This paper considers Café 2.0, an Automated Feedback system designed to support students' diagrammatic reasoning in STEM disciplines. Café 2.0 relies on a predefined error library, metamodels, and rules to correct students' solutions and deliver formative feedback. Implementing such a system requires a balance between constraining the solution syntax to enable AF and leaving freedom to students to reflect on their solution. This paper aims to evaluate whether the level of freedom provided by our AF system sufficiently prepares students for exams. In the exam, they must reason and construct solutions starting with a blank page. This study is conducted in an introductory programming course (CS1), based on two semesters (in 2022 and 2023), where Café 2.0 supports online homework. Findings reveal a discrepancy between students' performance in online homework and their success on exams. While many students feel comfortable with fill-in-the-blank diagrams in their homework, they struggle with the open-ended nature of exam tasks. Our results show that, among the students who succeeded in their online homework in 2023,$20\%$were still unable to produce any diagram in the exam. Additionally,$70\%$of them could not correctly provide a text description of their solution. To overcome this limitation, this paper proposes an enhanced system that integrates predefined rules with Large Language Models (LLMs). In this framework, LLMs serve as translators. Students can freely create their diagrams and annotate them with their own textual descriptions using a drawing editor. The LLM then maps these representations into a more structured format that aligns with predefined rules. In this way, Café 2.0 can generate accurate feedback. This transformed representation retains the same informational content as the original, differing only in format. This feature will offer students greater flexibility in constructing their solutions while ensuring that feedback remains precise and consistent by limiting the role of LLMs to translation rather than feedback generation.

Segment Routing (Sr), an advanced source routing mechanism, is a promising technology with a wide range of applications that has already gained traction from hardware vendors, network operators, and researchers alike. However, despite the abundance of activity surrounding Sr, little is known about how to gauge Sr deployment and its usage by operators.

In computer science, teaching first-year students to approach problems at varying levels of abstraction is both essential and challenging. While abstraction is a key component of problem solving, many students struggle with thinking abstractly. When presented with a problem, students often rush into coding, feeling closer to a solution through immediate feedback from the compiler or by simulating their code. However, this approach can cause them to overlook essential details, as their code may not account for all possible input scenarios. To address this issue, we introduced a programming methodology in our Introduction to Programming (CS1) course. This methodology requires students to first construct a graphical representation of their solution, ensuring coverage of all potential input cases, before translating it into code. To support regular practice in this diagrammatic reasoning process, we developed a learning tool called CAFÉ 2.0. Over the course of the semester, students use CAFÉ 2.0 to solve problems by submitting both a graphical model of their solution and the associated code implementation. In addition to evaluating the final code, CAFÉ 2.0 provides personalized feedback on the graphical model and how well it aligns with the code. This feedback guides students in refining their model and code, and resubmit them to get new feedback. CAFÉ 2.0's unique feature is its ability to automatically generate feedback on graphical models within an interactive online environment, fostering an engaging and supportive learning experience.

Nowadays, employers highly value soft skills, yet many students lack these fundamental abilities. Teaching soft skills involves fostering active student participation and facilitating communication of technical knowledge among peers. This approach presents challenges: (i) creating an engaging learning environment; (ii) ensuring students get timely feedback; (iii) finding an approach that is not too time-consuming for instructors to prepare.

Shaping first-year students' minds to solve problems at different levels of abstraction is both important and challenging. Although abstraction is a crucial skill in problem-solving, especially in STEM subjects, students often struggle with abstract thinking. They tend to focus their efforts on concrete aspects of the problem, where they feel more comfortable and closer to the final solution. Unfortunately, this approach can cause them to overlook critical details related to the problem or its solution. To address this issue in our Introduction to Programming (CS1) course, we introduced a programming methodology that requires students to create a graphical representation of their solution and then derive the code from it. To enable them to practice this diagrammatic reasoning approach on a regular basis, we developed a learning tool called CAFÉ 2.0. It facilitates a semester-long activity in which students solve problems by submitting both a graphical representation of their solution and its implementation. Further to checking the final implementation, CAFÉ 2.0 also provides personalized feedback on how students have graphically modeled their solution and how consistent it is with their code. This paper presents an overview of the features of CAFÉ 2.0 and the methodology it currently supports in the context of our CS1 course. Then, using a survey and learning analytics, this paper evaluates students' interactions with CAFÉ 2.0. Finally, the potential for extending CAFÉ 2.0 to other STEM disciplines is discussed.

