@inproceedings {DR:AIMS-15, title = {Anycast census and geolocation}, booktitle = {7th Workshop on Active Internet Measurements (AIMS 2015)}, year = {2015}, month = {April 2015}, url = {http://www.enst.fr/~drossi/paper/rossi15aims.pdf}, author = {Cicalese, Danilo and Auge, Jordan and Joumblatt, Diana and Rossi, Dario and Friedman, Timur} } @inproceedings {DR:CoNEXT-15, title = {Characterizing IPv4 Anycast Adoption and Deployment}, booktitle = {ACM CoNEXT}, year = {2015}, month = {12/2015}, publisher = {ACM}, organization = {ACM}, address = {Heidelberg, DE}, url = {http://www.enst.fr/~drossi/paper/rossi15conext.pdf}, author = {Cicalese, Danilo and Auge, Jordan and Joumblatt, Diana and Friedman, Tim ur and Rossi, Dario} } @inproceedings {DR:INFOCOM-15a, title = {A Fistful of Pings: Accurate and Lightweight Anycast Enumeration and Geolocation}, booktitle = {IEEE INFOCOM}, year = {2015}, month = {04/2015}, abstract = {

Use of IP-layer anycast has increased in the last few years: once relegated to DNS root and top-level domain servers, anycast is now commonly used to assist distribution of general purpose content by CDN providers. Yet, the measurement techniques for discovering anycast replicas have been designed around DNS, limiting their usefulness to this particular service. This raises the need for protocol agnostic methodologies, that should additionally be as lightweight as possible in order to scale up anycast service discovery. This is precisely the aim of this paper, which proposes a new method for exhaustive and accurate enumeration and city-level geolocation of anycast instances, requiring only a handful of latency measurements from a set of known vantage points. Our method exploits an iterative workflow that enumerates (an optimization problem) and geolocates (a classification problem) anycast replicas. We thoroughly validate our methodology on available ground truth (several DNS root servers), using multiple measurement infrastructures (PlanetLab, RIPE), obtaining extremely accurate results (even with simple algorithms, that we compare with the global optimum), that we make available to the scientific community. Compared to the state of the art work that appeared in INFOCOM 2013 and IMC 2013, our technique (i) is not bound to a specific protocol, (ii) requires 1000 times fewer vantage points, not only (iii) achieves over 50\% recall but also (iv) accurately identifies the city-level geolocation for over 78\% of the enumerated servers, with (v) a mean geolocation error of 361 km for all enumerated servers.

}, url = {http://www.enst.fr/~drossi/paper/rossi15infocom.pdf}, author = {Cicalese, Danilo and Joumblatt, Diana and Rossi, Dario and Buob, Marc-Olivier and Auge, Jordan and Friedman, Timur} } @inproceedings {DR:TRAC-15, title = {Impact of Carrier-Grade NAT on Web Browsing}, booktitle = { 6th International Workshop on TRaffic Analysis and Characterization (TRAC) - The paper won the BEST PAPER award}, year = {2015}, month = {08/2015}, publisher = {IEEE}, organization = {IEEE}, address = {Dobrovnik, Croatia}, abstract = {

Public IPv4 addresses are a scarce resource. While IPv6 adoption is lagging, Network Address Translation (NAT) technologies have been deployed over the last years to alleviate IPv4 exiguity and their high rental cost. In particular, Carrier- Grade NAT (CGN) is a well known solution to mask a whole ISP network behind a limited amount of public IP addresses, significantly reducing expenses. Despite its economical benefits, CGN can introduce connectiv- ity issues which have sprouted a considerable effort in research, development and standardization. However, to the best of our knowledge, little effort has been dedicated to investigate the impact that CGN deployment may have on users{\textquoteright} traffic. This paper fills the gap. We leverage passive measurements from an ISP network deploying CGN and, by means of the Jensen- Shannon divergence, we contrast several performance metrics considering customers being offered public or private addresses. In particular, we gauge the impact of CGN presence on users{\textquoteright} web browsing experience. Our results testify that CGN is a mature and stable technology as, if properly deployed, it does not harm users{\textquoteright} web browsing experience. Indeed, while our analysis lets emerge expected stochastic differences of certain indexes (e.g., the difference in the path hop count), the measurements related to the quality of users{\textquoteright} browsing are otherwise unperturbed. Interestingly, we also observe that CGN protects customers from unsolicited, often malicious, traffic.

