paper-icts10-intermo..

Advanced data mining system for inter-domain QoS and traffic analysis based on integrated measurement, modeling and

simulation

A. Nassri [email protected], A. Schildhofer [email protected] , Siemens AG Austria  PSE KB C3 A-1194 VIENNA,   Boschstrasse 10Austria

I.Miloucheva [email protected] U. Hofmann [email protected]

Jakob-Haringer-Str. 5/IIISalzburg Research 5020 Salzburg Austria

A. Kock [email protected]

T-Systems Nova BerkomGoslarer Ufer 35

D-10589 Berlin Germany

Abstract

Advanced data mining architecture for inter-domain QoS and traffic analysis developed in the framework of European Intermon project is discussed [Int-IST]. The architecture is based on distributed measurement, modeling and simulation components using common data base and user interface to integrate inter-domain topology, performance, border router traffic, end-to-end QoS and event data. Using Intermon architecture, different kind of models could be inferred to the corresponding measurement scenarios and used for integration in simulation environment. The paper addresses the formal framework and components of the Intermon data mining architecture as well as relationships of different kind of measurement and modeling data. Inter-domain data mining with Intermon could be used for different business scenarios. This paper is discussing possible scenarios in the framework of :

- application QoS and SLA validation to study end-to-end QoS and events of application classes considering inter-domain performance models

- border router traffic modeling in order to support ISP capacity planning and enhanced application QoS provision in inter-domain environment.

The paper also compare the Intermon inter-domain data mining usage for the described scenarios with current existing systems in the area of QoS and SLA validation as well as inter-domain traffic engineering and inter-domain ISP capacity planning.

1 IntroductionData mining is an approach to explorative data analysis and knowledge discovery that is build on the extensive use of visual computing. Large and normally incomprehensible amounts of data are reduced through the use of visualisation techniques based on particular metaphor or a combination of several metaphors. Integral part of information visualization is how well the information is understood, efficiency of information compression and level of cognitive overload [GR 94].Recent developments are extending visual data mining with algorithmic animation techniques [BS 93], multimedia support [BH 01] and incorporation of virtual reality visualizations. For the purpose of QoS and traffic analysis (in the framework of SLA validation, traffic optimization and other business scenarios), there is a challenge to find out data base concepts and techniques that support visual mining of large amounts of QoS and traffic measurement data. Especially, data base concepts and techniques able to combine topology and measurement data in a form appropriate for modeling, visualization and simulation are challenge of today QoS and traffic analysis systems.Research efforts for data base techniques to integrate large amounts of measurement data for modeling, simulation and visualization purposes are addressed by the CAIDA Macroscopic Internet data collection and analysis project which is aimed to make Internet performance measurement, topology, routing datasets available to the modeling and simulation community in formats most useful to them [MC 01]. It will also assist in the development of tools for navigation, analysis, and correlated visualization of routing tables and massive volumes of traffic data and path-specific performance and routing data that are critical to advancing both research and operational efforts regarding the evolving commercial Internet. The macroscopic project is working with the network modeling and simulation (NMS) community to identify what formats of datasets are most useful to them. Each format must focus on the potential use of the data, e.g., a study focusing on emerging protocols may require different data format from one designed to profile the effects of network congestion, outages, or route flapping. Libraries of case studies may be developed on select topics by varying data from different locations (e.g., core vs. edge), times, topology (e.g., what may be typical for one network may be unusual for another), etc. The CAIDA macroscopic data mining is using combination of active and passive monitoring tools, such as skitter tool based on active probing monitors on different locations to discover and measure global Internet topology [Skitter1], [Skitter2],[Skitter3] as well as passive monitoring tools for relating the Workload like [OCxmon/CoralReef ] and [cflowd]. Another research aimed to combine measurement, modeling and simulation information ist the QORE toolkit and data base [Hetz02]. QORE is designed to correlate measurement, modeling and simulation information used for measurement based admission control (MBAC) and optimization of router resources considering QoS of traffic flowsIntermon visual data mining discussed in this paper is another data mining concept for integration of measurement and modeling data focused on collection of inter-domain topology, traffic and QoS measurement and modeling information for the purpose of efficient simulation and visualization in the framework of inter-domain SLA validation and traffic optimization [IntD2], [Int-ISP].Especially following kinds of data are integrated by Intermon: Application end-to-end time dependent QoS measurements and models

Application event data and models

Inter-domain performance data and models

Topology data bases and models

Border router traffic data and models.

