In modern day applications, eBPF has emerged as a powerful mechanism for extensible networking, observability, and security. Yet its elevated in-kernel privileges also create new attack avenues, since third-party tooling and supply-chain compromises can introduce malicious BPF loaders. A stealthy attacker may embed trojaned eBPF programs in legitimate tools and application or exploit vulnerable plugins to gain CAP_BPF rights, then probe syscalls, trace kernel events and exfiltrate sensitive data; often without raising traditional alarms. In this paper we propose a threat model to encompass these attack vectors for infrastructure administrator and semi-trusted cloud environment where BPF itself becomes both a tool and a target. We introduce BPF-to-BPF Armor (BBArmor), a prototype solution that enforces stricter controls over BPF syscall usage, isolates BPF programs based on provenance and trust levels and blocks anomalous BPF interactions indicative of compromise. Our evaluation demonstrates that BBArmor mitigates BPF syscall misuse with minimal performance overhead, strengthening security against evolving supply-chain and software-supply threats.

Virtual switches are one of the most important building blocks in public cloud network stacks as they apply high-level policies to traffic enabling communication between virtual machines (VMs) and the rest of the world. The problem is that virtual switches need CPU cores to process packets and the more cores assigned to them, the less are available to VMs that are rented to customers and hence generate revenue. With this paper, we show that it is potentially possible to find a sweet-spot between performance and costs. The insight is that applications running on VMs are not always using 100% of their CPU processing power: we use this to design switch bypass, a new technique that allow virtual switches to opportunistically offload part of their processing to the virtual NIC drivers associated with guest VMs. Using packet classification as use-case, we show that with switch bypass we obtain a performance boost up to 40% without the need of additional core processing power.

Rust is a multi-paradigm, general-purpose programming language that prioritizes performance, type safety, and fearless concurrency. At compile time, Rust is able to ensure memory and thread safety without relying on automated memory management techniques such as garbage collection. As a result, Rust is gaining significant popularity as a replacement for $\mathrm{C} / \mathrm{C}++$ in various domains where performance and reliability are paramount, such as systems programming, embedded devices, and networking. This paper attempts to critically evaluate the claims of high performance and memory safety associated with Rust, particularly in the context of low-level network programming. The approach involves rewriting Nethuns, a fast C-based network I/O library, using Rust. The Rust-based implementation of Nethuns is described in detail in this work, with a particular emphasis on explaining the design choices, highlighting the primary benefits gained in terms of safety and security, and addressing the challenges encountered throughout the process. The paper concludes with a performance evaluation of the library. The obtained results are promising: the Rust-based library ensures a significantly higher level of safety at compile time, with a modest performance trade-off.

Modern multi-core servers are powerful enough to process multi-gigabit live packet streams on the network data plane. However, in most cases network programmers must build their applications from scratch, by implementing both the interfaces towards the lower hardware level and the proper mechanisms for parallel programming. Data Stream Processing (DaSP) frameworks have recently emerged as promising approaches to overcome the above issues and to let programmers simply focus on the logic of the application to develop. However, DaSP platforms are generally not designed for the networking domain, in terms of both performance and functions. In this paper, we selected the WindFlow DaSP framework and built suitable extensions to attach multiple (accelerated) packet sources of data to it. We then implemented a simple monitoring application on top of WindFlow and carried out stress tests with synthetic and real traffic. The results prove that performance scale linearly with the processing cores so that the application was able to process the whole amount of live data up to nearly 20 Gbps rate.

The large availability of multi-gigabit network cards for commodity PCs requires network applications to potentially cope with high volumes of traffic. However, computation intensive operations may not catch up with high traffic rates and need to be run in parallel over multiple processing cores. As of today, the vast majority of network applications-e.g., monitoring and IDS systems-are still based on the pcap library interface which, unfortunately, does not provide the native multi-core support, even though the current underlying capture technologies do. This paper introduces a novel version of the pcap library for the Linux operating system that enables transparent application level parallelism. The new library supports fan-out operations for both multi-threaded and multi-process applications, by means of extended API as well as by a declarative grammar for configuration files, suitable for legacy applications. In addition, the library can transparently run on top of the standard Linux socket as well as on other accelerated active engines. Performance evaluation has been carried out on a multi-core architecture in pure capture tests and in more realistic use cases involving monitoring applications such as Tstat and Bro, with standard Linux socket as well as PF_RING and PFQ accelerated engines.

