Middlebox

Last updated

A middlebox is a computer networking device that transforms, inspects, filters, and manipulates traffic for purposes other than packet forwarding. [1] Examples of middleboxes include firewalls, network address translators (NATs), load balancers, and deep packet inspection (DPI) devices. [2]

Contents

UCLA computer science professor Lixia Zhang coined the term middlebox in 1999. [1] [3]

Usage

Middleboxes are widely deployed across both private and public networks. Dedicated middlebox hardware is widely deployed in enterprise networks to improve network security and performance; however, even home network routers often have integrated firewall, NAT, or other middlebox functionality. [4] One 2017 study counted more than 1,000 deployments in autonomous systems, in both directions of traffic flows, and across a wide range networks, including mobile operators and data center networks. [2]

Examples

The following are examples of commonly-deployed middleboxes:

Criticism and challenges

Middleboxes have generated technical challenges for application development and have incurred "scorn" and "dismay" in the network architecture community [10] for violating the end-to-end principle of computer system design. [11]

Application interference

Some middleboxes interfere with application functionality, restricting or preventing end host applications from performing properly.

In particular, network address translators (NATs) present a challenge in that NAT devices divide traffic destined to a public IP address across several receivers. When connections between a host on the Internet and a host behind the NAT are initiated by the host behind the NAT, the NAT learns that traffic for that connection belongs to the local host. Thus, when traffic coming from the Internet is destined to the public (shared) address on a particular port, the NAT can direct the traffic to the appropriate host. However, connections initiated by a host on the Internet do not present the NAT any opportunity to "learn" which internal host the connection belongs to. Moreover, the internal host itself may not even know its own public IP address to announce to potential clients what address to connect to. To resolve this issue, several new protocols have been proposed. [12] [13] [14]

Additionally, because middlebox deployments by cell operators such as AT&T and T-Mobile are opaque, application developers are often "unaware of the middlebox policies enforced by operators", while operators lack full knowledge about application behavior and requirements. For example, one carrier set an "aggressive timeout value to quickly recycle the resources held by inactive TCP connections in the firewall, unexpectedly causing frequent disruptions to long-lived and occasionally idle connections maintained by applications such as push-based email and instant messaging". [8]

Other common middlebox-induced application challenges include web proxies serving "stale" or out-of-date content, [15] and firewalls rejecting traffic on desired ports. [16]

Internet extensibility and design

One criticism of middleboxes is they can limit the choice of transport protocols, thus limiting application or service designs. Middleboxes may filter or drop traffic that does not conform to expected behaviors, so new or uncommon protocols or protocol extensions may be filtered out. [17] Specifically, because middleboxes make hosts in private address realms unable to "pass handles allowing other hosts to communicate with them", they have hindered the spread of newer protocols like the Session Initiation Protocol (SIP) as well as various peer-to-peer systems. [10] [18] This progressive reduction in flexibility has been described as protocol ossification. [19] [20]

Conversely, some middleboxes can assist in protocol deployment by providing a translation between new and old protocols. For example, IPv6 can be deployed on public endpoints such as load balancers, proxies, or other forms of NAT, with backend traffic routed over IPv4 or IPv6.

See also

Related Research Articles

The Transmission Control Protocol (TCP) is one of the main protocols of the Internet protocol suite. It originated in the initial network implementation in which it complemented the Internet Protocol (IP). Therefore, the entire suite is commonly referred to as TCP/IP. TCP provides reliable, ordered, and error-checked delivery of a stream of octets (bytes) between applications running on hosts communicating via an IP network. Major internet applications such as the World Wide Web, email, remote administration, and file transfer rely on TCP, which is part of the Transport layer of the TCP/IP suite. SSL/TLS often runs on top of TCP.

In computing, Internet Protocol Security (IPsec) is a secure network protocol suite that authenticates and encrypts packets of data to provide secure encrypted communication between two computers over an Internet Protocol network. It is used in virtual private networks (VPNs).

<span class="mw-page-title-main">Network address translation</span> Protocol facilitating connection of one IP address space to another

Network address translation (NAT) is a method of mapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. The technique was originally used to bypass the need to assign a new address to every host when a network was moved, or when the upstream Internet service provider was replaced, but could not route the network's address space. It has become a popular and essential tool in conserving global address space in the face of IPv4 address exhaustion. One Internet-routable IP address of a NAT gateway can be used for an entire private network.

In computing, Internet Key Exchange is the protocol used to set up a security association (SA) in the IPsec protocol suite. IKE builds upon the Oakley protocol and ISAKMP. IKE uses X.509 certificates for authentication ‒ either pre-shared or distributed using DNS ‒ and a Diffie–Hellman key exchange to set up a shared session secret from which cryptographic keys are derived. In addition, a security policy for every peer which will connect must be manually maintained.

STUN is a standardized set of methods, including a network protocol, for traversal of network address translator (NAT) gateways in applications of real-time voice, video, messaging, and other interactive communications.

In computer networking, Teredo is a transition technology that gives full IPv6 connectivity for IPv6-capable hosts that are on the IPv4 Internet but have no native connection to an IPv6 network. Unlike similar protocols such as 6to4, it can perform its function even from behind network address translation (NAT) devices such as home routers.

A session border controller (SBC) is a network element deployed to protect SIP based voice over Internet Protocol (VoIP) networks.

UDP hole punching is a commonly used technique employed in network address translation (NAT) applications for maintaining User Datagram Protocol (UDP) packet streams that traverse the NAT. NAT traversal techniques are typically required for client-to-client networking applications on the Internet involving hosts connected in private networks, especially in peer-to-peer, Direct Client-to-Client (DCC) and Voice over Internet Protocol (VoIP) deployments.

Network address translation traversal is a computer networking technique of establishing and maintaining Internet Protocol connections across gateways that implement network address translation (NAT).

Anything In Anything (AYIYA) is a computer networking protocol for managing IP tunneling protocols in use between separated Internet Protocol networks. It is most often used to provide IPv6 transit over an IPv4 network link when network address translation masquerades a private network with a single IP address that may change frequently because of DHCP provisioning by Internet service providers.

Interactive Connectivity Establishment (ICE) is a technique used in computer networking to find ways for two computers to talk to each other as directly as possible in peer-to-peer networking. This is most commonly used for interactive media such as Voice over Internet Protocol (VoIP), peer-to-peer communications, video, and instant messaging. In such applications, communicating through a central server would be slow and expensive, but direct communication between client applications on the Internet is very tricky due to network address translators (NATs), firewalls, and other network barriers.

Hole punching is a technique in computer networking for establishing a direct connection between two parties in which one or both are behind firewalls or behind routers that use network address translation (NAT). To punch a hole, each client connects to an unrestricted third-party server that temporarily stores external and internal address and port information for each client. The server then relays each client's information to the other, and using that information each client tries to establish direct connection; as a result of the connections using valid port numbers, restrictive firewalls or routers accept and forward the incoming packets on each side.

An application-level gateway is a security component that augments a firewall or NAT employed in a mobile network. It allows customized NAT traversal filters to be plugged into the gateway to support address and port translation for certain application layer "control/data" protocols such as FTP, BitTorrent, SIP, RTSP, file transfer in IM applications. In order for these protocols to work through NAT or a firewall, either the application has to know about an address/port number combination that allows incoming packets, or the NAT has to monitor the control traffic and open up port mappings dynamically as required. Legitimate application data can thus be passed through the security checks of the firewall or NAT that would have otherwise restricted the traffic for not meeting its limited filter criteria.

An IPv6 transition mechanism is a technology that facilitates the transitioning of the Internet from the Internet Protocol version 4 (IPv4) infrastructure in use since 1983 to the successor addressing and routing system of Internet Protocol Version 6 (IPv6). As IPv4 and IPv6 networks are not directly interoperable, transition technologies are designed to permit hosts on either network type to communicate with any other host.

<span class="mw-page-title-main">Locator/Identifier Separation Protocol</span>

Locator/ID Separation Protocol (LISP) is a "map-and-encapsulate" protocol which is developed by the Internet Engineering Task Force LISP Working Group. The basic idea behind the separation is that the Internet architecture combines two functions, routing locators and identifiers in one number space: the IP address. LISP supports the separation of the IPv4 and IPv6 address space following a network-based map-and-encapsulate scheme. In LISP, both identifiers and locators can be IP addresses or arbitrary elements like a set of GPS coordinates or a MAC address.

In computing, a firewall is a network security system that monitors and controls incoming and outgoing network traffic based on predetermined security rules. A firewall typically establishes a barrier between a trusted network and an untrusted network, such as the Internet.

IPv4 Residual Deployment (4rd) is an IPv6 transition mechanism for Internet service providers for deployment of Internet Protocol version 6 (IPv6), while maintaining IPv4 service to customers. The protocol and sample applications are specified in RFC 7600.

QUIC is a general-purpose transport layer network protocol initially designed by Jim Roskind at Google, implemented, and deployed in 2012, announced publicly in 2013 as experimentation broadened, and described at an IETF meeting. QUIC is used by more than half of all connections from the Chrome web browser to Google's servers. Microsoft Edge, Firefox, and Safari support it.

Port Control Protocol (PCP) is a computer networking protocol that allows hosts on IPv4 or IPv6 networks to control how the incoming IPv4 or IPv6 packets are translated and forwarded by an upstream router that performs network address translation (NAT) or packet filtering. By allowing hosts to create explicit port forwarding rules, handling of the network traffic can be easily configured to make hosts placed behind NATs or firewalls reachable from the rest of the Internet, which is a requirement for many applications.