The design of consistent information models relating different kinds of inter-domain time dependent topology, measurement, modeling data over their “time states” is a key component in the Intermon data mining. The following issues are addressed in the sections of this paper in order to present actual approach to inter-domain data mining in the framework of Intermon project for different business scenarios. Section 2 describes the Intermon inter-domain architecture. Section 3 is focussed on the scenarios to use Intermon architecture for end to end QoS validation in inter-domain environment and comparison of this usage approach to current existing systems for end to end QoS measurement and validation. Section 4 discusses the usage of Intermon architecture for inter-domain traffic engineering and compares it with existing tools and concepts.

2 Intermon toolkit – integrated inter-domain tools for QoS and traffic analysis

The following figure shows the functional components of the INTERMON toolkit which are interworking using interaction control mechanisms and data base with policy control.

Figure 1: Intermon toolkit – functional componentsUsing the modular user interface, the Intermon toolkit for inter-domain data mining is used. For each usage scenario, interaction control mechanisms specify tool configuration parameters for the specific scenario (parameterisation of the individual

tools for monitoring, modelling, visual data mining, and simulation) tool and data base interworking - the data is specified which is used for data base

manipulation(storage and access), for instance measurement scenario, models, etc. dependent on the particular Intermon usage

tool interworking parameter - for instance interworking between monitoring and modeling toolkit should specify, dependent on the usage scenario, the parameters (QoS parameter, inter-domain performance metric, traffic parameters) for which a model should be obtained. The models are describing parameter behavior ( QoS , traffic, events) dependent on the time.

event driven tool interworking - for instance end-to-end QoS monitoring toolkit should initiate the inter-domain monitoring toolkit with some configuration parameters when application QoS degradation is detected.

The modular user interface is including a policy based data collection and management of data mining repositories (monitoring, modelling, topology data and their sources, for instance traces obtained from ISP which could be external sources, etc). The interaction control mechanisms are flexible, modular defined and extendable, i.e. considering enhancements of Intermon architecture framework as well as future applications and scenarios.Inter-domain structure discovery in Intermon is aimed to obtain border router level and Autonomous system level inter-domain connectivity and topology considering characteristics of Autonomous systems and border routers of inter-domain connections. The inter-domain topology is obtained from given source (one or more Autonomous Systems or user end system) to specific destinations (one or many Autonomous systems or user endsystem) by geographical and topological mapping. Each user of Intermon architecture (ISP operator or end user) builds its “individual data bases” on inter-domain topology, QoS and performance considering the source and destination systems which are important for the user. Strategies for “shared data bases” on inter-domain topology and performance, i.e. where multiple users of Intermon architecture builds their “shared data base views” on inter-domain topology and performance are also possible based on the policy controlled mechanisms. Policy controlled data collection defines rules for sharing of inter-domain QoS base data repositories of different Intermon users (monitoring, modeling and topology data). Based on this, a “global inter-domain QoS view” of inter-domain QoS could be obtained from the “individual inter-domain QoS view”. The concept of policy controlled data collection allows inter-domain performance measurements and models as viewed from one ISP provider of end-user to be reused by other ISPs or application user for inter-domain QoS and SLA specification and validation. This concept is implying some kind of cooperation between ISPs by inter-domain QoS and structure discovery. Using policy controlled data collection, ISPs are supplying to the rest of the world only this kind of inter-domain QoS, traffic and topology information which is not “secure”; the “secure” inter-domain traffic and QoS models are hidden from the rest of the world by the policy controlled data collection.QoS monitoring and traffic monitoring toolkits are obtaining monitoring results for given topology and measurement scenarios. The monitoring results are base for modeling, simulation and visualization of QoS, inter-domain performance and traffic data dependent on the time. Intermon data base is storing time dependent monitoring, modelling and simulation data. The relationships between different information elements in the data base is obtained from their “time states” which are calculated from monitoring parameters and other timing characteristics of the stored data. QoS monitoring toolkit in INTERMON consists of 3 components: end-to-end QoS monitoring considering QoS parameters for a wide range of today

