Techniques for the detection of faulty packet header modifications

Understanding, measuring, and debugging IP networks, particularly across administrative domains, is challenging.Compounding the problem are transparent in-path appliances and middleboxes that can be difficult to manage and sometimes left out-of-date or misconfigured.As a result, packet headers can be modified in unexpected ways, negatively impacting end-to-end performance.We discuss the impact of such packet header modifications, present an array of techniques for their detection, and define strategies to add tamper-evident protection to our detection techniques.We select a solution for implementation into the Linux TCP stack and use it to examine real-world Internet paths.We discover various instances of in-path modifications and extract lessons learned from them to help drive future design efforts.National Science Foundation and SPAWAR Systems Center AtlanticApproved for public release; distribution is unlimited