Subject: UDP Usage and draft-kuehlewind-quic-applicability-00

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 9 Mar 2017 10:39:43 +0000

Hi all,

I just took a brief look at draft-kuehlewind-quic-applicability-00 and read the following statement: "While there is no evidence of widespread, systematic disadvantage of UDP traffic compared to TCP in the Internet [Edeline16], somewhere between three [Trammell16] and five [Swett16] percent of networks simply block UDP traffic."

I wonder whether something can also be said about the use of UDP in enterprise environments since we have run into problems with firewalls being more aggressively configured to block UDP traffic, compared to TCP, in our IoT deployments with CoAP (which lead us to work on the CoAP over TCP spec).

Furthermore, of the disadvantages of UDP over TCP is that NATs have shorter timeouts for UDP-based protocols than for TCP-based protocols. Hence, you need to send keep-alive messages more frequently. (At least according to this older study: Eggert, L., "An experimental study of home gateway characteristics", Proceedings of the 10th annual conference on Internet measurement , 2010. Does the group see any problems with this, particularly when QUIC is used in the mobile space?

Ciao
Hannes

IMPORTANT NOTICE: The contents of this email and any attachments are confidential and may also be privileged. If you are not the intended recipient, please notify the sender immediately and do not disclose the contents to any other person, use it for any purpose, or store or copy the information in any medium. Thank you.

---

From: "Brian Trammell (IETF)" <[email-masked]>
Date: Thu, 9 Mar 2017 11:57:54 +0100

hi Hannes,

> On 09 Mar 2017, at 11:39, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi all,
> 

We could maybe be clearer here. The Edeline paper looks at differential treatment: bandwidth capping (which we have anecdotal evidence for but requires DoSing a network to find/confirm, and is therefore questionably ethical from an active Internet measurement standpoint) or latency disadvantage. I guess you could call "my access network won't let me use non-DNS UDP" a "systematic disadvantage".

> I wonder whether something can also be said about the use of UDP in enterprise environments since we have run into problems with firewalls being more aggressively configured to block UDP traffic, c…

Enterprise networks and access networks in highly challenged environments (i.e., all you get is DNS to a local resolver and proxied-caching no-S HTTP) is where those three to five percent come from.

> Furthermore, of the disadvantages of UDP over TCP is that NATs have shorter timeouts for UDP-based protocols than for TCP-based protocols. Hence, you need to send keep-alive messages more frequentl…

I thought we'd covered that here (indeed, that study and its implications have been discussed on this list). If not, we should mention the effects of shorter UDP timeouts in this draft, yes.

Thanks, cheers,

Brian

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 9 Mar 2017 11:01:47 +0000

Hi Brian,

Thanks for the quic (!) response.

[Hannes] I have tried to find the paper but I failed.

[Hannes] Where do I find the details of this investigation?

[Hannes] It would be great if the research community could re-do the story since it is already getting a bit old. ~6 years is a long time in the Internet age.

Ciao
Hannes

Thanks, cheers,

Brian

---

From: "Brian Trammell (IETF)" <[email-masked]>
Date: Thu, 9 Mar 2017 12:30:57 +0100

> On 09 Mar 2017, at 12:01, Hannes Tschofenig <[email-masked]> wrote:
> 
> Hi Brian,
> 

Ian gave a talk (at MAPRG, I think). The Edeline paper is in arXiv, https://arxiv.org/pdf/1612.07816.pdf -- papers that painstakingly measure something most people think is obvious are hard to publish academically.

> [Hannes] It would be great if the research community could re-do the story since it is already getting a bit old. ~6 years is a long time in the Internet age.

Basic network handling on CPE is a pretty mature market though. Throwing a student at this (on someone else's menagerie) is on my list of stuff to do someday, though.

