Subject: [Maprg] Is UDP a trash heap?

From: Aaron Falk <[email-masked]>
Date: Mon, 23 May 2016 16:06:51 -0400

See thread and cited draft below.  I’ve heard “UDP is a trash heap” invoked multiple times.  Are there any broad based measurements of UDP loss rates for ports other than 53?  Is IPv6 different than IPv4 in this regard?

--aaron

From: Spud <[email-masked]> on behalf of Ca By <[email-masked]>
Date: Monday, May 23, 2016 at 11:51 AM
To: Tom Herbert <[email-masked]>
Cc: Toerless Eckert <[email-masked]>, Michael Welzl <[email-masked]>, Joe Touch <[email-masked]>, "Scharf, Michael (Nokia - DE)" <[email-masked]>, "[email-masked]" <[email-masked]>, Jana Iyengar <[email-masked]>, Christian Huitema <[email-masked]>
Subject: Re: [Spud] Fwd: New Version Notification for draft-herbert-transports-over-udp-00.txt

On Monday, May 23, 2016, Tom Herbert <[email-masked]> wrote:

On Sun, May 22, 2016 at 1:06 PM, Ca By <[email-masked]> wrote:
>
>>
>> Now all this being said, I also don’t fully get why some folks have such a
>> big problem with running stuff over UDP. I’m not against doing that, if only
>> as a temporary solution that would serve to convince people that the
>> transport (option, ..) is useful.
>> In a TAPS world, it’s just another option to try…
>>
>
> The fact that udp is mostly (by volume) internet attack traffic  is my
> concern with udp.
>
> If legitimate traffic starts using udp in volume, it will make distiguishing
> and thwarting voulmetric attacks very difficult at scale. Without currently
> curbing n * 100g blasts of udp traffic with blanket policers, i would not be
> able to keep my network up... This is a daily issue.  For example, my usual
> udp volume is about 1%. If it goes to 10% suddenly, it is likely smart to
> drop 11% and onwards as a 10x increase in udp is 100% certainly not legit.
>
> My request to quic and spud is simply use a different transport protocol
> number so that their interesting and innovative traffic does not run up
> against the many network policers that are required to enforce well known
> baselines of good normal udp traffic. The quic folks say that they cannot do
> that since 10 year old cpe only passes udp and tcp, then they rant about
> ossified stacks and how we need to put everything on udp to make progess ...
> Seems like they are just choosing to ossify on udp ...  And udp is already
> considered trash (reflection attacks) ...So we agree to disagree, i guess
>
Isn't any other protocol besides TCP also considered trash right now?

My network only "manages" udp.  Ymmv. 

UDP based transport protocols would use well know port numbers. A 

firewall can allow UDP port X that carries a 

A "firewall" is a enterprise solution that does not scale for large national internet providers in the usa 

Yes, the bulk of the trash is less than 20 source ports (chargen, ntp, snmp, ntp, dns, ....). But we also get very large bot swarms doing straight packet attacks with udp.  Even a novice like me can write to udp sockets in python on any port and stuff data through it. 

properly congestion

controlled protocols not subject to reflection attacks, but disallow
other UDP ports.

Tom

> https://tools.ietf.org/html/draft-byrne-opsec-udp-advisory-00
>
>
>
>> Cheers,
>> Michael
>>
>

_______________________________________________ Spud mailing list [email-masked] https://www.ietf.org/mailman/listinfo/spud

---

From: Brian Trammell <[email-masked]>
Date: Tue, 24 May 2016 10:50:10 +0200

hi Aaron,

"Is UDP a trash heap" is, I think, really two questions: one of connectivity, and one of traffic quality. Your second question goes to connectivity, so let's look at that one first.

I don't know of a lot of data for connectivity, blocking, and impairment other than for port 53, either in raw or aggregate form. Our talk at the last maprg meeting looked into RIPE Atlas based UDP differential connectivity and incidence of complete blocking on networks with RIPE Atlas probes on them, and we're presently working on measuring differential treatment between UDP and TCP at relatively low (single flow) data rates, and hope to have something we can share on this shortly. (As an aside, searching for related work for the paper under submission on this was an enlightening activity. Academia seems to find this question uninteresting.)

