In recent years, the open source operating system OpenWrt has become a popular option for replacing proprietary firmware on networking devices such as home routers or access points. In order to configure an OpenWrt system, like setting up firewall rules, the user has to either sign in to the web interface or use SSH to manually change configuration files on the device. While the current approach is sufficient for small home networks, it only allows for limited automation of management tasks and configuration management becomes time-consuming, for example, on larger campus networks where access control lists on OpenWrt access points need updates regularly.This paper describes our efforts to implement the RESTCONF configuration management protocol standardized by the IETF on OpenWrt systems that have limited CPU and memory resources. We detail our design choices that make our implementation resource efficient for the use cases we target and we compare our implementation against other similar solutions. Our implementation is available on GitHub under an open source license1.

IPv6 measurement studies have focussed on measuring IPv6 adoption, while studies on measuring IPv6 performance have either become dated or only provide a snapshot view. We provide a longitudinal view of the performance of dual-stacked websites. We show that (since 2013) latency towards ALEXA 10K websites with AAAA entries over the six years have reduced by 29% over IPv4 and by 57% over IPv6. As of Dec 2018, 56% of these websites are faster over IPv6 with 95% of the rest being at most 1 ms slower. We also identify glitches in web content delivery that once fixed can help improve the user experience over IPv6. Using a publicly available dataset, we show that 40% of ALEXA 1M websites with AAAA entries were not accessible over IPv6 in 2009. These complete failures have reduced to 1.9% as of Jan 2019. However, our data collection on partial failures helps identify further that 27% of these popular websites with AAAA entries still suffer from partial failure over IPv6. These partial failures are affected by DNS resolution errors on images, javascript and CSS content. For 12% of these websites, more than half of the content belonging to same-origin sources fails over IPv6, while analytics and third-party advertisements contribute to failures from cross-origin sources. Our results also contribute to the IETF standardisation process. We witness that using an happy eyeballs timer value of 250 ms, clients prefer IPv6 connections to 99% of ALEXA 10 K websites (with AAAA entries) more than 96% of the time. Although, this makes clients prefer slower IPv6 connections in 81% of the cases. Our results show that a Happy Eyeballs (MBA) timer value of 150 ms does not severly affect IPv6 preference towards websites. The entire dataset presenting results on partial failures, latency and HE used in this paper is publicly released.

RIPE Atlas consists of ∼9.1K probes (as of Jan 2017) connected in core, access and home networks. RIPE Atlas has recently (Jul 2014) introduced a tagging mechanism for fine-grained vantage point selection of probes. These tags are subdivided into user and system tags. User tags are based on a manual process which is largely dependent on proactive participation of probe hosts. We show that only ∼2.8% of probe hosts ever update their user tags which may lead to user tags that tend to become stale over time. System tags on the other hand being automatically assigned and frequently updated (every 4 hours) are stable and accurate. We show an application of system tags by performing a vantage point selection of dual-stacked probes. This exploration reveals that with ∼2.3K (∼26%) connected dual-stacked probes, RIPE Atlas provides the richest source of vantage points for IPv6 measurement studies. These dual-stacked probes span 88 countries and cover 822 ASNs. ∼83% of these dual-stacked probes are connected within access networks with 782 probes deployed at homes with native IPv6 connectivity. These home dual-stacked probes are evenly split across DSL, cable and fibre deployments. We show that IPv6 latencies from these probes to RIPE Atlas anchors appear comparable to IPv4, although IPv4 performs marginally better. By applying a correlation against APNIC IPv6 user population estimate, we further reveal underrepresented countries (such as BE and JP) which would benefit from deployment of more probes for IPv6 measurement studies.

A number of large-scale network measurement platforms have emerged in the last few years. These platforms have deployed thousands of measurement probes at strategic locations within the access and backbone networks and at residential gateways. The primary goal of these efforts is typically to measure the performance of broadband access networks and to help regulators sketch better policy decisions. In this dissertation we expand the goal further by using large-scale measurement platforms to understand the impact of network infrastructure changes. We deploy probes at the edge of the network to measure IPv6 performance and to dissect last-mile latency characteristics of access networks.

