Prefetching is a double-edged sword. It can hide the latency of data transfers over poor and intermittently connected wireless networks, but the costs of prefetching in terms of increased energy and cellular data usage are potentially substantial, particularly for data prefetched incorrectly. Weighing the costs and benefits of prefetching is complex, and consequently most mobile applications employ simple but sub-optimal strategies.

Mobile devices face a diverse and dynamic set of networking options. Using those options to the fullest requires knowledge of application intent. This paper describes Intentional Networking, a simple but powerful mechanism for handling network diversity. Applications supply a declarative label for network transmissions, and the system matches transmissions to the most appropriate network. The system may also defer and re-order opportunistic transmissions subject to application-supplied mutual exclusion and ordering constraints. We have modified three applications to use Intentional Networking: BlueFS, a distributed file system for pervasive computing, Mozilla's Thunderbird e-mail client, and a vehicular participatory sensing application. We evaluated the performance of these applications using measurements obtained by driving a vehicle through WiFi and cellular 3G network coverage. Compared to an idealized solution that makes optimal use of all aggregated available networks but that lacks knowledge of application intent, Intentional Networking improves the latency of interactive messages from 48% to 13x, while adding no more than 7% throughput overhead.

Several research studies have been devoted to improving the reliability and performance of the Internet by utilizing redundant communication paths between end points. Multihoming, coupled with intelligent route control, and overlay networks are two main streams in this area of research which attempt to leverage redundant connections of the Internet for increased reliability and performance. However, the effectiveness of these approaches depends on the natural diversity of redundant paths between two endhosts in terms of physical links, routing infrastructure, administrative control, and geographical distribution. Even in the case of redundant paths, if traffic between two hosts is not actually routed along completely disjoint paths, congestion or failure of a single shared link or router can adversely affect the end-to-end performance or availability of all paths. This paper presents an experimental study of path diversity on the Internet, focusing on the impact of path diversity on multihomed and overlay networks. We base our analysis on traceroutes and routing table data collected from several vantage points in the Internet including: looking glasses at 10 major Internet service providers (ISPs), RouteViews servers from 20 ISPs, and more than 50 PlanetLab nodes globally distributed across the Internet. Using this data, we quantify the extent of path diversity in multihoming and overlay networks, highlighting the limitations, and also identifying the source of the limitations in these architectures. From the analysis, we learn that both multihoming route control and current overlay networks are not able to ensure path diversity, which makes it very difficult to provide high-availability services even with the use of these systems. We believe that this work provides the insight into building future systems based on understanding path diversity

Recently, overlay networks have emerged as a means to enhance end-to-end application performance and availability. Overlay networks attempt to leverage the inherent redundancy of the Internet's underlying routing infrastructure to detour packets along an alternate path when the given primary path becomes unavailable or suffers from congestion. However, the effectiveness of these overlay networks depends on the natural diversity of overlay paths between two endhosts in terms of physical links, routing infrastructure, administrative control, and geographical distribution. Several recent studies realized that a measurable number of path outages were unavoidable even with use of such overlay networks. This stems from the fact that overlay paths might overlap with each other when overlay nodes are selected without considering the underlying topology. An overlay network's ability to quickly recover from path outages and congestion is limited unless we ensure path independence at the IP layer. This paper proposes a novel framework for topology-aware overlay networks. In this framework, we expressly design overlay networks, aiming to maximize path independence without degrading performance. We develop measurement-based heuristics for 1) placement of overlay nodes inside an ISP and 2) selection of a set of ISPs. We base our analysis on extensive data collection from 232 points in 10 ISPs, and 100 PlanetLab nodes. On top of node placement, we present measurement-based verification to conclude that single-hop overlay routing performs as well as multi-hop routing with respect to both availability and performance. Our analysis results show that a single-hop overlay path provides the same degree of path diversity as the multi-hop overlay path for more than 90% of source and destination pairs. Finally, we validate the proposed framework using real Internet outages to show that our architecture is able to provide a significant amount of resilience to real-world failures.

Abstract This paper describes the architecture, implementation, and application of Windmill, a passive network protocol performance measurement tool. Windmill enables experimenters to measure a broad range of protocol performance metrics both by reconstructing application‐level network protocols and by exposing the underlying protocol layers' events. Windmill is split into three functional components: a dynamically compiled Windmill Protocol Filter (WPF), a set of abstract protocol modules, and an extensible experiment engine. To demonstrate Windmill's utility, we present the results from several experiments. The first set of experiments validates a possible cause for the correlation between Internet routing instability and network bandwidth usage. The second set of experiments highlights Windmill's ability to act as a driver for a complementary active Internet measurement infrastructure, its ability to perform online data reduction, and the non‐intrusive measurement of a closed system. Copyright © 2003 John Wiley & Sons, Ltd.

This paper describes the design and implementation of protocol scrubbers. Protocol scrubbers are transparent, interposed mechanisms for explicitly removing network scans and attacks at various protocol layers. The transport scrubber supports downstream passive network-based intrusion detection systems by converting ambiguous network flows into well-behaved flows that are unequivocally interpreted by all downstream endpoints. The fingerprint scrubber restricts an attacker's ability to determine the operating system of a protected host. As an example, this paper presents the implementation of a TCP scrubber that eliminates insertion and evasion attacks-attacks that use ambiguities to subvert detection-on passive network-based intrusion detection systems, while preserving high performance. The TCP scrubber is based on a novel, simplified state machine that performs in a fast and scalable manner. The fingerprint scrubber is built upon the TCP scrubber and removes additional ambiguities from flows that can reveal implementation-specific details about a host's operating system.

This paper presents the results from a detailed, experimental study of OSPF an intra-domain routing protocol, running on a mid-size regional Internet service provider. Using multiple, distributed probes running custom monitoring tools, we collected continuous protocol information for a full year. We use this data to analyze the health of the network including the amount, source, duration and periodicity of routing instability. We found that information from external routing protocols produces significant levels of instability within OSPF. We also examine the evolution of the routing topology over time, showing that short term changes are incremental and that the long term trend shows constant change. Finally, we present a set of detailed investigations into several large scale anomalies. These anomalies demonstrate the significant impact external routing protocols have on OSPF. In addition, they highlight the need for new network management tools that can incorporate information from routing protocols.

This paper describes the design and implementation of a protocol scrubber, a transparent interposition mechanism for explicitly removing network attacks at both the transport and application protocol layers. The transport scrubber supports downstream passive network-based intrusion detection systems; whereas the application scrubbing mechanism supports transparent fail-closed active network-based intrusion detection systems. The transport scrubber's role is to convert ambiguous network flows into well-behaved flows that are unequivocally interpreted by all downstream endpoints. As an example, this paper presents the implementation of a TCP/IP scrubber that eliminates insertion and evasion attacks-attacks that use ambiguities to subvert detection-on passive network-based intrusion detection systems, while preserving high performance. The application protocol scrubbing mechanism is used as a substrate for building fail-closed active network based intrusion detections systems that can respond to attacks by eluding or modifying application data flows in real-time. This paper presents the high performance implementation of a general purpose transparent application-level scrubbing toolkit in the FreeBSD kernel.