}, url = {http://www.enst.fr/~drossi/paper/rossi15trac.pdf}, author = {Bocchi, Enrico and Safari, Ali and Traverso, Stefano and Finamore, Alessandro and Di Gennaro, Valeria and Mellia, Marco and Munafo, Maurizio and Rossi, Dario} } @inproceedings {DR:INFOCOM-15b, title = {A Lightweight Anycast Enumeration and Geolocation}, booktitle = {IEEE INFOCOM, Demo Session}, year = {2015}, address = {Hong Kong, China}, abstract = {

Several Internet services such as CDNs, DNS name servers, and sinkholes use IP-layer anycast to reduce user response times and increase robustness with respect to network failures and denial of service attacks. However, current geolocation tools fail with anycast IP addresses. In our recent work [1], we remedy to this by developing an anycast detection, enumeration, and geolocation technique based on a set of delay measurements from a handful of geographically distributed vantage points. The technique (i) detects if an IP is anycast, (ii) enumerates replicas by finding the maximum set of non-overlapping disks (i.e., areas centered around vantage points), and (iii) geolocates the replicas by solving a classification problem and assigning the server location to the most likely city. We propose to demo this technique. In particular, we visually show how to detect an anycast IP, enumerate its replicas, and geolocate them on a map. The demo allows to browse previously geolocated services, as well as to explore new targets on demand.

}, url = {http://www.enst.fr/~drossi/paper/rossi15infocom-b.pdf}, author = {Cicalese, Danilo and Joumblatt, Diana and Rossi, Dario and Buob, Marc-Olivier and Auge, Jordan and Friedman, Timur} } @inproceedings {DR:TMA-15, title = {Zen and the art of network troubleshooting: a hands on experimental study}, booktitle = {Traffic Monitoring and Analysis}, year = {2015}, abstract = {

Growing network complexity necessitates tools and methodologies to automate network troubleshooting. In this paper, we follow a crowd-sourcing trend, and argue for the need to deploy measurement probes at end-user devices and gateways, which can be under the control of the users or the ISP. Depending on the amount of information available to the probes (e.g., ISP topology), we formalize the network troubleshooting task as either a clustering or a classification problem, that we solve with an algorithm that (i) achieves perfect classification under the assumption of a strategic selection of probes (e.g., assisted by an ISP) and (ii) operates blindly with respect to the network performance metrics, of which we consider delay and bandwidth in this paper. While previous work on network troubleshooting privileges a more theoretical vs practical approaches, our workflow balances both aspects as (i) we conduct a set of controlled experiments with a rigorous and reproducible methodology, (ii) on an emulator that we thoroughly calibrate, (iii) contrasting experimental results affected by real-world noise with expected results from a probabilistic model.

}, url = {http://www.enst.fr/~drossi/paper/rossi15tma.pdf}, author = {Espinet, Fran{\c c}ois and Joumblatt, Diana and Rossi, Dario} } @inproceedings {DR:ICN-14c, title = {Analyzing Cacheable Traffic in ISP Access Networks for Micro CDN applications via Content-Centric Networking}, booktitle = {ACM SIGCOMM Information Centric Networks (ICN)}, year = {2014}, month = {09/2014}, address = {Paris, FR}, url = {http://www.enst.fr/~drossi/paper/rossi14icn-c.pdf}, author = {Imbrenda, Claudio and Muscariello, Luca and Rossi, Dario} } @article {DR:COMNET-14a, title = {Delay-based congestion control: Flow vs. BitTorrent swarm perspectives}, journal = {Elsevier Computer Networks}, volume = {60}, year = {2014}, month = {02/2014}, chapter = {115 -- 128}, abstract = {

