A Router Mechanism for Extreme Overload

Disasters such as the 9/11 attacks, as well as major and unpredictable events, can cause extreme network overload. By \extreme overload" we mean, rst, that the ooered load at a link is signiicantly higher than the link's capacity, and second, that the average throughput per session is too low. Under such conditions, the network can suuer from a form of \livelock" in which even though links are fully utilized, most users cannot complete their transfers. The underlying reasons are that the network carries many retransmitted packets, and that it services ows that are nally aborted by users or applications. To prevent extreme network overload, we propose a router mechanism called Guardian. Guardian is a form of admission control module that is automatically activated when it detects the onset of extreme overload at a network link. Guardian's objective is to allow at least some sessions to complete, rejecting new TCP or UDP sessions that would probably not manage to acquire a minimum acceptable throughput. Guardian does not require signalling, and it can be implemented using standard techniques for session counting and caching. This paper describes ongoing work. As such, we focus on the motivation for the proposed mechanism, and on Guardian's main design.