Transcription

ShaperProbe: End-to-end Detection of ISP Traffic Shaping using Active MethodsPartha Kanuparthy, Constantine DovrolisSchool of Computer Science, Georgia Institute of [email protected], [email protected] present an end-to-end measurement method for the detection of traffic shaping. Traffic shaping is typically implemented using token buckets, allowing a maximum burstof traffic to be serviced at the peak capacity of the link,while any remaining traffic is serviced at a lower shapingrate. The contribution of this paper is twofold. First, wedevelop an active end-to-end detection mechanism, referredto as ShaperProbe, that can infer whether a particular pathis subject to traffic shaping, and in that case, estimate theshaper characteristics. Second, we analyze results from alarge-scale deployment of ShaperProbe on M-Lab over thelast 24 months, detecting traffic shaping in several majorISPs. Our deployment has received more than one millionruns so far from 5,700 ISPs.Categories and Subject DescriptorsC.2.3 [Computer-Communication Networks]: NetworkOperations—Network monitoringGeneral TermsMeasurement, PerformanceKeywordsActive probing, traffic shaping, inference1.INTRODUCTIONThe increasing penetration of broadband access technologies, such as DSL, DOCSIS and WiMAX, provides userswith a wide range of upstream and downstream service rates.Broadband users need to know whether they actually getthe service rates they pay for. On the other hand, ISPs nowhave an extensive toolbox of traffic management mechanismsthey can apply to their customers’ traffic: application classifiers, schedulers, active queue managers etc. In this paper This work was supported by a research gift from GoogleInc.Permission to make digital or hard copies of all or part of this work forpersonal or classroom use is granted without fee provided that copies arenot made or distributed for profit or commercial advantage and that copiesbear this notice and the full citation on the first page. To copy otherwise, torepublish, to post on servers or to redistribute to lists, requires prior specificpermission and/or a fee.IMC’11, November 2–4, 2011, Berlin, Germany.Copyright 2011 ACM 978-1-4503-1013-0/11/11 . 10.00.we focus on a class of such mechanisms referred to as trafficshapers or traffic policers.1A traffic shaper is a single-input single-output packet forwarding module that behaves as follows: Consider a link ofcapacity C bps, associated with a “token bucket” of size σtokens. Whenever the bucket is not full, tokens are generated at a rate ρ tokens per second, with ρ C. The linkcan transmit an arriving packet of size L bits only if the token bucket has at least L tokens - upon the transmission ofthe packet, the shaper consumes L tokens from the bucket.So, if we start with a full token bucket of size σ tokens, andwith a large burst of packets of size L bits each (supposethat σ is an integer multiple of L for simplicity), the linkwill be able to transmit k of those packets at the rate of theσ/Lcapacity C, with k 1 ρ/C. After those k packets, the linkwill start transmitting packets at the token generation rateρ. Usually ρ is referred to as the “shaping rate”, the capacityC is also referred to as the “peak rate”, while σ is referredto as the “maximum burst size”. Another way to describe atraffic shaper is by specifying that the maximum number ofbits that can be transmitted in any interval of duration τ ,starting with a full token bucket, is:Â(τ ) min{L Cτ, σ ρτ }The difference between a traffic shaper and a traffic policer is that the former has a buffer to hold packets thatarrive when the token bucket is empty [6, 23]. A policer simply drops such “non-conforming” packets. In other words, ashaper delays packets that exceed the traffic shaping profile (σ, ρ), while a policer drops them.2 Policers can causeexcessive packet losses and so shapers are more common inpractice - we focus on the latter in the rest of the paper.Why would a residential ISP deploy traffic shaping? First,to allow a user to exceed the service rate that he/she has paidfor, for a limited burst size. In that case the user pays forρ bps, with the additional service capacity C ρ marketedas a free service enhancement. This is, for instance, howComcast advertises their PowerBoost traffic shaping mechanism [5]. Second, an ISP may want to limit the servicerate provided to the aggregate traffic produced or consumedby a customer, or to limit the service rate consumed by acertain application (e.g. BitTorrent). This form of shapingis relevant to the network neutrality debate. Third, certainISPs prefer to describe their service rates as upper bounds1When it is not important to distinguish between shapingand policing, we will simply refer to such mechanisms as“traffic shapers” or just “shapers”.2A shaper also drops packets once its droptail buffer is full.

