Subject: [Spud] Thoughts on monitoring a network of only UDP traffic

From: Dave Dolson <[email-masked]>
Date: Tue, 26 Jul 2016 13:34:16 +0000

Consider a thought experiment for the year 2025...
- you are operating a network in a post-TCP world where PLUS and QUIC are standard
- all of the internet traffic is IP/UDP on arbitrary ports with encrypted payload
- you would like to know whether the network is functioning properly
   - does the network have enough capacity?
   - what latency are users/servers receiving?
   - is there a DDoS attack in progress?
   - are there rogue stack implementations that don't properly back off under congestion?

Today in 2016 operators can measure the health of the network by at least these methods:
- TCP round-trip time, such as absolute time to complete aspects of the 3-way handshake.
- TCP packet loss and retransmission, measured by tracking sequence numbers
- DNS response time (by correlating answers to queries)
- various protocol-aware voice quality and video quality measures

Even if you are using UDP protocols on the internet, you are benefiting from the TCP measurements that are proxy for the overall quality.
Of course none of these were designed (as far as I know) with this use in mind...

If TCP is to be replaced, we need to think about how what an operator can use in place of the TCP measurements to assess network health.

This is an opportunity to provide more explicit information to the network, *designed* for operations, (and not necessarily the same information used for end-point control.)
- should end-points expose sequence numbers and/or explicit loss information?
- should packets expose tokens that can be used to measure round-trip information?
- should senders be permitted to expose authenticating information to assist DDoS scrubbing?
   - could senders expose something that is difficult to fake?
- could there be a voluntary "debug mode" allowing network operators to collect a *lot* of information when users call the help desk?

And in the PLUS spirit, these could be optional, provided enough other traffic contained this information to provide enough samples for the operator.
Just as the presence of TCP allows all traffic to be managed, those exposing measurement information will benefit those that choose not to.

Thinking along these lines makes me in favor of PLUS but not a PLUS that is restricted to tube open/close.
I think there is a great opportunity to improve *both* privacy and network management.

Of course I'm also curious to hear how others expect networks to be managed in an all-UDP world.

-Dave