Reverse Engineering Approach to Validate the Implementation of Network Protocols in Operating Systems

Network communication protocols are standards defined in Request For Comments (RFCs) and are a vital component of today’s internet. However, a standard is only a specification, not the actual implementation of said protocols. Network protocols are implemented in software and different software solutions may or may not implement the full set of specifications defined in the RFCs. The current article proposes a reverse engineering approach to understand the implementation details of the communication protocols integrated in software. This methodology is applied on the sliding window feature of the Transmission Control Protocol (TCP) protocol when generating traffic on different operating systems and also on the Mininet network emulator. The feature that is primarily investigated is the sliding window adjustment depending on the current network conditions. Traffic captures are obtained and analyzed by generating network traffic between endpoints located on the same computer, at different locations in the internet and in the Mininet emulator. Experimental results and details about the reverse-engineered sliding window implementation are presented in each experiment. In this manner, the proposed reverse engineering approach identifies the implementation details of the TCP sliding window feature on different operating systems.