The rise of cryptocurrencies has created new avenues for criminal money exchanges. Among various techniques, Bitcoin address clustering plays a crucial role in detecting and grouping addresses owned by the same entity. This fundamental step is essential for deanonymizing addresses and analyzing the flow of funds in the blockchain. This advancement contributes to the battle against illicit commerce, money laundering, fraud, scams, and similar activities. In this paper, we introduce two new heuristics, NSS and PEKET. NSS leverages Bitcoin non-standard scripts, while PEKET exploits the re-use of public keys to establish connections controlled by the same entity. Our contributions encompass (i) the detailed explanation of these two novel methods; (ii) the open-source publication of the tools we developed; and, (iii) the assessment of these heuristics using a proprietary extensive dataset of labeled addresses, which achieve precision levels of 1.0 and 0.979 respectively.

In the context of contemporary data center networks (DCNs), optimizing resource utilization and preventing congestion are critical objectives. This paper introduces Smoothie, a dynamic path load balancer specifically designed for real-time congestion management using Inband Network Telemetry (Int) for collecting network state pieces of information and Segment Routing Version 6 (SRv6) for rerouting traffic. Leveraging the programmable nature of the P4 programming language, Smoothie effectively achieves its goals. Our experimental results showcase Smoothie’s superiority over conventional Equal-Cost Multipath (ECMP) routing and its competitive performance compared to other congestion-aware load balancing solutions. We assert that these findings can be attributed to Smoothie’s proactive congestion response, which minimizes the necessity for TCP congestion window resizing, and its ability to intelligently reroute flows onto optimal paths, thereby substantially reducing route flapping. These outcomes highlight Smoothie’s potential to significantly enhance network performance within DCNs. Furthermore, Smoothie offers enhanced manageability, ease of maintenance, and simplified deployment through a centralized controller, further underscoring its value.

This extended abstract introduces James, a new tool for measuring how IPv6 Extension Headers (IPv6 EHs) are processed in the network. James sends specially crafted Paris traceroute packets between a set of controlled vantage points. Early measurement results show that IPv6 EHs may be dropped in the network, depending on their type and the size of the Extension Header.

This extended abstract discusses our first attempt in revealing the deployment and usage of Segment Routing with MPLS as forwarding plane (Sr-Mpls), in a large European ISP. To do so, we study a longitudinal traceroute like dataset. Early results show that Sr-Mpls is mainly used in interworking with classic MPLS tunnels.

Researchers often face the lack of data on large operational networks to understand how they are used, how they behave, and sometimes how they fail. This data is crucial to drive the evolution of Internet protocols and develop techniques such as traffic engineering, DDoS detection and mitigation. Companies that have access to measurements from operational networks and services leverage this data to improve the availability, speed, and resilience of their Internet services. Unfortunately, the availability of large datasets, especially collected regularly over a long period of time, is a daunting task that remains scarce in the literature.

Recently, Intent-Based Networking (IBN) has known an increasing interest from both the industry and research communities. IBN comes with the advantage of easily expressing the desired state of a network. In parallel, service assurance, through observability, has been becoming more prevalent to maximize the business continuity. In that spirit, Service Assurance in Intent-based Networking (Sain), is under standardization at the IETF and proposes a general framework towards closed-loop automation for service assurance. This paper introduces the Diagnostic Agent (DxAgent), an open-source Sain implementation whose purpose is to determine symptoms and health levels of the different subservices of a network service. As such, the DxAgent appears as a first step towards closed-loop automation for service assurance. This paper describes the DxAgent implementation and demonstrates its efficiency through use cases.

