Congestion control in today’s Internet• Transmission Control Protocol (TCP)– Instrumental in preventing congestion collapse– Limit transmission rate at the source– Window-based rate control -- Congestion window(CWND)• Four algorithms:– Slow-start– Congestion-avoidance– Fast-retransmit– Fast-recovery

Junichi Maruyama, Go Hasegawa, and Masayuki Murata
Osaka University, JAPAN

1 packet/RTTincrease• Additive Increase
Multiplicative Decrease(AIMD) algorithm
2007/8/14

Definition of tampered-TCP

Packet losses

CWND

Protection Mechanisms for Well-behaved
TCP Flows from Tampered-TCPat Edge Routers

Halved when packet loss

SlowStartCongestion AvoidanceTime (RTT)ICCCN 2007

2

Effect of tampered-TCP flows
3 tampered flows and27 Reno flows
μ=100Mbps, β=0.5• TCP variants which modify their congestion
control mechanisms for higher throughput

Fairshare– Larger increasing ratio (α) and smaller
decreasing ratio (β)• Easy to be implemented to sender side TCP
Congestion window sizeαDecreasing the window size

packets/RTT
in increasing cwnd

2007/8/14

by ratio β (0.5 <=β<=1)on the packet drop event• Small number of tampered TCP flows significantly
degrades throughput of co-existing TCP Reno flows• Since tampered-TCP can be easily realized at end-hosts,
routers must be equipped with additional mechanisms toprotect well-behaved TCP Reno flows

tampered-TCP
TCP Reno(α, β) = (1, 0.5)
ICCCN 2007

32007/8/14

ICCCN 2007

Objectives of this work

Cwnd-based Mechanism (1/2)• Propose new mechanisms to detect and regulate
tampered-TCP connections at edge routers• Monitor TCP flow’s packets for estimatingcongestion window size

– Check the tampering property of TCP flows passing through a edgerouter– Discard packets from tampered TCP flows by considering the effect on
TCP throughput

4– TCP sends packets in a window in bursty fashion– A long interval between successive two packets is considered as theboundary of two windows
2･･･3･･･4･･･• Estimate increase and decrease ratio of the window
size ( α e ，β e ) of each flow
– From the changes in the estimated window size

• Estimate the packet loss ratio at the router– By using number of transmitted/discarded packets at the router,obtained from the router’s MIB• Two approaches– Cwnd-based mechanism and Throughput-based mechanism
2007/8/14

ICCCN 20075

2007/8/14

ICCCN 2007

61

Cwnd-based Mechanism(2/2)

Throughput-based Mechanism• Observe TCP flow’s throughput To• Assess the tampering property– Taken from traffic monitoring tools such as sFlow and NetFlow• Calculate the estimated Reno’s throughput Te– The connection that doesn’t satisfy the fairness against TCP Reno
connections is considered as tampered-TCP2– TCP Reno’s throughput under the same condition [18]) < (1 − γ ), (0 < γ < 1)
wRTT

• Set the target packet discarding probability p '– p ' is determined so as to equalize the throughput of the TCP Reno(• Set the target packet discarding probability p '– The TCP throughput is proportional to the inverse of the square root ofthe packet loss rate2⎛T ⎞p ' next = ⎜⎜ o ⎟⎟ p ' prev
⎝ Te ⎠(1 + β ) α p3 (1 − β )eee

ICCCN 2007[18] J. Padhye, V. Firoiu, D. Towsley, and J. Kurose, “Modeling TCP throughput: A simple model andempirical validation,” in Proceedings of ACM SIGCOMM’98, Sept. 1998.
2007/8/14
ICCCN 2007

7Simulation setting

No control

Throughput ratio =
9075
60
45
30
15
00.9
β0.8
0.7

0.5

20 Reno flows and one tampered flow
Bottleneck link: 50 Mbps, 10msec, 333 packets buffer
Packet size: 1500 bytes
Simulation time：70 seconds

51520

12
1.8
1.6
1.4
1.2
10.8
0.6

β0.8
0.7

– Throughput ratio，detection time, detection ratio, and false positive ratio

0.60.5(Throughput of tampered - TCP )(Throughput of TCP Reno)

2007/8/14

9Simulation results: Detection timeCwnd-based method

864200.9
β0.8
0.7

0.610
α1520

510α1520

2007/8/14

200.65101520α

ICCCN 2007

10Future works• Both methods detect tampered TCP flows in 2-3
seconds– Much faster than MIB-based detection mechanism,
which normally requires 5 minutes
ICCCN 2007

15

⇒The proposed methods can keep the throughput ratioaround 1, by intentionally discards packets fromtampered flows

0.5510α– Cwnd-based method– Throughput-based method

0.6

0.50.7

Proposed methods
keep the throughput
ratio to 1 in allparameter region• We proposed new mechanisms at edge routers todetect and control tampered-TCP connections

Time (s)0.7Time (s)

β0.8

2
1.8
1.6
1.4
1.2
1
0.8
0.6

0.8

Conclusion

18642
01

Conclusion and future works

Throughput-based method

1Throughput-based method
0.90.55ICCCN 2007

Throughput
ratioβCwnd-based method0.9• Metric2007/8/14

10α– At the beginning, only TCP Reno flows transmit data– After 10 seconds, the tampered-TCP connection joins the network

Throughput ratio =(Throughput of tampered - TCP )(Throughput of TCP Reno)

The throughput ratio is larger than 1
in almost all region,
meaning that the tampered-TCPconnection occupies the bandwidth

0.6

0.9

8Simulation results: Throughput ratio
1••••)

To> (1 + γ t ), (0 < γ t )Tep ' is set so as tobe p '= pp'=3 bp ⎞⎟ p 1 + 32 p 28 ⎟⎠• Assess the tampering property

connection with that of the regulated tampered-TCP connection

2007/8/14s⎛
2 bp+ T 0 min ⎜⎜ 1 , 33⎝

Te =w

Throughput ratio(4 1− βe3αe• Investigation of the performance of the proposedmechanisms in the actual Internet environment• Simulations with TCP variants for high-speed and longdistance networks– High-speed TCP, compound TCP, CUBIC, …

11

2007/8/14

ICCCN 2007

122

0.7
0.6
0.5

0.7
0.6

0.8
0.7
0.6
0.5

0.5510α15205510
α1520

MethodCwnd
Throughput

ICCCN 2007

15200.4
0.3
0.2
0.1
0510
α1520

Table : Throughput and throughput ratio of misassessed TCP Reno andSuccessfully-assessed TCP Reno connections• Both of proposed methods can detect tampered
TCP flows regardless of the degree of tampeing
characteristics

2007/8/14

10αThroughput-based method

The stronger the1tampering property
0.9
becomes,the larger
0.8
false positive
0.7
ratio becomes↑0.6
The throughput or0.5
window size ofTCP Reno unstablychanges
β0.8

0.18
0.16
0.14
0.12
0.1
0.08
0.06
0.04
0.02
00.9
β1
0.8
0.6
0.4
0.2
00.9

1

False positive rate

β0.81

Detection rate

10.8
0.6
0.4
0.2
00.9

Cwnd-based method

Throughput-based method

β1

Detection rate

Cwnd-based method

Simulation results: False positive ratio
False positive rate

Simulation results: Detection ratio

13

2007/8/14(α，β)

Misassessed Reno(Mbps)

Reno (Mbps)

Throughputratio(10，0.7)

2.333

2.396

0.973

(20，0.9)

2.290

2.386

0.960

(10，0.7)

2.548

2.401

1.061

(20，0.9)

2.175

2.431

0.895

ICCCN 2007

143