Standards govern the SHOULD and MUST requirements for protocol implementers for interoperability. In case of TCP that carries the bulk of the Internets' traffic, these requirements are defined in RFCs. While it is known that not all optional features are implemented and non-conformance exists, one would assume that TCP implementations at least conform to the minimum set of MUST requirements. In this paper, we use Internet-wide scans to show how Internet hosts and paths conform to these basic requirements. We uncover a non-negligible set of hosts and paths that do not adhere to even basic requirements. For example, we observe hosts that do not correctly handle checksums and cases of middlebox interference for TCP options. We identify hosts that drop packets when the urgent pointer is set or simply crash. Our publicly available results highlight that conformance to even fundamental protocol requirements should not be taken for granted but instead checked regularly.

Internet-wide scans are a common active measurement approach to study the Internet, e.g., studying security properties or protocol adoption. They involve probing large address ranges (IPv4 or parts of IPv6) for specific ports or protocols. Besides their primary use for probing (e.g., studying protocol adoption), we show that - at the same time - they provide valuable insights into the Internet control plane informed by ICMP responses to these probes - a currently unexplored secondary use. We collect one week of ICMP responses (637.50M messages) to several Internet-wide ZMap scans covering multiple TCP and UDP ports as well as DNS-based scans covering > 50% of the domain name space. This perspective enables us to study the Internet's control plane as a by-product of Internet measurements. We receive ICMP messages from ~171M different IPs in roughly 53K different autonomous systems. Additionally, we uncover multiple control plane problems, e.g., we detect a plethora of outdated and misconfigured routers and uncover the presence of large-scale persistent routing loops in IPv4.

In recent years, the amount of traffic protected with Transport Layer Security (TLS) has significantly increased and new protocols such as HTTP/2 and QUIC further foster this emerging trend. However, protecting traffic with TLS has significant impacts on network entities. While the restrictions for middleboxes have been extensively studied, addressing the impact of TLS on clients and servers has been mostly neglected so far. Especially mobile clients in emerging 5G and IoT deployments suffer from significantly increased latency, traffic, and energy overheads when protecting traffic with TLS. In this paper, we address this emerging topic by thoroughly analyzing the impact of TLS on clients and servers and derive opportunities for significantly decreasing latency of TLS communication and downsizing TLS management traffic, thereby also reducing TLS-induced server load. We propose a protocol compatible redesign of TLS session management to use these opportunities and showcase their potential based on mobile device traffic and mobile web-browsing traces. These show promising potentials for latency improvements by up to 25.8% and energy savings of up to 26.3%.

HTTP/2 supersedes HTTP/1.1 to tackle the performance challenges of the modern Web. A highly anticipated feature is Server Push, enabling servers to send data without explicit client requests, thus potentially saving time. Although guidelines on how to use Server Push emerged, measurements have shown that it can easily be used in a suboptimal way and hurt instead of improving performance. We thus tackle the question if the current Web can make better use of Server Push. First, we enable real-world websites to be replayed in a testbed to study the effects of different Server Push strategies. Using this, we next revisit proposed guidelines to grasp their performance impact. Finally, based on our results, we propose a novel strategy using an alternative server scheduler that enables to interleave resources. This improves the visual progress for some websites, with minor modifications to the deployment. Still, our results highlight the limits of Server Push: a deep understanding of web engineering is required to make optimal use of it, and not every site will benefit.

Mining is the foundation of blockchain-based cryptocurrencies such as Bitcoin rewarding the miner for finding blocks for new transactions. The Monero currency enables mining with standard hardware in contrast to special hardware (ASICs) as often used in Bitcoin, paving the way for in-browser mining as a new revenue model for website operators. In this work, we study the prevalence of this new phenomenon. We identify and classify mining websites in 138M domains and present a new fingerprinting method which finds up to a factor of 5.7 more miners than publicly available block lists. Our work identifies and dissects Coinhive as the major browser-mining stakeholder. Further, we present a new method to associate mined blocks in the Monero blockchain to mining pools and uncover that Coinhive currently contributes 1.18% of mined blocks having turned over 1293 Moneros in June 2018.

