3 June Paris Seminar Modelling and Analysis of TCP’s Connection Management Procedures Jonathan Billington and Bing Han Computer Systems Engineering Centre University of South Australia

3 June 2005Paris Seminar2 Motivation  Finding design flaws of complex protocols such as TCP is an important and difficult research problem.  Design flaws: – Specification rather than implementation – Including: deadlocks, livelocks, sequence inconsistency, dead code, and so on …  Important problem – TCP provides a reliable data transfer service to many Internet applications. – TCP is used as the basis of new protocols, e.g. DCCP  Difficult problem – TCP is a complex protocol. – The operation of TCP was originally specified in RFC 793 using narrative descriptions, message sequence diagrams, a FSM diagram and pseudo code.

3 June 2005Paris Seminar3 Outline  Research Scope – TCP Connection Management – Desired properties: Termination Absence of deadlocks  Approach – Modelling approach – Analysis approach  Analysis Results

3 June 2005Paris Seminar4 TCP and its Environment Two peer TCP entities communicate over the Internet Protocol (IP) as well as interacting with their application processes.

3 June 2005Paris Seminar5 TCP Segment Format

3 June 2005Paris Seminar6 Normal Connection Establishment

3 June 2005Paris Seminar7 Simultaneous Connection Establishment

3 June 2005Paris Seminar8 Normal Connection Release (Graceful Close)

3 June 2005Paris Seminar9 Simultaneous Connection Release

3 June 2005Paris Seminar10 TCP State Variables  SND_NXT (send next) – Stores the sequence number of the next segment to be sent.  RCV_NXT (receive next) – Stores the sequence number of the next segment to be received.  SND_UNA (send unacknowledged) – Records the sequence number of the earliest segment that has been sent but has yet to be acknowledged.  ISS (initial send sequence number) – The first sequence number sent in a connection.

3 June 2005Paris Seminar11 Our Approach Model TCP Connection Management using CPNs Define desired properties using ML Configure the CPN model Generate the state spaces Automatically check the terminal states using ML

3 June 2005Paris Seminar12 Top Level Page: TCP Overview

3 June 2005Paris Seminar13 Level 1 Level 2 Level 3 Level 4 1. Overview 2. Event Processing 3. User Commands Segment Processing Retransmissions 4. Command Pages State Pages Model Statistics Hierarchical Levels: 4 CPN Pages: 19 Places: 6 Substitution transitions: 19 Executable transitions: 97

3 June 2005Paris Seminar14 Desired Properties (Termination) Successful Abort Successful Abort Successful Release Successful Release Successful Establishment Successful Establishment Proper Establishment Proper Establishment

3 June 2005Paris Seminar15 Desired Terminal State for Establishment Successful Establishment Proper Establishment

3 June 2005Paris Seminar16 Acceptable Terminal State for Establishment

3 June 2005Paris Seminar17 CPN Model Configurations – Some Examples ConfigurationInitial Marking A C_S Opening D C_S Opening & Closing E Sim. Opening & Closing

3 June 2005Paris Seminar18 Analysis Results of Model 1: No Loss, No Retrans  Reordering channel with no loss  No retransmission  Run on a machine with 2.6GHz Pentium CPU and 1GB RAM. ConfigTime|V||A|TMsDLs ABCDEFGHIJKABCDEFGHIJK

3 June 2005Paris Seminar19 Initial Marking 1 User_1: 1`A_Open++1`Close User_2: 1`P_Open++1`Close H1_H2: empty H2_H1: empty TCB 1: 1`{CLOSED,{RCV_NXT=0,SND_NXT=0,SND_UNA=0,ISS=10},cls} TCB 2: 1`{CLOSED,{RCV_NXT=0,SND_NXT=0,SND_UNA=0,ISS=20},cls }

3 June 2005Paris Seminar20 Dead Marking 95 User_1: empty User_2: empty H1_H2: empty H2_H1: empty TCB 1: 1`{FIN_W2,{RCV_NXT=21,SND_NXT=12,SND_UNA=12,ISS=10},cls} TCB 2: 1`{CLOSING,{RCV_NXT=12,SND_NXT=22,SND_UNA=21,ISS=20},lis }

3 June 2005Paris Seminar21 A Reachability Graph Path to the Deadlock of Config.D

3 June 2005Paris Seminar22 Connection Release Fails

3 June 2005Paris Seminar23 Analysis Results of Model 2 (Configuration D) Config Dhh:mm:ss|V||A|TMsDLs (0,0,0,1) (0,1,0,0) (1,0,0,0) (0,1,0,1) (0,0,1,0) (1,1,0,0) (1,0,0,1) (0,0,1,1) (0,1,1,0) (1,1,0,1) (1,0,1,0) (0,1,1,1) (1,0,1,1) 00:00:01 00:00:02 00:00:11 00:00:15 00:00:16 00:00:28 00:04:26 00:05:07 00:07:16 00:14:34 00:48:  Reordering channel with no loss  Retransmissions  Run on a machine with 2.6GHz Pentium CPU and 1GB RAM.

3 June 2005Paris Seminar24 Analysis Results of Model 2 (Configuration E) Config Ehh:mm:ss|V||A|TMsDLs (0,0,0,1) (0,1,0,0) (1,0,0,0) (0,0,1,0) (0,1,0,1) 00:00:48 00:06:26 00:22:50 00:25:25 09:10:

3 June 2005Paris Seminar25 Conclusions  Over a reordering channel without loss, TCP terminates correctly in the following scenarios: – Client-server connection establishment – Simultaneous connection establishment – Orderly release after the connection is established – Aborting of connections  However, TCP can deadlock when the user releases the connection before it is established, i.e., while the TCP entity is in SYN_RCVD.  Retransmissions of the FIN in state FIN_WAIT_1 or CLOSING removes these deadlocks.

3 June 2005Paris Seminar26 Configuration: 1`A_Open++1`Close and 1`P_Open Nodes: 28 Arcs: 37 DMs: 4

3 June 2005Paris Seminar27 Configuration: 1`A_Open and 1`P_Open++1`Close Nodes: 25 Arcs: 33 DMs: 3