The fifth generation (5G) of cellular networks promises to be a major step in the evolution of wireless technology. 5G is planned to be used in a very broad set of application scenarios. These scenarios have strict heterogeneous requirements that will be accomplished by enhancements on the radio access network and a collection of innovative wireless technologies. Softwarization technologies, such as Software‐Defined Networking (SDN) and Network Function Virtualization (NFV), will play a key role in integrating these different technologies. Network slicing emerges as a cost‐efficient solution for the implementation of the diverse 5G requirements and verticals. The 5G radio access and core networks will be based on a SDN/NFV infrastructure, which will be able to orchestrate the resources and control the network in order to efficiently and flexibly and with scalability provide network services. In this paper, we present the up‐to‐date status of the software‐defined 5G radio access and core networks and a broad range of future research challenges on the orchestration and control aspects.

The evolution of commodity PCs towards multi-core processing platforms equipped with high-speed network interfaces makes them reasonable and cost effective targets for the implementation of generic network functions. In addition, the availability of software accelerated I/O frameworks provides a convenient ground for running a broad variety of applications, from simple software switches to more complex network systems, with near hardware-class performance and the flexibility of a software approach. Most network functions can be implemented by composing a set of elementary operations into processing pipelines to be run on top of multiple processing cores. In this framework, maintaining the flow consistency is crucial to enable stateful operations in the processing pipelines. This paper presents Enif-Lang, a functional language for programming network pipelines specifically targeted at multi-core scenarios. In addition to a large set of functions for generic packet manipulation, filtering, steering and state management, the framework is built upon an abstract model that provides state aware packet splitting to prevent inter-state sharing and enable consistent stateful parallel processing on-top-of multi-core architectures.

In LTE and LTE-Advanced systems the rate of requests on the Random Access CHannel (RACH) can be high. Indeed, the Machine Type Communication (MTC) implies to have a high number of devices that need to request radio resources for transmitting small amount of data. Furthermore, reducing the time in which radio resources are allocated to Human Type Communications (HTC) for energy savings purposes, may lead to radio access network overload as well. In this framework, this paper aims at providing a set of guidelines for the resource allocation task in the RACH. In particular, the study investigates the impact of both the backoff indicator scheme and the maximum number of retransmissions on the RACH performance parameters. The rate of RACH requests associated with the HTC traffic is modelled by inferring their statistical properties starting from a dataset acquired in an operational eNodeB. The estimation of the average delay and the average number of maximum retransmissions gives insights on how many preambles should be reserved for HTC in order to meet the target performance, and provides suggestions on the configuration of the backoff indicator.

This paper presents Packet Family Queue (PFQ), a high-performance framework for packet processing designed to flexibly handle network applications parallelism and making traffic processing safe and easy. PFQ is an open-source module for the Linux kernel that combines software-accelerated packet I/O to in-kernel early stage packet processing and fine-grained distribution to network applications and physical devices. PFQ does not require any modification to network device drivers and exposes programming interfaces to multi-threaded applications natively designed to run on top of it, as well as to legacy monitoring tools using the pcap library. The results show that the flexibility and the backward compatibility provided by PFQ do not impact its processing performance that, in fact, reaches line rate figures in the cases of pure speed tests and real practical monitoring use cases on 10+ Gb/s links.

In the LTE systems, battery lifetime and network traffic overhead on control plane may be largely affected by the Discontinuous reception (DRX) configuration and the Radio Resource Control (RRC) Inactivity Timer. In this scenario, the paper proposes an analysis aimed at defining how to properly set the RRC Inactivity Timer to achieve a trade-off between energy savings and traffic overhead on the control plane. The analysis is based on an energy consumption model, whose key parameters are inferred directly from passive measurements carried out by monitoring a commercial eNodeB of one of the Italian Mobile Operators. The results suggest that taking into account the network traffic characteristics is possible to find the RRC inactivity timer value that permits to save energy of user's device while the increase of the signalling load is limited.

Today's rapidly evolving network ecosystem, characterized by increasing traffic volumes, service heterogeneity and mutating cyber-threats, calls for new approaches to packet processing to address key issues such as scalability, flexibility, programmability and fast deployment. To this aim, this paper explores a new direction to packet processing by pushing forward functional programming principles in the definition of a ''software defined networking'' paradigm.