Cisco's NetFlow protocol and Internet engineering task force's Internet protocol flow information export open standard are widely deployed protocols for collecting network flow statistics. Understanding intricate traffic patterns in these network statistics requires sophisticated flow analysis tools that can efficiently mine network flow records. We present a network flow query language (NFQL), which can be used to write expressive queries to process flow records, aggregate them into groups, apply absolute or relative filters, and invoke Allen interval algebra rules to merge group records. We demonstrate nfql, an implementation of the language that has comparable execution times to SiLK and flow-tools with absolute filters. However, it trades performance when grouping and merging flows in favor of more operational capabilities that help increase the expressiveness of NFQL. We present two applications to demonstrate richer capabilities of the language. We show queries to identify flow signatures of popular applications and behavioural signatures to identify SSH compromise detection attacks.

We compare the similarity of webpages delivered over IPv4 and IPv6. Using the SamKnows web performance (webget) test, we implemented an extension (simweb) that allows us to measure the similarity of webpages. The simweb test measures against ALEXA top 100 dual-stacked websites from 80 SamKnows probes connected to dual-stacked networks representing 58 different ASes. Using a two months-long dataset we show that 14% of these dual-stacked websites exhibit a dissimilarity in the number of fetched webpage elements, with 94% of them exhibiting a dissimilarity in their size. We show that 6% of these websites announce AAAA entries in the DNS but no content is delivered over IPv6 when an HTTP request is made. We also noticed several cases where not all webpage elements (such as images, javascript and CSS) of a dual-stacked website are available over IPv6. We show that 27% of the dual-stacked websites have some fraction of webpage elements that fail over IPv6, with 9% of the websites having more than 50% webpage elements that fail over IPv6. We perform a causality analysis and also identify sources for these failing elements. We show that 12% of these websites have more than 50% webpage elements that belong to the same origin source and fail over IPv6. Failure rates are largely affected by DNS resolution error on images, javascript and CSS content delivered from both same-origin and cross-origin sources. These failures tend to cripple experience for users behind an IPv6-only network and a quantification of failure cases may help improve IPv6 adoption on the Internet.

Most devices deployed in the Internet of Things (IoT) are expected to suffer from resource constraints. Using specialized tools on such devices for monitoring IoT networks would take away precious resources that could otherwise be dedicated towards their primary task. In many IoT applications such as Advanced Metering Infrastructure (AMI) networks, higher order devices are expected to form the backbone infrastructure, to which the constrained nodes would connect. It would, as such, make sense to exploit the capabilities of these higher order devices to perform network monitoring tasks. We propose in this paper a distributed monitoring architecture that takes benefits from specificities of the IoT routing protocol RPL to passively monitor events and network flows without having impact upon the resource constrained nodes. We describe the underlying mechanisms of this architecture, quantify its performances through a set of experiments using the Cooja environment. We also evaluate its benefits and limits through a use case scenario dedicated to anomaly detection.

We compare IPv4 and IPv6 connectivity of dual-stacked hosts using a metric that measures Transmission Control Protocol (TCP) connection establishment time to 100 popular dual-stacked websites. We have deployed an implementation of this metric on 20 SamKnows probes connected to dual-stacked networks that are part of 18 different Autonomous Systems (AS). Using a year-long dataset gathered from these vantage points, we show how most of these websites centralise around Content Delivery Network (CDN) deployments and consequently show similar performance. We show that these CDN clusters are different for IPv4 and IPv6. Furthermore, some of these websites tend to be served by CDN caches deployed within service provider networks. We show how these CDN caches are largely absent over IPv6. The distributions of TCP connect times show how clusters serving popular websites over IPv6 have improved over time. We also illustrate cases where network policies inhibit hosts from connecting to websites over IPv6.

