STUN-based Detection of DSCP Mangling
Keywords:
DSCP, server, packet, mangling, QoS, headerAbstract
Differentiated Services Code Point (DSCP) is a field in the IP header used to classify and manage network traffic based on quality of service (QoS) requirements. However, malicious actors and misconfigured network devices can manipulate DSCP values, a practice known as DSCP mangling to evade traffic shaping policies, degrade service quality or bypass security controls. This paper explores and proposes an algorithm-based approach to detect DSCP mangling in real time network traffic. By improving traffic flow analysis, statistical modeling and anomaly detection techniques, the proposed system identifies inconsistencies between expected and observed DSCP markings. The STUN-based algorithm detects inconsistencies between declared and observed DSCP values along the network path. The algorithm also generates a fingerprint and compares the existent fingerprint packet within the database. This approach can enhance the integrity of QoS enforcement and contributes to improved security and reliability in IP networks.
Downloads
References
Alarood, A. A., Ibrahim, A. A., & Alsubaei, F. S. (2023). Attacks notification of differentiated services code point (DSCP) values modifications. IEEE Access, 11, 126950–126966.
Babiarz, J., Chan, K. H., & Baker, F. (2006). Configuration guidelines for DiffServ service classes (RFC 4594). RFC Editor.
Baker, F., Polk, J., & Dolly, M. (2010). A differentiated services code point (DSCP) for capacity-admitted traffic (RFC 5865). RFC Editor.
Black, D., & Jones, P. (2015). Differentiated services (DiffServ) and real-time communication (RFC 7657). RFC Editor.
Blake, S., Black, D., Carlson, M., Davies, E., Wang, Z., & Weiss, W. (1998). An architecture for differentiated services (RFC 2475). RFC Editor.
Chan, K. H., Babiarz, J., & Baker, F. (2008). Aggregation of DiffServ service classes (RFC 5127). RFC Editor.
Cisco. (2019). Quality of service (QoS) configuration guide, Cisco IOS XE Gibraltar 16.12.x (Catalyst 3850 switches): Configuring QoS.
Custura, A., Fairhurst, G., & Secchi, R. (2023). Considerations for assigning a new recommended differentiated services code point (DSCP) (RFC 9435). RFC Editor.
Custura, A., Secchi, R., & Fairhurst, G. (2018). Exploring DSCP modification pathologies in the Internet. Computer Communications, 127, 86–94.
Davie, B., Charny, A., Bennett, J. C. R., Benson, K., Le Boudec, J.-Y., Courtney, W., Davari, S., Firoiu, V., & Stiliadis, D. (2002). An expedited forwarding PHB (per-hop behavior) (RFC 3246). RFC Editor.
Fortinet. (2023). What is QoS (quality of service)?
Galea, N. (2015). What is the STUN protocol, its purpose and how it works.
Heinanen, J., Baker, F., Weiss, W., & Wroclawski, J. (1999). Assured forwarding PHB group (RFC 2597). RFC Editor.
Jabbar, A. K., Karimi, B., Jamel, T. M., & Abood, A. (2019). QoS mapping method based on DSCP/IP in LTE and EDCA AC/MAC in WiFi network. In 2019 12th International Conference on Developments in eSystems Engineering (DeSE) (pp. 662–667).
Jones, P., Dhesikan, S., Jennings, C., & Druta, D. (2021). Differentiated services code point (DSCP) packet markings for WebRTC QoS (RFC 8837). RFC Editor.
Keranen, A., Holmberg, C., & Rosenberg, J. (2018). Interactive connectivity establishment (ICE): A protocol for network address translator (NAT) traversal (RFC 8445). RFC Editor.
Khan, F. A., & Ibrahim, A. A. (2024). Network traffic classification analysis on differentiated services code point using deep learning models for efficient deep packet inspection. International Journal of Innovative Computing, 14(2), 15–24.
Liu, C. J. (2007). Tracking DSCP marking of packets in a QoS-enabled triple-play IP network. In International Conference on Networking and Services (ICNS 2007).
Luo, H., & Shyu, M.-L. (2007). Differentiated service protection of multimedia transmission via detection of traffic anomalies. In 2007 IEEE International Conference on Multimedia and Expo (pp. 1539–1542).
Mahy, R., Matthews, P., & Rosenberg, J. (2010). Traversal using relays around NAT (TURN): Relay extensions to session traversal utilities for NAT (STUN) (RFC 5766). RFC Editor.
Malikovich, K. M., Rajaboevich, G. S., Sobirovna, T. S., & Temurmalik, E. (2021). Differentiated services code point (DSCP) traffic filtering method to prevent attacks. In 2021 International Conference on Information Science and Communications Technologies (ICISCT).
Martinsen, P.-E., & Nandakumar, S. (2016). DSCP mangle detection (Internet-Draft draft-martinsen-tram-dscp-mangle-detection-00). IETF.
Mazhar, T., Malik, M. A., Mohsan, S. A. H., Li, Y., Haq, I., Ghorashi, S., Karim, F. K., & Mostafa, S. M. (2023). Quality of service (QoS) performance analysis in a traffic engineering model for next-generation wireless sensor networks. Symmetry, 15(2), 513.
Nichols, K., Blake, S., Baker, F., & Black, D. (1998). Definition of the differentiated services field (DS field) in the IPv4 and IPv6 headers (RFC 2474). RFC Editor.
Petit-Huguenin, M., Salgueiro, G., Rosenberg, J., Wing, D., Mahy, R., & Matthews, P. (2020). Session traversal utilities for NAT (STUN) (RFC 8489). RFC Editor.
Downloads
Published
Issue
Section
License
This work is licensed under a Creative Commons Attribution 4.0 International License (CC BY 4.0) 
