Timur Friedman

Obtaining an accurate, explainable and Internet scale IP geolocation dataset has been a longstanding goal of the research community. Despite decades of research on IP geolocation, no current technique can provide such a dataset. In particular, latency-based geolocation techniques do not scale, because, on one hand, we have thousands of available vantage points to perform measurements, but on the other hand, we have no way to select the right ones for each IP address. In this paper, we present GeoResolver, which is a serious step towards our goal, by using the idea that when multiple operators redirect two prefixes to the same servers, these prefixes should be close to each other. With this intuition, we define a methodology to measure and compare the redirection of prefixes to servers using ECS DNS measurements, and select the prefixes with the smallest redirection distance to a target prefix to issue the latency measurements to targets in that prefix. GeoResolver performs nearly as well as a brute force approach, geolocating 94% of the targets that could actually be geolocated at metro level, while using 4.3% of the probing budget compared to the state of the art. On the Internet scale CAIDA ITDK dataset, GeoResolver geolocates 16% of the IP addresses at metro level, 3.4 times more than the state of the art. In addition, GeoResolver is robust to public resolvers or hypergiants stopping supporting ECS.

The Border Gateway Protocol (BGP) offers several ''knobs'' to control routing decisions, but they are coarse-grained and only affect routes received from neighboring Autonomous Systems (AS). To enhance policy expressiveness, BGP was extended with the communities attribute, allowing an AS to attach metadata to routes and influence the routing decisions of a remote AS. The metadata can carry information to (e.g., where a route was received) or request an action from a remote AS (e.g., not to export a route to one of its neighbors). Unfortunately, the semantics of BGP communities are not standardized, lack universal rules, and are poorly documented. In this work, we design and evaluate algorithms to automatically uncover BGP action communities and ASes that violate standard practices by consistently using the information communities of other ASes, revealing undocumented relationships between them (e.g., siblings). Our experimental evaluation with billions of route announcements from public BGP route collectors from 2018 to 2023 uncovers previously unknown AS relationships and shows that our algorithm for identifying action communities achieves average precision and recall of 92.5% and 86.5%, respectively.

The Border Gateway Protocol (BGP) offers several "knobs" to control routing decisions, but they are coarse-grained and only affect routes received from neighboring Autonomous Systems (AS). To enhance policy expressiveness, BGP was extended with the communities attribute, allowing an AS to attach metadata to routes and influence the routing decisions of a remote AS. The metadata can carry information to ( e.g. , where a route was received) or request an action from a remote AS ( e.g. , not to export a route to one of its neighbors). Unfortunately, the semantics of BGP communities are not standardized, lack universal rules, and are poorly documented. In this work, we design and evaluate algorithms to automatically uncover BGP action communities and ASes that violate standard practices by consistently using the information communities of other ASes, revealing undocumented relationships between them (e.g., siblings). Our experimental evaluation with billions of route announcements from public BGP route collectors from 2018 to 2023 uncovers previously unknown AS relationships and shows that our algorithm for identifying action communities achieves average precision and recall of 92.5% and 86.5%, respectively.

Obtaining an accurate, explainable, Internet-scale IP geolocation dataset has been a longstanding goal of the research community. Despite decades of research on IP geolocation, no current technique can provide such a dataset. In particular, latency-based geolocation techniques do not scale, because, on one hand, we have thousands of available vantage points to perform measurements, but on the other hand, we have no way to select the right ones for each IP address. In this paper, we present GeoResolver, an efficient vantage point selection methodology, based on the assumption that two IP addresses that share a similar DNS redirection are likely to be geographically close together. GeoResolver performs nearly as well as a brute force approach using all the vantage points, geolocating 94% of the targets that could actually be geolocated at metro level by using all the vantage points, while using 4.3% of the probing budget compared to a state-of-the-art technique. We carefully design GeoResolver to be both accurate and scalable and with our implementation, we start a large-scale geolocation campaign.

In recent years, along with containers, the cloud community has rapidly taken up Kubernetes, the de facto industry standard container orchestration system. All major cloud providers currently offer Kubernetes-based Containers as a Service (CaaS). However, when CaaS is offered to multiple independent consumers, or tenants, a multi-instance approach is used, in which each tenant receives its own separate cluster, which imposes significant overhead due to employing virtual machines for isolation. If CaaS is to be offered not only in the cloud, but also in the edge cloud, where resources are limited, another solution is required. In this paper, drawing upon the scientific literature, we provide a novel classification of Kubernetes multitenancy into three approaches: multi-instance through multiple clusters, multi-instance through multiple control planes, and single-instance native. We propose a single-instance multitenancy framework, meaning tenants are served out of a shared control plane in a single cluster. Our empirical findings show that the single-instance approach imposes a markedly decreased overhead than the other two. However, it entails a tradeoff in workload isolation owing to tenants sharing the compute nodes. There are still means to compensate for such weakened isolation, and we describe how our framework does it. The framework is publicly available as liberally-licensed, free, open-source software that extends Kubernetes. It is in production use within the EdgeNet testbed for researchers.

What if tomorrow, hundreds, thousands, or even more people start sending 100,000 packets per second into the network using high speed probing? It is reasonable to think that this would not be a desirable scenario for the Internet. However, this might already be taking place, as high speed probing techniques such as ZMap [3] and Yarrp [ 1], the high speed evolution of Ping and Traceroute, are extensively used by the network research community and beyond. If they can definitely help for improving our understanding of the Internet, very little work has been done to examine their potential negative impact, i.e., their potential harm to the Internet's infrastructure, or their harm to the quality of measurement results. In this paper, we quantify the risks of those techniques, and provide recommendations on how to put in place high-speed ethical probing methods