Related work. Lakshminarayanan et al. recorded initialobservations of traffic shaping in residential ISPs in 2003[18]. Dischinger et al. found downstream traffic shaping ina 2007 study [13] using a 10s flow at 10Mbps; they did notfind evidence of upstream traffic shaping. More recently,two studies [12, 21] focused on the effects of PowerBoostin cable ISPs. Recent research efforts on detecting trafficdiscrimination in ISPs [14, 16, 19, 20, 22, 24, 25] compliment our work, since we consider the problem of detectingtraffic shaping independent of differentiation. In particular,Glasnost [14] uses aggregate throughput of an emulated application and compares it with a baseline to detect throughput differences. Weinsberg et al. infer queue weights of adiscriminatory scheduler [24].In the rest of the paper, we describe the active detectionmethod (§2), implementation and deployment of ShaperProbe (§3), and look at ShaperProbe data using case studiesof four ISPs (§4).2.ACTIVE PROBING METHODThe active probing method is an end-to-end process inwhich one end-host SN D sends packets on the network pathto the receiver RCV. We detect the presence of traffic shaping in the path SN D RCV at RCV.Suppose that the narrow link’s capacity on the path is C,and that the sender probes at a constant bit rate Rs C.The ShaperProbe capacity estimation process is described in3We log per-packet send and receive timestamps and sequence numbers for all probing phases, and client IP addressand server timestamp (UTC) for each run.10000Runs per day1000100101101l2 1Ju 201ay 1M 201ar 1M 201n 0Ja 201ov 0N 201pSe 010l2 0Ju 201ay 0M 201ar 0M 201n 9Ja 200ov 9N 200pSe 009l2 9Ju 200ayMfor what the user will actually get, e.g., a downstream rateof at most 6Mbps. In that case, a shaper can be used toenforce the upper bound of the service rate.The contribution of this paper is twofold. First, we develop an active end-to-end detection mechanism, referred toas ShaperProbe, that can infer whether a particular path issubject to traffic shaping, and in that case, estimate theshaper characteristics C, ρ and σ. Second, we analyze results from a large-scale deployment of ShaperProbe on MLab [11] since May 2009, detecting traffic shaping in severalmajor ISPs. Our deployment received about one millionruns over the last two years from more than 5,700 ISPs; wecurrently see 2,000-3,000 runs per day (see Figure 1). Alldata collected through ShaperProbe runs is publicly available through M-Lab [8].3Traffic shaping detection and estimation methods can beused in different ways: as a library (API); and as a service that enables users/administrators to detect or verifytheir SLAs/shaping configurations. In this paper, we focuson the latter. The ShaperProbe client is a download-andclick userspace binary (no superuser privileges or installationneeded) for 32/64-bit Windows, Linux, and OS X; a pluginis also available for the Vuze BitTorrent client. The non-UIlogic is about 6000 lines of open source native code.There are several challenges that one needs to tackle whendesigning an active measurement service that can scale tothousands of users per day, including accuracy, usability andnon-intrusiveness. Even though these challenges are oftenviewed as not significant, at least from the research perspective, they have greatly influenced several design choices andparameter values in ShaperProbe.TimeFigure 1: ShaperProbe: volume of runs. The gaps in timeshow downtime due to tool enhancements.the Tech Report [17]. The receiver RCV records the receivedrate timeseries Rr (t). We compute Rr (t) by discretizingtime into fixed size non-overlapping intervals of size . Forsimplicity, assume that the probing starts at t 0, and thatintervals are numbered as integers i 1. The i’th intervalincludes all packets received in the interval [(i 1) , i ),where packet timestamps are taken at RCV upon receipt ofeach packet. The discretized received rate