The evolution of commodity hardware makes it a very attractive platform to develop high-performance networking applications that are affordable to deploy. All but the most trivial applications must copy packets into user-space for further analysis. Therefore, the allocation of memory for these copies becomes a performance-critical operation. In this work, we present a multi-layer slice memory allocator specifically designed to take advantage of spatial and temporal locality in dealing with high-speed packet processing applications. Experimental results show that the proposed approach clearly outperforms existing memory allocators in common networking use-cases.

The increasing number of network attacks causes growing problems for network operators and users. Thus, detecting anomalous traffic is of primary interest in IP networks management and many detection techniques, able to promptly reveal and identify network attacks, mainly detecting Heavy Changes (HCs) in the network traffic, have been proposed. Nevertheless, the recent spread of coordinated attacks, that occur in multiple networks simultaneously, makes extremely difficult the detection, using isolated intrusion detection systems that only monitor a limited portion of the Internet. For this reason in this paper we propose a novel distributed architecture that represents a general framework for the detection of network anomalies. The performance analysis, presented in this paper, demonstrates the effectiveness of the proposed architecture.

In this paper we propose a novel hardware-software co-design vision that aims at enhancing flexibility and reusability of hardware based packet forwarding engines. In particular, we move on the path of the well-known OpenFlow architecture that allows the user to decide the action to be performed over the packet (drop, forward through a given port etc.) upon interaction with a software control plane. Although such an approach is certainly powerful and is gaining more and more attention in both academia and industry, it is biased towards routing application: its main goal is to allow the software control plane to arbitrarily route a packet flow. However, we think that a similar paradigm, encompassing high performance packet forwarding hardware driven by a flexible software control plane, may be beneficial even to other kinds of applications, like monitoring and measurements. However, the primitives that the OpenFlow protocol provides are not flexible enough for such purposes. For this reason, we propose a flexible packet forwarding architecture based on regular expression that, besides enabling standard-compliant OpenFlow switching, can be easily reconfigured through its control plane to support other kinds of applications.

Modern network devices need to perform deep packet inspection at high speed for security and application- specific services. For this purpose, regular expressions are used, due to their high expressive power, and Deterministic Finite Automata (DFAs) are adopted to match them. Many works have been proposed to improve DFAs, especially in terms of memory consumption and speed. Instead, we address another issue: the scalability of DFAs to parallel systems and their buffer requirements. To our knowledge, a single attempt to parallelize DFA walk on regular multicore systems (which ex- ploits speculation with limited efficiency) has been proposed in literature. We propose a solution in which a number of processing units are committed to walk in parallel a DFA for the same packet; at this aim, sampling techniques on both text and regular expressions are adopted. This scheme is the first in literature that proposes effective parallelization of DFA walk, hence allowing for packet processing time reduction and less memory for reordering buffers. The result is that speed scales as the number of processing units.

Deep packet inspection is a fundamental task to improve network security and provide application-specific services. State-of-the-art systems adopt regular expressions due to their high expressive power. They are typically matched through deterministic finite automata (DFAs), but large rule sets need a memory amount that turns out to be too large for practical implementation. Many recent works have proposed improvements to address this issue, but they increase the number of transitions (and then of memory accesses) per character. This paper presents a new representation for DFAs, orthogonal to most of the previous solutions, called delta finite automata ($\delta$FA), which considerably reduces states and transitions while preserving a transition per character only, thus allowing fast matching. A further optimization exploits$N$th order relationships within the DFA by adopting the concept of “temporary transitions.”

Because of the rapid growth of both traffic and links capacity, the time budget to perform IP address lookup on a packet continues to decrease and lookup tables of routers unceasingly grow. Therefore, new lookup algorithms and new hardware platform are required to perform fast IP lookup. This paper presents a new scheme on top of the NetFPGA board which takes advantage of parallel queries made on perfect hash functions. Such functions are built by using a very compact and fast data structure called Blooming Trees, thus allowing the vast majority of memory accesses to involve small and fast on-chip memories only.