Fault resolution in communication networks and distributed systems is a challenge that demands the expertise of system administrators and the support of multiple systems, such as monitoring and event correlation systems. Trouble ticket systems are frequently used to organize the workflow of the fault resolution process. In this context, we introduce DisCaRia, a distributed case-based reasoning system that assists system administrators and network operators in resolving faults. DisCaRia integrates various fault knowledge resources that are already available in the Internet, and it exploits them by applying a distributed case-based reasoning methodology, which is based on scalable peer-to-peer technology. We present the architecture of DisCaRia, the key algorithms used by DisCaRia, and provide an evaluation of a prototype implementation of the system.

Gaussian traffic models are widely used in the domain of network traffic modeling. The central assumption is that traffic aggregates are Gaussian distributed. Due to its importance, the Gaussian character of network traffic has been extensively assessed by researchers in the past years. In 2001, researchers showed that the property of Gaussianity can be disturbed by traffic bursts. However, assumptions on network infrastructure and traffic composition made by the authors back in 2001 are not consistent with those of today's networks. The goal of this paper is to study the impact of traffic bursts on the degree of Gaussianity of network traffic. We identify traffic bursts, uncover applications and hosts that generate them and, ultimately, relate these findings to the Gaussianity degree of the traffic expressed by a goodness-of-fit factor. In our analysis we use recent traffic captures from 2011 and 2012. Our results show that Gaussianity can be directly linked to the presence or absence of extreme traffic bursts. In addition, we also show that even in a more homogeneous network, where hosts have similar access speeds to the Internet, we can identify extreme traffic bursts that might compromise Gaussianity fit.

Interoperability testing is an important part of the lifecycle of a protocol. Interoperability tests not only help to reduce implementation bugs, but they also often improve the accuracy of a protocol specification. In a pursuit to improve Network Configuration (NETCONF) interoperability and foster it for community-based education, we have developed and deployed a NETCONF Interoperability Lab. The lab provides a platform to execute test-cases against an online catalogue of NETCONF server and client implementations. The NETCONF Interoperability lab is available online at: http://www.interop-lab.net.

The Internet Engineering Task Force (IETF) has developed protocols that promote a healthy IPv4 and IPv6 co-existence. The happy eyeballs algorithm for instance, provides recommendations to application developers to help prevent bad user experience in situations where IPv6 connectivity is broken. In this paper, we compare the IPv4 and IPv6 connectivity of a dual-stacked host using a metric that measures the Transmission Control Protocol (TCP) connection establishment time to a number of popular web services. We witnessed several cases where the connection establishment times and their variations over IPv6 are higher.

Cyber Physical Systems (CPSs) are widely expected to be formed of networked resource constrained devices. To suit the constraints of such networks, the IETF developed the RPL routing protocol for Low-power and Lossy Networks (LLNs). Security in CPSs is important for maintaining the integrity and privacy of data, while also improving network resiliency to attacks. Even though RPL provides support for integrity and confidentiality of messages, details regarding key management and signatures are not covered. Since complexity and size is a core concern in LLNs, off-loading the security features to a Trusted Platform Module (TPM) can make it possible to include sophisticated security provisions in an RPL implementation. This paper presents how it would be possible to use the security mechanisms of a TPM in order to secure the communication in an RPL network.

Frequent partitions, intermittent connectivity and message delivery delay are the commonly observed characteristics of disruption tolerant networks (DTNs). These networks often operate over extended periods since they are regularly deployed in harsh and constrained environments. Efficient energy conservation is therefore necessary to prolong network lifetime. Most DTNs nodes depend on mobility to deliver messages to their destination. The introduction of energy conservation, using a high power radio for data delivery and low power radio for neighbor discover to achieve higher energy savings, coupled with mobility can negatively impact the total connection opportunities. This makes it important to understand the effects that mobility patterns can have on the performance of DTNs when multi-radio energy conservation is used. In this paper we study the effects of random waypoint, Manhattan mobility, message-ferry, human and zebra mobility models on DTNs where a wake-up model multi-radio energy conservation is used. The simulation results show that absolute impact of mobility on energy savings is quite limited. It also appears that in high traffic load dense networks mobility impacts delivery ratios and average delays, while impact in low traffic is not pronounced.