timeseries Rr (i) isestimated as the total bytes received in interval i divided by . Note that this estimator of Rr (t) can result in an errorof up to ǫ S/ where S is the MTU packet size. Bychoosing a reasonably large , we can reduce the magnitudeof ǫ relative to the true received rate.In the presence of a token bucket traffic shaper (or policer)on SN D RCV, there exists a value of i 1 at whichthe received rate timeseries Rr (i) undergoes a level shift toa lower value. Our goal is to detect the presence of a levelshift, and estimate the token bucket parameters using Rr (i).2.1 DetectionWe want to detect a level shift in Rr in real-time, i.e., aswe compute the received rate for each new interval. Notethat the receiver RCV is also receiving new packets duringthe level-shift detection process, and so our method shouldbe fast and computationally light-weight to avoid the introduction of timestamping jitter. The detection method israther simple and relies on nonparametric rank statistics ofRr so that it is robust to outliers [15].We compute ranks online. Suppose that we have estimated n values of Rr so far. At the start of the new intervaln 1 (i.e., after the receipt of the first packet in that interval), we compute Rr (n) and update the ranks r(i) of Rr (i)for i 1 . . . n. We identify τ as the start of level shift if itis the first interval index that satisfies the following threeconditions.First, all ranks at the left of τ are equal to or higher thanall ranks at the right of τ :mini 1.τ 1r(i) maxj τ 1.nr(j)(1)Second, we have observed a minimum time duration before and after the current rate measurement:nL τ n nR(2)

βTimeFigure 2: Active probing: Level shift detection.The value of nL is chosen based on empirical observationsof typical burst durations in ISP deployments, and nR is asanity check to ensure that the drop in rate is not just atemporary variation (e.g., due to cross traffic).Third, we require that there is a significant drop in themedian rate at point τ :R̃r (i) γ R̃r (j)i 1.τ(3)j τ .nwhere R̃r denotes the median, and γ is a suitable threshold.We select γ based on empirical observations of ISP capacitiesand shaping rates in practice (see Section 2.3).Similarly, we detect the end of a level shift index β suchthat β τ and β is the last point which satisfies the ratecondition in Equation 1. Figure 2 illustrates the two levelshift indices.2.2 EstimationAfter the detection of a level shift, we estimate the tokenbucket parameters from the rate timeseries Rr as follows.The token generation rate (shaping rate) ρ is estimated asthe median (to be robust to outliers) of the received ratemeasurements after β:ρ̂ R̃r (i)(4)i β 1.nWe estimate the token bucket depth (burst size) σ basedon the number of bytes sent till the τ ’th time interval. Weestimate a range for σ, since we discretize time in to intervalsof size , based on the estimate ρ̂ of ρ and the received rates:σ̂ τX[R(i) ρ̂] i 1[R(i) ρ̂] 2(5)2.3 Parameter SelectionAs in any other measurement tool that is used in practice,there are some parameters that need to be tuned empirically. In ShaperProbe, the key parameters are the factor γ,the probing duration Λ, and the interval duration . Wehave selected the values of these parameters based on thedetection of actual shaper deployments in broadband ISPsfor which we knew the “ground truth”.Figure 3 shows the ratio of the capacity over the shapingrate C/ρ and the maximum burst duration (in seconds) for36 advertised traffic shaper deployments at Comcast andCox in metro Atlanta in October 2010. Note that all tiershave a capacity-to-shaping rate ratio of 1.1 or higher; in thecurrent implementation of ShaperProbe we use γ 1.1.The probing duration Λ should be sufficiently long so thatit can detect as many ISP shaping configurations as possible,Cap. / shaping-rate ratioτBurst duration (s)Received rate 01520253035303560s0510152025TierFigure 3: Advertised Comcast, Cox