Detecting ICMP Rate Limiting in the Internet. Guo, H. & Heidemann, J. In Proceedings of the Passive and Active Measurement Workshop, pages to appear, Berlin, Germany, March, 2018. Springer. ![Detecting ICMP Rate Limiting in the Internet [link]](https://bibbase.org/img/filetypes/link.svg "link")
Paper abstract bibtex ICMP active probing is the center of many network measurements. Rate limiting to ICMP traffic, if undetected, could distort measurements and create false conclusions. To settle this concern, we look systematically for ICMP rate limiting in the Internet. We create \emphFADER, a new algorithm that can identify rate limiting from user-side traces with minimal new measurement traffic. We validate the accuracy of FADER with many different network configurations in testbed experiments and show that it almost always detects rate limiting. With this confidence, we apply our algorithm to a random sample of the whole Internet, showing that \emphrate limiting exists but that \emphfor slow probing rates, rate-limiting is very rare. For our random sample of 40,493 /24 blocks (about 2% of the responsive space), we confirm 6 blocks (0.02%!) see rate limiting at 0.39 packets/s per block. We look at higher rates in public datasets and suggest that fall-off in responses as rates approach 1 packet/s per /24 block is consistent with rate limiting. We also show that even very slow probing (0.0001 packet/s) can encounter rate limiting of NACKs that are concentrated at a single router near the prober.
@InProceedings{Guo18a,
author = "Hang Guo and John Heidemann",
title = "Detecting {ICMP} Rate Limiting in the {Internet}",
booktitle = "Proceedings of the " # " Passive and Active Measurement Workshop",
year = 2018,
sortdate = "2018-03-26",
project = "ant, retrofuturebridge, lacrend",
jsubject = "topology_modeling",
pages = "to appear",
month = mar,
address = "Berlin, Germany",
publisher = "Springer",
jlocation = "johnh: pafile",
keywords = "icmp, rate limiting",
url = "https://ant.isi.edu/%7ejohnh/PAPERS/Guo18a.html",
pdfurl = "https://ant.isi.edu/%7ejohnh/PAPERS/Guo18a.pdf",
blogurl = "https://ant.isi.edu/blog/?p=1176",
abstract = "ICMP active probing is the center of many network measurements. Rate
limiting to ICMP traffic, if undetected, could distort measurements
and create false conclusions. To settle this concern, we look
systematically for ICMP rate limiting in the Internet. We
create \emph{FADER}, a new algorithm that can identify rate limiting from
user-side traces with minimal new measurement traffic. We validate
the accuracy of FADER with many different network configurations in
testbed experiments and show that it almost always detects rate
limiting. With this confidence, we apply our algorithm to a random
sample of the whole Internet, showing that \emph{rate limiting exists}
but that \emph{for slow probing rates, rate-limiting is very rare}.
For our random sample of 40,493 /24 blocks (about 2\% of the
responsive space), we confirm 6 blocks (0.02\%!) see rate limiting at
0.39 packets/s per block. We look at higher rates in public datasets
and suggest that fall-off in responses as rates approach 1 packet/s
per /24 block is consistent with rate limiting. We also show that
even very slow probing (0.0001 packet/s) can encounter rate limiting
of NACKs that are concentrated at a single router near the prober.",
}
Downloads: 0
{"_id":"J8FdGhv8Z8uGBEkAQ","bibbaseid":"guo-heidemann-detectingicmpratelimitingintheinternet-2018","author_short":["Guo, H.","Heidemann, J."],"bibdata":{"bibtype":"inproceedings","type":"inproceedings","author":[{"firstnames":["Hang"],"propositions":[],"lastnames":["Guo"],"suffixes":[]},{"firstnames":["John"],"propositions":[],"lastnames":["Heidemann"],"suffixes":[]}],"title":"Detecting ICMP Rate Limiting in the Internet","booktitle":"Proceedings of the Passive and Active Measurement Workshop","year":"2018","sortdate":"2018-03-26","project":"ant, retrofuturebridge, lacrend","jsubject":"topology_modeling","pages":"to appear","month":"March","address":"Berlin, Germany","publisher":"Springer","jlocation":"johnh: pafile","keywords":"icmp, rate limiting","url":"https://ant.isi.edu/%7ejohnh/PAPERS/Guo18a.html","pdfurl":"https://ant.isi.edu/%7ejohnh/PAPERS/Guo18a.pdf","blogurl":"https://ant.isi.edu/blog/?p=1176","abstract":"ICMP active probing is the center of many network measurements. Rate limiting to ICMP traffic, if undetected, could distort measurements and create false conclusions. To settle this concern, we look systematically for ICMP rate limiting in the Internet. We create \\emphFADER, a new algorithm that can identify rate limiting from user-side traces with minimal new measurement traffic. We validate the accuracy of FADER with many different network configurations in testbed experiments and show that it almost always detects rate limiting. With this confidence, we apply our algorithm to a random sample of the whole Internet, showing that \\emphrate limiting exists but that \\emphfor slow probing rates, rate-limiting is very rare. For our random sample of 40,493 /24 blocks (about 2% of the responsive space), we confirm 6 blocks (0.02%!) see rate limiting at 0.39 packets/s per block. We look at higher rates in public datasets and suggest that fall-off in responses as rates approach 1 packet/s per /24 block is consistent with rate limiting. We also show that even very slow probing (0.0001 packet/s) can encounter rate limiting of NACKs that are concentrated at a single router near the prober.","bibtex":"@InProceedings{Guo18a,\n\tauthor = \t\"Hang Guo and John Heidemann\",\n\ttitle = \t\"Detecting {ICMP} Rate Limiting in the {Internet}\",\n booktitle = \"Proceedings of the \" # \" Passive and Active Measurement Workshop\",\n year = 2018,\n\tsortdate = \t\t\"2018-03-26\", \n\tproject = \"ant, retrofuturebridge, lacrend\",\n\tjsubject = \"topology_modeling\",\n pages = \"to appear\",\n month = mar,\n address = \"Berlin, Germany\",\n publisher = \"Springer\",\n jlocation = \"johnh: pafile\",\n\tkeywords = \t\"icmp, rate limiting\",\n\turl =\t\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Guo18a.html\",\n\tpdfurl =\t\"https://ant.isi.edu/%7ejohnh/PAPERS/Guo18a.pdf\",\n\tblogurl = \"https://ant.isi.edu/blog/?p=1176\",\n\tabstract = \"ICMP active probing is the center of many network measurements. Rate\nlimiting to ICMP traffic, if undetected, could distort measurements\nand create false conclusions. To settle this concern, we look\nsystematically for ICMP rate limiting in the Internet. We \ncreate \\emph{FADER}, a new algorithm that can identify rate limiting from\nuser-side traces with minimal new measurement traffic. We validate\nthe accuracy of FADER with many different network configurations in\ntestbed experiments and show that it almost always detects rate\nlimiting. With this confidence, we apply our algorithm to a random\nsample of the whole Internet, showing that \\emph{rate limiting exists}\nbut that \\emph{for slow probing rates, rate-limiting is very rare}.\nFor our random sample of 40,493 /24 blocks (about 2\\% of the\nresponsive space), we confirm 6 blocks (0.02\\%!) see rate limiting at\n0.39 packets/s per block. We look at higher rates in public datasets\nand suggest that fall-off in responses as rates approach 1 packet/s\nper /24 block is consistent with rate limiting. We also show that\neven very slow probing (0.0001 packet/s) can encounter rate limiting\nof NACKs that are concentrated at a single router near the prober.\",\n}\n\n","author_short":["Guo, H.","Heidemann, J."],"bibbaseid":"guo-heidemann-detectingicmpratelimitingintheinternet-2018","role":"author","urls":{"Paper":"https://ant.isi.edu/%7ejohnh/PAPERS/Guo18a.html"},"keyword":["icmp","rate limiting"],"metadata":{"authorlinks":{}}},"bibtype":"inproceedings","biburl":"https://bibbase.org/f/dHevizJoWEhWowz8q/johnh-2023-2.bib","dataSources":["YLyu3mj3xsBeoqiHK","fLZcDgNSoSuatv6aX","fxEParwu2ZfurScPY","7nuQvtHTqKrLmgu99"],"keywords":["icmp","rate limiting"],"search_terms":["detecting","icmp","rate","limiting","internet","guo","heidemann"],"title":"Detecting ICMP Rate Limiting in the Internet","year":2018}