TCP and TLS are among the essential protocols in today's Internet. TCP ensures reliable data delivery while TLS secures the data transfer. Although they are very often used together, they have been designed independently following the Internet layered model. This paper demonstrates the various benefits that a closer integration between TCP and TLS would bring.

This abstract focuses on a CS2 course in which gamified homework exercises are provided to students instead of in-class exercise sessions. The course, provided to first-year Computer Science students, introduces a rigorous methodology to write programs using Loop Invariants, recursion, and basic data structures such as Files, Lists, Queues, and Stacks. In early 2020, the COVID-19 pandemic caused a lock-down in our country. The universities decided to fully switch to remote teaching. As the exercises sessions previously consisted of solving problems on a blackboard, we had to design in a hurry course materials that would cope with remote teaching. Instead of giving students yet another podcast in their course schedule, we gave them homework exercises, we called GameCode, that they could do at their own convenience. These exercises are inspired by GameBooks in which the reader can choose the path she takes to complete the story. With GameCode, students can choose their own solving path for each exercise. This can be related to gamification.

Blockchains are typically managed by peer-to-peer (P2P) networks providing the support and substrate to the so-called distributed ledger (DLT), a replicated, shared, and syn-chronized data structure, geographically spread across multiple nodes. The Bitcoin (BTC) blockchain is by far the most well-known DLT, used to record transactions among peers, based on the BTC digital currency. In this paper we focus on the network side of the BTC P2P network, analyzing its nodes from a purely network measurements-based approach. We present a BTC crawler able to discover and track the BTC P2P network through active measurements, and use it to analyze its main properties. Through the combined analysis of multiple snapshots of the BTC network as well as by using other publicly available data sources on the BTC network and DLT, we unveil the BTC P2P network, locate its active nodes, study their performance, and track the evolution of the network over the past two years. Among other relevant findings, we show that (i) the size of the BTC network has remained almost constant during the last 12 months – since the major BTC price drop in early 2018, (ii) most of the BTC P2P network resides in US and EU countries, and (iii) despite this western network locality, most of the mining activity and corresponding revenue is controlled by major mining pools located in China. By additionally analyzing the distribution of BTC coins among independent BTC entities (i.e., single BTC addresses or groups of BTC addresses controlled by the same actor), we also conclude that (iv) BTC is very far from being the decentralized and uncontrolled system it is so much advertised to be, with only 4.5% of all the BTC entities holding about 85% of all circulating BTC coins.

Over the past two decades, the research community has developed many approaches to study the Internet topology. In particular, starting from 2007, various tools explored the inference of subnets, i.e., sets of devices located on the same connection medium which can communicate directly with each other at the link layer. In this paper, we first discuss how today's traffic engineering policies increase the difficulty of subnet inference. We carefully characterize typical difficulties and quantify them in the wild. Next, we introduce WISE (Wide and lInear Subnet inferencE), a new tool which tackles those difficulties and discovers, in a linear time, large networks subnets. Based on two ground truth networks, we demonstrate that WISE outperforms state-of-the-art tools. Then, through large-scale measurements, we show that the selection of a vantage point with WISE has a marginal effect regarding accuracy. Finally, we discuss how subnets can be used to infer neighborhoods (i.e., aggregates of subnets located at most one hop from each other). We discuss how these neighborhoods can lead to bipartite models of the Internet and present validation results and an evaluation of neighborhoods in the wild, using WISE. Both our code and data are freely available.

Internet topology discovery aims at analyzing one of the most complex distributed systems currently deployed. Usually, it relies on measurement campaigns using hop-limited probes sent with traceroute. However, this probing tool comes with several limits. In particular, some MPLS clouds might obfuscate collected traces. The resulting Internet maps, their inferred properties, and the graph models are thus incomplete and inaccurate. In this paper, we introduce TNT (Trace the Naughty Tunnels), an extension to Paris traceroute for revealing, or at least detect, all MPLS tunnels along a path. First, along with traceroute and ping probes, TNT looks for hints indicating the presence of hidden tunnels. Those hints are peculiar patterns in the resulting output, e.g., significant TTL shifts or duplicate IP addresses. Second, if those hints trigger alarms, TNT launches additional dedicated probing for possibly revealing hidden tunnels. We use GNS3 to reproduce, verify, and understand the limits and capabilities of TNT in a controlled environment. We also calibrate the thresholds at which alarms are triggered through a dedicated measurement campaign. Finally, we deploy TNT on the Archipelago platform and provide a quantified classification of MPLS configurations. All our results, including the data, the code, and the GNS3 experiments, are fully and publicly available.