Network flow data is widely used to analyze the protocol mix forwarded by a router or to identify anomalies that may be caused by hardware and software failures, configuration errors, or intrusion attempts. The goal of our research is to find application signatures in network flow traces that can be used to pinpoint certain applications, such as specific web browsers, mail clients, or media-players. Our starting point is the hypothesis that popular applications generate application specific flow signatures. In order to verify our hypothesis, we recorded traffic traces of several applications and we subsequently analyzed the traces to identify flow signatures of these applications. The flow signatures were formalized as queries of a stream-based flow query language. The queries have been executed on several flow traces in order to evaluate our approach.

Since the early 1990s, there have been several attempts to secure the Simple Network Management Protocol (SNMP). The third version of the protocol, published as full standard in 2002, introduced the User-based Security Model (USM), which comes with its own user and key-management infrastructure. Since then, network operators have reported that deploying another user and key management infrastructure to secure SNMP is expensive and a reason to not deploy SNMPv3. This paper describes how existing security protocols operating above the transport layer and below application protocols can be used to secure SNMP. These protocols can take advantage of already deployed key management infrastructures that are used for other network management interfaces and hence their use can reduce the operational costs associated with securing SNMP. Our main contribution is a detailed performance analysis of a prototype implementation, comparing the performance of SNMPv3 over SSH, TLS, and DTLS with other versions of SNMP. We also discuss the differences between the various options to secure SNMP and provide guidelines for choosing solutions to implement or deploy.

The secure shell protocol (SSH) is widely deployed to access command line interfaces of network devices and host systems over an insecure network. Recently, the IETF has produced specifications how to run network management protocols such as NETCONF or SNMP over SSH. SSH computes new session keys whenever a new SSH session is established. This computationally expensive operation causes significant latency and processor load on low end devices and thus makes short-lived connections very expensive. To address this problem, we describe a session resumption feature that allows clients to resume sessions without having to compute new session keys.

A common radio technology used in wireless sensor networks is the IEEE 802.15.4 standard. Wireless sensor networks have so far used custom, light-weight, and application specific network protocols on top of IEEE 802.15.4, often optimized for resource constrained low power hardware. In order to achieve interoperability at the network layer, the Internet Engineering Task Force published a standard for the transmission of IPv6 packets over IEEE 802.15.4 low-power wireless personal area networks, which provides an additional layer adapting the IPv6 network layer to the low power and resource constrained IEEE 802.15.4 link layer. This paper provides an evaluation of several independent implementations of the IPv6 over IEEE 802.15.4 standard. We describe the characteristics of the implementations and the protocol features supported. Our interoperability tests, carried out using two different hardware platforms, show that at least three implementations are to a large extend compatible with each other. At the end of the paper, we summarize recent work in the IETF to improve the IPv6 over IEEE 802.15.4 technology.

This paper describes the marriage of two open source tools, namely the policy host configuration system cfengine and the SNMP command line interface scli. By integrating these two open source tools, we are able to use cfengine to configure bridges and wireless access points using a policy retrieved from a central repository and to monitor network devices for the detection of abnormal behaviour.

The simple network management protocol (SNMP) is widely deployed to monitor, control, and configure network elements. Even though the SNMP technology is well documented and understood, it remains relatively unclear how SNMP is used in practice and what the typical SNMP usage patterns are. This paper discusses how to perform large-scale SNMP traffic measurements in order to develop a better understanding of how SNMP is used in production networks. The tools described in this paper have been applied to networks ranging from large national research networks to relatively small faculty networks. The goal of the research is to provide feedback to SNMP protocol developers within the IETF, researchers working within the context of the IRTF-NMRG, as well as other researchers interested in network management in general. We believe that the results are also valuable for operators and vendors who want to optimize their management interactions or understand the traffic generated by their management software.