BitTorrent, one of the most widespread file-sharing P2P applications, recently introduced LEDBAT, a novel congestion control protocol aiming at (i) limiting the additional delay due to queuing, to reduce interference with the rest of user traffic (e.g., Web, VoIP and gaming) sharing the same access bottleneck, and (ii) efficiently using the available link capacity, to provide users with good BitTorrent performance at the same time. In this work, we adopt two complementary perspectives: namely, a flow viewpoint to assess the Quality of Service (QoS) as in classic congestion control studies, and a BitTorrent swarm viewpoint to assess peer-to-peer users Quality of Experience (QoE). We additionally point out that congestion control literature is rich of protocols, such as VEGAS, LP, and NICE sharing similarities with LEDBAT, that is therefore mandatory to consider in the analysis. Hence, adopting the above viewpoints we both (i) contrast LEDBAT to the other protocols and (ii) provide deep understanding of the novel protocol and its implication on QoS and QoE. Our simulation based investigation yields several insights. At flow-level, we gather LEDBAT to be lowest priority among all protocols, which follows from its design that strives to explicitly bound the queuing delay at the bottleneck link to a maximum target value. At the same time, we see that this very same protocol parameter can be exploited by adversaries, that can set a higher target to gain an unfair advantage over competitors. Interestingly, swarm-level performance exhibit an opposite trade-off, with smaller targets being more advantageous for QoE of BitTorrent users. This can be explained with the fact that larger delay targets slow down BitTorrent signaling task, with possibly negative effect on the swarming protocol efficiency. Additionally, we see that for the above reason, in heterogeneous swarms, any delay-based protocol (i.e., not only LEDBAT but also VEGAS or NICE) can yield a competitive QoE advantage over loss-based TCP. Overall this tension between swarm and flow-levels suggests that, at least in current ADSL/cable access bottleneck scenarios, a safe LEDBAT operational point may be used in practice. At the same time, our results also point out that benefits similar to LEDBAT can also be gathered with other delay-based protocols such as VEGAS or NICE.

}, url = {http://www.enst.fr/~drossi/paper/rossi14comnet-a.pdf}, author = {Claudio Testa and Dario Rossi} } @inproceedings {Cas2014a, title = {Distributed active measurement of Internet queuing delays}, booktitle = {Passive and Active Measurement (PAM), Extended Abstract}, year = {2014}, month = {March}, address = {Los Angeles, USA}, abstract = {

Despite growing link capacities, over-dimensioned buffers are still causing, in the Internet of the second decade of the third millenium, hosts to suffer from severe queuing delays (or bufferbloat). While maximum bufferbloat possibly exceeds few seconds, it is far less clear how often this maximum is hit in practice. This paper reports on our ongoing work to build a spatial and temporal map of Internet bufferbloat, describing a system based on distributed agents running on PlanetLab that aims at providing a quantitative answer to the above question.

}, url = {http://www.enst.fr/~drossi/paper/rossi14pam-b.pdf}, author = {P. Casoria and D Rossi and Jordan Aug{\'e} and Marc-Oliver Buob and T. Friedman and A. Pescape} } @article {DR:COMNET-14b, title = {{Fighting the bufferbloat: on the coexistence of AQM and low priority congestion control (extended version)}}, journal = {Elsevier Computer Networks}, volume = {60}, year = {2014}, chapter = {115--128}, abstract = {

Nowadays, due to excessive queuing, delays on the Internet can grow longer than the round trip time between the Moon and the Earth {\textendash} for which the {\textquoteleft}{\textquoteleft}bufferbloa t{\textquoteright}{\textquoteright} term was recently coined. Some point to active queue management (AQM) as the solution. Others propose end-to-end low-priority congestion control techniques (LPCC). Under both approaches, promising advances have been made in recent times: notable examples are CoDel for AQM, and LEDBAT for LPCC. In this paper, we warn of a potentially fateful interaction when AQM and LPCC techniques are combined: namely, AQM resets the relative level of priority between best-effort and low-priority congestion control protocols. We validate the generality of our findings by an extended set of experiments with packet-level ns2 simulation, considering 5 AQM techniques and 3 LPCC protocols, and carry on a thorough sensitivity analysis varying several parameters of the networking scenario. We complete the simulation via an experimental campaign conducted on both controlled testbeds and on the Internet, confirming the reprioritization issue to hold in the real world at least under all combination of AQM policies and LPCC protocols available in the Linux kernel. To promote cross-comparison, we make our scripts and dataset available to the research community.

}, url = {http://www.enst.fr/~drossi/paper/rossi14comnet-b.pdf}, author = {YiXi Gong and Dario Rossi and Claudio Testa and Silvio Valenti and Dave Taht} } @inproceedings {DR:TMA-14c, title = {Peeking Through the BitTorrent Seedbox Hosting Ecosystem}, booktitle = {Traffic Monitoring and Analysis (TMA)}, year = {2014}, abstract = {

In this paper, we propose a lightweight method for detecting and classifying BitTorrent content providers with a minimal amount of resources. While
heavy methodologies are typically used (which require long term observation
and data exchange with peers of the swarm and/or a semantic analysis of torrent
websites), we instead argue that such complexity can be avoided by analyzing
the correlations between peers and torrents. We apply our methodology to study
over 50K torrents injected in ThePirateBay during one month, collecting more
than 400K IPs addresses. Shortly, we find that exploiting the correlations not
only enhances the classification accuracy keeping the technique lightweight (our
methodology reliably identifies about 150 seedboxes), but also uncovers seeding behaviors that were not previously noticed (e.g., as multi-port and multi-host
seeding). Finally, we correlate the popularity of seedbox hosting in our dataset
to criteria (e.g., cost, storage space, Web popularity) that can bias the selection
process of BitTorrent content providers.

