Network security devices intercept, analyze and act on the traffic moving through the network to enforce security policies. They can have adverse impact on the performance, functionality, and privacy provided by the network. To address this issue, we propose a new approach to network security based on the concept of short-term on-demand security exceptions. The basic idea is to bring network providers and (trusted) users together by (1) implementing coarse-grained security policies in the traditional way using conventional in-band security approaches, and (2) handling special cases policy exceptions in the control plane using user/application-supplied information. By divulging their intent to network providers, trusted users can receive better service. By allowing security exceptions, network providers can focus inspections on general (untrusted) traffic. We describe the design of an on-demand security exception mechanism and demonstrate its utility using a prototype implementation that enables high-speed big-data transfer across campus networks. Our experiments show that the security exception mechanism can improve the throughput of flows by trusted users significantly.

The emergence of big data has created new challenges for researchers transmitting big data sets across campus networks to local (HPC) cloud resources, or over wide area networks to public cloud services. Unlike conventional HPC systems where the network is carefully architected (e.g., a high speed local interconnect, or a wide area connection between Data Transfer Nodes), today's big data communication often occurs over shared network infrastructures with many external and uncontrolled factors influencing performance. This paper describes our efforts to understand and characterize the performance of various big data transfer tools such as rclone, cyberduck, and other provider-specific CLI tools when moving data to/from public and private cloud resources. We analyze the various parameter settings available on each of these tools and their impact on performance. Our experimental results give insights into the performance of cloud providers and transfer tools, and provide guidance for parameter settings when using cloud transfer tools. We also explore performance when coming from HPC DTN nodes as well as researcher machines located deep in the campus network, and show that emerging SDN approaches such as the VIP Lanes system can deliver excellent performance even from researchers' machines.

Campus networks and enterprise networks increasingly depend on middleboxes (e.g., firewalls, NAT, load balancers, IDS/IDP) to provide essential services or enforce network policies. These middleboxes often limit the performance of network applications, especially those involved in big data transfer. To address this problem, we propose a Software Defined Networking (SDN) campus network architecture, called VIP Lanes, that provides the ability for pre-authorized, trusted users to create flows that bypass middleboxes, thereby enabling those users to achieve substantially better performance while maintaining security and policy compliance for other network traffic. In this paper, we present the VIP Lanes abstraction and describe an authorization and policy-enforcement service used to establish trusted VIP Lanes. We describe an initial prototype implementation that not only demonstrates the viability of the VIP Lanes approach, but also gives an indication of the types of performance improvements that are possible - in some cases approaching a two order of magnitude reduction in transmission times.

Big Data transfers are increasingly plagued by middlebox bottlenecks such as NAT boxes, firewalls, and intrusion detection systems that prevent large data transfers from achieving maximal throughput across the campus network. Science DMZs have historically been used to solve this problem. We are developing a Software Defined Networking (SDN) campus network that achieves the same benefits - by allowing privileged flows to bypass middleboxes - without the limitations and downsides of Science DMZs. To evaluate our approach and develop a prototype implementation, we created a campus-like lab-based physical network using Aruba switches that support running multiple OpenFlow (virtual) instances per physical chassis. We will demonstrate the control software used to drive the testbed and the performance improvement for big data transfers under our approach.

Researchers from almost all academic disciplines who now rely on large data sets for their work - are increasingly facing "middlebox" bottlenecks (e.g., firewalls, NAT, IDS/IDP) that limit performance when transferring data sets across the campus network. To address this problem, we are exploring Software Defined Networking (SDN) campus network designs that allow researchers to "bypass" rate-limiting middleboxes for certain approved data transfers. However, testing and evaluating new bypass control software for a campus-wide SDN network is challenging for a variety of reasons, beginning with the need to create a realistic test environment. To address this problem, we created three different testbeds that emulate the complexities of a campus network, and have been using these testbeds to evaluate our approach and prototype implementation. In particular, we developed (1) a GENI network testbed, (2) a lab-based physical network testbed, and (3) a limited campus network testbed. We describe the challenges and obstacles encountered while creating these testbed networks, and we report on the solutions developed that produced three realistic but unique "campus network" testbeds. We describe the experiments we were able to perform on the testbeds as well as performance results.

Experimentation with new network architectures and protocols is one of the primary motivations for building future Internet testbeds such as the Global Environment for Network Innovations (GENI) testbed. A key part of experimentation is the ability to observe, measure, evaluate, and compare these new architectures and protocols. Observing an experiment's network performance requires setting up the measurement infrastructure needed to monitor and record the behavior of the network. It also requires a full set of tools and user interfaces that enable access to the measurement data both while the experiment is running and later during post-analysis.To simplify the task of measuring experiments in future Internet testbeds like GENI, we developed an instrumentation and measurement system called INSTOOLS. It automates the process of setting up the measurement infrastructure, tailoring the measurement infrastructure and the data capture to the experimental network's topology and configuration. In addition, INSTOOLS provides a suite of tools via its "portal" service that make it easy for users to observe, measure, format, and archive data from their experiments. This paper describes the INSTOOLS system and the set of interfaces/tools it offers to users. INSTOOLS has been in use for several years, and we provide performance results that illustrate its scalability. We also present our second-generation portal, the GENI One Stop Portal, that offers a comprehensive. interface to a wide range of tools. (c) 2013 Elsevier B.V. All rights reserved.

