RFC 1273

RFC 1273 🌈

• Stream: Network Working Group 🌷
• Number and title: RFC 1273 🦋, A Measurement Study of Changes in Service-Level Reachability in the Global TCP/IP Internet: Goals, Experimental Design, Implementation, and Policy Considerations
• Author: M. Schwartz, University of Colorado 🎓
• Date: November 1991 📅
• Category: informational. This doc gives info to the Internet community and doesn't specify a standard 📚
• Obsoletes and updates: nothing is listed 🙌

---

Status of this Memo ✨

Okay so this memo is here to give the Internet community some info, and it does not specify an Internet standard 🧐. Distribution is unlimited, so pass it around as much as you want 💌.

Abstract 🌸

In this report we talk about our plans for a longitudinal measurement study (aka watching the same thing over a long stretch of time 👀) of changes in service-level reachability in the global TCP/IP Internet. We go over our experimental design, how we keep network and remote site load in check, the mechanisms that control the measurement collection process, and network appropriate use and privacy issues, including our efforts to let the sites we measure know what's up. A list of references and info on how to contact the Principal Investigator are included too 💕.

Introduction 🦋

The global TCP/IP Internet connects millions of individuals at thousands of institutions worldwide 🌍, which means huge potential for collaboration through network services and electronic information exchange. But that same powerful connectivity opens up lots of avenues for security violations, as a bunch of well publicized events over the past few years showed 😬. So lots of sites have put mechanisms in place to limit their exposure to security intrusions. That ranges from disabling certain inter-site services, to using external gateways that only allow electronic mail delivery, to gateways that limit remote interactions via access control lists, to disconnecting from the Internet entirely. These measures are way better than the damage security violations could cause, but taken to an extreme they could eventually reduce the Internet to little more than a means of supporting certain pre-approved point-to-point data transfers 💀. That kind of diminished functionality could hinder or prevent the deployment of important new types of network services, which would slow down both research and commercial advancement.

To understand how this is evolving, we designed a study to measure changes in Internet service-level reachability over a period of one year 📈. It looks at upper layer service reachability instead of basic IP connectivity, because the former shows how willing organizations are to take part in inter-organizational computing. That's going to be a big component of future wide area distributed applications 🫶.

The data we gather will feed into Internet research and engineering planning in a few ways 🧠. It will show the mechanisms sites use to distance themselves from Internet connectivity, the types of services sites are willing to run (and therefore the kind of distributed collaboration they're willing to support), and how these characteristics vary by geographic location and type of institution (commercial, educational, etc.). Understanding these trends lets application designers and network builders plan more realistically for supporting future wide area distributed applications like digital library systems, information services, wide area distributed file systems, and conferencing and other collaboration-support systems 🎀. The measurements are also of general interest, since they're direct measurements of the evolution of a global electronic society 🌈.

Clearly, a study of this nature and magnitude raises a number of potential concerns 🙈. In this note we go over our experimental design, considerations of network and remote site load, mechanisms used to control the measurement collection process, and our efforts to inform the sites measured by this study, along with the related network appropriate use and privacy issues.

A point we really want to stress from the outset: this is not a study of network security 🔐. The experiments do not try to probe the security mechanisms of any machine on the network. The study is concerned solely with the evolution of network connectivity and service reachability.

Experimental Design 📋

Here's the plan. The study is a set of runs of a program over the span of one to two days each month, repeated bimonthly for a period of one year (in January 1992, March 1992, May 1992, July 1992, September 1992, and November 1992). Each program run tries to connect to 13 different TCP services at each of approximately 12,700 Internet domains worldwide, recording the failure/success status of each attempt. The program will attempt no data transfers in either direction 🙅‍♀️. If a connection succeeds, it's simply closed and counted. (Note in particular that this means the security mechanism behind individual network services will not be tested 🔒.) The machines we try to connect to are selected at random from a large list of machines in the Internet, constrained so that at most 1 to 3 machines is contacted in any particular domain.

The services we try to connect to are:

    __________________________________________________________________
      Port Number   Service                Port Number   Service
    ------------------------------------------------------------------
          13        daytime                    111       Sun portmap
          15        netstat                    513       rlogin
          21        FTP                        514       rsh
          23        telnet                     540       UUCP
          25        SMTP                       543       klogin
          53        Domain Naming System       544       krcmd, kshell
          79        finger
     _________________________________________________________________

This list was picked to cover a representative range of service types, each one something you'd expect to find on basically any machine at a site. That's what makes probing random machines meaningful ✨. The one exception is the Domain Naming System, where the machines to probe are picked from info obtained from the Domain system itself 🧚. Only TCP services get tested, since the TCP connection mechanism lets you tell whether a server is running in an application-independent fashion 💅.