A broad range of research areas including Internet measurement, privacy, and network security rely on lists of target domains to be analysed; researchers make use of target lists for reasons of necessity or efficiency. The popular Alexa list of one million domains is a widely used example. Despite their prevalence in research papers, the soundness of top lists has seldom been questioned by the community: little is known about the lists' creation, representativity, potential biases, stability, or overlap between lists. In this study we survey the extent, nature, and evolution of top lists used by research communities. We assess the structure and stability of these lists, and show that rank manipulation is possible for some lists. We also reproduce the results of several scientific studies to assess the impact of using a top list at all, which list specifically, and the date of list creation. We find that (i) top lists generally overestimate results compared to the general population by a significant margin, often even an order of magnitude, and (ii) some top lists have surprising change characteristics, causing high day-to-day fluctuation and leading to result instability. We conclude our paper with specific recommendations on the use of top lists, and how to interpret results based on top lists with caution.

The Internet of Things (IoT) permeates our everyday life, e.g., in the area of health monitoring, wearables, industry, and home automation. It comprises devices that provide only limited resources, operate in challenging network conditions, and are often battery-powered. To embed these devices into the Internet, they are envisioned to operate standard protocols. Yet, these protocols occupy the majority of limited program memory resources. Thus, devices can neither add application logic nor apply security updates or adopt optimizations for efficiency. This problem will further exacerbate in the future as the further ongoing permeation of smart devices in our environment demands for more and more functionality. To overcome limited functionality due to resource constraints, we show that not all functionality is required in parallel, and thus can be SPLIT in a feasible manner. This enables on-demand loading of functionality outsourced as (multiple) modules to the significantly lesser constrained flash storage of devices. We exemplify efficient modularization of DTLS and show that SPLIT enables operation of large protocol stacks while it incurs reasonable, tunable performance trade-offs. Our use case specific results show an initial runtime overhead of 23.34 % and 4.9 % for subsequent protocol executions.

CDNs have reshaped the Internet architecture at large. They operate (globally) distributed networks of servers to reduce latencies as well as to increase availability for content and to handle large traffic bursts. Traditionally, content providers were mostly limited to a single CDN operator. However, in recent years, more and more content providers employ multiple CDNs to serve the same content and provide the same services. Thus, switching between CDNs, which can be beneficial to reduce costs or to select CDNs by optimal performance in different geographic regions or to overcome CDN-specific outages, becomes an important task. Services that tackle this task emerged, also known as CDN broker, Multi-CDN selectors, or Meta-CDNs. Despite their existence, little is known about Meta-CDN operation in the wild. In this paper, we thus shed light on this topic by dissecting a major Meta-CDN. Our analysis provides insights into its infrastructure, its operation in practice, and its usage by Internet sites. We leverage PlanetLab and Ripe Atlas as distributed infrastructures to study how a Meta-CDN impacts the web latency.

As network speed increases, servers struggle to serve all requests directed at them. This challenge is rooted in a partitioned data path where the split between the kernel space networking stack and user space applications induces overheads. To address this challenge, we propose Santa, an architecture to optimize the data path by enabling server applications to (partially) offload packet processing to a generic rule processor. We exemplify Santa by showing how it can drastically accelerate UDP packet processing in the Linux kernel-a currently neglected domain. Our evaluation focuses on accelerating DNS traffic for which we find a performance increase by a factor of 5.5 on real-world request pattern.