For years, Internet topology research has been conducted through active measurement. For instance, Caida builds router level topologies on top of IP level traces obtained with traceroute. The resulting graphs contain a significant amount of nodes with a very large degree, often exceeding the actual number of interfaces of a router. Although this property may result from inaccurate alias resolution, we believe that opaque MPLS clouds made of invisible tunnels are the main cause. Using Layer-2 technologies such as MPLS, routers can be configured to hide internal IP hops from traceroute. Consequently, an entry point of an MPLS network appears as the neighbor of all exit points and the whole Layer-3 network turns into a dense mesh of high degree nodes.

Traffic Engineering (TE) is one of the keys for improving packet forwarding in the Internet. It allows IP network operators to finely tune their forwarding paths according to various customer needs. One of the most popular tool available today for optimizing the use of networking resources is MPLS. On the one hand, operators may use MPLS and label distribution mechanisms such as RSVP-TE in conjunction with BGP to define multiple transit paths (for a given edge pair) verifying different constraints on their network. On the other hand, when operators simply enable LDP for distributing MPLS labels in order to improve the scalability of their network, another kind of path diversity may appear thanks to the ECMP feature of IGP routing.

A significant portion of what is known about Internet routing stems out from public BGP datasets. For this reason, numerous research efforts were devoted to (i) assessing the (in)completeness of the datasets, (ii) identifying biases in the dataset, and (iii) augmenting data quality by optimally placing new collectors. However, those studies focused on techniques to extract information about the AS-level Internet topology. In this paper, we show that considering different metrics influences the conclusions about biases and collector placement. Namely, we compare AS-level topology discovery with iBGP policy inference. We find that the same datasets exhibit significantly diverse biases for these two metrics. For example, the sensitivity to the number and position of collectors is noticeably different. Moreover, for both metrics, the marginal utility of adding a new collector is strongly localized with respect to the proximity of the collector. Our results suggest that the “optimal” position for new collectors can only be defined with respect to a specific metric, hence posing a fundamental trade-off for maximizing the utility of extensions to the BGP data collection infrastructure.

The future Internet has been a hot topic during the past decade and many approaches towards this future Internet, ranging from incremental evolution to complete clean slate ones, have been proposed. One of the proposition, LISP, advocates for the separation of the identifier and the locator roles of IP addresses to reduce BGP churn and BGP table size. Up to now, however, most studies concerning LISP have been theoretical and, in fact, little is known about the actual LISP deployment performance. In this paper, we fill this gap through measurement campaigns carried out on the LISP Beta Network. More precisely, we evaluate the performance of the two key components of the infrastructure: the control plane (i.e., the mapping system) and the interworking mechanism (i.e., communication between LISP and non-LISP sites). Our measurements highlight that performance offered by the LISP interworking infrastructure is strongly dependent on BGP routing policies. If we exclude misconfigured nodes, the mapping system typically provides reliable performance and relatively low median mapping resolution delays. Although the bias is not very important, control plane performance favors USA sites as a result of its larger LISP user base but also because European infrastructure appears to be less reliable.

Middleboxes such as firewalls, NAT, proxies, or Deep Packet Inspection play an increasingly important role in various types of IP networks, including enterprise and cellular networks. Recent studies have shed the light on their impact on real traffic and the complexity of managing them. Network operators and researchers have few tools to understand the impact of those boxes on any path. In this paper, we propose tracebox, an extension to the widely used traceroute tool, that is capable of detecting various types of middlebox interference over almost any path. tracebox sends IP packets containing TCP segments with different TTL values and analyses the packet encapsulated in the returned ICMP messages. Further, as recent routers quote, in the ICMP message, the entire IP packet that they received, tracebox is able to detect any modification performed by upstream middleboxes. In addition, tracebox can often pinpoint the network hop where the middlebox interference occurs. We evaluate tracebox with measurements performed on PlanetLab nodes. Our analysis reveals various types of middleboxes that were not expected on such an experimental testbed supposed to be connected to the Internet without any restriction.

