Due to its superior efficiency, network operators frequently prefer flow monitoring over full packet captures. However, packet-level information is crucial for the timely and reliable detection, investigation, and mitigation of security incidents. Currently, no solution effectively balances these two contradicting approaches, forcing network operators to compromise between efficiency and accuracy. In this paper, we thus propose HybridMon, a hybrid solution that combines condensed packet-level monitoring with selective flow-based aggregation to strike a new balance between efficiency and accuracy. Operating on the data plane of P4-programmable switches, HybridMon enables fine-grained, practical, and flexible network monitoring at Tbps speeds. We validate the effectiveness of HybridMon through extensive evaluations using Internet backbone and university campus traffic traces, demonstrating its reliability and performance in network forensics and intrusion detection contexts. Our results show that HybridMon reliably monitors all flows while reducing the output bandwidth to 12% to 20% compared to packet monitoring when exporting standard features.

Programmable network devices are on the rise with many applications ranging from improved network management to accelerating and offloading parts of distributed systems. Processor-based SmartNICs, match-action-based switches, and FPGA devices offer on-path programmability. Whereas processor-based SmartNICs are much easier and more versatile to program, they have the huge disadvantage that the resulting throughput may vary strongly and is not easily predictable even to the programmer. We want to close this gap by presenting a methodology which, given a SmartNIC program, determines the achievable throughput of this SmartNIC program in terms of achievable packet rate and bit rate. Our approach combines incremental longest path search with SMT checks to establish a lower bound for the slowest satisfiable program path. By analyzing only the slowest program paths, our approach estimates throughput bounds within a few seconds. The evaluation with our prototype on real programs shows that the estimated throughput guarantees are correct with an error of at most 1.7% and provide a tight lower bound for processor- and memory-bottlenecked programs with only 8.5% and 18.2% underestimation.

Access to networks for purposes of executing remote services has become a dominant form of communication, while virtualization has enabled the flexible and fast deployment of those services across distributed locations. This seems at odds with the design that drives the network layer of the Internet. Our paper presents an approach to flexibly deploy a network layer solution for optimizing service access within a single domain, while retaining full connectivity to Internet-based services. We discuss design considerations and the resulting design. We analyze expected gains from our solution.

HTTP/2 and HTTP/3 avoid concurrent connections but instead multiplex requests over a single connection. Besides enabling new features, this reduces overhead and enables fair bandwidth sharing. Redundant connections should hence be a story of the past with HTTP/2. However, they still exist, potentially hindering innovation and performance. Thus, we measure their spread and analyze their causes in this paper. We find that 36% - 72% of the 6.24 M HTTP Archive and 78% of the Alexa Top 100k websites cause Chromium-based webbrowsers to open superfluous connections. We mainly attribute these to domain sharding, despite HTTP/2 efforts to revert it, and DNS load balancing, but also the Fetch Standard.

Congestion control (CC) is an indispensable component of transport protocols to prevent congestion collapse as it distributes the available bandwidth among all competing flows, ideally in a fair manner. It thus has a large impact on performance and there exists a constantly evolving set of CC algorithms, each addressing different performance needs. While the algorithms are commonly tested regarding the problems underlying their implementation, the interaction with existing algorithms is often not considered. Additionally considering the fact that content providers (CPs) such as content distribution networks (CDNs) are known to tune TCP stacks for performance gains, the large assortment of algorithms opens the door for custom parametrization and potentially unfair bandwidth sharing. In this paper, we thus empirically investigate if current Internet traffic generated by CPs still adheres to the conventional understanding of fairness. For this, we compare fairness properties of testbed hosts to actual traffic of six major CPs subject to different queue sizes and queueing disciplines in a home-user setting. Additionally, we investigate how mice and elephant flows from the different CPs interact. We find that some employed CC algorithms lead to significantly asymmetric bandwidth shares and very poor flow completion times for mice flows. Fortunately, AQMs such as FQ_CoDel are able to alleviate such unfairness.

QUIC, as the foundation for HTTP/3, is becoming an Internet reality. A plethora of studies already show that QUIC excels beyond TCP+ TLS+HTTP/2. Yet, these studies compare a highly optimized QUIC Web stack against an unoptimized TCP-based stack. In this paper, we bring TCP up to speed to perform an eye-level comparison. Instead of relying on technical metrics, we perform two extensive user studies to investigate QUIC's impact on the quality of experience. First, we investigate if users can distinguish two protocol versions in a direct comparison, and we find that QUIC is indeed rated faster than TCP and even a tuned TCP. Yet, our second study shows that this perceived performance increase does mostly not matter to the users, and they rate QUIC and TCP indistinguishable.

High packet rates at ≥ 10 GBit/s challenge the packet processing performance of network stacks. A common solution is to offload (parts of) the user-space packet processing to other execution environments, e.g., into the device driver (kernel-space), the NIC or even from virtual machines into the host operating system (OS), or any combination of those. While common wisdom states that offloading optimizes performance, neither benefits nor negative effects are comprehensively studied. In this paper, we aim to shed light on the benefits and shortcomings of eBPF/XDP-based offloading from the user-space to i) the kernel-space or ii) a smart NIC-including VM virtualization. We show that offloading can indeed optimize packet processing, but only if the task is small and optimized for the target environment. Otherwise, offloading can even lead to detrimental performance.