applications, VoIP, bulk data, streaming applications inter-domain performance monitoring end-to-end event detection.

Based on an end-to-end QoS measurement scenario, the architecture should define following kinds of end-to-end QoS models: simple end-to-end QoS models obtained from a single measured QoS parameter which

describe the QoS parameter behaviour in the time complex end-to-end QoS models based on correlation (inferring) of measured end-to-end

QoS parameters. These models describe the behaviour of set of parameters in the time by given monitoring intervals.

Because the modelling components of INTERMON toolkit have access, using the data base, to the end-to-end QoS measurement scenarios, it is possible to derive different kinds of long and short term models and to compare models of different measurement scenarios.Inter-domain performance monitoring is based on active probing of inter-domain topology to measure inter-domain performance metrics such as delay and loss for a given topology, i.e. connectivity obtained from the structure discovery component. Inter-domain performance metrics are measured between two border router of the specified topology. An inter-domain performance monitoring scenario should specify the configuration parameters of the inter-domain monitoring tool in order to obtain inter-domain performance metrics for the specified topology. Based on inter-domain performance measurement scenario, the following kinds of inter-domain performance models are obtained: simple inter-domain link performance model (inter-domain link is connection between

two border routers). This model shows the behaviour of a single inter-domain performance metric for the link dependent on time.

simple inter-domain topology performance model obtained from one kind performance metric. This model describes the behaviour of inter-domain performance metric for the border router of the specified topology dependent on the time.

complex inter-domain link performance model based on correlation (inferring) of measured inter-domain performance parameter. This model describes the behaviour of multiple inter-domain performance metrics for the link dependent on the time.

complex inter-domain topology performance model describing the behaviour of different kinds of performance metrics for the border routers of the topology dependent on the time.

End-to-end event detection is considering QoS parameter constraints which describe degradation for QoS of applications, resp. levels for elastic applications. Based on QoS monitoring and event detection scenario, following kinds of event patterns could be obtained: simple event pattern behaviour dependent on the time obtained from scenarios for

monitoring and detection of a simple event complex event pattern behaviour dependent on the time obtained from scenarios for

detection of multiple events.To infer inter-domain QoS and traffic analysis, Intermon includes border router traffic monitoring (by ISP provider). This component aims to provide time and monitoring interval dependent border router traffic measurement data in order to obtain border router traffic models. Intermon could use also border router traffic measurements obtained externally by other tools. Border router traffic measurements are obtaining traffic dynamic for different granularities, monitoring intervals and other configuration parameters: Total traffic volume. Traffic per source and destination end systems Traffic per source, destination and neighbor autonomous system Traffic per application class. Traffic per protocol.Based on border router traffic measurement scenario, traffic matrix is obtained considering traffic per source and destination end system, autonomous systems, application class, and protocol type. The different kinds of border router traffic measurements are base for time dependent traffic behaviour models.