Modern network devices need to perform deep packet inspection at high speed for security and application-specific services. Instead of standard strings to represent the dataset to be matched, state-of-the-art systems adopt regular expressions, due to their high expressive power. The current trend is to use Deterministic Finite Automata (DFAs) to match regular expressions. However, while the problem of the large memory consumption of DFAs has been solved in many different ways, only a few works have focused on increasing the lookup speed. This paper introduces a novel yet simple idea to accelerate DFAs for security applications: payload sampling. Our approach allows to skip a large portion of the text, thus processing less bytes. The price to pay is a slight number of false alarms which require a confirmation stage. Therefore, we propose a double-stage matching scheme providing two new different automata. Results show a significant speed-up in regular traffic processing, thus confirming the effectiveness of the approach.

Bloom Filters are efficient randomized data structures for membership queries on a set with a certain known false positive probability. Counting Bloom Filters (CBFs) allow the same operation on dynamic sets that can be updated via insertions and deletions with larger memory requirements. This paper first presents a simple tight upper bound for counters overflow probability in CBFs, which is adopted in the design of more efficient CBFs. On the basis of such theoretical achievements, we introduce the idea of a hierarchical structure as well as the use of Huffman code to improve standard CBFs in terms of fast access and limited memory consumption (up to 50% of memory saving). The target could be the implementation of the compressed data structures in the small (but fast) local memory or “on-chip SRAM” of devices such as network processors. As an application of our algorithms, an anti-evasion system is finally proposed.

IP address lookup is a fundamental task for Internet routers, due to the rapid growth of both traffic and links capacity. Many algorithms have been proposed to improve lookup performance in terms of memory consumption, search speed and update complexity. Due to the presence of wildcards and netmasks, such algorithms adopt several techniques to deal with longest prefix matching. However, the analysis of lookup tables reveals that the first 16 bits of forwarding rules are almost always specified. Therefore, more powerful exact-matching schemes can be applied to the first half of addresses. This paper presents a routing lookup accelerator (RLA) which allows the lookup of the first 16 bits to be sped up. The target is an efficient scheme to be implemented in small and fast memories of recent hardware platforms. Specifically, since in several forwarding tables the distribution of the first 16 bits is characterized by empty gaps as well as pronounced peaks, we propose to divide the address space in different ranges and to encode each address only as a difference with respect to a given address chosen as reference for that range. Then, a hybrid direct-addressing / multibit trie scheme is used for each range. As RLA is orthogonal to all other schemes, any other lookup algorithm can be used to perform longest prefix matching on the remaining bits.

Characterizing delay distribution over the links of a network provides a remarkable amount of information which can be useful for troubleshooting, traffic engineering, adaptive multimedia flow coding, overlay network design, etc. Since querying each and every node of a path in order to retrieve this kind of information can be unfeasible or just too resource demanding, the recent research trend is to infer the internal state of a network by means of end-to-end measurements. Many algorithms in literature require active measurements and are based on a single-sender multiple-receivers scheme, thus relying on the cooperation of a possibly wide number of nodes, which is a quite strong assumption. Moreover, many previous works adopt Expectation-Maximization algorithms to cope with large and under-determined equation systems, thus increasing the uncertainty of the final delay estimation. This paper, instead, proposes a technique to infer the cumulants of the delay distribution over each link of a given network path, based on two-points measurements only. The cumulants, in turn, can be used to approximate the distribution function through the Edgeworth series. The results of our approach are assessed through a wide series of model-based and ns2 based simulations and show fairly good performance under different network load conditions.

Network Topology Discovery is crucial to a number of network management tasks. Traditional topology discovery techniques require internal nodes to take actions on measurement packets, which makes them unpractical in many cases. For these reasons, tomographic techniques have been introduced, which allow for the reconstruction of network topologies with no need for cooperation from internal routers. The usual approach to tomographic topology discovery is based on clustering nodes into tree structures according to soft similarity metrics. We recently proposed a novel technique based on decision theoretic considerations that help the topology reconstruction by limiting the set of hypotheses to a finite and well-defined set, thus determining hard metrics. In the scheme, probe traffic is sent to all couples of end-nodes and a metric is assigned to each measurement. In this paper, we extend the technique by ordering the topology reconstruction procedure according to metrics reliability defined in terms of their variances. The algorithms presented in the paper are validated through extensive simulations in several network scenarios. The results show that such a methodology allows to retrieve a complete picture of the network that includes the detection of all the internal nodes along with the values of capacities of the interconnecting links.

