Defeating TCP Congestion Control in Three Easy StepsStefan SavageNeal Cardwell, David Wetherall and Tom AndersonDepartment of Computer Science and EngineeringUniversity of WashingtonOverview● Simple Question■ Can a TCP client influence how fast a TCP server sends it data?● Simple Answer■ Oh yeah… Big time.RTTSender ReceiverACK 487Data 4381:5841Data 1461:2921Data 2921:4381Data 5841:7301ACK 973ACK 1461Data 1:1461ACK Division• Send M ACKs for one pkt• Exponential growth factor proportional to M!• Preserves end-to-end semanticsRTTSender ReceiverACK 1Data 1:1461Data 1461:2921Data 2921:4381Data 4381:5841ACK 1ACK 1Data 1:1461ACK 1ACK 1Data 5841:7301DupACK Spoofing• Send extra duplicate ACKs• Sender sends one pkt for each duplicate ACK• Preserves end-to-end semanticsRTTSender ReceiverData 1:1461ACK 1461ACK 2921Data 1461:2921Data 4381:5841Data 2921:4381Data 5841:7301Optimistic ACKing• Send ACKs early• Sender sends pktsin proportion to ACK rate• Violates end-to-endsemanticsImplementation experience● TCP Daytona■ Easy to implement (<75 lines in Linux)■ Works with all popular sender TCP stacks● We have the world’s fastest Web browserWhat to do?● Sender-side TCP modifications can mitigate these problems● Its possible to remove the incentivefor receiver misbehavior using a variant on nonces.■ Receiver can only hurt itself by lying● Details can be found in:TCP Congestion Control with a Misbehaving Receiver, to appear ACM Computer Communications Review, October, 1999.RFC 2581Controlling the congestion windowDuring slow start, TCP increments cwndby at most SMSS bytes for each ACK received that acknowledges new data.…During congestion avoidance, cwnd is incremented by 1 full-sized segment per round-trip time (RTT).RFC 2581Fast Retransmit and RecoverySet cwnd to ssthresh plus 3*SMSS. This artificially “inflates” the congestion window by the number of segments (three) that have left the network and which the receiver has buffered.…For each additional duplicate ACK received, increment cwnd by SMSS. This artificially inflates the congestion window in order to reflect the additional segment that has left the