As noted over on the [email-masked] list, there are other questions about UDP vs TCP treatment that we need answers to as well: distribution of NAT timers on UDP NAT, prevalence and distribution of UDP rate limiting. (The second question is of course hard to answer with active measurement unless you're willing to run DoS attacks.)

As to traffic quality, that's an entirely separate question, answerable only by passive measurement, with all the caveats associated therewith. A simple number "n% of UDP is crap" is useless without knowing how much productive UDP traffic there is on a given network, and different links and different networks look wildly different in this respect. I don't have a lot of answers here, but will think about how to get them.

Thanks, cheers,

Brian

> On 23 May 2016, at 22:06, Aaron Falk <[email-masked]> wrote:
> 
>> _______________________________________________ Spud mailing list [email-masked]://www.ietf.org/mailman/listinfo/spud
> _______________________________________________
> Maprg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/maprg

---

From: "Eggert, Lars" <[email-masked]>
Date: Tue, 24 May 2016 08:58:01 +0000

> As noted over on the [email-masked] list, there are other questions about UDP vs TCP treatment that we need answers to as well: distribution of NAT timers on UDP NAT, prevalence and distribution of…

There is some (now old) data on this in our IMC paper: http://conferences.sigcomm.org/imc/2010/papers/p260.pdf

NAT timers are shorter, and rate limiting more prevalent.

Lars

---

From: Brian Trammell <[email-masked]>
Date: Tue, 24 May 2016 11:11:18 +0200

hi Lars,

thanks for the link! had am (admittedly vague) memory of this paper. Rerunning these experiments on a modern zoo of middleboxes (copying Paul Hoffman, who might know where we could find such a thing ;) ) would be a worthwhile activity, to see if there's been any change here in the intervening six years.

Cheers,

Brian

> On 24 May 2016, at 10:58, Eggert, Lars <[email-masked]> wrote:
>

---

From: "Eggert, Lars" <[email-masked]>
Date: Tue, 24 May 2016 09:39:41 +0000

Glad you found the paper useful. And I realized that we never published the throughput measurements for UDP. CC'ing Markku, in case there has been a later publication or preprint that has that data.

> On 2016-05-24, at 11:11, Brian Trammell <[email-masked]> wrote:
> 
> hi Lars,
>

---

From: "Caozhen (zcao)" <[email-masked]>
Date: Wed, 25 May 2016 00:38:17 +0000

There was some measurement study of the UDP flows in this work: http://ieeexplore.ieee.org/xpls/abs_all.jsp?arnumber=7349581&tag=1

This was a study of the wechat (the most famous IM app in China) VoIP calls and video traffic (both use UDP bearer).  I find it useful because it uncovers many aspects of the UDP flows, such as the use of ISP-aware paths, aggressive retransmission, and both domestic& inter-continental packet loss rate, hops and delay.

Cheers,
Zhen
From: Maprg [mailto:[email-masked]] On Behalf Of Aaron Falk
Sent: Tuesday, May 24, 2016 4:07 AM
To: [email-masked]
Subject: [Maprg] Is UDP a trash heap?

--aaron

From: Spud <[email-masked]<mailto:[email-masked]>> on behalf of Ca By <[email-masked]<mailto:[email-masked]>>
Date: Monday, May 23, 2016 at 11:51 AM
To: Tom Herbert <[email-masked]<mailto:[email-masked]>>
Cc: Toerless Eckert <[email-masked]<mailto:[email-masked]>>, Michael Welzl <[email-masked]<mailto:[email-masked]>>, Joe Touch <[email-masked]<mailto:[email-masked]>>, "Scharf, Michael (Nokia - DE)" <[email-masked]<mailto:[email-masked]>>, "[email-masked]<mailto:[email-masked]>" <[email-masked]<mailto:[email-masked]>>, Jana Iyengar <[email-masked]<mailto:[email-masked]>>, Christian Huitema <[email-masked]<mailto:[email-masked]>>
Subject: Re: [Spud] Fwd: New Version Notification for draft-herbert-transports-over-udp-00.txt

On Monday, May 23, 2016, Tom Herbert <[email-masked]<mailto:[email-masked]>> wrote:

properly congestion

Tom

> https://tools.ietf.org/html/draft-byrne-opsec-udp-advisory-00
_______________________________________________ Spud mailing list [email-masked]<mailto:[email-masked]> https://www.ietf.org/mailman/listinfo/spud