Deep packet inspection is required in an increasing number of network devices, in order to improve network security and provide application-specific services. Instead of standard strings to represent the data set to be matched, state-of-the-art systems adopt regular expressions, due to their high expressive power and flexibility. Typically regular expressions are matched through deterministic finite automata (DFAs), but large rule sets need a memory amount which turns out to be too large for practical implementation. Many recent works have proposed improvements to address this issue, but they increase the number of transitions (and then of memory accesses) per character. In a previous work, we have presented a smart representation for DFA which, while preserving fast matching (i.e., a transition per character only), considerably reduces states and transitions. In this paper we introduce a novel optimized automaton, which exploits second order relationships within the DFA and is based on the key concept of "temporary transitions". Results for real data sets show that it allows for a further memory saving.

Tomographic techniques allow the reconstruction of network topologies with no need for cooperation from internal routers. However, most of such mechanisms adopt a method of node clustering producing trees that reveal only a partial structure of the network. Therefore, we have proposed a novel approach to topology discovery based on packet sandwich probes and decision theory allowing to retrieve a complete picture of the network, which includes the detection of all the internal nodes along with the values of capacities of the interconnecting links. Such an approach, as well as all the standard techniques of topology discovery, reconstructs the spanning tree of the probe sender only. Hence, in this paper a specific technique is presented for merging the spanning trees associated to all different roots, in order to provide a complete representation of the network. Such a method does not require further probing traffic and is specifically designed to merge topology reconstructions where all the nodes of the network (not only the branching nodes) are revealed, along with link capacities. Our algorithm performs quite well on a wide set of both synthetic and realistic topologies, and in many cases provides a picture of the network which is exactly equivalent to the original one.

Performing deep packet inspection at high speed is a fundamental task for network security and application-specific services. In state-of-the-art systems, sets of signatures to be searched are described by regular expressions, and finite automata (FAs) are employed for the search. In particular, deterministic FAs (DFAs) need a large amount of memory to represent current sets, therefore the target of many works has been the reduction of memory footprint of DFAs. This paper, instead, focuses on speed multiplication by enlarging the amount of bytes observed in the text (i.e., searching for k-bytes per state-traversal). For this purpose, an interesting yet simple inverse homomorphism is employed to reduce the amount of transitions in the modified DFA. The algorithm results to be remarkably faster than standard DFAs, and provides also a good compression scheme that is orthogonal to other schemes.

Evaluating the performance of high-speed networks is a critical task due to the lack of reliable tools to generate traffic workloads at high rates. The current open-source software tools are not suitable to deal with high-speed networks as they present poor performance in terms of generated frames per second and scarce timing/rate accuracy in traffic generation. These issues are due to the intrinsic limitations of the PC architecture, for which these tools are designed. This paper proposes a different approach based on the Intel Network Processor IXP2400. The design aims to maintain the high flexibility of PC solutions while outperforming them in terms of throughput and packet rate. This is obtained by combining a general-purpose PC with the processing units of a network processor.

Hash tables are used in many networking applications, such as lookup and packet classification. But the issue of collisions resolution makes their use slow and not suitable for fast operations. Therefore, perfect hash functions have been introduced to make the hashing mechanism more efficient. In particular, a minimal perfect hash function is a function that maps a set of n keys into a set of n integer numbers without collisions. In literature, there are many schemes to construct a minimal perfect hash function, either based on mathematical properties of polynomials or on graph theory. This paper proposes a new scheme which shows remarkable results in terms of space consumption and processing speed. It is based on an alternative to Bloom Filters and requires about 4 bits per key and 12.8 seconds to construct a MPHF with 3.8times109elements.

Tomographic techniques allow for the reconstruction of network topologies with no need for cooperation from internal routers. Traditional tomographic techniques infer the internal network layout by clustering nodes into tree structures that, in many cases, reveal only a partial graph structure of the network. This paper proposes a novel approach to network topology discovery by means of packet sandwich probes; the underlying theoretical basis relies on the application of Decision Theory to a finite set of possible topological hypotheses. The decision process is however disturbed by the interaction of probes with regular cross traffic, which results in a background noise that afflicts the measurements. To cope with this phenomenon, a model-free noise reduction technique is also used. The algorithms presented in the paper are validated through extensive simulations in several network scenarios. The results show that such a methodology allows to retrieve a complete picture of the network that includes the detection of all the internal nodes along with the values of capacities of the interconnecting links.