}, url = {http://www.enst.fr/~drossi/paper/rossi14tma-c.pdf}, author = {Dario Rossi and Guilhem Pujol and Xiao Wang and Fabien Mathieu} } @inproceedings {DR:TRAC-14, title = {A per-Application Account of Bufferbloat: Causes and Impact on Users}, booktitle = {5th International Workshop on TRaffic Analysis and Characterization (TRAC), Best Paper Award}, year = {2014}, abstract = {

We propose a methodology to gauge the extent of queueing delay (aka bufferbloat) in the Internet, based on purely passive measurement of TCP traffic. We implement our methodology in Tstat and make it available as open source software. We leverage Deep Packet Inspection (DPI) and behavioral classification of Tstat to breakdown the queueing delay across different applications, in order to evaluate the impact of bufferbloat on user experience. We show that there is no correlation between the ISP traffic load and the queueing delay, thus confirming that bufferbloat is related only to the traffic of each single user (or household). Finally, we use frequent itemset mining techniques to associate the amount of queueing delay seen by each host with the set of its active applications, with the goal of investigating the root cause of bufferbloat.

}, url = {http://www.enst.fr/drossi/paper/rossi14trac.pdf}, author = {Andrea Araldo and Dario Rossi} } @inproceedings {Col2014, title = {Scalable accurate consolidation of passively measured statistical data}, booktitle = {Passive and Active Measurement (PAM), Extended Abstract}, year = {2014}, month = {March}, address = {Los Angeles, USA}, abstract = {

Passive probes continuously collect a significant amount of traffic vol- ume, and autonomously generate statistics on a large number of metrics. A common statistical output of passive probe is represented by probability mass functions (pmf). The need for consolidation of several pmfs arises in two contexts, namely: (i) whenever a central point collects and aggregates measurement of multiple disjoint vantage points, and (ii) whenever a local measurement processed at a single vantage point needs to be distributed over multiple cores of the same physical probe, in order to cope with growing link capacity. Taking an experimental approach, we study both cases assessing the impact of different consolidation strategies, obtaining general design and tuning guidelines.

}, url = {http://perso.telecom-paristech.fr/~drossi/paper/rossi14pam-a.pdf}, author = {S. Colabrese and D Rossi and Marco Mellia} } @inproceedings {DR:PAM-14c, title = {Violation of Interdomain Routing Assumptions}, booktitle = {Passive and Active Measurement (PAM)}, year = {2014}, month = {03/2014}, address = {Los Angeles, USA}, url = {http://www.enst.fr/~drossi/paper/rossi14pam-c.pdf}, author = {R. Mazloum and M.-O. Buob and J. Auge and B. Baynat and T. Friedman and D. Rossi} } @inproceedings {Tes2013, title = {Data Plane Throughput vs Control Plane Delay: Experimental Study of BitTorrent Performance}, booktitle = {IEEE P2P{\textquoteright}XIII}, year = {2013}, month = {09/2013}, abstract = {In this paper, we address the trade-off between the data plane efficiency and the control plane timeliness for the BitTorrent performance. We argue that loss-based congestion control protocols can fill large buffers, leading to a higher end-to-end delay, unlike low-priority or delay-based congestion control protocols. We perform experiments for both the uTorrent and mainline BitTorrent clients, and we study the impact of uTP (a novel transport protocol proposed by BitTorrent) and several TCP congestion control algorithms (Cubic, New Reno, LP, Vegas and Nice) on the download completion time. Briefly, in case peers in the swarm all use the same congestion control algorithm, we observe that the specific algorithm has only a limited impact on the swarm performance. Conversely, when a mix of TCP congestion control algorithms coexists, peers employing a delay-based low-priority algorithm exhibit shorter completion time.}, url = {http://www.enst.fr/~drossi/paper/rossi13p2p-a.pdf}, author = {C. Testa and D Rossi and A. Rao and A. Legout} } @inproceedings {Ara2013, title = {Dissecting Bufferbloat: Measurement and Per-Application Breakdown of Queueing Delay}, booktitle = {ACM CoNEXT{\textquoteright}13, Student Workshop}, year = {2013}, abstract = {