tiers: required γ and Λ.while at the same time keeping the total probing durationreasonably short when there is no shaping. Figure 3 showsthat the burst duration is at most 48s, except for 4 out of 36configurations. Λ is set to 60s in the current implementation.A typical ShaperProbe residential run lasts for 2-3 minutes.The averaging window size should be sufficiently largeto keep the estimation noise in Rr low, and sufficiently shortso that Λ includes several rate samples. We have performed100 trials in the upstream direction of a Comcast residential connection, whose SLA we know (4.5Mbps shaped to2Mbps). We found that for 50ms, the shaping detection rate is 100%; as approaches the inter-packet gap,the detection rate drops significantly. We set to 300ms sothat we can detect shaping even in low capacity links.3. SHAPERPROBE IMPLEMENTATIONThe design of a tool that works well on a wide variety ofnetwork conditions, OS platforms and broadband link technologies is challenging. A first challenge is that ShaperProberequires a fast and accurate estimate of the narrow-link capacity between the sender and receiver; this estimate is theShaperProbe probing rate. ShaperProbe uses packet traindispersion for estimating capacity; it additionally probes using a longer train to be robust to wireless link effects. Second, the probing method should be able to generate trafficat a constant rate, even with a coarse-grained userspace OStimer granularity. At the same time, the transmission ofpackets should not impose heavy load on the CPU resourcesat the sender. ShaperProbe sends small periodic packettrains, and times the inter-train gaps such that busy-waitloops are minimized. Third, the ShaperProbe client shouldbe non-intrusive. The client and server abort the probingprocess if they observe losses on the path. Finally, crosstraffic on the path may lead to temporary drops in the received rate Rr ; we need to incorporate a filtering mechanism that can remove outliers from Rr . ShaperProbe filtersoutliers using recorded observations from the local neighborhood of the Rr timeseries. The Tech Report [17] describeshow ShaperProbe addresses the previous challenges and implementation details.We currently run load-balanced ShaperProbe server replicas on 48 M-Lab hosts connected directly to tier-1 ASes.For measurement accuracy, we allow only one client at eachserver replica at any time.

ISPComcastRoad RunnerAT&TCoxMCI-VerizonUpstream (%)71.5 (34874)6.5 (7923)10.1 (8808)63 (5797)5.6 (8753)Dwnstrm. (%)73.5 (28272)63.9 (5870)10.9 (7748)47.4 (4357)8.4 (7733)Table 1: Shaping detections: top-5 ISPs in terms of ShaperProbe runs. For each ISP we show percentage of runs withdetected shaping and number of total runs.4.RESULTSIn this section, we take a first look at results from theShaperProbe deployment at M-Lab. We first examine accuracy using two ISPs for which we know the shaping groundtruth and from emulation experiments.Accuracy. We test the latest version of ShaperProbe ontwo residential ISPs, AT&T and Comcast, at two homesin metro Atlanta. We use the High-Speed Internet service of Comcast, and the DSL service of AT&T. At thetime of these experiments, the Comcast configuration was:{10Mbps up, 22Mbps down} shaped to {2Mbps up, 12Mbpsdown} [5], while the AT&T configuration did not use shaping ({512Kbps up, 6Mbps down}) [2]. Out of 60 runs, we didnot observe any shaping detection errors in either directionat the AT&T connection, while we observed two upstreamfalse negatives at the Comcast connection due to capacityunderestimation.We also emulated token bucket shaping on a wide-areapath between a residential Comcast connection and a serverdeployed at the Georgia Tech campus. We use the LARTCtc tool on Linux with a 2.6.22 kernel on a dual-NIC 1GHzCeleron router with 256MB RAM. Over 20 experiments foreach token bucket configuration and 10 configurations, wefound that ShaperProbe detects the traffic