This thesis addresses the challenges posed by traffic dynamics in network management, contrasting the perspectives of a tier-1 Internet Service Provider (ISP) and operators of Industrial Control Systems (ICS). For ISPs, a significant portion of these dynamics arises from the behavior of large Content Providers and Content Delivery Networks (CDNs). Suboptimal mappings, such as to geographically distant servers, or unexpected traffic engineering practices, create challenges including overloaded links, suboptimal routing, and asymmetric paths. To address these issues, ISPs require accurate ingress traffic monitoring to efficiently detect improper CDN mappings and talk to interconnected networks to optimize traffic engineering. This thesis introduces the Ingress Point Detection (IPD) algorithm, which aggregates flow-level data from border routers to assign traffic ingress points to IP prefixes with a predefined level of granularity. The algorithm's design requirements were derived from empirical observations, demonstrating an accuracy of 97.6% for the top 5 Autonomous Systems (ASes) responsible for over 56% of the total ingress traffic. Beyond its primary purpose as an efficient network debugging tool, IPD enabled an in-depth study of ingress traffic dynamics within a major tier-1 ISP. Findings from six years of deployment reveal that most prefixes ingress through the same link for only short periods, often as short as one hour. Additionally, the IPD range distribution varies significantly throughout the day, with the finest granularity observed during peak traffic hours, suggesting highly detailed traffic engineering from the CDN side. Using IPD, this work conducted the first study of path asymmetry in a major tier-1 ISP. By comparing next-hop routers from historical BGP dumps with ingress routers identified by IPD, it was observed that 9% of the ISP's traffic ingress occurs through a different link than the one it was sent out. Similar trends were identified for the top 5 ASes, while the top 20 ASes exhibited approximately 30% path asymmetry. IPD has become an invaluable tool for the ISP, supporting ingress traffic monitoring and efficient network troubleshooting. For ICS operators, traffic dynamics pose distinct challenges due to the need for high reliability and minimal variability. Unlike the Internet, ICS networks are inherently static, employing proprietary protocols and limited security measures. This thesis presents an in-depth study of the traffic characteristics of Distributed Control Systems (DCS), alongside a comprehensive analysis of their vulnerabilities. These include a demonstrated attack on the Profinet IO protocol, capable of disrupting automation processes. Furthermore, a benchmarking framework for Time-Sensitive Networking (TSN) schedulers is introduced, enabling operators to evaluate and compare schedulers for modern ICS networks. In conclusion, this comparative analysis highlights that while ISPs adapt to dynamic environments through fine-grained ingress monitoring and traffic engineering, ICS operators focus on strong isolation and layered security to mitigate risks effectively.
Stefan Mehner (Thu,) studied this question.