Monitoring Network Bias

1
Monitoring Network Bias

• Gergely Biczok, Whitney Young, and Aleksandar
  Kuzmanovic
• Northwestern Networks Group (http//networks.cs.no
  rthwestern.edu)
• Supported by NSF CAREER Award No. 0746360

Motivation

• Other probes
• DNS hijacking of mistyped web addresses
• Blocking HTTP download of .torrent files
• Can add newly discovered probes modularly

• Net Neutrality
• Openness vs. managing traffic
• Debate in public, struggle in legislation, war
  in the Internet
• ISPs are already installing middleboxes capable
  of degrading/changing/blocking popular
  applications
• We do not take sides
• but want to facilitate network accountability

System Design

• Goal
• Develop an end-host based measurement system for
  detecting and exposing biased network behavior

Methodology

• Main idea
• Collect reported/possible types of
  discriminatory ISP practices/middleboxes
• Reverse-engineer their operation to create
  probes that will likely trigger them
  (approximately emulate desired traffic pattern)
• Detect and locate biased network elements
• Filtering
• Port-based
• Signature-based
• Signature database compiled from open source
  tools, web search and packet traces
• Flow-pattern-based
• Spatial and temporal correlation of UDP and TCP
  flows specific to p2p applications
• Shaping
• Extensive shaping reported for p2p and encrypted
  traffic
• Compare HTTP/FTP data rates to SSL and
  BitTorrent (emulated) rates
• Back-to-back minute-long experiments
• Significant and consistent (across hosts from
  the same ISP) difference in data rates indicate
  the presence of shapers
• Locating middleboxes (filters and shapers)
• Repeat the same measurements between the same
  end-host and multiple specifically selected
  PlanetLab nodes
• Select servers that are geographically far
  away from each other minimizing the common
  segment of the paths
• If same phenomena are observed, middlebox is in
  the shared path segments

• Central Server
• Serves the main website
• Selects multiple PL nodes for given end-host
• Coordinates probing PL nodes
• Handles incoming reports and generate feedback
  to users
• PlanetLab Node
• If selected serves the Java applet to a Client
• Sends and receives probes to/from a Client via
  applet
• Sends a report to Central Server at the end of
  every measurement session
• Client
• Runs an applet in a web browser
• Sends and receives probes from multiple PL nodes
• Sends reports to PL nodes
• Displays results to the user in a browser

Results and Future Work

• Implementation is ongoing
• Functions partly tested manually on small scale
• Experienced BT shaping on well seeded torrents
  (D/U 30 KBps/5 KBps) vs. HTTP download (200
  KBps) at a given ISP
• Signature-based filtering probes validated with
  open-source filtering software in a testbed
• Large-scale live measurement in the near future
• Upon collecting sufficient data we can draw a
  global map of biased network behavior