shaper in all (200)experiments; it also accurately estimates the shaping rateand bucket depth for all configurations.Data preprocessing. In the following, we analyze datacollected from the ShaperProbe M-Lab service. First, weconsider runs from the latest ShaperProbe release, collectedbetween 20th October 2009 and 9th May 2011 (total of845,223 runs). Each run’s trace contains per-packet timestamps and sequence numbers for the upstream and downstream probing “half runs”. Second, we say that a half runis “unfinished” if no shaping was detected and the run lastedfor less than 50s - we discard such runs. All completed halfruns which are not diagnosed as shaping are considered noshaping cases. Recall that ShaperProbe probes each direction for 60s, and terminates a half run if it either detectedshaping or if it observed packet losses during probing. Ahalf run can also be unfinished if the user aborted the clientbefore it could run to completion. After preprocessing, wehave a total of 281,394 upstream and 236,423 downstreamfinished half runs.Next, we cluster AS numbers into ISPs using their whoisAS names. The AS information was obtained from Cymru’swhois database in May 2011. Runs which passed the preprocessing checks come from 5,167 distinct ISPs. The topC (Mbps)3.54.88.814.5ρ (Mbps)125.510σ (MB)55, 101010Burst duration (s)16.715.2, 30.525.818.8(a) Upstream.C (Mbps)19.421.128.234.4ρ (Mbps)6.412.81723.4σ (MB)10102020Burst duration (s)6.410.114.915.3(b) Downstream.Table 2: Comcast: detected shaping properties.five ISPs in terms of the number of runs as well as the fraction of shaping detections are shown in Table 1.It should be noted that there are several factors that influence the fraction of shaping detections in an ISP. First,ISPs provide multiple tiers of service; some tiers may notuse shaping, while service tiers change frequently. Second,an ISP may not deploy shaping in all geographic markets.Third, the access link type can be a factor: a DSL providercan dynamically change the link capacity instead of doingshaping, while a cable provider is more likely to use shaping since DOCSIS provides fixed access capacities. Fourth,for a given connection, the shaping parameters can be dynamically adjusted based on time or load conditions in theISP. Fifth, an ISP A can originate the BGP prefixes of asmaller ISP B that deploys shaping (while A does not) - wecannot distinguish A from B based on BGP prefix-to-ASNmapping. We study some of these factors in ISP case studiesnext. Some ISPs disclose their traffic shaping configurations;in such cases, we can validate our observations.4.1 Case Study: ComcastComcast offers Internet connectivity to homes [5] and enterprises [3], and uses two types of access technologies: cable(DOCSIS 3.0) and Ethernet. In each access category, it offers multiple tiers of service. Comcast shapes traffic usingthe PowerBoost technology [4].Shaping profiles. We observed many shaping configurations at Comcast between October 2009 and May 2011. Figure 4 shows the shaping configuration of each run (orderedby capacity). For each run, designated by an ”ID”, we plottwo points in the top panel for the capacity and the shaping rate; and a point in the bottom panel for the burst size.The capacities form an envelope of the shaping rate points.We see that there are strong modes in the data; Table 2 isa summary of these modes. For higher capacities, we seea larger number of modes in the shaping rate. However, atthe tail of the capacity distribution there is only one shapingrate that corresponds to the highest service tier provided byComcast. We verified our observations with the Comcastwebsite listings [3, 5]. Note that we may not observe allservice tiers in that web page, depending on the numberof ShaperProbe users at each service tier. We also observetwo or three burst sizes that are used across all tiers; thePowerBoost FAQ mentions 10MB and 5MB burst sizes [4].