Side tea ☕: you could grab "Well Known Service" records out of the Domain Naming System, which would be a bit less "invasive" as a measurement approach. BUT these records aren't required for proper network operation, so they're far from complete or consistent in the Domain Naming System 😤. The only way to collect the data we want is to measure them the way described above.

Network and Remote Site Load 🫧

The measurement software is super careful about not generating unnecessary internet packets, and about not congesting the internet with too much concurrent activity 🌷. Once it has successfully connected to a particular service in a domain, the software never tries that service on any machine in that domain again for the duration of the current measurement run (i.e., the current 60 days). Once it has recorded 3 connection refusals at any machines in that domain for a service, it doesn't try that service at that domain again during the current measurement run. If it experiences 3 timeouts on any machine in a domain, it gives up on the domain, possibly retrying a day later (to get past transient network problems). In the worst case there will be 3 connection failures for each service at 3 different machines, which adds up to 37 connection requests per domain (3 for each of the 12 services other than the Domain Naming System, and one for the Domain Naming System). Don't panic, though: the average will be much less than this 💖.

To quantify the actual Internet load, we now present some measurements from test runs of the measurement software performed in August 1991 📊. In total, 50,549 Domain Naming System lookups were performed, and 73,760 connections were attempted. This measurement run completed in approximately 10 hours, never initiating more than 20 network operations (name lookups or connection attempts) concurrently. The total NSFNET backbone load from all traffic sources that month was approximately 5 billion packets. Therefore, the traffic from our measurement study amounted to less than .5% of this volume on the day the measurements were collected. Since the Internet contains several other backbones besides NSFNET, the proportionate increase in total Internet traffic was significantly less than .5% 🙌.

The cost to a remote site being measured is effectively zero 🎉. From the above measurements, on average we attempted 5.7 connections per remote domain. The cost of a connection open/close sequence is quite small, especially compared to the many electronic mail and news transmissions most sites experience on a given day 📬.

Control Over Measurement Collection Process 🎛️

The measurement software grew out of an earlier set of experiments used to measure the reach of an experimental Internet white pages tool called netfind [Schwartz & Tsirigotis 1991b]. It has been evolved and tested extensively over a period of two years 🧪, and during that time it's been used in a number of experiments of increasing scale. The software uses several redundant checks and other mechanisms to make sure careful control is maintained over the network operations that are performed [Schwartz & Tsirigotis 1991a]. On top of that, we monitor the progress and network loading of the measurements during the runs. We watch the log of connection requests in progress, plus the physical and transport level network status (which shows the amount of concurrent network activity in progress) 👀. Finally, because the measurements are controlled from a single centralized location, it's super easy to stop them at any time 🛑.

Network Appropriate Use and Privacy Issues ✨

okay so bestie, this part is about the awkward stuff: how the team told site admins about the study, why it got messy, and how they protected people's privacy 🔒💖

When they did the first test runs, they tried to let site admins know. They posted a note on the USENET newsgroup "alt.security" and emailed individual site admins. They also told the Computer Emergency Response Team (CERT) at CMU. 😭 Telling every site was a nightmare, because there's no easy channel for spreading news like that across the whole Internet. About half the emails bounced back as undeliverable 💀. The announcements also created more network traffic and admin work than the study itself! Some sites were like, "ugh, this is a waste of our time" 🙄

The announcement could also mess with the data itself 🧐. Some sites would probably change how reachable their services were after hearing about it, which totally skews what you're measuring. Asking sites for explicit permission would be even worse, because you'd end up with a self-selected group of sites that are less likely to drop off the Internet. Not iconic for science 🙅‍♀️

Here's the plot twist: running the study without announcing it only caused a small number of admins to notice the traffic and ask about it, either through CERT or through one of the responsible network contacts at the University of Colorado 🙌. So the overhead and the practical and methodological problems of announcing pushed the team toward not doing more broad announcements. BUT, to keep sites from freaking out when they spot the measurement activity, announcing still makes sense 🤔 it's a whole balancing act, periodt 💅

To sort this out, the team talked with a bunch of people: the Internet Activities Board, the Internet Engineering Steering Group, the National Science Foundation, reps from several U.S. regional networks, and a crew of network security folks. That included CERT, members of the IETF Security and Advisory Group, and a member of the Lawrence Livermore National Laboratory Computer Incident Advisory Capability 🫶. That first round of work became Internet Request For Comments (RFC) number 1262 [Cerf 1991] 🎀

