In current networks, a domain can effectively run a network architecture only if it is explicitly supported by the network infrastructure. This coupling between architecture and infrastructure means that any significant architectural change involves sizable costs for vendors (for development) and network operators (for deployment), creating a significant barrier to architectural evolution.

This paper presents Ethane, a new network architecture for the enterprise. Ethane allows managers to define a single network-wide fine-grain policy, and then enforces it directly. Ethane couples extremely simple flow-based Ethernet switches with a centralized controller that manages the admittance and routing of flows. While radical, this design is backwards-compatible with existing hosts and switches.

This paper describes flow-cookies which defend against DDoS flooding attacks using bandwidth amplification. "Flow-cookies" is a mechanism in which a Website can reliably send filtering requests to a cooperating node in the network, leveraging its protection bandwidth. In this approach, a third party provider installs a flow-cookies enabled middlebox called the cookie box, in the network at a high bandwidth link. All traffic to or from the protected Web server must traverse the cookie box. The cookie box guarantees that all packets that pass between it and the server belong to a legitimate TCP flow with a valid sender. This implementation is able to operate at gigabit speeds including per-packet IP filtering of millions of addresses. This approach is also very effective against high volume SYN flooding attacks

We present our experience with the design and teaching of a graduate-level networking hardware course in which students design and build an Internet router. Each team of two students (one proficient in hardware and one proficient in software) design and develop a fully functional router that routes live Internet traffic and inter-operates with other students' routers via a simple routing protocol. Hardware is designed in Verilog using an industry-standard design flow on a specially designed platform, called NetFPGA. Software is written in user-space using a high-level language. Software and hardware are combined and tested using real network traffic over arbitrary private topologies using a custom tool, called VNS. Our approach is distinguished in that both hardware and software can be designed, tested and deployed remotely over the Internet. Our goal is to give students experience in the design of complex networking systems. In our initial course offering in Spring 2004, all teams successfully implemented fully functional routers in less than ten weeks. We will pilot courses outside of Stanford using the remote teaching infrastructure presented in this paper.

The goal of our work is to give students a hands-on experience designing, deploying and debugging parts of the Internet infrastructure, such as an Internet router that routes real network traffic, or a security firewall. To do so normally requires that the students have access to snoop and generate raw network traffic, which is a risk to privacy and security. And it normally requires each student to have a dedicated computer, and to modify the kernel. The Virtual Network System (VNS) is a teaching tool designed for undergraduate and graduate networking courses. With VNS, each student can build a router (or any packet-processing device) in user-space, in their own private, protected topology, and process real Internet traffic. VNS has been used by over 500 students at Stanford and remotely from other universities. This paper describes the VNS tool, and our experiences using it in the classroom.