---

From: Ian Swett <[email-masked]>
Date: Thu, 9 Mar 2017 07:41:05 -0500

On Thu, Mar 9, 2017 at 6:30 AM, Brian Trammell (IETF) <[email-masked]>
wrote:

> >> I just took a brief look at draft-kuehlewind-quic-applicability-00 and
> read the following statement: "While there is no evidence of widespread,
> systematic disadvantage of UDP traffic compared to TCP in the Internet
> [Edeline16], somewhere between three [Trammell16] and five [Swett16]
> percent of networks simply block UDP traffic."
> >
> > We could maybe be clearer here. The Edeline paper looks at differential
> treatment: bandwidth capping (which we have anecdotal evidence for but
> requires DoSing a network to find/confirm, and is therefore questionably
> ethical from an active Internet measurement standpoint) or latency
> disadvantage. I guess you could call "my access network won't let me use
> non-DNS UDP" a "systematic disadvantage".
> >
> >> I wonder whether something can also be said about the use of UDP in
> enterprise environments since we have run into problems with firewalls
> being more aggressively configured to block UDP traffic, compared to TCP,
> in our IoT deployments with CoAP (which lead us to work on the CoAP over
> TCP spec).
> >
> > Enterprise networks and access networks in highly challenged
> environments (i.e., all you get is DNS to a local resolver and
> proxied-caching no-S HTTP) is where those three to five percent come from.
> >
> Ian gave a talk (at MAPRG, I think). The Edeline paper is in arXiv,
> https://arxiv.org/pdf/1612.07816.pdf -- papers that painstakingly measure
> something most people think is obvious are hard to publish academically.
>

Yes, my talk was in Berlin 2016 at TSV Open(
https://datatracker.ietf.org/meeting/96/agenda/tsvarea/).  I sent Mirja a
PDF copy of the slides, but I'm not sure where they are posted.

To second what Brian said, most 'networks' which block QUIC are
corporations that are large enough to have their own AS number.  I've never
found a major ISP that blocks UDP 443.

>
> >> Furthermore, of the disadvantages of UDP over TCP is that NATs have
> shorter timeouts for UDP-based protocols than for TCP-based protocols.
> Hence, you need to send keep-alive messages more frequently. (At least
> according to this older study: Eggert, L., "An experimental study of home
> gateway characteristics", Proceedings of the 10th annual conference on
> Internet measurement , 2010. Does the group see any problems with this,
> particularly when QUIC is used in the mobile space?
> >
> > I thought we'd covered that here (indeed, that study and its
> implications have been discussed on this list). If not, we should mention
> the effects of shorter UDP timeouts in this draft, yes.
> >
> > [Hannes] It would be great if the research community could re-do the
> story since it is already getting a bit old. ~6 years is a long time in the
> Internet age.
>
> Basic network handling on CPE is a pretty mature market though. Throwing a
> student at this (on someone else's menagerie) is on my list of stuff to do
> someday, though.
>
>
> >
> > Ciao
> > Hannes
> >
> >
> > Thanks, cheers,
> >
> > Brian
> >
> >
> >> Ciao
> >> Hannes
> >>
> >> IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> >>
> >
> > IMPORTANT NOTICE: The contents of this email and any attachments are
> confidential and may also be privileged. If you are not the intended
> recipient, please notify the sender immediately and do not disclose the
> contents to any other person, use it for any purpose, or store or copy the
> information in any medium. Thank you.
> >
>
>

---

From: Hannes Tschofenig <[email-masked]>
Date: Thu, 9 Mar 2017 12:48:58 +0000

Hi Ian,

Ø  Yes, my talk was in Berlin 2016 at TSV Open(https://datatracker.ietf.org/meeting/96/agenda/tsvarea/).  I sent Mirja a PDF copy of the slides, but I'm not sure where they are posted.

Found them at https://www.ietf.org/proceedings/96/slides/slides-96-tsvarea-2.pdf

Ø  To second what Brian said, most 'networks' which block QUIC are corporations that are large enough to have their own AS number.  I've never found a major ISP that blocks UDP 443.

Have you tested the results of using UDP on ports other than 443 and whether the blocking rate increases?

Ciao
Hannes

---

From: Ian Swett <[email-masked]>
Date: Thu, 9 Mar 2017 07:51:52 -0500

On Thu, Mar 9, 2017 at 7:48 AM, Hannes Tschofenig <[email-masked]

> Hi Ian,
>
>
>
> Ø  Yes, my talk was in Berlin 2016 at TSV Open(https://datatracker.ietf.
> org/meeting/96/agenda/tsvarea/).  I sent Mirja a PDF copy of the slides,
> but I'm not sure where they are posted.
>
>
>
> Ø  To second what Brian said, most 'networks' which block QUIC are

We have some data from about 4 years ago on this, but I don't have it
easily available.  I don't remember 443 being dramatically more open than
other ports.  In general, it seemed UDP either was blocked or wasn't.

