Detecting Cellular Middleboxes Using Passive Measurement Techniques

Abstract

The Transmission Control Protocol (TCP) follows the endto-end principle-when a client establishes a connection with a server, the connection is only shared by two physical machines, the client and the server. In current cellular networks, a myriad of middleboxes disregard the end-to-end principle to enable network operators to deploy services such as content caching, compression, and protocol optimization to improve end-to-end network performance. If server operators remain unaware of such middleboxes, TCP connections may not be optimized specifically for middleboxes and instead are optimized for mobile devices. We argue that without costly active measurement, it remains challenging for server operators to reliably detect the presence of middleboxes that split TCP connections. In this paper, we present three techniques (based on latency, loss, and characteristics of TCP SYN packets) for server operators to passively identify Connection Terminating Proxies (CTPs) in cellular networks, with the goal to optimize TCP connections for faster content delivery. Using TCP and HTTP logs recorded by Content Delivery Network (CDN) servers, we demonstrate that our passive techniques are as reliable and accurate as active techniques in detecting CTPs deployed in cellular networks worldwide.

Hic Sunt Proxies: Unveiling Proxy Phenomena in Mobile Networks

“…Methodologies to detect proxies, and more generally middleboxes, are diverse and can rely on active measurements as well as passive measurements [15]. Mobile Tracebox [16], belongs to the first school of thought: it sends specially crafted packets to highlight intermediate boxes that modify those packets or alter the path between source and destination.…”

Hic sunt NATs: Uncovering address translation with a smart traceroute

“…Detection through passive measurement is also possible [20] but, as middleboxes are usually designed to be transparent, methods often resort to active probing to force the box to reveal its presence. Mobile Tracebox relies on an active measurement paradigm by sending specially crafted packets and retrieving them after modifications occur.…”

Performance analysis of next generation web access via satellite

“…Protocol Enhancing Proxies are therefore currently considered an important tool by operators needing to support long network paths. They are widely used for satellite broadband access and also in mobile operator networks to ensure acceptable web performance without the need to update or configure client equipment [36].…”

“…Perhaps most significantly, current application PEPs are incompatible with the end-to-end security model of HTTPS and HTTP/2 and need to break this model to enable acceleration. The volume of encrypted HTTP traffic continues to grow [37], and many networks enable such proxies by installing root certificates in user devices to sign the HTTPS objects requested by the user [36]. This allows a TLS connection to be split at an application-layer PEP but breaks the end-to-end integrity of the connection [43] and is only possible in scenarios where the network administrator has access to user devices (e.g.…”

“…This allows a TLS connection to be split at an application-layer PEP but breaks the end-to-end integrity of the connection [43] and is only possible in scenarios where the network administrator has access to user devices (e.g. common for handheld devices on a mobile operator network [36]). All PEPs introduce an additional service element that can ossify the network, unless the element continues to be updated, for example, tracking changes in application semantics, such as introduction of HTTP/2 methods, or changes in transport protocol design or usage.…”