Modernisation et extension de TCPSnitch : Analyse comportementale multi-couches des applications

Details

Supervisors

Bonaventure, Olivier

Faculty

Ecole polytechnique de Louvain

Degree label

Master [60] en sciences informatiques

Abstract

enApplications interact with the network stack via the Socket API. Over the years, the context in which this API evolves has profoundly changed. Designed in 2017 to analyze these interactions, the TCPSnitch software relied on user-space interception. Today, this method is limited by the emergence of asynchronous interfaces, rendering the software blind to the internal decisions of the kernel. To restore total visibility, this thesis proposes a hybrid architecture: an interception at the application level preserves the context; intra-kernel probes extract the TCP/IP dynamics, and a system monitor tracks the physical topology. The evaluation of this tool on recent traces (Android and Linux) reveals a major evolution in practices. On mobile, traffic is massively dominated by UDP driven by QUIC, and applications react very unevenly to network outages. Conversely, the Linux desktop ecosystem relies very effectively on the kernel to absorb these failures. Finally, the study highlights that this observation "from the inside" is now heavily hindered by modern security policies. The source code of the modernized version is available open source, and the entire dataset is in open access.