Wednesday, November 5, 2008

Middleboxes No Longer Considered Harmful

This paper discusses how middle-boxes such as NAT and firewalls violate the two principles of the Internet architecture:
  1. Unique identifier for each Internet entity.
  2. Packets processed by their respective owners.
The authors say that even though the middle-boxes break the rules but they are required for important reasons. Few reasons being security and performance improvement through caching as well as load balancing. The paper then proposes an architecture to include the functionality of middle-boxes without breaking the principles.

The architecture called Delegation Oriented Architecture proposes the following things:
  1. Globally unique ID in flat namespace which is carried by the packets
  2. Sender and Receiver can define the intermediaries that should process the packet.
Without going into the details of the architecture and how it works, I want to list some of the things that concerned me:
  1. After adding the intermediary information in the packet we are still defying the end-to-end principle. What happens if the intermediary crashes?
  2. The unique identifiers are said to be 160 bit long. The packet is supposed to have 2 160-bit identifiers. Isn't this an overhead for small packets?
  3. The idea seems to be interesting but I am concerned about performance. Even though the architecture provides flexibility by allowing the intermediaries to be anywhere and not in the path to the destination. The packet now has to be first traversed to the intermediary and then to the destination. Also, it is required to lookup of the path to the intermediary.
  4. Another question that get raised with such systems is scalability. With so many machines in the Internet, if every machine sends the message to an intermediary and the DHT being used for EID resolving, an important question arises that we are relying on the performance of the DHT for lookup and information retrieval.

1 comment:

Randy H. Katz said...

I don't think the size of packets/EID issue is that great anymore. In the old days, small packets contained single character payloads -- I just don't think that happens anymore, with apps moving into the client browser/http traffic dominating the packet payloads/etc. It is really nice to have a large number of bits to identify network elements.