Protocol ossification is the loss of flexibility, extensibility and evolvability of network protocols. This is largely due to middleboxes that are sensitive to the wire image of the protocol, and which can interrupt or interfere with messages that are valid but which the middlebox does not correctly recognise. This is a violation of the end-to-end principle. Secondary causes include inflexibility in endpoint implementations of protocols.

References

  1. 1 2 3 Brian Carpenter (2002). "Middleboxes: Taxonomy and Issues". Ietf Datatracker. doi:10.17487/RFC3234. RFC   3234 .
  2. 1 2 Shan Huang; Steve Uhlig; Félix Cuadrado (2017). "Middleboxes in the Internet: A HTTP perspective". 2017 Network Traffic Measurement and Analysis Conference (TMA). pp. 1–9. doi:10.23919/TMA.2017.8002906. ISBN   978-3-901882-95-1. S2CID   34925433.
  3. ↑ Kromhout, Wileen Wong (February 2, 2012), "Lixia Zhang named to UCLA's Jonathan B. Postel Chair in Computer Science", UCLA Newsroom, archived from the original on April 25, 2019, retrieved 2015-06-14
  4. ↑ Ido Dubrawsky and Wes Noonan. "Broadband Routers and Firewalls". CISCO Press. Retrieved 15 July 2012.
  5. ↑ Magalhaes, Ricky. "The Difference Between Application and Session Layer Firewalls" . Retrieved 17 July 2012.
  6. ↑ "Understanding Intrusion Detection Systems" . Retrieved 17 July 2012.
  7. ↑ K. Egevang and P. Francis (2001). "The IP Network Address Translator (NAT)". Ietf Datatracker. doi:10.17487/RFC3022. RFC   1631 .
  8. 1 2 Zhaoguang Wang, Zhiyun Qian, Qiang Xu, Z. Morley Mao, Ming Zhang (August 2011). "An Untold Story of Middleboxes in Cellular Networks" (PDF). ACM SIGCOMM Computer Communication Review. 41 (4). Association for Computing Machinery: 374–385. doi:10.1145/2043164.2018479.{{cite journal}}: CS1 maint: multiple names: authors list (link)
  9. ↑ Poe, Robert. "What Is WAN Optimization, and How Can It Help You?" . Retrieved 17 July 2012.
  10. 1 2 Michael Walfish, Jeremy Stribling, Maxwell Krohn, Hari Balakrishnan, Robert Morris, and Scott Shenker (2004). "Middleboxes No Longer Considered Harmful" (PDF). 6th Symposium on Operating Systems Design and Implementation. USENIX Association: 215–230.{{cite journal}}: CS1 maint: multiple names: authors list (link)
  11. ↑ Walfish; et al. (2004). "Middleboxes no longer considered harmful" (PDF). OSDI. Retrieved 17 July 2012.
  12. ↑ J. Rosenberg; et al. (2008). "Session Traversal Utilities for NAT (STUN)". Ietf Datatracker. doi: 10.17487/RFC5389 . RFC   5389 . S2CID   6777753.
  13. ↑ "NAT-PMP". Ietf Datatracker. Retrieved 17 July 2012.
  14. ↑ "Port Control Protocol Working Group" . Retrieved 17 July 2012.
  15. ↑ "BlueCoat Knowledge Base: Proxy is displaying stale content" . Retrieved 17 July 2012.
  16. ↑ "Using FaceTime and iMessage behind a firewall" . Retrieved 17 July 2012.
  17. ↑ Honda; et al. (2011). "Is it still possible to extend TCP?" (PDF). Internet Measurement Conference.
  18. ↑ Bryan Ford; Pyda Srisuresh; Dan Kegel (2005). "Peer-to-Peer Communication Across Network Address Translators" (PDF). 2005 USENIX Annual Technical Conference. USENIX Association: 179–192. arXiv: cs/0603074 . Bibcode:2006cs........3074F.
  19. ↑ Papastergiou, Giorgos; Fairhurst, Gorry; Ros, David; Brunstrom, Anna; Grinnemo, Karl-Johan; Hurtig, Per; Khademi, Naeem; Tuxen, Michael; Welzl, Michael; Damjanovic, Dragana; Mangiante, Simone (2017). "De-Ossifying the Internet Transport Layer: A Survey and Future Perspectives". IEEE Communications Surveys & Tutorials. 19 (1): 619–639. doi:10.1109/COMST.2016.2626780. hdl: 2164/8317 . ISSN   1553-877X. S2CID   1846371. Archived (PDF) from the original on 2021-09-22.
  20. ↑ Corbet, Jonathan (January 29, 2018). "QUIC as a solution to protocol ossification". lwn.net. Retrieved 2020-03-14.
This page is based on this Wikipedia article
Text is available under the CC BY-SA 4.0 license; additional terms may apply.
Images, videos and audio are available under their respective licenses.