Fingerprinting networking equipment has many potential applications and benefits in network management and security. More generally, it is useful for the understanding of network structures and their behaviors. In this paper, we describe a simple fingerprinting mechanism based on the initial TTL values used by routers to reply to various probing messages. We show that main classes obtained using this simple mechanism are meaningful to distinguish routers platforms. Besides, it comes at a very low additional cost compared to standard active topology discovery measurements. As a proof of concept, we apply our method to gain more insight on the behavior of MPLS routers and to, thus, more accurately quantify their visible/invisible deployment.

Recent developments in router level topology discovery have suggested the introduction of IGMP probing in addition to standard techniques such as traceroute and alias resolution. With a single IGMP probe, one can obtain all multicast interfaces and links of a multicast router. If such a probing is a promising approach, we noticed that IGMP probes are subject to filtering, leading so to the fragmentation of the collected multicast graph into several disjoint connected components. In this paper, we cope with the fragmentation issue. Our contributions are threefold: (i) we experimentally quantify the damages caused by IGMP filtering on collected topologies of large tier-1 ISPs; (ii) using traceroute data, we construct a hybrid graph and estimate how far each IGMP fragment is from each other; (iii) we provide and experimentally evaluate a recursive approach for reconnecting disjoint multicast components. The key idea of the third contribution is to recursively apply alias resolution to reassemble disjoint fragments and, thus, progressively extend the mapping of the targeted ISP. Data presented in the paper, as well as reconstructed topologies, are freely available at http://svnet.u-strasbg.fr/merlin.

For a long time, traceroute measurements combined with alias resolution methods have been the sole way to collect Internet router level maps. Recently, a new approach has been introduced with the use of a multicast management tool, mrinfo, and a recursive probing scheme. In this paper, after analyzing advantages and drawbacks of probing approaches based on traceroute and mrinfo, we propose a hybrid discovery tool, Merlin (MEasure the Router Level of the INternet), mixing mrinfo and traceroute probes. Using a central server controlling a set of distributed vantage points in order to increase the exploration coverage while limiting the probing redundancy, the purpose of Merlin is to provide an accurate router level map inside a targeted Autonomous System (AS). Merlin also takes advantage of alias resolution methods to reconnect scattered multicast components. To evaluate the performance of Merlin, we report experimental results describing its efficiency in topology exploration and reconstruction of several ASes.

The Internet topology data collected through traceroute exploration has been extensively studied in the past. In particular, a remarkable property of the Internet, the power-law shape of node degree distribution, drew the attention of the research community. Several studies have since questioned this property.

Redundant connectivity (or multiconnectivity) between adjacent autonomous systems (ASes) is important for interdomain traffic engineering and fast recovery in case of failures. However, the redundancy of ASes business relationship links has not been quantitatively studied, mainly due to the difficulty of obtaining relevant data. In this paper, we show that the mrinfo multicast monitoring tool can provide useful data about the Internet topology and such redundant links in particular. Our analysis relies on more than four years of daily queries to about ten thousand routers mapped into more than two hundred ASes. We demonstrate that peering links between ASes are frequently redundant. In particular, our analysis shows that more than half of the studied ASes pairs are connected through multiple physical links. We then refine our analysis by considering the different types of ASes and their business relationships. A particular result of our analysis is that at least 75% of the peer-to-peer relationships between adjacent Tier-1 ASes are redundant, i.e., the connections between these ASes involve several physical links. Our analysis is conservative, providing so a lower bound, as some links might not be seen by mrinfo due to ISPs filtering policies.

