain after revocation; a problem for non-browser software that often blindly trusts all CA certificates and ignores revocations. However, cross-signing also enables fast bootstrapping of new CAs, e.g., Let's Encrypt, and achieves a non-disruptive user experience by providing backward compatibility. In this paper, we propose new rules and guidance for cross-signing to preserve its positive potential while mitigating its risks.

Due to the COVID-19 pandemic, many governments imposed lock-downs that forced hundreds of millions of citizens to stay at home. The implementation of confinement measures increased Internet traffic demands of residential users, in particular, for remote working, entertainment, commerce, and education, which, as a result, caused traffic shifts in the Internet core.

Domain classification services have applications in multiple areas, including cybersecurity, content blocking, and targeted advertising. Yet, these services are often a black box in terms of their methodology to classifying domains, which makes it difficult to assess their strengths, aptness for specific applications, and limitations. In this work, we perform a large-scale analysis of 13 popular domain classification services on more than 4.4M hostnames. Our study empirically explores their methodologies, scalability limitations, label constellations, and their suitability to academic research as well as other practical applications such as content filtering. We find that the coverage varies enormously across providers, ranging from over 90% to below 1%. All services deviate from their documented taxonomy, hampering sound usage for research. Further, labels are highly inconsistent across providers, who show little agreement over domains, making it difficult to compare or combine these services. We also show how the dynamics of crowd-sourced efforts may be obstructed by scalability and coverage aspects as well as subjective disagreements among human labelers. Finally, through case studies, we showcase that most services are not fit for detecting specialized content for research or content-blocking purposes. We conclude with actionable recommendations on their usage based on our empirical insights and experience. Particularly, we focus on how users should handle the significant disparities observed across services both in technical solutions and in research.

Quality of Experience is traditionally evaluated by using short stimuli usually representing parts or single usage episodes. This opens the question on how the overall service perception involving multiple usage episodes can be evaluated—a question of high practical relevance to service operators. Despite initial research on this challenging aspect of multi-episodic perceived quality, the question of the underlying quality formation processes and its factors are still to be discovered. We present a multi-episodic experiment of an Audio-on-Demand service over a usage period of 6 days with 93 participants. Our work directly extends prior work investigating the impact of time between usage episodes. The results show similar effects — although the recency effect is not statistically significant. In addition, we extend prediction of multi-episodic judgments by accounting for the observed saturation.

Congestion control (CC) is an indispensable component of transport protocols to prevent congestion collapse as it distributes the available bandwidth among all competing flows, ideally in a fair manner. It thus has a large impact on performance and there exists a constantly evolving set of CC algorithms, each addressing different performance needs. While the algorithms are commonly tested regarding the problems underlying their implementation, the interaction with existing algorithms is often not considered. Additionally considering the fact that content providers (CPs) such as content distribution networks (CDNs) are known to tune TCP stacks for performance gains, the large assortment of algorithms opens the door for custom parametrization and potentially unfair bandwidth sharing. In this paper, we thus empirically investigate if current Internet traffic generated by CPs still adheres to the conventional understanding of fairness. For this, we compare fairness properties of testbed hosts to actual traffic of six major CPs subject to different queue sizes and queueing disciplines in a home-user setting. Additionally, we investigate how mice and elephant flows from the different CPs interact. We find that some employed CC algorithms lead to significantly asymmetric bandwidth shares and very poor flow completion times for mice flows. Fortunately, AQMs such as FQ_CoDel are able to alleviate such unfairness.

QUIC, as the foundation for HTTP/3, is becoming an Internet reality. A plethora of studies already show that QUIC excels beyond TCP+ TLS+HTTP/2. Yet, these studies compare a highly optimized QUIC Web stack against an unoptimized TCP-based stack. In this paper, we bring TCP up to speed to perform an eye-level comparison. Instead of relying on technical metrics, we perform two extensive user studies to investigate QUIC's impact on the quality of experience. First, we investigate if users can distinguish two protocol versions in a direct comparison, and we find that QUIC is indeed rated faster than TCP and even a tuned TCP. Yet, our second study shows that this perceived performance increase does mostly not matter to the users, and they rate QUIC and TCP indistinguishable.

Booter services continue to provide popular DDoS-as-a-service platforms and enable anyone irrespective of their technical ability, to execute DDoS attacks with devastating impact. Since booters are a serious threat to Internet operations and can cause significant financial and reputational damage, they also draw the attention of law enforcement agencies and related counter activities. In this paper, we investigate booter-based DDoS attacks in the wild and the impact of an FBI takedown targeting 15 booter websites in December 2018 from the perspective of a major IXP and two ISPs. We study and compare attack properties of multiple booter services by launching Gbps-level attacks against our own infrastructure. To understand spatial and temporal trends of the DDoS traffic originating from booters we scrutinize 5 months, worth of inter-domain traffic. We observe that the takedown only leads to a temporary reduction in attack traffic. Additionally, one booter was found to quickly continue operation by using a new domain for its website.

High packet rates at ≥ 10 GBit/s challenge the packet processing performance of network stacks. A common solution is to offload (parts of) the user-space packet processing to other execution environments, e.g., into the device driver (kernel-space), the NIC or even from virtual machines into the host operating system (OS), or any combination of those. While common wisdom states that offloading optimizes performance, neither benefits nor negative effects are comprehensively studied. In this paper, we aim to shed light on the benefits and shortcomings of eBPF/XDP-based offloading from the user-space to i) the kernel-space or ii) a smart NIC-including VM virtualization. We show that offloading can indeed optimize packet processing, but only if the task is small and optimized for the target environment. Otherwise, offloading can even lead to detrimental performance.

Quality of Experience (QoE) typically involves conducting experiments in which stimuli are presented to participants and their judgments as well as behavioral data are collected. Nowadays, many experiments require software for the presentation of stimuli and the data collection from participants. While different software solutions exist, these are not tailored to conduct experiments on QoE. Moreover, replicating experiments or repeating the same experiment in different settings (e. g., laboratory vs. crowdsourcing) can further increase the software complexity. TheFragebogen is an open-source, versatile, extendable software framework for the implementation of questionnaires - especially for research on QoE. Implemented questionnaires can be presented with a state-of-the-art web browser to support a broad range of devices while the use of a web server being optional. Out-of-the-box, TheFragebogen provides graphical exact scales as well as free-hand input, the ability to collect behavioral data, and playback multimedia content.

TCP congestion control and particularly its initial congestion window (IW) size is one long-debated topic that can influence Web performance. Its size is, however, assumed to be static by IETF recommendations-despite being network- and application-dependent-and only infrequently changed in its history. To understand if the standardization and research perspective still meets Internet reality, we study the IW configurations in IPv4 and of major content delivery networks (CDNs). We have been regularly inspecting IPv4 for HTTP and TLS servers to investigate their IW configuration and found a steady increase in IETF-recommended configurations. We additionally study how CDNs configure their IWs given their relevance for content distribution. To shed light on network-dependent CDN configurations, we use a globally distributed infrastructure of VPNs giving access to residential access links. We observe that most CDNs are well aware of the IW's impact and find a high amount of customization that is beyond current Internet standards. We find various initial window configurations, most below 50 segments, yet, with exceptions of up to 100 segments-the tenfold of current standards. This paper highlights that Internet reality has drifted away from recommended and standardized practices. Driven by these findings, we investigate the effects of this new reality on the slow start of Cubic and BBR congestion controlled TCP flows. We find that TCP pacing is a key to enable increased IWs when competing against other traffic.

HTTP/2 supersedes HTTP/1.1 to tackle the performance challenges of the modern Web. A highly anticipated feature is Server Push, enabling servers to send data without explicit client requests, thus potentially saving time. Although guidelines on how to use Server Push emerged, measurements have shown that it can easily be used in a suboptimal way and hurt instead of improving performance. We thus tackle the question if the current Web can make better use of Server Push. First, we enable real-world websites to be replayed in a testbed to study the effects of different Server Push strategies. Using this, we next revisit proposed guidelines to grasp their performance impact. Finally, based on our results, we propose a novel strategy using an alternative server scheduler that enables to interleave resources. This improves the visual progress for some websites, with minor modifications to the deployment. Still, our results highlight the limits of Server Push: a deep understanding of web engineering is required to make optimal use of it, and not every site will benefit.

Cloud computing offers the potential to store, manage, and process data in highly available, scalable, and elastic environments. Yet, these environments still provide very limited and inflexible means for customers to control their data. For example, customers can neither specify security of inter-cloud communication bearing the risk of information leakage, nor comply with laws requiring data to be kept in the originating jurisdiction, nor control sharing of data with third parties on a fine-granular basis. This lack of control can hinder cloud adoption for data that falls under regulations. In this paper, we show in six use cases how cloud environments can be enriched with policy language support to give customers control over cloud data. Our use cases are based on realizing policy language support in all three cloud environment layers, i.e., IaaS, PaaS, and SaaS. Specifically, we present policy-aware resource management (with OpenStack) and dynamic network configuration. With CERN's big data storage and the in-memory database Hyrise, we show realization for storage and further exemplify policy-aware cloud processing by network function virtualization which enables Orange to offload customer home gateways to the cloud. Finally, we discuss benefits of policy support in F-Secure's Security Cloud. These use cases show the feasibility of realizing customer control with policy support in the cloud. Thus, our work enables customers with regulated data to tap cloud benefits and significantly broadens the market for cloud providers.

We compare web caching strategies based on the least recently used (LRU) and the least frequently used (LFU) replacement principles with optimum caching according to Belady's algorithm. The achievable hit rates of the strategies are shown to improve with the exploited knowledge about the request pattern while the computation effort is also increasing. The results give an overview of performance tradeoffs in the whole relevant range for web caching with Zipf request pattern. In a second part, we study a combined approach of the optimum strategy for a limited look-ahead with LRU, LFU or other non-predictive methods. We evaluate the hit rate gain depending on the extent of the look-ahead for request traces and for the independent reference model (IRM) via simulation and derive an analytic confirmation of the observed behaviour. It is shown that caching for video streaming can benefit from the proposed look-ahead technique, when replacement decisions can be partly revised due to new requests being encountered during long lasting content updates.

Software Defined Networking (in short SDN, which is also an acronym for Software Defined Network), has emerged as a response to the limitations and complexities of traditional network architectures. At the heart of SDN lies the idea to consolidate the control over network devices into a logically centralized (software) controller separated from the data plane. The separation of the control plane and the data plane is realized via an open programming interface between the data plane switches and the SDN controller. The decoupling allows the control plane to evolve independently of the data plane, which enables faster innovation since software often exceeds hardware in innovation speed. Furthermore, logical centralization has the potential to simplify network operation and management by providing a single focal point where the consequences of management actions can be assessed, and possibly rejected if they would lead to some violation of operational constraints. OpenFlow, the standard SDN protocol today, is based on a simple match-action paradigm which results in great flexibilities, e.g., in terms of traffic engineering, definition of flows, as well as in-band network control functionalities.

Improving web performance is fueling the debate of sizing TCP's initial congestion window (IW), which is a critical performance parameter especially for short-lived flows. This debate yielded several RFC updates to recommended IW sizes, e.g., an increase to IW10 in 2010. The current adoption of IW recommendations is, however, unknown. In this paper, we therefore conduct large-scale measurements covering the entire IPv4 space inferring the IW distribution size by probing HTTP and HTTPS servers. We present an HTTP and TLS scanning method implemented in ZMap, enabling quick estimations of IW sizes at Internet scale. For the first time since the standardization and implementation of IW 10, we shed light on the rugged landscape of IW configurations on the Internet.

Bitcoin has revolutionized digital currencies and its underlying blockchain has been successfully applied to other domains. To be verifiable by every participating peer, the blockchain maintains every transaction in a persistent, distributed, and tamper-proof log that every participant needs to replicate locally. While this constitutes the central innovation of blockchain technology and is thus a desired property, it can also be abused in ways that are harmful to the overall system. We show for Bitcoin that blockchains potentially provide multiple ways to store (malicious and illegal) content that, once stored, cannot be removed and is replicated by every participating user. We study the evolution of content storage in Bitcoin's blockchain, classify the stored content, and highlight implications of allowing the storage of arbitrary data in globally replicated blockchains.

Delay effects can impact the Quality of Experience of interactive systems, which motivates research assessing delay impairments, mostly for web based systems. Current studies follow individual methodologies and typically assesses individual and custom-made web pages, whose construction requires expert knowledge in web technologies. Further, a range of native, non-web applications cannot be easily modified for delay studies. Thus, a generalized methodology for assessing delay impacts for a broad range of applications that is accessible to researchers without (web) development expertise is still missing. This paper contributes to this open problem by i) presenting a new methodology for reproducible delay assessments in a broad class of systems and ii) presenting an open-source implementation to be used by the community. This methodology particularly aims at making delay assessment available to a broad range of researchers by avoiding programming skills and thus by lowering the barrier for setting-up delay assessments.

Content and services which are offered for free on the Internet are primarily monetized through online advertisement. This business model relies on the implicit agreement between content providers and users where viewing ads is the price for the "free" content. This status quo is not acceptable to all users, however, as manifested by the rise of ad-blocking plugins which are available for all popular Web browsers. Indeed, ad-blockers have the potential to substantially disrupt the widely established business model of "free" content, currently one of the core elements on which the Web is built.

Gaze tracking is a common technique to study user interaction but is also increasingly used as input modality. In this regard, computer vision based systems provide a promising low-cost realization of gaze tracking on mobile devices. This paper complements related work focusing on algorithmic designs by conducting two users studies aiming to i) independently evaluate EyeTab as promising gaze tracking approach and ii) by providing the first independent use case driven evaluation of its applicability in mobile scenarios. Our evaluation elucidates the current state of mobile computer vision based gaze tracking and aims to pave the way for improved algorithms. In this regard, we aim to further foster the development by releasing our source data as reference database open to the public.

Increasing network speeds challenge the packet processing performance of networked systems. This can mainly be attributed to processing overhead caused by the split between the kernel-space network stack and user-space applications. To mitigate this overhead, we propose Santa, an application agnostic kernel-level cache of frequent requests. By allowing user-space applications to offload frequent requests to the kernel-space, Santa offers drastic performance improvements and unlocks the speed of kernel-space networking for legacy server software without requiring extensive changes.

A spammer needs three elements to run a spam operation: a list of victim email addresses, content to be sent, and a botnet to send it. Each of these three elements are critical for the success of the spam operation: a good email list should be composed of valid email addresses, a good email content should be both convincing to the reader and evades anti-spam filters, and a good botnet should efficiently sent spam. Given how critical these three elements are, figures specialized on one of these elements have emerged in the spam ecosystem. Email harvesters crawl the web and compile email lists, botmasters infect victim computers and maintain efficient botnets for spam dissemination, and spammers rent botnets and buy email lists to run spam campaigns. Previous research suggested that email harvesters and botmasters sell their services to spammers in a prosperous underground economy. No rigorous research has been performed, however, on understanding the relations between these three actors. This paper aims to shed some light on the relations between harvesters, botmasters, and spammers. By disseminating email addresses on the Internet, fingerprinting the botnets that contact these addresses, and looking at the content of these emails, we can infer the relations between the actors involved in the spam ecosystem. Our observations can be used by researchers to develop more effective anti-spam systems.

Despite decades of operational experience and focused research efforts, standards for sizing and configuring buffers in network systems remain controversial. An extreme example of this is the recent claim that excessive buffering (i.e., bufferbloat) can severely impact Internet services. In this paper, we systematically examine the implications of buffer sizing choices from the perspective of factors impacting end user experience. To assess user perception of application quality under various buffer sizing schemes we employ Quality of Experience (QoE) metrics. We evaluate these metrics over a wide range of end-user applications (e.g., web browsing, VoIP, and RTP video streaming) and workloads in two realistic testbeds emulating access and backbone networks. The main finding of our extensive evaluations is that network workload, rather than buffer size, is the primary determinant of end user QoE. Our results also highlight the relatively narrow conditions under which bufferbloat seriously degrades QoE, i.e., when buffers are oversized and sustainably filled.

This paper analyzes queueing behavior in queues with a random number of parallel flows, and not static as typically assumed. By deriving upper and lower bounds on the queue size distribution, the paper identifies extremal properties in such dynamic queues. The extremal best-case distribution (minimizing the queue) is simply the constant, whereas the worst-case distribution (maximizing the queue) has a bimodal structure. From a more practical point of view, this paper highlights an idiosyncrasy of dynamic queues: unlike in static queues whereby capacity dimensioning is dominated by average-values (subject to certain safety margins), in dynamic queues the capacity dimensioning is dominated instead by peak-values.

This paper investigates the origins of the spamming process, specifically concerning address harvesting on the web, by relying on an extensive measurement data set spanning over three years. Concretely, we embedded more than 23 million unique spamtrap addresses in web pages. 0.5% of the embedded trap addresses received a total of 620,000 spam messages. Besides the scale of the experiment, the critical aspect of our methodology is the uniqueness of the issued spamtrap addresses, which enables the mapping of crawling activities to the actual spamming process.

Ensuring a high customer satisfaction by monitoring Quality of Experience (QoE) aspects has become common practice for service providers. Such monitoring solutions, together with underlying QoE models, are mostly limited to measures captured in the core or access network and may thus neglect the QoE impact of recovery mechanisms deployed at client-side, e.g., FEC or ARQ. This limitation makes QoE models prone to mispredict QoE and consequently may lead the operators to misleading interpretations of customer experience. In this paper, we empirically study the behavior of the Microsoft TV Set-top Box (STB) with respect to the deployed ARQ recovery mechanism. As the ARQ implementation details of the STB are proprietary, we implement and simulate three ARQ algorithms of different complexities and evaluate their performance by comparing with corresponding empirical measurements. This comparison reveals insights into the ARQ scheme implemented in the STB. Moreover, it leads us to speculate that MSTV uses simple ARQ schemes which are sufficient to drastically improve the QoE in the presence of a multitude of loss patterns.

Many of computing and communication systems are based on FIFO queues whose performance, e.g., in terms of throughput and fairness, is highly influenced by load fluctuations, especially in the case of short-term overload. This paper analytically proves that, for both Markovian and heavy-tailed/self-similar arrivals, overloaded FIFO queues are asymptotically fair in the sense that each flow or aggregate of flows receives a weighted fair share over large time scales. In addition, the paper provides the corresponding transient results and convergence rates, i.e., the amount of time it takes for a flow to probabilistically attain the fair share. Interestingly, for Markovian arrivals, the paper indicates smaller convergence rates at higher utilizations, which is exactly the opposite behavior characteristic to underloaded queueing systems.

The stochastic network calculus is an analytical tool which was mainly developed to compute tail bounds on backlogs and delays. From these, bounds on average backlogs and delays are derived in the literature by integration. This paper improves such bounds on average backlogs by using Jensen's inequality; improved bounds on average delays follow immediately from Little's Law. The gain factor can be substantial especially at high utilizations, e.g., of order Ω (1/1-ρ ) when ρ → 1. This gain is further numerically illustrated for Markov-modulated On-Off arrival processes. Moreover, the paper shows how to improve standard stochastic network calculus performance bounds by suitably using FIFO service curves.

Real-time Internet services are gaining in popularity due to rapid provisioning of broadband access technologies. Delivery of high quality of experience (QoE) is important for consumer acceptance of multimedia applications. IP packet level errors affect QoE and the resulting quality degradations have to be taken into account in network operation. We derive the second order statistics of the number of packet losses in finite Markov models over several relevant time scales and adapt them to loss processes visible in wired and wireless transmission channels. Higher order Markov chains offer a large set of parameters to be exploited by complex fitting procedures. We experience that the 2-state Gilbert-Elliott model already captures a wide range of observed loss pattern appropriately and discuss how such models can be used to examine the quality degradations caused by packet losses.