---

From: Mike Bishop <[email-masked]>
Date: Thu, 9 Mar 2017 15:25:29 +0000

Part of me wonders whether QUIC will wind up running over port 53 for the same reason that every protocol in the world seems to run over TLS on TCP port 443.  ;-)

From: QUIC [mailto:[email-masked]] On Behalf Of Ian Swett
Sent: Thursday, March 9, 2017 4:52 AM
To: Hannes Tschofenig <[email-masked]>
Cc: Brian Trammell (IETF) <[email-masked]>; [email-masked]
Subject: Re: UDP Usage and draft-kuehlewind-quic-applicability-00

On Thu, Mar 9, 2017 at 7:48 AM, Hannes Tschofenig <[email-masked]<mailto:[email-masked]>> wrote:
Hi Ian,

>  Yes, my talk was in Berlin 2016 at TSV Open(https://datatracker.ietf.org/meeting/96/agenda/tsvarea/).  I sent Mirja a PDF copy of the slides, but I'm not sure where they are posted.

>  To second what Brian said, most 'networks' which block QUIC are corporations that are large enough to have their own AS number.  I've never found a major ISP that blocks UDP 443.

We have some data from about 4 years ago on this, but I don't have it easily available.  I don't remember 443 being dramatically more open than other ports.  In general, it seemed UDP either was blocked or wasn't.

Ciao
Hannes

---

From: Patrick McManus <[email-masked]>
Date: Thu, 9 Mar 2017 12:16:33 -0500

no joke - I tested out 53/80/443 on a Digital Ocean virtual host last
weekend and only 53 moved bidirectionally (it all worked inbound) - though
I suspect that's more bug than policy and can be resolved by market
interest.

---

From: Stefan Eissing <[email-masked]>
Date: Fri, 10 Mar 2017 09:58:28 +0100

> Am 09.03.2017 um 18:16 schrieb Patrick McManus <[email-masked]>:
> 
> no joke - I tested out 53/80/443 on a Digital Ocean virtual host last weekend and only 53 moved bidirectionally (it all worked inbound) - though I suspect that's more bug than policy and can be resolved by market interest.

Deep down, everything is a DNS query.

-Stefan

---

From: Eliot Lear <[email-masked]>
Date: Fri, 10 Mar 2017 10:12:45 +0100

Hi Brian,

> Basic network handling on CPE is a pretty mature market though. Throwing a student at this (on someone else's menagerie) is on my list of stuff to do someday, though.

I don't think it will remain so.  How the CPE evolves will really depend
on what is in the CP ;-)  Directionality in particular remains important
and will perhaps become more so with IoT devices.  Also what happens in
customer prem and what is handled upstream is evolving.

---

From: Jana Iyengar <[email-masked]>
Date: Fri, 10 Mar 2017 18:46:14 -0800

On Thu, Mar 9, 2017 at 7:25 AM, Mike Bishop <[email-masked]>
wrote:

> Part of me wonders whether QUIC will wind up running over port 53 for the
> same reason that every protocol in the world seems to run over TLS on TCP
> port 443.  ;-)
>

We do have port negotiation in Alt-Svc for QUIC. It's a hammer that's
available to us :-)
I suspect we'll detect other failure modes -- middleboxes that drop packets
that don't look like DNS packets. I think there's ~10% that we need to
write off for any new protocol at this point.

*From:* QUIC [mailto:[email-masked]] *On Behalf Of *Ian Swett
> *Sent:* Thursday, March 9, 2017 4:52 AM
> *To:* Hannes Tschofenig <[email-masked]>
> *Cc:* Brian Trammell (IETF) <[email-masked]>; [email-masked]
> *Subject:* Re: UDP Usage and draft-kuehlewind-quic-applicability-00
>
>
>
>
>
> On Thu, Mar 9, 2017 at 7:48 AM, Hannes Tschofenig <
> [email-masked]> wrote:
>
> Hi Ian,
>
>
>