Mobile offloading overcomes the resource limitations of offloader devices by splitting resource-intensive tasks and allocating subtasks to nearby offloadee devices. In processing its subtask, each offloadee effectively executes foreign and untrusted code which might both harm the device and exhaust its resources. Given the personal nature and constrained resources of offloadee devices, such as smartphones, precise control at the offloadee over the execution environment of offloaded tasks as well as the provided and consumed resources then is a natural requirement for the success of offloading approaches. We thus contribute a mechanism for fine-grained resource control of local task execution, benefitting allocation approaches by precisely assessing, advertising, and guaranteeing offloadee processing resources. Our design protects local device integrity and usability by isolating the execution of each task in a dedicated Linux container with precisely defined resource constraints. We highlight the performance and immediate applicability of our design through a prototypical implementation using LXC containers on COTS Android smartphones that achieves controllable task execution at minimal costs: Each container starts up in only 2 ms, imposes less than 5 % computation overhead, and consumes only 10MB of memory.

In the past, communication in industrial monitoring, automation, and control was mostly realized locally, often relying on wired solutions, restricting communication and control to single factory environments. To overcome this limitation, the Industrial Internet of Things (IIoT) envisions the integration of these local communication structures into larger systems, such as the interconnection between factories and suppliers, or even the Internet. Moreover, to achieve flexibility with regard to automation processes and to save costs in deployment and maintenance, wireless solutions more and more find their way into factories. In this chapter, we present recent efforts and standardized solutions to realize wireless communication for local industrial automation and ultimately identify the requirements and mechanisms for connecting these setups to globally accessible communication infrastructures. To this end, we focus on special requirements unique to the IIoT, e.g., the use of highly constraint devices and the resulting effects on the use of standardized protocols.

HTTP/2 was recently standardized to optimize the Web by promising faster Page Load Times (PLT) as compared to the widely deployed HTTP/1.1. One promising feature is HTTP/2 server push, which turns the former pull-only into a push-enabled Web. By enabling servers to preemptively push resources to the clients without explicit request, it promises further improvements of the overall PLT. Despite this potential, it remains unknown if server push can indeed yield human perceivable improvements. In this paper, we address this open question by assessing server push in both i) a laboratory and ii) a crowdsourcing study. Our study assesses the question if server push can lead to perceivable faster PLTs as compared to HTTP/1.1 and HTTP/2 without push. We base this study on a set of 28 push-enabled real-word websites selected in an Internet-wide measurement. Our results reveal that our subjects are able to perceive utilization of server push. However, its usage does not necessarily accomplish perceived PLT improvements and can sometimes even be noticeably detrimental.

The simplicity of HTTP made it the default building block for desktop and mobile apps, yet it suffers from inherent inefficiencies in the modern web. HTTP/2 was designed to address these inefficiencies and its adoption remarks a major protocol shift in the Internet. Despite this relevance, its Internet-wide adoption remains unknown. Especially, the adoption and use of server push — advertised as a key feature to further reduce page load times — is completely unexplored. To answer both questions, we provide large-scale measurements of the HTTP/2 adoption and usage of server push in the wild, probing the entire IPv4 address space and the complete set of .com/.net/.org domains. We find 5.38M HTTP/2 enabled domains hosted by only few infrastructures driving this adoption. While we find the overall HTTP/2 adoption to increase, only few hundred domains utilize server push. We examine pushed content, push strategies and identify the use of currently undocumented push strategies. Moreover, we discover large sources of overheads through server push for reoccurring page visits. By measuring page load times, we show that while push can speed up webpages, it also can slow them down — motivating the need for optimized push strategies.

Pervasive applications evolve around the user's context, making it a full-fledged communication party. However, no equivalent approach to End-to-End communication exists that allows a sender to bind data, through encryption, to a target context. Existing solutions require central infrastructures or only apply to the immediate context, restricting pervasive applications.We propose Encryption to Trusted Contexts (ETC), a communication security building block that enforces context bindings while preserving the data handling and forwarding mechanisms of the original application. Our approach leverages a Broadcast Encryption scheme to protect data in transit and binds decryption to the verification of an expressive, flexible context specification based on trusted, unforgeable sensing. Data can then be encrypted from and to any context, securely exchanged among devices, and made accessible only within the specified context. We demonstrate the feasibility of ETC in a prototypical implementation for ARM TrustZone devices, realizing communication security for context driven, pervasive applications.