3 INTERMON toolkit usage for performance analysis of QoS enabled applications in inter-domain environment

3.1 Objectives for performance analysis of applications in inter-domain environment and comparison of QoS monitoring tools and architectures

Performance analysis of QoS enabled applications in inter-domain environment could have different objectives, such as: Measurement and monitoring of end-to-end QoS of application traffic Passive and active measurement of end-to-end QoS for performance problem detection

and validation, Measurement, modelling and prediction of end-to-end QoS of applications and emulated

traffic in inter-domain environment, Simulation and optimisation of end-to-end QoS and application traffic mapping

considering different inter-domain connections and their network performance parameters, Mapping of end-to-end application QoS to inter-domain performance metrics, i.e. spatial

composition of application end-to-end QoS, Inferring of application end-to-end QoS and inter-domain network performance metrics

and models for inter-domain QoS/SLA analysis, Obtaining of effective bandwidth required for the application traffic in order to provide

end-to-end QoS /SLA, Event monitoring and event pattern analysis for inter-domain QoS degradation, Traffic aggregation and admission control for QoS enabled applications, Measurement and modelling of application traffic, end-to-end QoS and inter-domain

network performance parameters for specification and validation of inter-domain SLA of applications (agreements between end users and ISPs for provision of inter-domain performance metrics).

The current focus in the advanced end-to-end QoS monitoring tools and architectures, AQUILA [AQUILA], RIPE TTM [RIPE], Surveyor [Surveyor] and other tools included in CAIDA`s QoS monitoring toolkit list [CAIDA] is the integration more monitoring techniques and tools for complex performance analysis and performance problem detection, such as: usage of router information to study performance for applications at router path

performance information to detect performance problems caused by the Internet workload integration of active probing and passive toolkits for detection of performance problems

and QoS verification tools for deriving traffic models and emulated traffic tools for inferring QoS and performance information for event detection internet structure discovery (topology, paths) and path performance measurement usage of measurement database and advance user interface to integrate toolkits.Compared with the current state of the art of these tools, INTERMON toolkit is a novel concept for inter-domain performance analysis of QoS enabled applications which is based on advanced data mining facilities, in particular: policy controlled data base including topology, monitoring and modelling data for visual

data mining on inter-domain topology, traffic, performance and application QoS inter-domain QoS analysis using common user interface and data base including tools for

QoS/SLA and event monitoring, inter-domain structure discovery on border router and Autnomous System(AS) level, modelling, simulation and visual data mining

performance analysis based on inferring of different kinds of monitoring and modelling data – inter-domain connectivity, application QoS, event patterns, inter-domain performance parameters and their visual data mining

novel tool interaction control mechanisms (such as event based tool interworking).

Table 1: Aspects for usage of INTERMON toolkit for inter-domain performance analysis of QoS enabled applications

Especially addressing users and application service providers of QoS enabled applications and services in inter-domain environment, the INTERMON toolkit is intended to cover a wide range of usage scenarios:

1. Measurement based modelling and prediction of application end-to-end QoS in inter-domain environment: Monitoring, modelling and prediction of application end-to-end QoS in inter- domain

environment - Monitoring of application QoS complemented with measurement based short and long term QoS modelling in inter-domain environment

Monitoring, modelling and prediction of inter-domain performance parameters for different kinds of flows. Monitoring of inter-domain performance (delay and packet loss) for a flow and obtaining of predictive long and short term models of inter-domain parameters in order to take decisions on application traffic mapping to inter-domain routing paths, and border router resources.

2. Measurement based simulation of user traffic and end-to-end QoS of applications in inter-domain environment Optimisation of perceived end-to-end QoS Prediction of application end-to-end QoS for

different parameters – inter-domain performance parameters, application traffic mapping to border router resources, traffic aggregates and traffic mapping to inter-domain routing paths

Prediction of end-to-end QoS based on simulation and verification – use of application QoS monitoring, performance topology models as well as application QoS and traffic demand models, for verification use topology performance models and if possible use also of ISP inter-domain traffic models

Modelling and simulation of user traffic mapping to different border router level AS interconnections based on QoS and traffic models of application and topology performance models.

3. Complex performance analysis and problem detection based of end-to-end QoS and inter-domain network performance monitoring and modelling Inferring of different kind of monitored data (inter-domain performance metrics,

application end-to-end QoS and events), long and short term modelling, visual data mining in order to support complex performance analysis

Performance problem detection (i.e. QoS degradation) based on interaction control mechanisms using application QoS and event monitoring tools as well as inter-domain performance monitoring and structure discovery.

