Cellular networks:
========================
* Widely used form of Internet access
* Many generations of cellular networks:
  --> 1G (1979 onwards): Analog communication, good only for voice calls, no data, e.g., AMPS
      (no real concept of data rate just like a landline phone)
  --> 2G (1991 onwards): Data for the first time, introduction of SMS: first SMS sent in 1992, e.g., GSM
      (10s of kbit/s)
  --> 3G (1998 onwards): Basic Internet access, e.g., CDMA2000 and UMTS
      (100s of kbit/s)
  --> 4G (2009 onwards): Better Internet access (video calls, gaming, mobile TV),
      e.g., LTE (technically isn't 4G, but was retrospectively declared 4G due to marketing pressures).
      (a few Mbit/s)
  --> 5G (ongoing, demonstrated at 2018 Winter Olympics, Verizon roll out planned in 2018):
      Intended to support IoT applications such as sensors sending massive amounts of data to the cloud
      e.g., work going on at NYU Wireless
      (expectation of a few Gbit/s)
* Many different physical layer technologies over the ages:
  --> Time Division Multiplexing, Frequency Division Multiplexing, OFDM, CDMA, MIMO, full duplex
  --> Will study two of these technologies next week (MIMO and full duplex) but in the context of WiFi.
  --> Improvements in the physical layer translate into new use cases at higher layers
      (web browsing, video conferencing, gaming, etc.)

This week's papers:
=========================
* Viewing cellular networks from two very different vantage points
  --> Sprout: Operates at the transport layer
      * What Sprout sees: A time varying link that isolates users from each other and rarely drops packets
  --> LTEye: Operates at the physical layer
      * What LTEye sees: Bitmap representing which time slots+frequency blocks have been allotted to users and which are frees.
* In some way, these viewpoints are at two ends of the networking stack
  --> They show how the same technology (LTE in specific, cellular networks in general) can have connections to
      * Stochastic processes and stastistics at the transport layer (Sprout)
      * Wave propoagation (multipath), antenna design (synthetic aperture radar), and electrical engineering in general (LTEye)
  --> More than any other pair of papers assigned in this course, these two papers illustrate
      * the richness of networking
      * its connections to diverse adjacent disciplines.
* Question: Which layer is a better vantage point?
  --> It really depends.
  --> Easier to change things at the transport layer. End-to-end transport like Sprout only needs the ability to open a socket.
  --> But you can't really change things substantially (e.g., allotment of uplink and downlink capacity) at the transport layer.
      --> LTEye was one of the first papers to do an in-depth study of the LTE physical layer.

Sprout: A transport protocol for videoconferencing on cellular networks
==========================
* Motivated by poor performance of Skype (and similar programs) over cellular networks.
* Observation:
  --> Cellular networks isolate users into per-user queues (for accounting, fairness, etc.)
      * Not all wireless networks behave this way (WiFi doesn't have per-user queues).
  --> Network capacity varies considerably over time.
      * User mobility
      * Dead spots/outages/going through a tunnel.
      * Varying number of users under each cell tower.
  --> Network rarely drops a packet
      * Mindset: Try and utilize the network as much as possible.
      * Implies that you buffer as many packets as possible in the event that network capacity suddenly gets better.
      * Delays of a few tens of seconds common on these networks when queues are full.
* The goal of congestion control is different in such situations:
  --> Easier in some ways because the network provides per-user queues (similar to WFQ).
  --> Harder in some ways because the network provides no real feedback and drops packets far too late.
* Goal of congestion control: Minimize self-inflicted delay while maximising throughput.
  --> Unconventional in some ways: Doesn't tackle fairness unlike most congestion control protocols.
  --> That's because the network already provides fairness.

Sprout's model of the network
===========================
* Sprout assumes a certain model of the network---specifically of how the network's link capacity varies over time.
* And then tries to infer parameters in this model in an online fashion.
* Is this model accurate?
  --> Probably not. As George Box said: "All models are wrong but some are useful."
  --> Ultimately, the real question is whether this model provides an end-to-end benefit in throughput and queueing delay,
      which is the problem that Sprout sets out to solve.
  --> And on that metric, Sprout does quite well.
* Sprout's model
  --> Network's packet deliveries can be modeled as a Poisson process.
  --> But occasionally the network might be in an outage and when in an outage, it tends to remain in the outage.
  --> Also, the rate of the Poisson process varies according to Brownian motion.
      --> From the paper: "In other words, if at time t = 0 the value of λ was known to be 137, then when t = 1 the probability
          distribution on λ is a normal distribution with mean 137 and standard deviation σ."
* Evolution of the model
  --> Maintain probability distribution over rates (initially a uniform distribution over all lambdas)
  --> Evolve this forward in time according to Brownian motion with sticky outages (lambda = 0 tends to remain at lambda = 0)
  --> Observe the number of bytes that actually got delivered and update probability distribution based on this observation. 
  --> Normalize probabilities again.
  --> Account for times when the sender had nothing to send (app-limited in the terminology of the BBR paper).
* Forecast
  --> Integrate probability distribution forward in time to
      determine the number of bytes that will get delivered in each of the next 8 ticks (160 ms).
  --> Take 5th percentile of this distribution as the conservative forecast for how much will get delivered.
* Control
  --> Subtract queue size from forecast of what will be delivered (with 95% probability) in 100 ms
      to determine what is safe to send.

Evaluation
============================
* Trace-driven emulation
* Saturator: Saturate network with packets in both directions to measure simulatenous uplink and downlink capacity
  --> Why saturate the network?
  --> How does it saturate the network? By keeping the delay relatively high but not way too high.
  --> Why do we need a second phone for feedback? Controling a system becomes harder with feedback delay.
* Cellsim: Trace-driven replay of traces collected by Saturator
* Why does the paper talk about the parameters being frozen before the experiments were run?
  --> If the parameters aren't frozen, the results reported would be better than what they would be in practice.
* Results: Better throughput and lower delay than most other competitors
* Comparable throughput and delay to Cubic + CoDel (an in-network scheme), which is surprising.
* Suprising result:
  --> Sprout-EWMA (which only tracks a point estimate of rate instead of a probability distribution) is almost as good as Sprout.
  --> Conclusion: If you care about a reasonable throughput-delay compromise, Sprout-EWMA might be sufficient (and is simpler).
  --> Why does Sprout-EWMA work so well?
      * Turns out that the per-user queues simplify the problem of congestion control considerably.
      * Each user only needs to worry only about their own delay.
      * But the link capacity is still variable so some caution in forecasting (similar to Sprout) is useful.

LTEye:
===========================
* Goal: Understanding LTE performance at the physical layer.
  You can think of it as explaining the cellular network variability that Sprout takes as a given.
* Motivation: Help spectrum providers, researchers, campuses, etc. understand LTE performance without relying on operators.
* Problem is hard for many reasons:
  --> LTE is a complicated protocol (much more so than WiFi).
  --> Very few open implementations that can interoperate with standard cellular operators.
* Measurement work until then had focused on higher layers of the stack.
* LTEye was likely the first to measure the physical layer of an operational LTE network.
  --> Didn't have to interoperate or even implement a subset of the LTE network.
  --> Instead, it used a software-defined radio to
      passively listen for signals within a certain band, logged these signals, and then decoded them.
  --> LTEye needed to know just enough about LTE to decode signals in the control channel.

Aside: Modulation and coding
===========================
* Modulation: Prepare digital signals for transmission on an analog medium (e.g., AM, FM, etc.)
* Coding: Add some redundant bits to ensure the transmission can detect and correct some losses (e.g., parity and repetition codes)
* MCS (from LTEye paper): Modulation and Coding Scheme
* MCS detemines the current bit rate of the channel.
* Picking the MCS is the job of bit rate selection.
  --> Much more important in wireless networks than wired ones because wired networks rarely see packet losses.
  --> In other words, you can mostly get by picking the highest MCS possible.