A Bloom filter is an efficient randomized data structure for membership queries on a set with a certain known false positive probability. A counting Bloom filter (CBF) allows the same operations on dynamical sets that can be updated via insertions and deletions with larger memory requirements. This paper presents a novel hierarchical data structure, called Blooming tree, that replicates the functionalities of a CBF with lower memory consumption and tunable false positive probability. The hierarchical multi-layer design of Blooming trees allows for distributing the structure in different memory levels, thus exploiting small but fast on-chip memories for most frequently accessed substructures. The proposed algorithm is compared to previous existing schemes on a target platform: Intel IXP2XXX Network Processors (NPs).

The paper presents PingPair, a novel tool for end-to-end path capacity estimation. The tool is based on the classical packet dispersion technique, enhanced by a novel algorithm for the selection of the best measurement samples based on queueing delay estimation. In addition, PingPair takes into account the measurement noise that afflicts the interarrival times registered by a user level application; we experimentally observe the Gaussian nature of such a noise. Since PingPair relies on one- point measurements only, it can be deployed in almost all network scenarios, thus providing maximum flexibility. The performance of the tool has been assessed through both NS2 simulations and extensive experimental campaigns, including Internet as well as field trial measurements. The results are compared to those achieved by Capprobe, which is one of the most effective out of the many available one-point measurement-based capacity estimation tools. Despite the very low amount of probing traffic generated, PingPair outperforms Capprobe in most scenarios, yielding more precise capacity estimates; therefore, it proves to be a very fast and unintrusive way to measure the capacity of a network path.

Bloom filters are efficient randomized data structures for membership queries on a set with a certain known false positive probability. Counting bloom filters (CBFs) allow the same operation on dynamic sets that can be updated via insertions and deletions with larger memory requirements. This paper first presents a new upper bound for counters overflow probability in CBFs. This bound is much tighter than that usually adopted in literature and it allows for designing more efficient CBFs. Three novel data structures are proposed, which introduce the idea of a hierarchical structure as well as the use of Huffman code. Our algorithms improve standard CBFs in terms of fast access and limited memory consumption (up to 50% of memory saving): the target could be the implementation of the compressed data structures in the small (but fast) local memory or "on-chip SRAM" of devices such as network processors .

The high level of performance achieved by todays traditional PCs makes x86 personal computers effective and inexpensive platforms for the development of high performance network devices. In particular, such devices can replace, especially in the access portion of the network, traditional devices for operations like management, monitoring and accounting. This new possibility pushes the research towards the development of new algorithms and functionalities on top of the x86 architecture. In this framework, the purpose of this work is to design a new high-speed longest prefix classification algorithm for packet accounting to be integrated on top of Linux based PCs for traffic characterization and accounting on high speed (> 1Gbps) links, regardless of the detail level of the rule set.

Topology discovery techniques based on a network tomography approach can be successfully adopted in almost all scenarios, in that they infer the internal characteristics of a network without any cooperation from the internal nodes. Out of the many tomographic topology discovery techniques proposed in the literature, those based on the use of packet sandwich probes (a special kind of packet trains) present some particularly attractive features. The rationale of such approaches is to take advantage of end-to-end measurements to infer the logical topology of the network through hierarchical clustering algorithms. Typically, due to the interference with cross traffic, such measurements are affected by a zero-mean noise which, in turn, may cause the wrong reconstruction of the network topology. This paper analyzes the causes of certain noise patterns (which have actually been observed during experiments) and proposes a noise reduction algorithm to sort out this issue. Such an algorithm does not rely on any assumption about the statistical model of the cross-traffic noise and its effectiveness has been tested through a campaign of ns2 simulations.

Nowadays packet classification is a fundamental task for network devices such as edge routers, firewalls and intrusion detection systems. Determining which flow packets belong to is important for many applications, and it is necessary, for example, to provide differentiated services, to detect anomalous traffic and to sort attack patterns. Therefore packet classification is becoming more and more complex, with more flexibility and higher performance requirements. Network Processors (NPs) are emerging as very promising platforms due to their capability to combine the flexibility of general-purpose processors with high performance of hardware-based solutions. In this paper we illustrate the design of a multidimensional packet classifier realized on the Radisys® ENP-2611 board equipped with Intel® IXP2400 Network Processor. The first goal of this study is the selection of the most suitable classification algorithm to be integrated into the embedded system. Our investigation is then directed to adjustments and refinements of the selected algorithm (namely the multidimensional multibit trie algorithm) to capitalize the peculiar functional properties and capabilities of our network processor.

