Packet reordering is generally considered to have negative impact on network performance. In this thesis, the packet reordering is used to assist TCP to recover faster in RED-enabled packet switched networks. The RED queue management prevents networks from congestion by dropping packets with a probability earlier than the time when congestion would actually occur. After a RED router drops a packet, packer reordering is introduced during TCP¡¦s recovery process. A new, simple buffer mechanism, called RED with Recovery Queue or R2Q, is proposed to create this type of packet reordering on behalf of TCP with the objective of accelerating TCP¡¦s recovery and thus improving the overall network performance. In R2Q, the original RED queue is segmented into two sub-queues. The first sub-queue remains the function of the original RED while the second picks up the packets discarded by the first. Then, scheduling of the second-chance transmission of the packets in the secondary sub-queue is the key in achieving our objective. In this thesis, we considered two scheduling schemes: priority and weighted round robin. To evaluate the performance of R2Q with these two scheduling schemes, we implemented and evaluated them in the J-Sim network simulation environment. The well-known dumbbell network topology was adopted and we varied different parameters, such as round-trip time, bottleneck bandwidth, buffer size, WRR weight and so on, in order to understand how R2Q performs under different network configurations. We found that R2Q is more effective in the networks of sufficient buffer and larger product of RTT and bandwidth. With WRR, we may achieve as much as 2% improvement over the original RED. The improvement may be more in networks of even higher speed.

To provide Internet applications with good performance, the transport protocol TCP is designed to optimize the throughput of data transfers. Today, however, more and more applications rely on low latency rather than throughput. Such applications can be referred to as data-limited and are not appropriately supported by TCP. Another emerging problem is associated with the use of novel networking techniques that provide infrastructure-less networking. To improve connectivity and performance in such environments, multi-path routing is often used. This form of routing can cause packets to be reordered, which in turn hurts TCP performance. To address timeliness issues for data-limited traffic, we propose and experimentally evaluate several transport protocol adaptations. For instance, we adapt the loss recovery mechanisms of both TCP and SCTP to perform faster loss detection for data-limited traffic, while preserving the standard behavior for regular traffic. Evaluations show that the proposed mechanisms are able to reduce loss recovery latency with 30-50%. We also suggest modifications to the TCP state caching mechanisms. The caching mechanisms are used to optimize new TCP connections based on the state of old ones, but do not work properly for data-limited flows. Additionally, we design a SCTP mechanism that reduces overhead by bundling several packets into one packet in a more timely fashion than the bundling normally used in SCTP. To address the problem of packet reordering we perform several experimental evaluations, using TCP and state of the art reordering mitigation techniques. Although the studied mitigation techniques are quite good in helping TCP to sustain its performance during pure packet reordering events, they do not help when other impairments like packet loss are present. / <p>Paper V was in manuscript form at the time of the defense.</p>

In recent years there has been an exponential growth in Internet traffic resulting in increased network bandwidth requirements which, in turn, has led to stringent processing requirements on network layer devices like routers. Present backbone routers on OC 48 links (2.5Gbps) have to process four million minimum-sized packets per second. Further, the functionality supported in the network devices is also on the increase leading to programmable processors, such as Intel's IXP, Motorola's C5 and IBM's.NP. These processors support multiple processors and multiple threads to exploit packet-level-parallelism inherent in network workloads. This thesis studies the performance of network processors. We develop a Petri Net model for a commercial network processors (Intel IXP 2400,2850) for three different applications viz., IPv4 forwarding, Network Address Translation and IP security protocols. A salient feature of the Petri net model is its ability to model the application, architecture and their interaction in great detail. The model is validated using the intel proprietary tool (SDK 3.51 for IXP architecture) over a range of configurations. Our Performance evaluation results indicate that 1. The IXP processor is able to support a throughput of 2.5 Gbps for all modeled applications. 2. Packet buffer memory (DRAM) is the bottleneck resource in a network proces sor and even multithreading is ineffective beyond a total of 16 threads in case of header processing applications and beyond 32 threads for payload processing applications. Since DRAM is the bottleneck resource we explore the benefits of increasing the DRAM banks and other software schemes like offloading the packet header to SRAM. The second part of the thesis studies the impact of parallel processing in network processor on packet reordering and retransmission. Our results indicate that the concurrent processing of packets in a network processor and buffer allocation schemes in TFIFO leads to a significant packet reordering, (61%), on a 10-hop network (with packet sizes of 64 B) which in turn leads to a 76% retransmission under the TCP fast-restransmission algorithm. We explore different transmit buffer allocation schemes namely, contiguous, strided, local, and global for transmit buffer which reduces the packet retransmission to 24%. Our performance results also indicate that limiting the number of microengines can reduce the extent of packet reordering while providing the same throughput. We propose an alternative scheme, Packetsort, which guarantees complete packet ordering while achieving a throughput of 2.5 Gbps. Further, we observe that Packetsort outperforms, by up to 35%, the in-built schemes in the IXP processor namely, Inter Thread Signaling (ITS) and Asynchronous Insert and Synchronous Remove (AISR). The final part of this thesis investigates the performance of the network processor in a bursty traffic scenario. We model bursty traffic using a Pareto distribution. We consider a parallel and pipelined buffering schemes and their impact on packet drop under bursty traffic. Our results indicate that the pipelined buffering scheme outperforms the parallel scheme.

This thesis is focused on network behavior analysis (NBA) designed to detect network attacks. The goal of the thesis is to increase detection accuracy of obfuscated network attacks. Methods and techniques used to detect network attacks and network traffic classification were presented first. Intrusion detection systems (IDS) in terms of their functionality and possible attacks on them are described next. This work also describes principles of selected attacks against IDS. Further, obfuscation methods which can be used to overcome NBA are suggested. The tool for automatic exploitation, attack obfuscation and collection of this network communication was designed and implemented. This tool was used for execution of network attacks. A dataset for experiments was obtained from collected network communications. Finally, achieved results emphasized requirement of training NBA models by obfuscated malicious network traffic.