LTEye approach:
==========================
* Two main ideas
  --> Listen for signals in the control channel to understand allocation of frequency-time blocks to users.
  --> Localize users using LTE alone.
      * Why is localization important? GPS doesn't work indoors.
      * But localization is a secondary contribution of LTEye.
      * Could have used other technologies for indoor localization, e.g., WiFi based, ultrasonic based, etc.
      * They did LTE-based localization because they didn't want to spend money on more hardware.

LTEye tracking using control channel:
==========================
* Use unencrypted control channel for inferring allocation to users; other channels are encrypted.
* Why is the control channel unencrypted?
  --> Needed for seamless roaming. Encryption typically kicks in at higher layers.
      Similar to how Ethernet headers are unencryped.
      Encryption can be technically be done but needs long term keys.
* Radio resources: 2D grid of frequencies and time slots. 
* Track users anonymously using PHY User Identifier: C-RNTI
* But how do you get the C-RNTI in the first place?
  --> End of each message has a 16-bit sequence (scrambled checksum) which is the XOR of C-RNTI and checksum.
  --> LTEye decodes the control message first.
  --> LTEye then XORs the scrambled checksum with the real checksum to compute C-RNTI.
  --> Re-encodes the message to ensure this wasn't a fluke.
  (Sidebar: Any measurement study has to make a number of such intelligent guesses because it doesn't fully control
   the world it's measuring. The Heartbleed paper also made a number of such guesses.)
* How do you know what MCS to use for decoding?
  --> Brute force check for a small number of MCS schemes.
* C-RNTI might change for the same user across logs due to either inactivity or change in cell tower.
  --> Use a bipartite matching algorithm to match up C-RNTIs across logs.
* Log several statistics per user (Table 2):
  --> E.g., Number of resource blocks, bitmap of blocks, Modulation and Coding Scheme, etc.

LTEye's localization:
=========================
* Extract multipath profile of LTE signal.
  --> i.e., what is the signal strength in each direction?
* Use this to identify the direction of the shortest path.
* Triangulate by intersecting the shortest paths from multiple LTEye devices.
* Many low-level details hidden in the brief description above.
* Net result: O(10 cm) localization error.
  --> Enough to detect students cheating in an exam down to the specific chair according to the paper :)
* Ultimately though, the LTE-based localization can be treated as a blackbox for the rest of the paper.
  --> And any other localization technique can also be used as long as you're willing to spend additional money on hardware.

LTEye results:
========================
* Uplink is significantly underutilized relative to the downlink even though both have the same bandwidth allocated to them.
  --> Implication: can benefit considerably from asymmetric carrier aggregation.
* Unneccesary overhead on control channel for Verizon
  --> Implication: Cell providers should adapt number of control symbols to requirements dynamically.
* Some blocks are never allocated (e.g., blocks 22 to 27)
* There is considerable inter-cell inference because cells are placed too close to each other.
* Rate adaptation is very aggressive even if channel conditions remain stable over time. 
* Base station uses conservative modulation (i.e., loss rates are low), but only if it doesn't eat into another user's throughput.

LTEye summary:
=======================
* Rich visibility into the physical layer of LTE.
* Hadn't been done before because:
  --> LTE is complicated.
  --> Requires some reverse engineering and intelligent guesses (e.g., brute force decoding of control messages, reencoding, etc.)
  --> Several algorithmic tricks (e.g., matching algorithm to match C-RNTIs across logs and LTEye's localization algorithm).
  --> And a deep familiarity with the lowest layer of the stack, which most networking researchers don't have.
* In a way, demystifies the underlying causes of cellular network variability that Sprout takes as a law of nature.