On the use of TCP's Initial Congestion Window in IPv4 and by Content Delivery Networks

Transcription

1 On the use of TCP's Initial Congestion Window in IPv4 and by Content Delivery Networks Jan Rüth, Christian Bormann, Oliver Hohlfeld London / IETF-11, March 218

2 Why look at s? = bootstrap value for cwnd in slowstart Number of unacknowledged bytes in the first round trip Typically a multiple of the MSS 8 7 AFCT [s] 6 CWND MBit/s 7 MBit/s 26 MBit/s 1 MBit/s RTT 3 ms RTT 1 ms RTT 25 ms RTT 3 4 Jan Rüth, Christian Bormann, Oliver Hohlfeld

3 Why look at s? TCP bursts the IW in an unprobed network Can lead to loss at the bottleneck à bad MBit/s 26 MBit/s QLIM 16 pkts # Average Retrans CWND 32 RTT 4 MBit/s QLIM 4 pkts At the start, we don t know the bottleneck capacity 3 1 MBit/s QLIM 32 pkts Jan Rüth, Christian Bormann, Oliver Hohlfeld

4 How large is it? IW : RFC 2414 experimental IWs measured Padhye and Floyd SIGCOMM 1 IWs in ISP Qian et al. IMC 9 IW 1 213: RFC 6928 experimental IW unknown IW 1 Van Jacobsen SIGCOMM 88 IW : RFC 21 standardized IW : RFC 339 standardized IW 1 Dukkipati et al. SIGCOMM CCR 21 IW 1 Linux Kernel 211 IWs measured Medina et al. SIGCOMM CCR 25 4 Jan Rüth, Christian Bormann, Oliver Hohlfeld

5 Rüth et al. Measuring IWs Our Scanner Probed Host SYN [MSS=...,WIN=...] Loss is a problem Actually tail-loss SYN, ACK ACK, REQUEST Estimate MSS Estimate IW=n Verify IW full Do multiple scans Disable tail-loss probes ACK, SEG 1 SEG n SEG 1 ACK n+1, WIN=2 MSS Timeout ¾ Do not enable SACK Retransmission SEG n+1 SEG n+2 RST Announce MSS and large gure 1: Scan procedure: small A small MSS is announced andreceive vered, preventing to run out of data prior to reaching IW. The Use ACK to test for more data imated IW is the # bytes received before retransmission. window Was the host out of data or was the IW actually full? stop sending before reaching the full IW size if the request not trigger a large enough response. As in [18], we do not Jan Rüth, Christian Bormann, Oliver Hohlfeld d 5acknowledgments causing the remote end not to increase the

6 Scanner implementation We want to probe all reachable IPv4 HTTP/TLS hosts We implement the methodology in ZMap Bypasses the kernel stack Typically only used for enumeration We enable Zmap to send multiple packets We can manually craft connections and manipulate them Modified ZMap, HTTP/TLS scanners available on Github 6 Jan Rüth, Christian Bormann, Oliver Hohlfeld

7 Fraction of IPs [%] Results IPv4 HTTP/TLS 6 5 TLS 4 TLS HTTP 3 2 HTTP 1% HTTP 3% HTTP 1% TLS 5 % TLS 1 % HTTP TLS HTTP Size 25 TLS and HTTP do not agree Many TLS hosts still use IW 4 HTTP scan triggers many abuse mails In contrast to TLS, this appears in access logs How much scanning is enough? 7 HTTP 1% HTTP 5% TLS 1 % TLS 3 % TLS 1 % Jan Rüth, Christian Bormann, Oliver Hohlfeld

8 Results Alexa 1M 16 85% 8% # IPs 15 7% 14 8% 7% HTTP TLS 11% Size Most people in the Alexa list follow current RFCs Here: similar distribution for HTTP and TLS Generally, we see older IWs in Access Networks What about CNDs? 8 Jan Rüth, Christian Bormann, Oliver Hohlfeld

9 Content Delivery Networks Get large URLs from HTTPArchive for each CDN Use regular-sized MSS (enough data) Use HTTP to request resources Also announce Window Scaling Option [kb] CDN B CDN Q CDN A CDN B CDN C CDN D CDN E CDN F CDN G CDN I CDN J CDN K CDN G CDN H CDN L CDN M CDN E CDN N CDN B is 1x over current IETF standard, most are under IW 5 CDNs customize IWs for different customers CDN O CDN P [Segments] 9 Jan Rüth, Christian Bormann, Oliver Hohlfeld

10 Conclusion Distributions dominated by RFC-recommended values Still a lot of IW 2 and IW 4 Popular hosts seem to be on IW 1 We also find some customization Some hosts have very large IWs CDNs are far beyond current standards ¾ Some even customize for different networks Periodic 1% scans are available at Source code available at 1 Jan Rüth, Christian Bormann, Oliver Hohlfeld

11 Thank you! Any questions? Thanks to RWTH Aachen ITC for enabling our measurements 11 Jan Rüth, Christian Bormann, Oliver Hohlfeld