In this paper we use jump process driven Stochastic Differential Equations to model the interactions of a set of TCP flows and Active Queue Management routers in a network setting. We show how the SDEs can be transformed into a set of Ordinary Differential Equations which can be easily solved numerically. Our solution methodology scales well to a large number of flows. As an application, we model and solve a system where RED is the AQM policy. Our results show excellent agreement with those of similar networks simulated using the well known ns simulator. Our model enables us to get an in-depth understanding of the RED algorithm. Using the tools developed in this paper, we present a critical analysis of the RED algorithm. We explain the role played by the RED configuration parameters on the behavior of the algorithm in a network. We point out a flaw in the RED averaging mechanism which we believe is a cause of tuning problems for RED. We believe this modeling/solution methodology has a great potential in analyzing and understanding various network congestion control algorithms.

In this paper we use a previously developed nonlinear dynamic model of TCP to analyze and design Active Queue Management (AQM) control systems using RED. First, we linearize the interconnection of TCP and a bottlenecked queue and discuss its feedback properties in terms of network parameters such as link capacity, load and round-trip time. Using this model, we next design an AQM control system using the random early detection (RED) scheme by relating its free parameters such as the low-pass filter break point and loss probability profile to the network parameters. We present guidelines for designing linearly stable systems subject to network parameters like propogation delay and load level. Robustness to variations in system loads is a prime objective. We present ns simulations to support our analysis.

No abstract

In active queue management (AQM), core routers signal transmission control protocol (TCP) sources with the objective of managing queue utilization and delay. It is essentially a feedback control problem. Based on a recently developed dynamic model of TCPs congestion-avoidance mode, this paper does three things. First, it relates key network parameters such as the number of TCP sessions, link capacity and round-trip time to the underlying feedback control problem. Second, it analyzes the present de facto AQM standard: random early detection (RED) and determines that REDs queue-averaging is not beneficial. Finally, it recommends alternative AQM schemes which amount to classical proportional and proportional-integral control. We illustrate our results using ns simulations and demonstrate the practical impact of proportional-integral control on managing queue utilization and delay.

REPORT DOCUMENTATION PAGEForm Public reporting burden for this collection of information is estimated to average 1 hour per response, including the time for reviewing instructions, searching existing data sources, gathering and maintaining the data needed, and completing and reviewing this collection of information. The goal of the Secure Overlay Services (SOS) project is to develop an infrastructure upon the existing, insecure Internet that allows an organization to install entities inside the network. An example of an entity is a military database that maintains timely or confidential information (e.g., intelligence). The SOS allows authorized users located anywhere in the Internet to communicate with the entity, and prevents unauthorized users from communicating with the entity. Furthermore, the SOS prevents unauthorized users from denying authorized users access to the entity. NUMBER OF PAGES AbstractIn the Secure Overlay Services (SOS) project, we investigated the use of overlay network technologies as a means for defeating denial of service (DoS) attacks. Through a use of overlay tunneling, routing via consistent hashing, and filtering at a very small number of routers, we reduce the probability of successful attacks while only increasing the end-to-end latency of communications using SOS by a factor of 2 to 3.Contrary to most other work in network denial of service, our system provides a means for ensuring the existence of an un-congested end-to-end communications channel between clients and servers in an IP network. SOS does not require changes in existing protocols or infrastructures, and can be deployed in an incremental fashion without collaboration from Internet Service Providers (ISPs). Furthermore, SOS need not be used, and thus need not affect the performance or other characteristics of communications, when no denial of service is taking place in the network.Our conclusions are that incrementally deployed, overlay-based mechanisms can be very effective in mitigating the impact of denial of service attacks in certain environments, without requiring infrastructure or protocol changes.The project web page may be found at