Slides from IETF P2PI meeting...

The following opinions are my own, not that of the rest of the ICSI networking group or any funder.

Here are my slides for my 5 minute talk at the IETF Peer to Peer Infrastructure meeting in Boston. In them, I argue that bulk-data P2P is not about cost savings but about cost shifting: moving the cost of providing content from the content provider to the recipient or the recipient's ISP. In particular, this cost shifting is very inefficient, greatly increasing aggregate costs, as ISP transit costs significantly more than content provider transit. This is, I believe, the root of the conflict between bulk data P2P and ISPs.

I also believe that caches are a non-starter, as they are less transport efficient than HTTP caches, are lawsuit bait for illegal content, and don't have a business rationale for the ISP to provide one for legal content.

Measurement Framework Papers at PAM

We presented two papers at PAM in Cleveland this week. Both of them involve new frameworks and systems for taking network measurements. The papers are:

• Mark Allman, Vern Paxson. A Reactive Measurement Framework. Passive and Active Measurement Conference, April 2008.
• Mark Allman, Lann Martin, Michael Rabinovich, Kenneth Atchinson. On Community-Oriented Internet Measurement. Passive and Active Measurement Conference, April 2008.

Both of these represent early work and comments are certainly welcome and appreciated.

Should PCs Grapple With Ethics?

Last week at the USENIX WOWCS workshop the following paper was presented:

• Mark Allman. What Ought A Program Committee To Do?. USENIX Workshop on Organizing Workshops, Conferences, and Symposia for Computer Systems (WOWCS), April 2008. Slides available.

LEET'08 paper on botnet-based spam campaign infiltration

At today's LEET'08 workshop we presented a detailed analysis of the internal workings of a large-scale spamming operation, namely that orchestrated using the Storm botnet.

• C. Kreibich, C. Kanich, K. Levchenko, B. Enright, G. Voelker, V. Paxson, and S. Savage. On the Spam Campaign Trail. First USENIX Workshop on Large-scale Exploits and Emergent Threats (LEET '08), 2008, San Francisco, USA.

This is joint work with UCSD as part of our CCIED effort.

An Interactive Shell For Operating Bro Setups

For the Bro Cluster, we are developing an interactive shell to facilitate easy operation of such multi-system setups. The shell provides a customizable framework for all the common tasks involved in maintaining a Bro setup, such as configuration & installation, log rotation & archival, mail notifications, profiling, etc.

While we originally intended the shell to be used with clusters, it seems only natural to provide the same functionality for traditional, single-system Bro setups as well. Consequently, we added a standalone mode to the shell, and the freshly updated shell documentation explains how to set this up.

Be careful though: this is still under development and requires an unstable development version of Bro. Things are still in flux and the shell is not suitable for production use at this time. If however the standalone mode turns out to work well, it might at some point replace Bro's current BroLite run-time framework, which is no longer maintained.

Note About Peer Review

A new short note on refereeing appears in the editorial zone of the April issue of CCR:

• Mark Allman. Thoughts on Reviewing. ACM Computer Communication Review, Editorial Contribution, 38(2), April 2008.

Comments welcome!

ICSI's CyberTrust Poster

Our Poster from the CyberTrust PI Meeting is online. This acts as a very high level summary of four of our current focuses: Understanding the underground economy, developing situational awareness across time and space, parallelizing intrusion detection, and web tripwires.