Network-based deployments within the Internet of Things increasingly rely on the cloud-controlled federation of individual networks to configure, authorize, and manage devices across network borders. While this approach allows the convenient and reliable interconnection of networks, it raises severe security and safety concerns. These concerns range from a curious cloud provider accessing confidential data to a malicious cloud provider being able to physically control safety-critical devices. To overcome these concerns, we present D-CAM, which enables secure and distributed configuration, authorization, and management across network borders in the cloud-based Internet of Things. With D-CAM, we constrain the cloud to act as highly available and scalable storage for control messages. Consequently, we achieve reliable network control across network borders and strong security guarantees. Our evaluation confirms that D-CAM adds only a modest overhead and can scale to large networks.

More and more Internet-enabled devices, such as server instances or smartphones, have multiple network interfaces. Multipath TCP (MPTCP) has proven to increase bandwidth for these devices, while remaining compatible with the existing network infrastructure and applications. For interactive applications and services, however, low latency and low jitter often is more important than bandwidth. In this paper, we rethink the MPTCP approach, focusing on end-to-end latency and jitter. We propose ReMP TCP, an MPTCP extension that sends data redundantly over multiple paths in the network. Exchanging bandwidth for latency, this approach guarantees the lowest possible latency in existing best-effort networks. The integration into the MPTCP protocol provides benefits such as transparent end-to-end connection establishment, multipath-enabled congestion control, and the prevention of head of line blocking. We discuss end-to-end latency in multipath environments considering both queuing delays and packet drops. Further, we evaluate the performance of our ReMP TCP Linux Kernel implementation for data center and mobile scenarios in Mininet and real world experiments. We show for a real world mobile scenario in a stressed environment that ReMP TCP can halve the average round-trip time and reduce its standard deviation by a factor of 19.

Legacy Internet systems and protocols are mostly static and keep state information in silo-style storage, thus making state migration, transformation and re-use difficult. Software Defined Networking (SDN) approaches in unison with Network Functions Virtualization (NFV) allow for more flexibility, yet they are currently restricted to a limited set of state migration options. Impeding the sharing of networking and system state severely limits the ability to optimally manage resources and dynamically adapt to a desirable overall configuration. We propose a generalized way to collect, store, transform, and share context between NFs in both the legacy Internet and NFV/SDN-driven systems. To this end, we design and implement a Storage and Transformation Engine for Advanced Networking Context (STEAN), which constitutes a shared context storage, making network state information available to other systems and protocols. Its pivotal feature is the ability to allow for state transformation as well as for persisting state to enable future reuse. By means of experimentation, we show that STEAN covers a diverse set of challenging use cases in legacy systems as well as in NFV/SDN-enabled systems.

The growing demand for mobile content has increased the burden on cellular network providers. To this end, mobile content offloading approaches aim to offer a relief of overloaded cellular network infrastructures via local content exchanges between mobile devices. A core assumption of proposed approaches is the voluntary, honest, and altruistic participation of devices or their owners. This dependency offers malicious participants an avenue of mounting denial-of-service attacks by lying about the content they have or by providing forged content, thereby negating the principal advantages of mobile offloading. Furthermore, without mutual authentication between the participants, there are no means of identification and thereby no chance to report or to stop abuse. In this paper, we thus propose MIRCO, an approach that adds integrity protection to the offloaded content, authentication for participants, and a commitment to the exchange of content between devices. We embed the aforementioned techniques into the offloading process and implement and evaluate our approach using Android smartphones with regard to time and energy overhead. Our results show that MIRCO only adds negligible overhead to content exchanges, thus enabling a feasible and accountable content offloading approach.