CapacityShaping rate160001400050000Rate (Kbps)12000Rate (Kbps)CapacityShaping 0300002500020000150001000050000Burst size (KB)Burst size 0015000Run ID20000250000(a) Upstream.500010000Run ID1500020000(b) Downstream.Figure 4: Comcast: Shaping characteristics.upto 03/2010since 03/201105000100001500020000upto 03/2010since 03/201125000010000 20000 30000 40000 50000 60000 70000 80000 90000Capacity (Kbps)02000 4000 6000 8000 10000 12000 14000 16000 18000 20000Shaping rate (Kbps)(a) Upstream.Capacity (Kbps)010000200003000040000Shaping rate (Kbps)5000060000(b) Downstream.Figure 5: Comcast: histogram of bandwidth with time.Note that the capacity curves do not show strong modes,unlike the shaping rates. This is due to the underlying DOCSIS access technology. The cable modem uplink is a nonFIFO scheduler; depending on the activity of other nodes atthe CMTS, the capacity can vary due to customer scheduling and DOCSIS concatenation. A DOCSIS downlink canalso influence the dispersion-based capacity estimates underheavy traffic load conditions because it is a broadcast link.Did shaping configurations change during the lasttwo years?. We compare data from Comcast collected inOctober 2009-March 2010 and in March-May 2011. Figure5 shows estimates of the capacity and shaping rate distributions using a Gaussian kernel density estimator. In the upstream direction, the capacity and shaping rates (the modesof the corresponding distributions) have not changed significantly. The downstream links show a new capacity modeof 30Mbps and a shaping rate mode of 22Mbps in 2011. Wedid not find significant changes in the burst size during thelast two years.Non-shaped runs. We examine runs in which ShaperProbe did not detect shaping. Figure 6 compares the capacity distribution in such runs with the shaping rate distribution in shaping runs. The non-shaped capacity distributionsare similar to the shaping rate distributions. Non-shapingruns occur due to the following two reasons. First, Comcastprovides service tiers that do not include PowerBoost, buthave capacities similar to PowerBoost service tiers (e.g., theEthernet 1Mbps and 10Mbps business service). Second, it ispossible that cross traffic resulted in an empty token bucketat the start of the measurement, and so the capacity thatShaperProbe estimated was equal to the shaping rate; wewould not detect shaping in that case.4.2 Case Studies: Road Runner and CoxRoad Runner (RR) is a cable ISP. A unique aspect ofRR is that we have found evidence of downstream shaping,but no evidence of upsteam shaping in any service tier ontheir web pages. The ShaperProbe measurements for RRsupport this observation - 94% of the upstream runs didnot detect shaping, while 64% of the downstream runs did.Another interesting aspect of RR is that shaping depends on

1Rate (Kbps)0.8CDF0.6Burst size (KB)0.4Upstream: non-shapingUpstream: shapingDownstream: non-shapingDownstream: 5002000150010005000CapacityShaping rate05001000Capacity (Kbps)Figure 6: Comcast: distribution of capacities in non-shapingand shaping rate in shaping runs.15002000Run ID250030003500Figure 7: Cox: Upstream shaping.14.3 Case Study: AT&TOur final case study is that of an ISP for which we donot see frequent shaping detections (10% or less). AT&Tprovides Internet access to a wide range of customers, fromhomes and small businesses to enterprises (including otherISPs). Their residential service includes four DSL servicetiers [1, 2]. We did not find any mention of traffic shapingin the AT&T service descriptions [1, 2].Capacity. We first look at the 90% of the runs that did notsee shaping. The capacity distribution of non-shaped runsis shown in Figure 8. Given the point-to-point nature ofDSL links, ShaperProbe estimates the narrow link capacitymore accurately than in cable links. The capacity distributions show several modes: {330Kbps, 650Kbps, 1Mbps,1.5Mbps} upstream, and {1Mbps, 2.5Mbps, 5Mbps, 6Mbps,11Mbps, 18Mbps} downstream. We did not observe significant changes in the capacity modes between 2009-2011.Shaping runs. We look at the 10% of AT&T runs thatwere probably mis-diagnosed as shaping.We found thatabout a third of these runs exhibit strong shaping rate modes0.80.70.6CDFthe geographic region of the customer; for example, in Texas,RR provides four service tiers: the lower two are not shapedwhile the upper two are shaped [10]. Under the hypothesisthat RR does not shape upstream traffic, we can say thatour false positive detection