Subject: RE: The problem with tagging packets

From: [email-masked] (Kilkki Kalevi NRC/Hki)
Date: Mon, 10 Nov 1997 16:23:06 +0200

On  7 Nov 97 at 17:06, Alessio Casati wrote:

>Paul, just to let people on the list get more awareness of the reasons   
why ISPs
>like more granularity, drop to the list some of their more urgent needs.

Urgent needs? If I must pick one of them it is the fairness problem   
between different customers using TCP/IP. Malicious users have a lot of   
possibilities to get more resources than well-behaving ones, for   
instance, they may use several parallel TCP/IP flows.

Shortly, with the DP bits the operator can convey the necessary   
information for fair bandwidth allocation from access router to all other   
routers on the path of the flow. Actually, what the access router can do   
is to inform the other routers on the relative bandwidth used by each   
flow compared with some nominal value that could be different for   
different flows. One DP bit is not enough because the access router   
cannot know (without a complicated ABR type of mechanism) what is the   
fair bandwidth for every individual flow at every instant of time. We   
cannot assume that there is a fixed operating point (let say 50 kbit/s)   
around which the TCP/IP control is working all the time and independent   
of the location of other end of the flow. Therefore, we need more   
granularity.

Note that in this case, there is no need to explain to all customers how   
do all the different DP levels work and what are the predicted packet   
loss ratios etc. The priority system with 8 DP levels only forms a tool   
for managing the network more fairly. And the implementation will be   
quite simple.

May any supporter of 1 DP bit explain how can the above TCP/IP problem be   
solved with one DP bit?

.. Kalevi

---

From: Jon Crowcroft <[email-masked]>
Date: Mon, 10 Nov 1997 14:41:36 +0000

>May any supporter of 1 DP bit explain how can the above TCP/IP problem be   

and how is it that {F}RED (without any bits) fails to solve this?

or at least, why is it not good enough short of a full FQ...?

why dopes having more bits explicit in the packets, ratehr than in the
profiles, make a blind bit of difference?
 jon

---

From: Wu-chang Feng <[email-masked]>
Date: Mon, 10 Nov 1997 10:23:11 -0500 (EST)

> May any supporter of 1 DP bit explain how can the above TCP/IP problem be   

Weighted fair bandwidth sharing in single-bit schemes is done by marking 
different fractions of a connection's, a machine's, a subnetwork's, etc. 
packets.  With multiple DP schemes such as SIMA, weighted sharing is done
by encoding the "weight" in each packet.  I think it is possible to have 
SIMA-like functionality with a single bit by translating the weight 
encoding into a marking fraction.

Wu

---

From: "Alessio Casati" <[email-masked]>
Date: Mon, 10 Nov 1997 16:41:33 +0100

> instance, they may use several parallel TCP/IP flows.

Can you indeed show me how by multiple drop levels you can prevent a malicious user
from using more TCP connections?

For fairness reasons I must now tell you how you can solve it with 1 bit DP and a profile meter.
Let us suppose Guy A wants a FCS (First Class Service) TCP service.
A goes to his provider (ISPA) an tells he wants that. ISPA is happy he got a new customer and asks
him what's the per connection profile he feels more comfortable with (IETF guys have been able to
find workable TCP service profile, some early proposal exists in Clark/Wroclawski draft).
A choses its own profile and back he goes.
When using such a service, A's behaviour will be metered by some ISPA's access profile meter.
If A is a bad guy the meter will detect it. And mark (or discard, if A is too bad) all the 
traffic exceeding the profile.
The network will deliver bad packets IFF

- enough resouces are available.
- Drop statistics don't identify A as a too bad guy, in such a case some information will be 
  propagated back to the access to enforce drop at the ingress (this is not ABR, it's bad guys
  penalty).

That'my point of view. To be fair the hardest point is how to define a TCP profile and
coping with the extension of the required service.
The advantage is very simple network behaviour and complexity at the access (that's the way the 
internet has scaled up to date).
Yes, some overprovisioning is likely to occur, if we want to provide FCS this way. But I don't 
think multiple DP will avoid it.

Waiting for your detailed explanation.

Alessio