4. Inter-domain end-to-end QoS/SLA specification and validation support Support for inter-domain QoS/SLA specification obtaining the impact of the inter-domain

performance on the end-to-end QoS of applications. Support for specification and validation of SLA for QoS enabled applications in inter-

domain environment based on monitoring, modelling and simulation of application QoS and inter-domain performance.

Using inter-domain performance monitoring and SLA to determine the AS or border router responsible for end-to-end QoS degradation.

5. Inter-domain connectivity optimisation Support for selection of optimal transit ISP connecting user to the destination ASs using

Intermon structure discovery tool (border router level and AS level structure discovery) and inter-domain performance models describing performance from source AS to destination AS.

Support for selection of optimal inter-domain route for multi-homed user using Intermon facilities for structure discovery (border router level and AS level structure discovery) and inter-domain performance models to the destination ISP.

6. Visual data mining of end-to-end QoS of applications in inter-domain environment, inter-domain performance and inter-domain structure discovery Visualisation of application traffic and QoS models in inter-domain environment

(considering dynamics, QoS issues for traffic aggregation, traffic and application classes, application traffic demand modelling, etc)

Visualisation of different kinds of end-to-end QoS metrics, their modelling and inferring for performance analysis (multidimensional visualisation techniques)

Visualisation scenarios based on inter-domain performance and application QoS models, application traffic models as well as their inferring

Topological and geographical visualisation focussed on different kinds of inter-domain connections and edge systems.

3.2 Scenarios for optimal inter-domain route selection and inter-domain QoS/SLA validation for enhanced performance of VoIP traffic

The goal of this scenario is to demonstrate the usage of the Intermon components to support selection of optimal inter-domain route and inter-domain QoS/SLA validation for enhanced performance of VoIP traffic.

Figure : Scenario for inter-domain QoS and SLA validation of VoIP application

This scenario assumes a multihome transit domain for VoIP traffic based on multiple border egress nodes leading to the destination of the VoIP traffic.

Scenario description for inter-domain SLA modelling and inter-domain route optimisation with Intermon toolkit consists of the following steps:

1. End to end QoS monitoring with event detectionUsage of end to end QoS Monitoring (QMON) to obtain end to end QoS parameters for VoIP flows and their storage in the data base Interaction control is set to use QoS monitoring with event detection mechanisms (EMON) to obtain QoS degradation of VoIP flow compared with SLA

2. Visual data mining for VoIPVisual data mining (VISMON) to obtain possible QoS degradation based on inferring of different VoIP inter-domain parameters (delay, packet loss, jitter), see also chapter ‘Requirements for Access Devices’.

3. Validation of inter-domain SLA:In case of VoIP QoS degradation measurement based models are obtained to validate SLA and QoS. Configure and Execute QoS Monitoring and Event Detection for Measurement based Modelling of inter-domain VoIP flow performance (IPMON) and application QoS (QMON) in order to facilitate the location and the detection of abnormal behaviours responsible for the perceived QoS degradation. As the result, the cause of the QoS degradation (AS, Border Router or the Endsystem) is localised.

4. Find other possible inter-domain routes to the destination AS:If inter-domain QoS / SLA are violated, use of Topology discovery (IPTOP) to find other possible inter-domain routes to the destination AS

5. Inter-domain performance modelling to describe QoS/ SLA of other routes to destination AS:

Configure and Execute Monitoring inter-domain Performance Monitoring for measurement based modelling of inter-domain performance of additional routes. Usage of emulated traffic VoIP like to monitor the inter-domain performance.Short or long term inter-domain models (IMOD) based on monitored inter-domain performance metrics of the found inter-domain routing connections (inter-domain performance models).

