Transparent measurement and manipulation of Internet protocols.
G. Robert Malan, Farnam Jahanian · Deep Blue (University of Michigan) · 2000
This thesis investigates the use of passive and active interposition mechanisms respectively for the measurement and manipulation of Internet protocols. As such it demonstrates their utility for providing value-added Internet services. The first half of the thesis examines the use of passive interposition for the functional and performance measurement of Internet protocols. This thesis investigates passive measurement through both the design and architecture of a passive measurement device; and its deployment and utility. As our vehicle for passive interposition, the Windmill measurement probe allows us to experiment with the design and architecture of a passive measurement device. The thesis explores the use of passive measurement techniques to investigate the behavior of shrink-wrapped protocol implementations. The thesis also investigates applications of passive measurement to real-time statistics gathering. The second half focuses on active interposition as a means of augmenting the Internet protocols with incremental functionality. These active mechanisms sit in the middle of the network and manipulate the functional and performance characteristics of an end host's protocols. The thesis identified the state spectrum for active interposition mechanisms, where the amount of protocol state kept at the mechanism determines its functional and performance characteristics. An active interposition framework for transparently modifying both transport and application-level Internet protocols was then introduced to study these mechanisms. The investigation of this framework was carried out through the creation of the Protocol Scrubbers---an application of interposition to the security domain. Specifically, the framework for low-level active interposition was described within the context of the TCP/IP Scrubber; and high-level interposition through the transparent application-level protocol scrubber (TAP). The TCP/IP scrubber is a novel mechanism for removing ambiguities from underlying TCP/IP flows; in effect, homogenizing---or normalizing---the TCP/IP traffic. The TAP scrubber supports flexible transparent application protocol scrubbers that can elide or modify application level flows in real-time.