arXiv subjects

Baptiste Jonglez

Publications and source records attributed to Baptiste Jonglez.

4 recordsLinked to original sources

arXiv2026

Application-level observability for adaptive Edge to Cloud continuum systems

Modern Edge-to-Cloud (E2C) systems require fine-grained observability to ensure adaptive behavior and compliance with performance objectives across heterogeneous and dynamic environments. This work introduces an application-level observability framework that integrates developer-driven instrumentation and SLO-aware feedback for autonomous adaptation. By combining OpenTelemetry, Prometheus, K3s, and Chaos Mesh, the framework enables real-time monitoring and adaptive control across the continuum. A video processing use case demonstrates how application-level metrics guide automatic adjustments to maintain target frame rate, latency, and detection accuracy under variable workloads and injected faults. Preliminary results highlight improved scalability, fault tolerance, and responsiveness, providing a practical foundation for adaptive, SLO-compliant E2C applications.

cs.DC↗

arXiv2023

The Closed Resolver Project: Measuring the Deployment of Source Address Validation of Inbound Traffic

Source Address Validation (SAV) is a standard aimed at discarding packets with spoofed source IP addresses. The absence of SAV for outgoing traffic has been known as a root cause of Distributed Denial-of-Service (DDoS) attacks and received widespread attention. While less obvious, the absence of inbound filtering enables an attacker to appear as an internal host of a network and may reveal valuable information about the network infrastructure. Inbound IP spoofing may amplify other attack vectors such as DNS cache poisoning or the recently discovered NXNSAttack. In this paper, we present the preliminary results of the Closed Resolver Project that aims at mitigating the problem of inbound IP spoofing. We perform the first Internet-wide active measurement study to enumerate networks that filter or do not filter incoming packets by their source address, for both the IPv4 and IPv6 address spaces. To achieve this, we identify closed and open DNS resolvers that accept spoofed requests coming from the outside of their network. The proposed method provides the most complete picture of inbound SAV deployment by network providers. Our measurements cover over 55 % IPv4 and 27 % IPv6 Autonomous Systems (AS) and reveal that the great majority of them are fully or partially vulnerable to inbound spoofing. By identifying dual-stacked DNS resolvers, we additionally show that inbound filtering is less often deployed for IPv6 than it is for IPv4. Overall, we discover 13.9 K IPv6 open resolvers that can be exploited for amplification DDoS attacks - 13 times more than previous work. Furthermore, we enumerate uncover 4.25 M IPv4 and 103 K IPv6 vulnerable closed resolvers that could only be detected thanks to our spoofing technique, and that pose a significant threat when combined with the NXNSAttack.

cs.NI↗

arXiv2020

Don't Forget to Lock the Front Door! Inferring the Deployment of Source Address Validation of Inbound Traffic

This paper concerns the problem of the absence of ingress filtering at the network edge, one of the main causes of important network security issues. Numerous network operators do not deploy the best current practice - Source Address Validation (SAV) that aims at mitigating these issues. We perform the first Internet-wide active measurement study to enumerate networks not filtering incoming packets by their source address. The measurement method consists of identifying closed and open DNS resolvers handling requests coming from the outside of the network with the source address from the range assigned inside the network under the test. The proposed method provides the most complete picture of the inbound SAV deployment state at network providers. We reveal that 32 673 Autonomous Systems (ASes) and 197 641 Border Gateway Protocol (BGP) prefixes are vulnerable to spoofing of inbound traffic. Finally, using the data from the Spoofer project and performing an open resolver scan, we compare the filtering policies in both directions.

cs.NI↗

arXiv2014

A delay-based routing metric

In overlay networks, both local and long-distance links appear as a single hop to a routing protocol. Traditional routing metrics (based on hop count or packet loss) fail to take the differences between such links into account. In this paper, we study a metric based on packet delay that has been designed to improve routing in overlay networks. We show a lightweight technique for measuring delay asynchronously, and show how to use the data it provides for constructing a routing metric. Using delay naively leads to persistent routing oscillations, so our routing protocol implements a number of features to bound the frequency of oscillations. We show that our protocol causes no oscillations in real-world tests, and has oscillations with a period on the order of minutes in artificially constructed worst-case setups.

cs.NI↗