Are TCP extensions middlebox-proof?

Abstract

Besides the traditional routers and switches, middleboxes such as NATs, firewalls, IDS or proxies have a growing importance in many networks, notably in entreprise and wireless access networks. Many of these middleboxes modify the packets that they process. For this, they to implement (a subset of) protocols like TCP. Despite the deployment of these middleboxes, TCP continues to evolve on the endhosts and little is known about the interactions between TCP extensions and the middleboxes.In this paper, we experimentally evaluate the interference between middleboxes and the Linux TCP stack. For this, we first propose MBtest, a set of Click elements that model middlebox behavior. We use it to experimentally evaluate how three TCP extensions interact with middleboxes. We also analyzes measurements of the interference between Multipath TCP and middleboxes in fifty different networks.

Use Cases and Operational Experience with Multipath TCP

“…This paper was the main motivation for Multipath TCP incorporating various techniques to cope with middlebox interference. More specifically, Multipath TCP has been designed to cope with middleboxes that: The interactions between Multipath TCP and real deployed middleboxes are also analyzed in [HotMiddlebox13]; a particular scenario with the FTP Application Level Gateway running on a NAT is described.…”

A middlebox-cooperative TCP for a non end-to-end internet

“…For instance, in the case of sequence number translation that is SACK-naïve, performance suffers in proportion to loss rate [24]. For ECN, performance suffers when false congestion signals are inadvertently marked, experiencing dramatic performance impact if a congestion codepoint is added, or a TCP-layer congestion echo is added [6].…”

A First Look at the Prevalence and Persistence of Middleboxes in the Wild

“…Indeed, it has been shown that middleboxes have a negative impact on the TCP protocol (and its extensions) evolution [5], [6]. Middleboxes may modify, filter, or drop packets that do not conform to expected behaviors.…”

“…Each new mechanism has to be certified as middlebox-proof [6], [7]. For those researchers, a summary of the potential middlebox network interferences would be a valuable asset as they could easily confront their new protocol with potential issues caused by middleboxes.…”