This paper presents a simulative analysis of a modification to the TCP congestion control mechanism called ESSE (early slow start exit), designed to improve the TCP startup phase by setting the slow start threshold according to a pipesize estimation based on the observation of few ACK arrival times. We evaluate the performance of ESSE by using various methods to estimate the pipesize as the ratio between the round trip time and the spacing between ACK. This algorithm is easy to implement and preserves the compatibility with the standard protocol since it requires changes to the sender side only. Simulative experiments show that ESSE allows us to speed-up TCP connections and drastically reduce the packet drop rate under several working conditions and load levels. Better performance of TCP can be observed for any of the considered estimators, which indicates that the algorithm is robust against estimation errors. Further, the characteristics of fairness and friendliness (towards Newreno) of the algorithm are investigated. According to our simulations, ESSE-modified protocols guarantee fair utilization of bandwidth among homogeneous and heterogeneous (Newreno) connections sharing a common link.

The fractal nature of Internet traffic allows extending the application of the nonlinear chaotic system theory to the traffic control in modern telecommunication networks. In particular, the prediction techniques developed for these systems provide teletraffic engineers with a novel powerful tool for designing optimized traffic control algorithms. In this framework, the paper presents the performance evaluation of the Radial Basis Function Predictor (RBFP) in predicting actual traffic data. Predictor parameters are selected automatically by minimizing a suitably defined metric of prediction accuracy. The prediction system is then exploited in a simple resource allocation strategy to test the performance improvement achievable whenever a prediction of the future traffic intensity is available. The results obtained by means of discrete event simulation using actual traffic data are encouraging and stimulate a further-investigation of this approach.

We present a performance model of TCP Westwood (TCPW), a new TCP protocol with a sender-side modification of the window congestion control scheme. TCP Westwood controls the window using end-to-end connection bandwidth share estimation, obtained by monitoring the ACK reception rate. An analytic model using Markov Chain techniques is developed in this paper, and then used to assess the performance improvements obtained using TCPW. The model takes into account the estimation and filtering method used in TCPW, as well as the following system parameters, bottleneck link bandwidth, buffer space at the bottleneck router, end-to-end propagation time, and error rate. The model reveals substantial TCPW gains over Reno whenever losses due to link or other errors are taken into consideration. The analytic model accuracy is confirmed by comparing to simulation results.

The paper presents joint measurements of IP and ATM traffic over an MPOA based campus network. The search for parsimonious realistic modeling of heterogeneous aggregated traffic has led to the generalization of on/off modeling schemes. Even a single on/off pattern with Pareto-geometric distributions of the sojourn times in each state determines a hyperbolic decay of the autocovariance function corresponding to long range dependence (LRIB). Hence, adequate on/off models can fit real traces corresponding to the multiplexing of several heterogeneous connections. In the paper, the on/off behavior of the traffic is evidenced at the ATM level. The relevant feature of the traces is that either the on and the off sojourn times could be well approximated by a light tailed distribution. The observed LRD behavior is due to the presence of correlation in the sequence of on (as well as off) periods lengths. In order to confirm this hypothesis, different synthetic traces were considered, verifying the LRD behavior by means of wavelet analysis. Implications of such state correlations on queueing behavior are then compared by means of discrete event simulations.

The paper presents the analysis of the applicability of /spl alpha/-stable processes in traffic modelling. This study is suggested by the goodness of /spl alpha/-stable processes in capturing not only the long range dependence (LRD) of actual traffic, but also the heavy tailness of its marginal distribution. The relevance of this property is proved by means of discrete event simulations carried out considering two different data traffic sets, respectively related to a LAN-to-LAN interconnection and entertainment video service. Errors in the estimation of Hurst parameter and in the evaluation of queueing behaviour are highlighted either analytically and empirically by simulations. In particular the queueing simulations have emphasised the improvements in the performance forecasting introduced by the higher flexibility of /spl alpha/-stable model with respect to the widely used fractional Brownian motion (FBM).