The anonymization of SNMP traffic traces requires an IP address anonymization scheme which is prefix-preserving and lexicographical-order-preserving. We present an anonymization scheme satisfying these two requirements which has been derived from the prefix-preserving cryptography-based scheme Crypto-PAn. We formally prove the correctness of the scheme and we describe an embeddable implementation. Limits of the proposed anonymization scheme and some security aspects are discussed as well.

The Internet management framework separates the management protocol from the management information manipulated by the management protocol. While several studies have been published about the protocol behavior, little is known about the characteristics of the management information carried by the protocol. This paper presents an empirical analysis of standardized and proprietary management information base (MIB) module sets. The analysis reveals key characteristics of the MIB module sets and the MIB engineering processes deployed by different organizations.

Summary form only given, as follows. The purpose of the tutorial is to discuss the status of Internet management standardization. We identify the remaining technical problems, and present possible solutions. We first give the status of IETF management standards, and present an overview of the goals and results of recent IETF working groups, concluding with a critical analysis of the IETF management standardization process. We then focus on monitoring, and show how SNMP (simple network management protocol) is currently used to retrieve management information, and present current problems with bulk data retrieval. Alternative techniques, like Web-services, which are currently being investigated by the IRTF-NMRG, are discussed. Finally, we focus on configuration management. We give an overview of the successes and failures of SNMP based configuration management, and discuss possible alternatives. This discussion is based on current IETF NetConf activities.

The IETF has developed several specifications for policy-based configuration management. In addition, an infrastructure for distributed management by delegation has been specified. This paper combines key concepts developed in these two efforts and proposes a policy-based configuration management architecture built upon the distributed management infrastructure. Two prototype implementations for managing Differentiated Services are discussed and evaluated.

The Internet-standard management protocol SNMP manipulates data structures that are defined in MIB modules. A large number of MIB modules has been defined over the last decade. Some of them are rather complex and full of technical details, which makes it hard to understand them. Furthermore, the limitations of the current data definition language make it impossible to formally express the conceptual model underlying a well-engineered MIB module. This paper presents a reverse engineering algorithm which extracts conceptual models from the MIB data definitions. The algorithm uses several heuristics that are derived from common MIB naming and registration conventions. The output produced by the algorithm is a graphical representation for conceptual MIB models, which is a slightly customized version of a unified modeling language (UML) class diagram. A prototype implementation of the algorithm is described which has been integrated into the libsmi software package.

The joint Jasmin project of the Technical University of Braunschweig and NEC C&C Research Laboratories is concerned with the development, implementation and practical evaluation of the management by delegation architecture standardized by the Distributed Management (DISMAN) working group of the IETF. This paper presents the open source software components that have been developed over two years within the Jasmin project, namely the Jasmin DISMAN-SCRIPT-MIB SNMP agent with its Java and Tcl runtime engines, a Java package for higher level operations on the DISMAN-SCRIPT-MIB and DISMAN-SCHEDULE-MIB agents, a Java GUI application for interacting with DISMAN-SCRIPT-MIB agents, a Java AgentX sub-agent toolkit that simplifies the development of scripts exporting new MIB objects, a package that facilitates the development of monitoring scripts, and a DISMAN-SCHEDULE-MIB sub-agent. Besides describing the software components and their relations, we also present some project history and experiences specific to open source software development.

Scalable and efficient management of today's fast growing networks requires distributed management systems. This paper introduces a classification of distributed management systems, followed by an overview of technologies for building such systems. One technology, the IETF Script MIB, is discussed in detail, including an implementation architecture and performance studies. Finally, application scenarios are presented, demonstrating how distributed management applications can be built by means of the IETF Script MIB.

This paper discusses the security aspects of the IETF Script MIB which integrates the management by delegation model into the Internet management framework. The paper shows how SNMPv3 security mechanisms have been utilized to protect the Script MIB from unauthorized access. This paper also describes the security aspects of a prototype implementation which uses the Java virtual machine as a runtime system for delegated management functions.