During the past ten years, we have seen the emergence of a set of applications requiring more and more quality of service (QoS). For instance, IPTV needs large bandwidth and delays as lows as possible. Further, while previously a content was located in a single place, it is, nowadays, frequent that the content is replicated among a set of servers located anywhere on five continents or even among users themselves. Perfect examples of this are peer-to-peer (P2P) applications and FTP mirrors. In addition, multihoming, i.e., the ability of having different connections to Internet potentially through different providers, is becoming more and more popular [1, 2]. Finally, network level protocols such as SHIM6 or LISP must often choose the best path among a list of highly disparate paths according to traffic engineering or policies considerations (see discussions on IETF mailing lists). This situation leads to more complexity in ensuring QoS to the user. We have now to maximize the QoS perceived by the user based on a set of highly disparate paths. In addition, in many new applications, path selection and QoS are ensured at the application layer resulting in an ineffective network level resources use. Today, although many of measurements techniques have been developed within the IPPM working group of the IETF, an application that needs to select a path or a server must implement its own measurement system to obtain data to perform its selection. Thus, several applications running on the same host or in the same campus will probably perform almost the same kind of measurements. Duplicating those measurements is not the appropriate solution. This work was partially supported by the Europeanfounded

Where distributed agents must share voluminous set membership information, Bloom filters provide a compact, though lossy, way for them to do so. Numerous recent networking papers have examined the trade-offs between the bandwidth consumed by the transmission of Bloom filters, and the error rate, which takes the form of false positives, and which rises the more the filters are compressed. In this paper, we introduce the retouched Bloom filter (RBF), an extension that makes the Bloom filter more flexible by permitting the removal of selected false positives at the expense of generating random false negatives. We analytically show that RBFs created through a random process maintain an overall error rate, expressed as a combination of the false positive rate and the false negative rate, that is equal to the false positive rate of the corresponding Bloom filters. We further provide some simple heuristics that decrease the false positive rate more than than the corresponding increase in the false negative rate, when creating RBFs. Finally, we demonstrate the advantages of an RBF over a Bloom filter in a distributed network topology measurement application, where information about large stop sets must be shared among route tracing monitors.

Topology discovery systems are starting to be introduced in the form of easily and widely deployed software. Unfortunately, the research community has not examined the problem of how to perform such measurements efficiently and in a network-friendly manner. This paper describes several contributions towards that end. These were first presented in the proceedings of ACM Sigmetrics 2005. We show that standard topology discovery methods (e.g., skitter) are quite inefficient, repeatedly probing the same interfaces. This is a concern, because when scaled up, such methods will generate so much traffic that they will begin to resemble distributed denial-of-service attacks. We propose two metrics focusing on redundancy in probing and show that both are important. We also propose and evaluate Doubletree, an algorithm that strongly reduces redundancy, while maintaining nearly the same level of node and link coverage. The key ideas are to exploit the tree-like structure of routes to and from a single point in order to guide when to stop probing, and to probe each path by starting near its midpoint. Following the Sigmetrics work, we implemented Doubletree, and deployed it in a real-network environment. This paper describes that implementation, as well as preliminary favorable results

There is a growing interest in discovery of internet topology at the interface level. A new generation of highly distributed measurement systems is currently being deployed. Unfortunately, the research community has not examined the problem of how to perform such measurements efficiently and in a network-friendly manner. In this paper we make two contributions toward that end. First, we show that standard topology discovery methods (e.g., skitter) are quite inefficient, repeatedly probing the same interfaces. This is a concern, because when scaled up, such methods will generate so much traffic that they will begin to resemble DDoS attacks. We measure two kinds of redundancy in probing (intra- and inter-monitor) and show that both kinds are important. We show that straightforward approaches to addressing these two kinds of redundancy must take opposite tacks, and are thus fundamentally in conflict. Our second contribution is to propose and evaluate Doubletree, an algorithm that reduces both types of redundancy simultaneously on routers and end systems. The key ideas are to exploit the tree-like structure of routes to and from a single point in order to guide when to stop probing, and to probe each path by starting near its midpoint. Our results show that Doubletree can reduce both types of measurement load on the network dramatically, while permitting discovery of nearly the same set of nodes and links.