TCP congestion control and particularly its initial congestion window (IW) size is one long-debated topic that can influence Web performance. Its size is, however, assumed to be static by IETF recommendations-despite being network- and application-dependent-and only infrequently changed in its history. To understand if the standardization and research perspective still meets Internet reality, we study the IW configurations in IPv4 and of major content delivery networks (CDNs). We have been regularly inspecting IPv4 for HTTP and TLS servers to investigate their IW configuration and found a steady increase in IETF-recommended configurations. We additionally study how CDNs configure their IWs given their relevance for content distribution. To shed light on network-dependent CDN configurations, we use a globally distributed infrastructure of VPNs giving access to residential access links. We observe that most CDNs are well aware of the IW's impact and find a high amount of customization that is beyond current Internet standards. We find various initial window configurations, most below 50 segments, yet, with exceptions of up to 100 segments-the tenfold of current standards. This paper highlights that Internet reality has drifted away from recommended and standardized practices. Driven by these findings, we investigate the effects of this new reality on the slow start of Cubic and BBR congestion controlled TCP flows. We find that TCP pacing is a key to enable increased IWs when competing against other traffic.

In many areas such as bioinformatics, pattern recognition, and signal processing, Hidden Markov Models (HMMs) have become an indispensable statistical tool. A fundamental building block for these applications is the Forward algorithm which computes the likelihood to observe a given sequence of emissions for a given HMM. The classical Forward algorithm requires that one party holds both the model and observation sequences. However, we observe for many emerging applications and services that the models and observation sequences are held by different parties who are not able to share their information due to applicable data protection legislation or due to concerns over intellectual property and privacy. This renders the application of HMMs infeasible. In this paper, we show how to resolve this evident conflict of interests using secure two-party computation. Concretely, we propose Priward which enables two mutually untrusting parties to compute the Forward algorithm securely, i.e., without requiring either party to share her sensitive inputs with the other or any third party. The evaluation of our implementation of Priward shows that our solution is efficient, accurate, and outperforms related works by a factor of 4 to 126. To highlight the applicability of our approach in real-world deployments, we combine Priward with the widely used HMMER biosequence analysis framework and show how to analyze real genome sequences in a privacy-preserving manner.

Improving web performance is fueling the debate of sizing TCP's initial congestion window (IW), which is a critical performance parameter especially for short-lived flows. This debate yielded several RFC updates to recommended IW sizes, e.g., an increase to IW10 in 2010. The current adoption of IW recommendations is, however, unknown. In this paper, we therefore conduct large-scale measurements covering the entire IPv4 space inferring the IW distribution size by probing HTTP and HTTPS servers. We present an HTTP and TLS scanning method implemented in ZMap, enabling quick estimations of IW sizes at Internet scale. For the first time since the standardization and implementation of IW 10, we shed light on the rugged landscape of IW configurations on the Internet.

Within the Internet of Things (IoT), Smart Things (STs) promise to permeate all contexts of daily life, offering digital access to their physical functionality. Mobile users then would be able to ubiquitously and spontaneously interact with things they encounter, enabling a wealth of diverse usage scenarios and applications. Currently, however, ST interaction requires a pre-controlled Internet or network connection as well as the prior installation of the ST-specific interaction interface, i.e., smartphone app. Users can thus only interact with known things, in contrast to the vision of spontaneous, ubiquitous discovery and interaction. We thus propose STIF (Smart Things Interaction Framework), enabling local wireless discovery of STs spontaneously via Wi-Fi, Bluetooth Low Energy, Visible Light Communication, or Acoustic Communication. STIF allows STs to transmit their interaction interface directly to users and supports interaction based on user input via touch and AR GUIs as well as motion and speech recognition. We implement STIF for Android phones as well as Arduino and Raspberry Pi things and demonstrate the real-life applicability of the supported communication and interaction techniques.

Mobile users are continuously surrounded by heterogeneous (mobile) devices that provide a basis for direct multimedia interaction within the immediate physical context. However, current multimedia approaches are restricted to sense the availability of devices and their respective multimedia application content through Internet services that manage the locality of devices and content. Each service thereby manages only the narrow context of each device according to the respective application, preventing devices and approaches from sensing the diversity, spontaneity, and dynamics of mobile contexts and the physical interaction scope.

No abstract available.

Computer Vision (CV) approaches, e.g., as the basis for mobile Augmented Reality (AR), depend on continuous Internet access for image uploads and large-scale Internet databases to perform image recognition against comparison images. This dependency impedes the ubiquity of applying CV in spontaneous, real-world mobile scenarios as users may not have continuous Internet access. Furthermore, the underlying databases are inherently volatile and may only afford sporadic coverage.