Detecting Middlebox Interference on Applications

Abstract

Middleboxes are widely used in today’s Internet, especially for security and performance. Middleboxes classify, filter and shape traffic, therefore interfering with application behaviour and performing new network functions for end hosts. Recent studies have uncovered and studied middleboxes in different types of networks. In order to understand the middlebox interference on traffic flows and explore the involved ASes, our methodology relies on a client-server architecture, to be able to observe both directions of the middlebox interaction. Meanwhile, probing with increasing TTL values provides us chances to inspect behaviour of middleboxes hop by hop. Implementing our methodologies, we exploit a large-scale proxy infrastructure Luminati, to detect HTTP-interacting middleboxes across the Internet. We collect a large-scale dataset from vantage points distributed in nearly 10,000 ASes across 196 countries. Our results provide abundant evidence for middleboxes deployed across more than 1000 ASes. We observe various middlebox interference in both directions of traffic flows, and across a wide range networks, including mobile operators and data center networks.