From here, the plan is to announce the study well before running it. The announcement is this RFC, plus an electronic posting that briefly explains the study goals and methodology and points to this RFC 📣. The posting will go to the Internet Engineering Task Force mailing list, the comp.protocols.tcp-ip USENET bulletin board, and CERT's cert-tools mailing list 🦋

Just in case a site misses all of that, the team set things up so an admin who spots the activity can figure out what's going on with minimal effort 🕵️‍♀️ The program will run from an account called "testnet" on a machine with few other users logged in. "Fingering" [Zimmerman 1990] that machine will show the testnet login, and "fingering" the testnet login will return info about the study 🧚

⚠️ Privacy check: the data could be used as a "road map" of accessible network services, so it's a little sensitive. The team will treat the raw data as private information and only publish measurements in global statistical terms, separated from the actual sites that make up each data point. 🔒

They've done this before, too. An earlier study had way bigger privacy implications [Schwartz & Wood 1991], and they successfully masked the data to protect individual privacy 👑

---

For Further Information ✨

If you want more context on the bigger research program this study belongs to, you can grab it by anonymous FTP from latour.cs.colorado.edu, in the pub/RD.Papers directory 📂 There's a "README" file there that describes the overall research project (which focuses on resource discovery) and includes a bibliography 📚 The most relevant bits are:

• [Schwartz 1991b], a project overview;
• [Schwartz 1991a], about an earlier, simpler version of the current study;
• [Schwartz & Tsirigotis 1991b], about the netfind white pages tool;
• [Schwartz & Tsirigotis 1991a], which covers a number of the techniques used in this experiment, including the ones for controlling the progress of the measurements;

and

• [Schwartz & Wood 1991], about an earlier study that raises significant potential privacy questions. They carefully masked the underlying data and presented the results without sacrificing individual privacy 🫶

Also:

• [Cerf 1991], the IAB guidelines for Internet measurement activity 🌸

Once the results are done, they'll get published in a conference or journal, and also by anonymous FTP 🎉

---

Communication With Principal Investigator ✨

If you want your site taken off the study list, want to be added to the list of people who get the results, or just want to talk to the Principal Investigator about something else, email schwartz@cs.colorado.edu 💌

---

References ✨

• [Cerf 1991] Cerf, V., Editor, "Guidelines for Internet Measurement Activities", RFC 1262, IAB, October 1991. 📖
• [Schwartz & Tsirigotis 1991a] Schwartz M., and P. Tsirigotis, "Techniques for Supporting Wide Area Distributed Applications", Technical Report CU-CS-519-91, Department of Computer Science, University of Colorado, Boulder, Colorado, February 1991; Revised August 1991. Submitted for publication. 🧠
• [Schwartz & Tsirigotis 1991b] Schwartz M., and P. Tsirigotis "Experience with a Semantically Cognizant Internet White Pages Directory Tool", Journal of Internetworking: Research and Experience, 2(1), pp. 23-50, March 1991. 🌈
• [Schwartz 1991a] Schwartz, M., "The Great Disconnection?", Technical Report CU-CS-521-91, Department of Computer Science, University of Colorado, Boulder, Colorado, February 1991. 💀
• [Schwartz & Wood 1991] Schwartz M., and D. Wood, "A Measurement Study of Organizational Properties in the Global Electronic Mail Community", Technical Report CU-CS- 482-90, Department of Computer Science, University of Colorado, Boulder, Colorado, August 1990; Revised July 1991. Submitted for publication. 🔒
• [Schwartz 1991b] Schwartz, M., "Resource Discovery in the Global Internet", Technical Report CU-CS-555-91, Department of Computer Science, University of Colorado, Boulder, Colorado, November 1991. Submitted for publication. 🦋
• [Zimmerman 1990] Zimmerman, D., "The Finger User Information Protocol", RFC 1194, Center for Discrete Mathematics and Theoretical Computer Science, November 1990. 🧚

---

Security Considerations ✨

Okay, this one's serious, so pay attention 🚨 Security issues are discussed in the "Network Appropriate Use and Privacy Issues" section. Go read that part again if you skipped it, because the whole privacy and road-map situation is a big deal 😤🔥

---

Author's Address ✨

Michael F. Schwartz
Department of Computer Science
Campus Box 430
University of Colorado
Boulder, Colorado 80309-0430

Phone:  (303) 492-3902

EMail: schwartz@cs.colorado.edu