rate for their upstream links isabout 6.4%. The capacity distribution of non-shaped RRruns shows that, unlike Comcast, the downstream capacitymode of 750Kbps is not equal to any of their shaping modes(figure omited due to space constraints; see [17]).Cox provides residential and business Internet access usingcable and Ethernet access. The website [7] mentions thatthe residential shaping rates and capacities depend on thelocation of the customer. We gathered residential shapingconfigurations from the residential pages [7]. The upstreamshaping properties of Cox runs in Figure 7 agree with someof the ground truth information we found: (C, ρ)Mbps: (1,0.77), (1.3, 1), (2, 1.5), (2.5, 1), (2.5, 2), (3, 2), (3.5, 3),(5, 4) and (5.5, 5). Note that the previous ground truthwas collected in October 2010, while the ShaperProbe datacovers two years. We also found a single burst size 00 15000 20000Capacity (Kbps)2500030000Figure 8: AT&T: Capacity of non-shaping runs.and an associated burst size mode (for figure, see [17]).About 80% of 333 runs that have the shaping rate modescome from hostnames that resolve to the domain mchsi.com,owned by the cable ISP Mediacom [9]. So, it is possible(though we can not be certain) that these shaping detections were not errors afterall.5. CONCLUSIONIn this work, we presented an end-to-end active probing, detection, and estimation method of traffic shaping inISPs. Our evaluation using controlled experiments and intwo known ISP deployments shows that ShaperProbe hasfalse positive and false negative detection rates of less than5%. We presented a first large-scale study of shaping atfour large ISPs, and validated some of our observations using ISP advertised tier data. A strong modality of shapingrates and burst sizes suggests that ISPs typically deploy asmall set of shaping configurations. We found some shaping detections for which the ISPs do not mention shapingin their service descriptions4 . Lack of publicly-available information, however, does not necessary imply that these arefalse detections. We are currently working on passive shaping detection methods (for preliminary results, see [17]).4ISPs, however, typically mention in their SLAs that “listedcapacities may vary”.

6.REFERENCES[1] AT&T FastAccess Business DSL Plans (May 12,2010). http://smallbusiness.bellsouth.com/internet dsl services.html.[2] AT&T FastAccess DSL Plans (May 12, inetsrvcs compare.html?src lftnav.[3] Comcast Business Class Internet (May 12, .aspx.[4] Comcast High Speed Internet FAQ: stViewer.aspx?topic Internet&folder 8b2fc392-4cde-4750-ba34-051cd5feacf0.[5] Comcast High-Speed Internet (residential; May 122010). ternet/speedcomparison.html.[6] Comparing Traffic Policing and Traffic Shaping forBandwidth Limiting. Cisco Systems: Document ID:19645.[7] Cox: Residential Internet (May 12, 429259002/intercept.cox?lob residential&s pf.[8] Data from M-Lab Tools (May 2011).http://www.measurementlab.net/data.[9] Mediacom: Hish-speed Internet (May 12, 2010). http://www.mediacomcable.com/internet online.html.[10] Road Runner cable: central Texas (May 12, rn/hso/roadrunner/speedpricing.html.[11] ShaperProbe (M-Lab). s#tool5.[12] S. Bauer, D. Clark, and W. Lehr. PowerBoost. InACM SIGCOMM HoneNets workshop, 2011.[13] M. Dischinger, A. Haeberlen, K. Gummadi, andS. Saroiu. Characterizing residential broadbandnetworks. In ACM IMC, 2007.[14] M. Dischinger, M. Marcon, S. Guha, K. 5]R. Mahajan, and S. Saroiu. Glasnost: Enabling EndUsers to Detect Traffic Differentiation. In USENIXNSDI, 2010.M. Hollander and D. Wolfe. Nonparametric statisticalmethods. 1973.P. Kanuparthy and C. Dovrolis. DiffProbe: DetectingISP Service Discrimination. In IEEE INFOCOM,2010.P. Kanuparthy and C. Dovrolis. End-to-end Detectionof ISP Traffic Shaping using Active and PassiveMethods. Technical Report, Georgia Tech, 2011. http://www.cc.gatech.edu/ partha/shaperprobe-TR.pdf.K. Lakshminarayanan and V. Padmanabhan. Somefindings on the network performance of broadbandhosts. In ACM SIGCOMM IMC, 2003.G. Lu, Y. Chen, S. Birrer, F. Bustamante, C. Cheung,and X. Li. End-to-end inference of router packetforwardin

subject to traffic shaping, and in that case, estimate the shaper characteristics C, ρ and σ. Second, we analyze re-sults from a large-scale deployment of ShaperProbe on M-Lab [11] since May 2009, detecting traffic shaping in several major ISPs. Our deployment received about one million runs over the last two years from more than 5,700 ISPs; we