We designed Glasnost to enable individual users to detect if their BitTorrent traffic is being shaped by ISPs. We can control the accuracy with which users can detect traffic shaping. But, in the process, we have to make some hard trade-offs between false positives, where the test indicates traffic shaping by ISPs even when they are not, and false negatives, where the test fails to detect traffic shaping even when ISPs are shaping traffic. To better understand how to choose the trade-offs, we need to understand how Glasnost tests work.
At a high-level, Glasnost test sets up a series of BitTorrent flows interspersed with control TCP flows (with random bits in the payload) between an end user's host and our Glasnost test servers. We collect the packet trace for each flow on the server side, and we compare the bandwidths obtained by the BitTorrent and control TCP flows. If the bandwidths achieved by the BitTorrent flows are consistently different than those achieved by control TCP flows, we report the BitTorrent flows as being traffic shaped by some ISP along their paths.
More specifically, we configured Glasnost to run BitTorrent and control TCP flows three times each and we report the BitTorrent connections as being traffic shaped only when:
The noise in flow bandwidth measurements is lower than a threshold value (X): Flow bandwidths can vary, even over short time-scales, due to cross-traffic along Internet paths. To prevent such transient noise from affecting our results, we discard all tests where measurements appear to be affected by noise. In particular, we compare the bandwidths achieved by successive BitTorrent flows and control TCP flows separately. If the difference between the maximum and median bandwidths achieved by the multiple runs of BitTorrent flows or control TCP flows exceeds a threshold value, X, we discard the test and do not include it in further analysis.
The bandwidth achieved by BitTorrent flows differs from that of control TCP flows by more than a threshold value (Y): For tests that pass the noise test described above, we compare the bandwidths achieved by BitTorrent and control TCP flows. If the difference in bandwidths exceeds a threshold value, Y, we declare BitTorrent traffic as being shaped.
Data analysis presented in our NSDI 2010 paper shows that setting the values of noise-threshold (X) and bandwidth-difference threshold (Y) to 20% yields a good trade-off between false positives (where the test indicates traffic shaping by ISPs when they are not) and false negatives (when the test fails to detect traffic shaping when ISPs are shaping traffic). At these threshold values, our analysis estimates that there is about 4% chance of false positives. By raising the bandwidth-difference threshold (Y) to 50%, we can further reduce the chance of false positives to less than 1%, but we would fail to detect traffic shaping that throttles BitTorrent flows' bandwidths by less than 50%.
If you have questions or feedback, you can contact us via e-mail: