Video-conferencing applications face an unwavering surge in traffic, stressing their underlying infrastructure in unprecedented ways. This paper rethinks the key building block for conferencing infrastructures — selective forwarding units (SFUs). SFUs relay and adapt media streams between participants and, today, run in software on general-purpose servers. Our main insight, discerned from dissecting the operation of production SFU servers, is that SFUs largely mimic traditional packet-processing operations such as dropping and forwarding. Guided by this, we present Scallop, an SDN-inspired SFU that decouples video-conferencing applications into a hardware-based data plane for latency-sensitive and frequent media operations, and a software control plane for the (infrequent) remaining tasks, such as analyzing feedback signals and session management. Scallop is a general design that is suitable for a variety of hardware platforms, including programmable switches and SmartNICs. Our Tofino-based implementation fully supports WebRTC and delivers 7-422× improved scaling over a 32-core commodity server, while reaping performance improvements by cutting forwarding-induced latency by 26×. We also present an implementation of Scallop on the BlueField-3 SmartNIC.

Video-conferencing applications impose high loads and stringent performance requirements on the network. To better understand and manage these applications, we need effective ways to measure performance in the wild. For example, these measurements would help network operators in capacity planning, troubleshooting, and setting QoS policies. Unfortunately, large-scale measurements of production networks cannot rely on end-host cooperation, and an in-depth analysis of packet traces requires knowledge of the header formats. Zoom is one of the most sophisticated and popular applications, but it uses a proprietary network protocol. In this paper, we demystify how Zoom works at the packet level, and design techniques for analyzing Zoom performance from packet traces. We conduct systematic controlled experiments to discover the relevant unencrypted fields in Zoom packets, as well as how to group streams into meetings and how to identify peer-to-peer meetings. We show how to use the header fields to compute metrics like media bit rates, frame sizes and rates, and latency and jitter, and demonstrate the value of these fine-grained metrics on a 12-hour trace of Zoom traffic on our campus network.

Round-trip time (RTT) is a central metric that influences end-user QoE and can expose traffic-interception attacks. Many popular RTT monitoring techniques either send active probes (that do not capture application-level RTTs) or passively monitor only the TCP handshake (which can be inaccurate, especially for long-lived flows). High-speed programmable switches present a unique opportunity to monitor the RTTs continuously and react in real time to improve performance and security. In this paper, we present Dart, an inline, real-time, and continuous RTT measurement system that can enable automated detection of network events and adapt (e.g., routing, scheduling, marking, or dropping traffic) inside the network. However, designing Dart is fraught with challenges, due to the idiosyncrasies of the TCP protocol and the resource constraints in high-speed switches. Dart overcomes these challenges by strategically limiting the tracking of packets to only those that can generate useful RTT samples, and by identifying the synergy between per-flow state and per-packet state for efficient memory use. We present a P4 prototype of Dart for the Tofino switch, as well our experiments on a campus testbed and simulations using anonymized campus traces. Dart, running in real time and with limited data-plane memory, is able to collect 99% of the RTT samples of an offline, software baseline---a variant of the popular tcptrace tool that has access to unlimited memory.

Network traffic classification is an important tool for network administrators in enabling monitoring and service provisioning. Traditional techniques employed in classifying traffic do not work well for mobile app traffic due to lack of unique signatures. Encryption renders this task even more difficult since packet content is no longer available to parse. More recent techniques based on statistical analysis of parameters such as packet-size and arrival time of packets have shown promise; such techniques have been shown to classify traffic from a small number of applications with a high degree of accuracy. However, we show that when employed to a large number of applications, the performance falls short of satisfactory. In this paper, we propose a novel set of bit-sequence based features which exploit differences in randomness of data generated by different applications. These differences originating due to dissimilarities in encryption implementations by different applications leave footprints on the data generated by them. We validate that these features can differentiate data encrypted with various ciphers (89% accuracy) and key-sizes (83% accuracy). Our evaluation shows that such features can not only differentiate traffic originating from different categories of mobile apps (90% accuracy), but can also classify 175 individual applications with 95% accuracy.

A large fraction of video content providers have adopted adaptive bitrate streaming over HTTP. The client player typically runs an adaptive bitrate (ABR) algorithm to decide upon the most optimal quality for the next few seconds of video playback. State-of-the-art ABR algorithms attempt to achieve an optimal trade-off among the competing objectives of high bitrate, less rebuffering, and high smoothness, in the face of unpredictable bandwidth variability. However, optimal bandwidth utilization does not necessarily ensure high quality of experience (QoE). Different users have different content preferences even within the same video, due to differences in team loyalties (in sport), character preferences (in movies and soaps), and so on. In this work, we present HotDASH, a system which enables opportune prefetching of user-preferred temporal video segments (called hotspots). HotDASH implements a prefetch module in the open source DASH player dash.js, which is powered by an optimal prefetch and bitrate decision engine. The decision engine is designed as a cascaded reinforcement learning (RL) model, implemented using a state-of-the-art actor-critic RL algorithm over a neural network. We train the neural network using trace-driven simulations over a large variety of bandwidth conditions. HotDASH outperforms all baseline algorithms, with a 16.2% QoE improvement over the best-performing baseline, and achieves 14.31% better average bitrate due to its ability to prefetch opportunistically.

Side-channel attacks, which exploit deficiencies in the implementations of theoretically secure systems, have been known to take a variety of forms on the mobile platforms. In this work, we present Magneto, a magnetic field based app classification mechanism. Magneto captures the Hall effect due to energy consumption by different components in a smartphone, and fingerprints apps based on data captured with a Hall sensor, and a phone magnetometer. We demonstrate that our mechanism can identify magnetic field changes due to varying levels of energy consumption. We further show that Magento can not only classify between apps in the same scenario, but also can tell apart scenarios when the phone is being charged (with an AC adapter, wireless charger, or powerbank) or not. We perform validation experiments with 5 different apps, and achieve ~85% accuracy with 3 Android apps, subject to 3 different charging scenarios.

In this paper we analyze Facebook's Free Basics program, which provides free Internet access to a restricted set of web services. As the program grows to 60+ developing countries, an independent and data-driven audit of its scope and outreach is highly relevant to the ICTD community.

Among the mobile applications contributing to the surging Internet traffic, video applications are some of the biggest contributors. Most of these video applications use HTTP/HTTPS tunneling making it difficult to apply port based or packet data based identification of flows. This makes it challenging for network operators to enforce bandwidth regulation policies for app based service differentiation due to lack of flow identification mechanisms for mobile apps. We explore a packet data agnostic feature of video flows, namely packet-size, to identify the flows. We show that it is possible to train a classifier that can distinguish packets from streaming and interactive video apps with high accuracy. We design and implement a system, called MoViDiff, with this classifier at the core, that allows bandwidth regulation between video traffic of two different categories, streaming and interactive. We show that we can achieve an average accuracy of 96% in classifying the traffic, with the maximum accuracy reaching as high as 98%.

YouTube has emerged as the largest player among video streaming services, serving video content for users using DASH. Research studies on various aspects of YouTube, especially its streaming service, abound in the literature. However, these works study YouTube streaming from the periphery, and report results based on their understanding of general DASH recommendations. In this study, we explore in depth YouTube's implementation of the DASH client. We identify important parameters in YouTube's rate adaptation algorithm, and study their roles. In a departure from existing literature, we observe that YouTube opportunistically adapts segment length, in addition to quality level, in response to bandwidth fluctuations. We report that this scheme results in a much lower average data wastage ratio (0.82x10-6), than reported earlier. We also propose an analytical model, augmented with a machine learning based classifier (with average accuracy of 85.75%), to predict data consumption for a playback session in advance.