We propose a passive methodology to estimate the queueing delay incurred by TCP traffic, and additionally leverage DPI classification to breakdown the delay across different applications. Ultimately, we correlate the queueing delay to the performance perceived by the users of that applications, depending on their delay-sensitivity. We implement our methodology in Tstat, and make it available 1 as open source software to the community. We validate and tune the tool, and run a preliminary measurement campaign based on a real ISP traffic trace, showing interesting yet partly counter-intuitive results.

}, doi = {10.1145/2537148.2537785}, url = {http://www.enst.fr/~drossi/paper/rossi13conext.pdf}, author = {A. Araldo and D Rossi} } @inproceedings {Gon2013, title = {Fighting the bufferbloat: on the coexistence of AQM and low priority congestion control}, booktitle = {IEEE INFOCOM Workshop on Traffic Monitoring and Analysis (TMA{\textquoteright}13)}, year = {2013}, keywords = {Bufferbloat}, doi = {10.1109/INFCOM.2013.6567153}, url = {http://www.enst.fr/~drossi/paper/rossi13tma-b.pdf}, author = {YiXi Gong and D Rossi and C. Testa and S. Valenti and D. Taht} } @inproceedings {Ros2013, title = {I tube, YouTube, P2PTube: assessing ISP benefits of peer-assisted caching of YouTube content}, booktitle = {IEEE P2P{\textquoteright}XIII}, year = {2013}, month = {09/2013}, abstract = {

This paper proposes P2PTube, a very simple yet effective set-top-box system to assist diffusion of YouTube videos. We argue that, due to the spatial and temporal nature of video requests, the simplest design already provides non marginal gains. Our trace driven evaluation shows that, with moderate cache size (100MB) and nominal upload rates (500Kbps), about half of the video requests could be served by P2PTube. Interestingly, we also see that non marginal gains are already achievable with tiny caches {\textendash} which is tied to the presence of advertisement prior that the actual video requested by the user.

}, url = {http://www.enst.fr/~drossi/paper/rossi13p2p-b.pdf}, author = {D Rossi and Y. Nicolas and D. Wolff and Alessandro Finamore} } @inproceedings {Gon2013a, title = {Modeling the interdependency of low-priority congestion control and active queue management}, booktitle = { 25th International Teletraffic Congress (ITC{\textquoteright}25), Runner up for best-paper award}, year = {2013}, abstract = {

Recently, a negative interplay has been shown to
arise when scheduling/AQM techniques and low-priority conges-
tion control protocols are used together: namely, AQM resets
the relative level of priority among congestion control protocols.
This work explores this issue by (i) studying a fluid model that
describes system dynamics of heterogeneous congestion control
protocols competing on a bottleneck link governed by AQM and
(ii) proposing a system level solution able to reinstate priorities
among protocols.

}, doi = {10.1109/ITC.2013.6662942}, author = {YiXi Gong and D Rossi and Emilio Leonardi} } @inproceedings {Bel2013, title = {On Netflix catalog dynamics and caching performance}, booktitle = {IEEE CAMAD}, year = {2013}, month = {09/2013}, abstract = {

Multimedia streaming applications have substantially changed the market policy of an increasing number of content providers that offer streaming services to the users. The need for effective video content delivery re-fueled interest for caching: since the Web-like workload of the 90s are not longer fit to describe the new Web of videos, in this work we investigate the suitability of the publicly available Netflix dataset for caching studies. Our analysis shows that, as the dataset continuously evolves (i) a steady state description is not statistically meaningful and (ii) despite the cache hit ratio decreases due to the growth of active movies in the catalog, simple caching replacement approaches are close to the optimum given the growing skew in the popularity distribution over the time. Additionally, we point out that, since the dataset reports logs of movie ratings, anomalies arise when ratings are considered to be movie views. At the same time, we show anomalies yield conservative caching results, that reinforces the soundness of our study.

