What packets may come: Automata for network monitoring

We consider the problem of monitoring an interactive de-vice, such as an implementation of a network protocol, in order to check whether its execution is consistent with its speci cation. At rst glance, it appears that a monitor could simply follow the input-output trace of the device and check it against the specication. However, if the monitor is able to observe inputs and outputs only from a vantage point ex-ternal to the device|as is typically the case|the problem becomes surprisingly diÆcult. This is because events may be buered, and even lost, between the monitor and the de-vice, in which case, even for a correctly running device, the trace observed at the monitor could be inconsistent with the speci cation. In this paper, we formulate the problem of external monitor-ing as a language recognition problem. Given a specication that accepts a certain language of input-output sequences, we dene another language that corresponds to input-output sequences observable externally. We also give an algorithm to check membership of a string in the derived language. It turns out that without any assumptions on the specica-tion, this algorithm may take unbounded time and space. To address this problem, we dene a series of properties of device specications or protocols that can be exploited to construct eÆcient language recognizers at the monitor. We characterize these properties and provide complexity bounds for monitoring in each case. To illustrate our methodology, we describe properties of the Internet Transmission Control Protocol (TCP), and identify features of the protocol that make it challenging to monitor eÆciently.