Subject: [tcpm] Fwd: [Fwd: [Bloat] Interesting new study of wireless carrier "middle box" characteristics - buffering and strange TCP activities]

From: Fernando Gont <[email-masked]>
Date: Wed, 31 Aug 2011 22:39:57 -0300

FYI

-------- Original Message --------
Subject:     [Bloat] Interesting new study of wireless carrier "middle box"
characteristics - buffering and strange TCP activities
From:      "richard" <[email-masked]>
Date:     August 26, 2011 22:41
To:      [email-masked]
--------------------------------------------------------------------------

http://www.eecs.umich.edu/~qiangxu/paper/sigcomm11_wang.pdf

includes creation of Android app "NetPiculet" to analyze this activity.

sample:
We released NetPiculet on Android Market in January 2011 and
attracted 393 unique mobile users within merely two weeks. Leveraging
the data from these users, we report our ï¬ndings from 10 7
cellular carriers around the world. In particular, we studied the
policies of two large nation-wide U.S. carriers in more depth and
corroborated our ï¬ndings carefully with controlled experi ments.
Due to security and privacy concerns, we anonymize their names
and label them as Carrier A and Carrier B. We summarize our key
ï¬ndings as follows:
â¢ In some cellular networks, a single mobile device can encounter more
than one type of NAT, likely due to load balancing. We also discovered
some NAT mappings increment
external port number with time which was not documented
in any prior NAT study. Accordingly, we develop new NAT
traversal techniques to handle both cases.
â¢ Four cellular networks are found to allow IP spooï¬ng, which
provides attack opportunities by punching holes on NATs
and ï¬rewalls âon behalf ofâ a victim from inside the networks, and
thus
directly exposing the victim to further attacks from the Internet.
â¢ Eleven carriers are found to impose a quite aggressive timeout value
of less than 10 minutes for idle TCP connections,
potentially frequently disrupting long-lived connections maintained by
applications such as push-based email. The resulting extra radio
activities on a mobile device could use more
than 10% of battery per day compared to those under a more
conservative timeout value (e.g., 30 minutes).
â¢ One of the largest U.S. carriers is found to conï¬gure ï¬rewalls to
buffer out-of-order TCP packets for a long time,
likely for the purpose of deep packet inspection. This unexpectedly
interferes with TCP Fast Retransmit and Forward
RTO-Recovery, severely degrading TCP performance triggered merely by a
single packet loss.
â¢ At least one ï¬rewall of a major cellular ISP liberally accept s
TCP packets within a very large window of sequence numbers, greatly
facilitating the traditional blind data injection attacks, endangering
connections that transfer relatively large
amount of data (e.g., streaming applications).
â¢ Some cellular network ï¬rewalls do not immediately remove
the TCP connection state after a connection is closed, allowing
attackers to extend his attack on a victim even after the
victim has closed the connection to a malicious server. This
also dramatically lengthens the NAT traversal time to a few
minutes, given that the same TCP ï¬ve tuple cannot be reused
quickly.

original pointer from
http://www.technologyreview.com/communications/38435/page1/

richard