{"id":1015,"date":"2017-05-25T09:04:40","date_gmt":"2017-05-25T16:04:40","guid":{"rendered":"https:\/\/ant.isi.edu\/blog\/?p=1015"},"modified":"2025-08-26T16:17:35","modified_gmt":"2025-08-26T23:17:35","slug":"new-technical-report-detecting-icmp-rate-limiting-in-the-internet","status":"publish","type":"post","link":"https:\/\/ant.isi.edu\/blog\/?p=1015","title":{"rendered":"new technical report \u201cDetecting ICMP Rate Limiting in the Internet\u201d"},"content":{"rendered":"

We have released a new technical report \u201cDetecting ICMP Rate Limiting in the Internet<\/a>\u201d as an ISI technical report ISI-TR-717.<\/p>\n

From the abstract of our technical report:<\/p>\n

\"\"<\/a>
Comparing model and experimental effects of rate limiting (Figure 2.a from [Guo17a] )<\/figcaption><\/figure>\n

Active probing with ICMP is the center of many network measurements, with tools like ping, traceroute, and their derivatives used to map topologies and as a precursor for security scanning. However, rate limiting of ICMP traffic has long been a concern, since undetected rate limiting to ICMP could distort measurements, silently creating false conclusions. To settle this concern, we look systematically for ICMP rate limiting in the Internet. We develop a model for how rate limiting affects probing, validate it through controlled testbed experiments, and create FADER, a new algorithm that can identify rate limiting from user-side traces with minimal requirements for new measurement traffic. We validate the accuracy of FADER with many different network configurations in testbed experiments and show that it almost always detects rate limiting. Accuracy is perfect when measurement probing ranges from 0 to 60\u00a0times the rate limit, and almost perfect (95%) with up to 20% packet loss. The worst case for detection is\u00a0when probing is very fast and blocks are very sparse, but even there accuracy remains good (measurements 60 times the rate limit of a 10% responsive block is correct 65% of the time). With this confidence, we apply our algorithm to a random sample of whole Internet, showing that rate limiting exists
\nbut that for slow probing rates, rate-limiting is very, very rare. For our random sample of 40,493 \/24 blocks (about 2\\% of the responsive space), we confirm 6 blocks (0.02%!) see rate limiting
\nat 0.39 packets\/s per block. We look at higher rates in public datasets
\nand suggest that fall-off in responses as rates approach 1 packet\/s per \/24 block (14M packets\/s from the prober to the whole Internet),
\nis consistent with rate limiting. We also show that even very slow probing (0.0001 packet\/s) can encounter rate limiting of NACKs that are concentrated at a single router near the prober.<\/p><\/blockquote>\n

Datasets we used in this paper are all public. ISI Internet Census and Survey data (including it71w, it70w, it56j, it57j and it58j census and survey) are available at https:\/\/ant.isi.edu\/datasets\/index.html<\/a>. ZMap 50-second experiments data are from their WOOT 14 paper<\/a> and can be obtained from ZMap authors\u00a0upon request.<\/p>\n

This technical report is joint work of Hang Guo and \u00a0John Heidemann from USC\/ISI.<\/p>\n","protected":false},"excerpt":{"rendered":"

We have released a new technical report \u201cDetecting ICMP Rate Limiting in the Internet\u201d as an ISI technical report ISI-TR-717. From the abstract of our technical report: Active probing with ICMP is the center of many network measurements, with tools like ping, traceroute, and their derivatives used to map topologies and as a precursor for […]<\/p>\n","protected":false},"author":632,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[282,283],"tags":[175,71,174,58,67,5,41,173,170,26,176,57],"class_list":["post-1015","post","type-post","status-publish","format-standard","hentry","category-publications","category-technical-report","tag-active-probing","tag-datasets","tag-icmp","tag-isi","tag-lacrend","tag-papers","tag-predict","tag-rate-limiting","tag-retrofuturebridge","tag-tech-report","tag-traffic-policing","tag-usc"],"_links":{"self":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1015","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/users\/632"}],"replies":[{"embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1015"}],"version-history":[{"count":21,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1015\/revisions"}],"predecessor-version":[{"id":2277,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=\/wp\/v2\/posts\/1015\/revisions\/2277"}],"wp:attachment":[{"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1015"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1015"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ant.isi.edu\/blog\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1015"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}