}, url = {http://www.enst.fr/~drossi/paper/rossi13camad.pdf}, author = {Walter Bellante and Rosa Vilardi and D Rossi} } @inproceedings {Chi2013, title = {Passive bufferbloat measurement exploiting transport layer information}, booktitle = {IEEE GLOBECOM}, year = {2013}, month = {12/2013}, url = {http://www.enst.fr/~drossi/paper/rossi13globecom.pdf}, author = {C. Chirichella and D Rossi and C. Testa and T. Friedman and A. Pescape} } @inproceedings {Chi2013c, title = {Remotely Gauging Upstream Bufferbloat Delays}, booktitle = {Passive and Active Measurement (PAM)}, year = {2013}, abstract = { {\textquoteleft}{\textquoteleft}Bufferbloat{\textquoteright}{\textquoteright} is the growth in buffer size that has led Internet delays to occasionally exceed the light propagation delay from the Earth to the Moon. Manufacturers have built in large buffers to prevent losses on Wi-Fi, cable and ADSL links. But the combination of some links{\textquoteright} limited bandwidth with TCP{\textquoteright}s tendency to saturate that bandwidth results in excessive queuing delays. In response, new congestion control protocols such as BitTorrent{\textquoteright}s uTP/LEDBAT aim at explicitly limiting the delay that they add over the bottleneck link. This work proposes and validate a methodology to monitor the upstream queuing delay experienced by remote hosts, both those using LEDBAT, through LEDBAT{\textquoteright}s native one-way delay measurements, and those using TCP (via the Time-stamp Option). }, doi = {10.1007/978-3-642-36516-4_25}, url = {http://www.enst.fr/~drossi/paper/rossi13pam.pdf}, author = {C. Chirichella and D Rossi and C. Testa and T. Friedman and A. Pescape} } @inproceedings {Chi2013a, title = {To the Moon and back: are Internet bufferbloat delays really that large}, booktitle = {IEEE INFOCOM Workshop on Traffic Monitoring and Analysis (TMA{\textquoteright}13)}, year = {2013}, doi = {10.1109/INFCOMW.2013.6562886}, url = {http://www.enst.fr/~drossi/paper/rossi13tma-a.pdf}, author = {C. Chirichella and D Rossi} } @inproceedings {Gon2012, title = {Interaction or Interference: can AQM and Low Priority Congestion Control Successfully Collaborate}, booktitle = {ACM CoNEXT, Extended Abstract}, year = {2012}, month = {12/2012}, abstract = {

Heterogeneity in the Internet ecosystem sometimes turns interaction into interference. Over the years, active queue management (AQM) and end-to-end low-priority congestion control (LPCC) have been proposed as alternative solutions to counter the persistently full buffer problem -- that recently became popular under the {\textquoteleft}{\textquoteleft}bufferbloat{\textquoteright}{\textquoteright} term. In this work, we point out the existence of a negative interplay among AQM and LPCC techniques. Intuitively, as AQM is designed to penalize the most aggressive flows it mainly hit best effort TCP: it follows that LPCC is not able to maintain its low priority, thus becoming as aggressive as TCP. By an extended set of simulation on various AQM policies and LPCC protocols, including the very recent CoDel AQM and LEDBAT LPCC proposals, we point out that this interference is quite universal and deserves further attention.

}, doi = {10.1145/2413247.2413263}, url = {http://www.enst.fr/drossi/paper/rossi12conext.pdf}, author = {YiXi Gong and D Rossi and C. Testa and S. Valenti and D. Taht} } @inproceedings {Rio2012, title = {Wire-speed statistical classification of network traffic on commodity hardware}, booktitle = {ACM Internet Measurement Conference (IMC)}, year = {2012}, month = {11/2012}, abstract = {

In this paper we present a software-based traffic classification engine running on commodity multi-core hardware, able to process in real-time aggregates of up to 14.2Mpps over a single 10Gbps interface -- i.e., the maximum possible packet rate over a 10Gbps Ethernet links given the minimum frame size of 64Bytes. This significant advance with respect to the current state of the art in terms of achieved classification rates are made possible by: (i) the use of an improved network driver, PacketShader, to efficiently move batches of packets from the NIC to the main CPU; (ii) the use of lightweight statistical classification techniques exploiting the size of the first few packets of every observed flow; (iii) a careful tuning of critical parameters of the hardware environment and the software application itself.

}, doi = {10.1145/2398776.2398784}, author = {Pedro Maria Santiago del Rio and D Rossi and Francesco Gringoli and Lorenzo Nava and Luca Salgarelli and Javier Aracil} }