Wide-spread deployment of infrastructure WLANs has made Wi-Fi an integral part of today's Internet access technology. Despite its crucial role in affecting end-to-end performance, past research has focused on MAC protocol enhancement, analysis and simulation-based performance evaluation without sufficient consideration for modeling inaccuracies stemming from inter-layer dependencies, including physical layer diversity, that significantly impact performance. We take a fresh look at IEEE 802.11 WLANs, and using a combination of experiment, simulation, and analysis demonstrate its surprisingly agile performance traits. Our main findings are two-fold. First, contention-based MAC throughput degrades gracefully under congested conditions, enabled by physical layer channel diversity that reduces the effective level of MAC contention. In contrast, fairness and jitter significantly degrade at a critical offered load. This duality obviates the need for link layer flow control for throughput improvement but necessitates traffic control for fairness and QoS. Second, TCP-over-WLAN achieves high throughput commensurate with that of wireline TCP under saturated conditions, challenging the widely held perception that TCP throughput fares poorly over WLANs when subject to heavy contention. We show that TCP-over-WLAN prowess is facilitated by the self-regulating actions of DCF and TCP congestion control that jointly drive the shared physical channel at an effective load of 2-3 wireless stations, even when the number of active stations is very large. Our results highlight subtle inter-layer dependencies including the mitigating influence of TCP-over-WLAN on dynamic rate shifting.

Denial of service (DoS) attack on the Internet has become a pressing problem. In this paper, we describe and evaluate route-based distributed packet filtering (DPF), a novel approach to distributed DoS (DDoS) attack prevention. We show that DPF achieves proactiveness and scalability, and we show that there is an intimate relationship between the effectiveness of DPF at mitigating DDoS attack and power-law network topology.The salient features of this work are two-fold. First, we show that DPF is able to proactively filter out a significant fraction of spoofed packet flows and prevent attack packets from reaching their targets in the first place. The IP flows that cannot be proactively curtailed are extremely sparse so that their origin can be localized---i.e., IP traceback---to within a small, constant number of candidate sites. We show that the two proactive and reactive performance effects can be achieved by implementing route-based filtering on less than 20% of Internet autonomous system (AS) sites. Second, we show that the two complementary performance measures are dependent on the properties of the underlying AS graph. In particular, we show that the power-law structure of Internet AS topology leads to connectivity properties which are crucial in facilitating the observed performance effects.