A Systematic Simulation - based Study of Adverse Impact of Short - lived TCP Flows on Long - lived TCP Flows 1

UDP, can be used in attacks that capture unfairly large share of bandwidth compared to TCP flows. While earlier studies may have pointed out that short-lived TCP flows (mice) may hurt long-lived TCP flows (elephants) on the long term, no insight was given as to developing scenarios leading to drastic drop in throughputs of long-lived TCP flows. We have systematically developed TCP attack scenarios that differ from all prior research in that we use short-lived TCP flows to attack long-lived TCP flows. Our attacks are interesting since, (a) they are more difficult to detect, and (b) they point out the increased vulnerabilities of recently proposed scheduling, AQM and routing techniques that further favor short-lived flows. We systematically exploit the ability of TCP flows in slow-start to rapidly secure greater proportion of bandwidth compared to long-lived TCP flows in congestion avoidance phase, to a point where they drive long-lived TCP flows into timeout. We use simulations, analysis, and experiments to systematically study the dependence of the severity of impact on long-lived TCP flows on key parameters of short-lived TCP flows – including their locations, durations, and number, as well as the intervals between consecutive flows. We derive the ideal durations of, as well as the ideal intervals between, attacking short-lived TCP flows. We show that targeting bottleneck links does not always cause maximal performance degradation for the long-lived flows. In particular, our approach illustrates the interactions between TCP flows and multiple bottleneck links and their sensitivities to correlated losses in the absence of 'non-TCP friendly' flows and paves the way for a systematic synthesis of worst-case congestion scenarios. While randomly generated sequences of short-lived TCP flows may provide some reductions (up to 10%) in the throughput of the long-lived flows, we generate scenarios that cause much greater reductions (>85%). Similar scenarios achieve similar reductions for several TCP variants (Tahoe, Reno, New Reno, Sack), and for different packet drop policies (DropTail and RED). A. INTRODUCTION TCP carries 95% of today's Internet traffic and 80% of the total number of flows in the Internet [6]. A large majority of TCP flows are short-lived. The main distinction between short-lived and long-lived TCP flows (also called mice and elephants, respectively) is how the congestion window grows. Short-lived TCP flows spend most of their lifetime in the slow start phase when the congestion window is increased exponentially. Long-lived TCP flows also start in the slow start …