1. 3 June 2005 1 Paris Seminar Modelling and Analysis of TCP’s Connection Management Procedures Jonathan Billington and Bing Han Computer Systems Engineering Centre University of South Australia

2. 3 June 2005Paris Seminar2 Motivation  Finding design flaws of complex protocols such as TCP is an important and difficult research problem.  Design flaws: – Specification rather than implementation – Including: deadlocks, livelocks, sequence inconsistency, dead code, and so on …  Important problem – TCP provides a reliable data transfer service to many Internet applications. – TCP is used as the basis of new protocols, e.g. DCCP  Difficult problem – TCP is a complex protocol. – The operation of TCP was originally specified in RFC 793 using narrative descriptions, message sequence diagrams, a FSM diagram and pseudo code.

3. 3 June 2005Paris Seminar3 Outline  Research Scope – TCP Connection Management – Desired properties: Termination Absence of deadlocks  Approach – Modelling approach – Analysis approach  Analysis Results

4. 3 June 2005Paris Seminar4 TCP and its Environment Two peer TCP entities communicate over the Internet Protocol (IP) as well as interacting with their application processes.

5. 3 June 2005Paris Seminar5 TCP Segment Format

6. 3 June 2005Paris Seminar6 Normal Connection Establishment

7. 3 June 2005Paris Seminar7 Simultaneous Connection Establishment

8. 3 June 2005Paris Seminar8 Normal Connection Release (Graceful Close)

9. 3 June 2005Paris Seminar9 Simultaneous Connection Release

10. 3 June 2005Paris Seminar10 TCP State Variables  SND_NXT (send next) – Stores the sequence number of the next segment to be sent.  RCV_NXT (receive next) – Stores the sequence number of the next segment to be received.  SND_UNA (send unacknowledged) – Records the sequence number of the earliest segment that has been sent but has yet to be acknowledged.  ISS (initial send sequence number) – The first sequence number sent in a connection.

11. 3 June 2005Paris Seminar11 Our Approach Model TCP Connection Management using CPNs Define desired properties using ML Configure the CPN model Generate the state spaces Automatically check the terminal states using ML

12. 3 June 2005Paris Seminar12 Top Level Page: TCP Overview

13. 3 June 2005Paris Seminar13 Level 1 Level 2 Level 3 Level 4 1. Overview 2. Event Processing 3. User Commands Segment Processing Retransmissions 4. Command Pages State Pages Model Statistics Hierarchical Levels: 4 CPN Pages: 19 Places: 6 Substitution transitions: 19 Executable transitions: 97

14. 3 June 2005Paris Seminar14 Desired Properties (Termination) Successful Abort Successful Abort Successful Release Successful Release Successful Establishment Successful Establishment Proper Establishment Proper Establishment

15. 3 June 2005Paris Seminar15 Desired Terminal State for Establishment Successful Establishment Proper Establishment

16. 3 June 2005Paris Seminar16 Acceptable Terminal State for Establishment

17. 3 June 2005Paris Seminar17 CPN Model Configurations – Some Examples ConfigurationInitial Marking A C_S Opening D C_S Opening & Closing E Sim. Opening & Closing

18. 3 June 2005Paris Seminar18 Analysis Results of Model 1: No Loss, No Retrans  Reordering channel with no loss  No retransmission  Run on a machine with 2.6GHz Pentium CPU and 1GB RAM. ConfigTime|V||A|TMsDLs ABCDEFGHIJKABCDEFGHIJK 0000301100100003011001 11 42 57 225 2850 51 355 356 79 73 742 12 60 92 455 8260 91 870 792 141 129 1896 2 1 3 6 3 4 13 2 3 4 0001200000000012000000

19. 3 June 2005Paris Seminar19 Initial Marking 1 User_1: 1`A_Open++1`Close User_2: 1`P_Open++1`Close H1_H2: empty H2_H1: empty TCB 1: 1`{CLOSED,{RCV_NXT=0,SND_NXT=0,SND_UNA=0,ISS=10},cls} TCB 2: 1`{CLOSED,{RCV_NXT=0,SND_NXT=0,SND_UNA=0,ISS=20},cls }

20. 3 June 2005Paris Seminar20 Dead Marking 95 User_1: empty User_2: empty H1_H2: empty H2_H1: empty TCB 1: 1`{FIN_W2,{RCV_NXT=21,SND_NXT=12,SND_UNA=12,ISS=10},cls} TCB 2: 1`{CLOSING,{RCV_NXT=12,SND_NXT=22,SND_UNA=21,ISS=20},lis }

21. 3 June 2005Paris Seminar21 A Reachability Graph Path to the Deadlock of Config.D

22. 3 June 2005Paris Seminar22 Connection Release Fails

23. 3 June 2005Paris Seminar23 Analysis Results of Model 2 (Configuration D) Config Dhh:mm:ss|V||A|TMsDLs (0,0,0,1) (0,1,0,0) (1,0,0,0) (0,1,0,1) (0,0,1,0) (1,1,0,0) (1,0,0,1) (0,0,1,1) (0,1,1,0) (1,1,0,1) (1,0,1,0) (0,1,1,1) (1,0,1,1) 00:00:01 00:00:02 00:00:11 00:00:15 00:00:16 00:00:28 00:04:26 00:05:07 00:07:16 00:14:34 00:48:35 1309 1362 1810 8743 10156 10381 10481 16612 64871 65381 77940 104046 126098 3899 3498 4810 31122 34825 33056 38071 59184 258399 273981 317337 426872 530381 5 7 6 11 16 10 15 24 32 12220420040001222042004000  Reordering channel with no loss  Retransmissions  Run on a machine with 2.6GHz Pentium CPU and 1GB RAM.

24. 3 June 2005Paris Seminar24 Analysis Results of Model 2 (Configuration E) Config Ehh:mm:ss|V||A|TMsDLs (0,0,0,1) (0,1,0,0) (1,0,0,0) (0,0,1,0) (0,1,0,1) 00:00:48 00:06:26 00:22:50 00:25:25 09:10:37 19354 45293 98627 122654 328023 75158 163984 392610 516530 1524604 8 21 24 12 29 2880828808

25. 3 June 2005Paris Seminar25 Conclusions  Over a reordering channel without loss, TCP terminates correctly in the following scenarios: – Client-server connection establishment – Simultaneous connection establishment – Orderly release after the connection is established – Aborting of connections  However, TCP can deadlock when the user releases the connection before it is established, i.e., while the TCP entity is in SYN_RCVD.  Retransmissions of the FIN in state FIN_WAIT_1 or CLOSING removes these deadlocks.

26. 3 June 2005Paris Seminar26 Configuration: 1`A_Open++1`Close and 1`P_Open Nodes: 28 Arcs: 37 DMs: 4

27. 3 June 2005Paris Seminar27 Configuration: 1`A_Open and 1`P_Open++1`Close Nodes: 25 Arcs: 33 DMs: 3