Search

Since ZMap's debut in 2013, networking and security researchers have used the open-source scanner to write hundreds of research papers that study Internet behavior. In addition, ZMap powers much of the attack-surface management and security ratings industries, and more than a dozen security companies have built products on top of ZMap. Behind the scenes, much of ZMap's behavior - ranging from its pseudorandom IP generation to its packet construction - has quietly evolved as we have learned more about how to scan the Internet. In this work, we quantify ZMap's adoption over the ten years since its release, describe its modern behavior (and the measurements that motivated those changes), and offer lessons from releasing and maintaining ZMap., Comment: 12 pages, 7 figures, in submission at Internet Measurement Conference 2024

As Internet censors rapidly evolve new blocking techniques, circumvention tools must also adapt and roll out new strategies to remain unblocked. But new strategies can be time consuming for circumventors to develop and deploy, and usually an update to one tool often requires significant additional effort to be ported to others. Moreover, distributing the updated application across different platforms poses its own set of challenges. In this paper, we introduce WATER (WebAssembly Transport Executables Runtime), a novel design that enables applications to use a WebAssembly-based application-layer (e.g., TLS) to wrap network connections and provide network transports. Deploying a new circumvention technique with WATER only requires distributing the WebAssembly Transport Module(WATM) binary and any transport-specific configuration, allowing dynamic transport updates without any change to the application itself. WATMs are also designed to be generic such that different applications using WATER can use the same WATM to rapidly deploy successful circumvention techniques to their own users, facilitating rapid interoperability between independent circumvention tools., Comment: FOCI 2024

The Explicit Congestion Notification (ECN) field has taken on new importance due to Low Latency, Low Loss, and Scalable throughput (L4S) technology designed for extremely latency-sensitive applications (such as cloud games and cloud-rendered VR/AR). ECN and L4S need to be supported by the client and server but also all devices in the network path. We have identified that "ECN bleaching", where an intermediate network device clears or "bleaches" the ECN flags, occurs and quantified how often that happens, why it happens and identified where in the network it happens. In this research, we conduct a comprehensive measurement study on end-to-end traversal of the ECN field using probes deployed on the Internet across different varied clients and servers. Using these probes, we identify and locate instances of ECN bleaching on various network paths on the Internet. In our six months of measurements, conducted in late 2021 and early 2022, we found the prevalence varied considerably from network to network. One cloud provider and two cellular providers bleach the ECN field as a matter of policy. Of the rest, we found 1,112 out of 129,252 routers, 4.17% of paths we measured showed ECN bleaching., Comment: 13 pages, 11 figures