6. Decision to select “optimal” inter-domain route for VoIP traffic (in case of transit domain SLA should be changed) based on inter-domain performance model comparison.

The scenario to support “optimal” inter-domain route and inter-domain SLA validation could have more variants if inter-domain QoS interfaces (DiffServ, MPLS), are available and there is possibility to map application traffic to different traffic classes of the egress border router. In this case, when QoS degradation is found during validation of inter-domain SLA, before using the structure discovery and inter-domain performance monitoring for selecting of the new route, it is to verify whether the mapping of the application traffic to other traffic classes and resources are useful to increase the performance. For this purpose the INTERMON traffic application modelling is used.In case that border router ISP traffic measurement and models are available, then further strategies for optimisation of inter-domain performance of VoIP traffic based on mapping of application traffic to inter-domain traffic classes could be checked. Such strategies could be based on:

- application traffic profiling of the border router ISP traffic as well as- egress traffic topology considering next destination or transit AS.

3.3 Usage of INTERMON toolkit by ISP operator for inter-domain performance modelling

The INTERMON toolkit could be used for ISP inter-domain operator to support inter-domain performance modelling for QoS / SLAs specification and validation Following INTERMON components could be used for this purpose: Monitoring, modelling and simulation of inter-domain performance parameters (delay,

packet loss) of flow aggregates focussed on their dynamics Monitoring and modelling of border router traffic dynamic and topology (traffic matrix

model describing destination and transit ISP) Visual data mining for Internet structure discovery on AS and border router level with

inferring of border router traffic models (traffic matrix) Visual data mining to infer inter-domain performance parameters and border router traffic

models in order to specify and validate inter-domain SLAs.

In its application to support ISP operator on decisions about inter-domain QoS / SLA, and inter-domain performance, INTERMON toolkit could be compared with the MatrixInsight [MatrixNet] proposed as a novel, advanced product aimed at visualisation of ISP monitoring information and comparing the accessibility of ISPs. Compared with the MatrixInsight, INTERMON toolkit design is much more powerful because on the interaction of monitoring, modelling and simulation toolkits.

Following benefits of INTERMON toolkits considering MatrixInsight could be emphasised:

monitoring, as well as measurement based modelling and simulation of inter-domain performance of flows

interaction control of inter-domain performance monitoring and modelling tools Inferring and visual data mining of application QoS models, event pattern and inter-

domain performance models. integrated policy controlled data base for monitoring, modelling, structure discovery,

visualisation and simulation results information.

Another inter-domain performance measurement toolkit is Skitter [Skitter]. Skiter is primary aimed to discover and depict global Internet topology, as well as measure performance from different measurement points in the global Internet. Differently to the “macroscopic” goals of skitter, INTERMON toolkit is based on “individual ISP views” to the global Internet, i.e. inter-domain connections and their performance from an individual ISP to its destination ISP`s to which traffic is flowing through the border router of the individual ISPs. This gives a partial view to the global Internet border router level topology and performance as measured and modelled from the individual ISP border router. “Global views” are derived based on inferring of “individual ISP`s INTERMON data bases”.

Further architecture which could be compared to INTERMON is Argus [Argus] – an architecture integrating algorithms, tools and database for discovery of topology and performance information.

4 Use of Intermon toolkit for traffic engineering and capacity planning

Intermon toolkit supports the ISP operator in inter-domain traffic engineering tasks.According to the ITU-T Recommendation E.600 [ITU E.600], traffic engineering includes measurements, forecasting, planning, dimensioning, control and performance monitoring of the traffic. [RFC 2702] gives similar definition “Traffic engineering encompasses the application of technology and scientific principles to the measurement, characterisation, modelling, and control of Internet traffic”.Because there are also other concepts to support inter-domain traffic engineering issues see EU IST projects [TEQUILA], [CADENUS] and [AQUILA], some more explanation is needed about the tasks which are addressed by Intermon toolkit in supporting the inter-domain traffic engineering.