Test beds such as GENI provide an ideal environment for experimenting with future internet architectures such as Choice Net. Unlike the narrow waist of the current Internet (IP), Choice Net encourages alternatives and competition at the network layer via an economic plane that allows users to choose and purchase precisely the services they need. In this paper we describe our experiences implementing the Choice Net architecture on GENI. Some features of GENI, such as the ability to program the network layer, to leverage existing protocols and software, to run real applications generating realistic traffic, and the ability to perform long-running experiments made GENI an ideal platform for Choice Net experimentation. However, we found that GENI currently lacks the tools needed to make it easy to use these features. To address this issue, we designed and implemented a GENI Experimenter Tool specifically designed and tailored to perform tasks commonly needed by experimenters such as dynamically configuring nodes, loading and compiling node-specific code, executing Click modules, running commands on sets of nodes, accessing the local file system on nodes, and dynamically logging into nodes.

Although GENI has been readily embraced by the research community as a testbed for exploring new network architectures and services, its use as an educational tool has not seen the same level of acceptance and usage. There are multiple reasons for this, not the least of which is a lack of good examples showing how to use GENI in an educational setting. This paper attempts to remedy this by describing our experiences using GENI in our networking classes at the University of Kentucky. Using GENI as the experimental basis for the projects in our classes allowed us to leverage several of its rich set of features including its global span of resources, programmability, virtualization, and instrumentation and measurement tools. In particular, we describe two projects that we have used in our networking classes, and we share some of the experience we gained in the process. As a result, these experiences motivated us to develop and integrate new functions into the GENI desktop in order to make it easier to access and control GENI's various resources and tools.

Much of the GENI effort in developing network testbeds has been focused on building the control frameworks needed to allocate and initialize the network resources that make up an experiment. We argue that building the instrumentation and measurement system to monitor and capture the behavior of the network is just as important and challenging as setting up the network itself, especially in a virtualized and federated environment where getting information from experimental nodes is too complicated and too much to handle for a typical user. In this paper, we describe the design of an instrumentation and measurement infrastructure that allows users to monitor their experiments. The challenge that virtualization and federation of GENI testbeds bring to instrumentation and monitoring is how to hide the details of instrumentation setup from users so that users do not need to be experts in system administration or network management of virtualized and federated systems, but are still able to “see” what is going on with their experiments. Our instrumentation tool sets up experiment-specific monitoring infrastructure that is tailored to capture, record, and display only information associated with that experiment. Our tools are currently available in GENI, and we present a simple example of how to use them to instrument an experiment.

GENI, the Global Environment for Network Innovations, is a National Science Foundation project to create a "virtual laboratory at the frontiers of network science and engineering for exploring future internets at scale." It provides researchers, educators, and students with resources that they can use to build their own networks that span the country and---through federation---the world. GENI enables experimenters to try out bold new network architectures and designs for networked systems, and to deploy and evaluate these systems on a diverse set of resources over a large footprint. This tutorial is a starting point for running experiments on GENI. It provides an overview of GENI and covers the process of creating a network and running a simple experiment using two tools: the Flack GUI and the INSTOOLS instrumentation service.

GENI, the Global Environment for Network Innovations, is a National Science Foundation project to create a "virtual laboratory at the frontiers of network science and engineering for exploring future internets at scale." It provides researchers, educators, and students with resources that they can use to build their own networks that span the country and---through federation---the world. GENI enables experimenters to try out bold new network architectures and designs for networked systems, and to deploy and evaluate these systems on a diverse set of resources over a large footprint. This tutorial is a starting point for running experiments on GENI. It provides an overview of GENI and covers the process of creating a network and running a simple experiment using two tools: the Flack GUI and the INSTOOLS instrumentation service.

Over the last few years the National Science Foundation (NSF) has been investing in and developing a new network calledGENI, a wide-area testbed network for at-scale experimentation with future internet designs. Th e GENI network has recently become available for use and is beginning to attract users. In this paper, we take a closer look at GENI with a particular focus on how GENI can be used to enhance education in the areas of computer science and computer engineering. We describe what GENI is, the resources available in GENI, and how instructors might use GENI in their classes. Being early adopters, we describe our experience using GENI in our classes, and we point out various features and challenge s of using GENI. Finally, we provide tips and pointers to instructors who are interested in incorporating GENI into