Exploiting the IPID field to infer network path and end-system characteristics

Authors:
Weifeng Chen;Yong Huang;Bruno F. Ribeiro;Kyoungwon Suh;Honggang Zhang;Edmundo de Souza e Silva;Jim Kurose;Don Towsley
Affiliations:
Department of Computer Science, University of Massachusetts at Amherst, MA;Department of Electrical and Computer Engineering, University of Massachusetts at Amherst, MA;Department of Computer Science, University of Massachusetts at Amherst, MA;Department of Computer Science, University of Massachusetts at Amherst, MA;Department of Computer Science, University of Massachusetts at Amherst, MA;COPPE and Computer Science Department, Federal University of Rio de Janeiro (UFRJ), Rio de Janeiro, RJ, Brazil;Department of Computer Science, University of Massachusetts at Amherst, MA;Department of Computer Science, University of Massachusetts at Amherst, MA
Venue:
PAM'05 Proceedings of the 6th international conference on Passive and Active Network Measurement
Year:
2005

Citing 5
Cited 9

Multicast-based inference of network-internal delay distributions

IEEE/ACM Transactions on Networking (TON)
Measuring ISP topologies with rocketfuel

Proceedings of the 2002 conference on Applications, technologies, architectures, and protocols for computer communications
A technique for counting natted hosts

Proceedings of the 2nd ACM SIGCOMM Workshop on Internet measurment
A framework for classifying denial of service attacks

Proceedings of the 2003 conference on Applications, technologies, architectures, and protocols for computer communications
User-level internet path diagnosis

SOSP '03 Proceedings of the nineteenth ACM symposium on Operating systems principles

Defending against hitlist worms using network address space randomization

Proceedings of the 2005 ACM workshop on Rapid malcode
The devil and packet trace anonymization

ACM SIGCOMM Computer Communication Review
Fisher information of sampled packets: an application to flow size estimation

Proceedings of the 6th ACM SIGCOMM conference on Internet measurement
Modeling, analysis, measurement and experimentation with the Tangram-II integrated environment

valuetools '06 Proceedings of the 1st international conference on Performance evaluation methodolgies and tools
Defending against hitlist worms using network address space randomization

Computer Networks: The International Journal of Computer and Telecommunications Networking
A root cause analysis toolkit for TCP

Computer Networks: The International Journal of Computer and Telecommunications Networking
Reference models for network data anonymization

Proceedings of the 1st ACM workshop on Network data anonymization
One bit is enough: a framework for deploying explicit feedback congestion control protocols

COMSNETS'09 Proceedings of the First international conference on COMmunication Systems And NETworks
A non-cooperative active measurement technique for estimating the average and variance of the one-way delay

NETWORKING'07 Proceedings of the 6th international IFIP-TC6 conference on Ad Hoc and sensor networks, wireless networks, next generation internet

Quantified Score

Hi-index	0.00

Visualization

Abstract

In both active and passive network Internet measurements, the IP packet has a number of important header fields that have played key roles in past measurement efforts, e.g., IP source/destination address, protocol, TTL, port, and sequence number/acknowledgment. The 16-bit identification field (IPID) has only recently been studied to determine what information it might yield for network measurement and performance characterization purposes. We explore several new uses of the IPID field, including how it can be used to infer: (a) the amount of internal (local) traffic generated by a server; (b) the number of servers in a large-scale, load-balanced server complex and; (c) the difference between one-way delays of two machines to a target computer. We illustrate and validate the use of these techniques through empirical measurement studies.