4.1 The novel concepts of Intermon toolkit to support inter-domain traffic engineering issues

Traffic engineering as defined by ITU and discussed in the known research include different tasks such as: Traffic measurement and monitoring Traffic demand characterisation Performance characterisation and performance monitoring Traffic control (policy, quality and congestion control) Network dimensioning Traffic mapping based on Routing and Topology Analysis Admission control and statistical traffic multiplexing Capacity planning and forecasting Dynamical topology and network adaptation.The following figure is showing the INTERMON toolkit support to provide different inter-domain TE tasks considering specifics of the inter-domain TE environment (BGP-4,

DiffServ, MPLS). The integrated tool, models and tool interaction mechanisms for each particular TE task are given.

Figure 2: INTERMON toolkit usage for inter-domain traffic engineering and QoS and performance optimisation by ISP operator

Considering the figure, INTERMON is able to support inter-domain TE in different usage scenarios: Support of ISP border router capacity planning – measurement, modelling and simulation

of ISP inter-domain border router traffic with focus on building of traffic matrix models, traffic dynamic and asymmetry, traffic modelling per destination, source and transit AS considering application and traffic classes.

Load balancing optimisation – Simulation of strategies for ISP customer traffic models mapping on multiple inter-domain routes (structure discovery) considering traffic aggregate models considering AS source and destination pairs, next transit AS, application and traffic class.

Support of peering decisions based on traffic models per destination and source AS, per transit AS and their costs, per application and traffic class and models per pair AS able to show traffic asymmetry.

Traffic aggregates modelling and traffic profiling to optimise mapping of traffic to border router QoS interfaces (MPLS, DiffServ) considering application and traffic classes.

Inter-domain optimal route selection, i.e. determination based on traffic aggregate modelling and border router traffic models which egress point to choose for a given traffic aggregate directed to a specific final destination and requesting precise QoS commitments

Support for selection of optimal transit ISPs (i.e. inter-domain route for user traffic) considering inter-domain performance models, QoS and application traffic models, geographic and structure mapping

Modelling and simulation of QoS enabled customer performance – optimal customer traffic mapping to different AS interconnections (considering resilience, policies, security and other issues) based on QoS and traffic models of application and topology performance models

Inter-domain QoS and SLA modelling and validation based on border router traffic modelling and inter-domain performance monitoring and modelling

Usage of structure discovery and inter-domain performance monitoring to determine the AS or border router responsible for inter-domain QoS degradation of customer.

The inter-domain traffic engineering with Intermon toolkit is based on ISP border router outbound-, inbound and transit traffic (obtaining traffic matrix with source transit and destination AS) as well as inter-domain connection performance study considering inter-domain routing, topology (BGP-4 protocol) and inter-domain QoS technology (DiffServ, MPLS) constraints. Thus, Intermon toolkit differentiates from macroscopic traffic engineering (based for instance on skitter) which is addressing the optimization of the Autonomous system interconnection structure and performance issues of global internet.Netscope is another traffic engineering tool aimed at distinction of inter-ISP traffic, based on models of topology, routing, and traffic demands [FGLRR 00 ], [FR 00]. The traffic demands are based on flow-level measurements collected at each ISP entry point (including inter-domain router). The topology model includes layer-two and layer-three connectivity, link capacities, and the configuration of the routing protocols, as well as the homing locations for customer and external IP addresses. Compared with Intermon, Netscope has more specific goal addressing intra- and inter-domain traffic engineering with router configuration for backbone ISPs. Intermon toolkit is not designed with specific AS characteristics in mind and are not including router configurations. Intermon measurement and modeling is based on border router traffic flow considering flow dynamic, dynamic of traffic and application class, border router traffic topology, AS distance consideration, traffic AS destination and source distinction.

4.2 Scenario description for border router capacity planning and inter-domain connectivity optimisation for improved QoS provision

Goal: To show the usage of INTERMON border router traffic models and inter-domain performance modelling for capacity planning of ISPs with different kinds of inter-domain connectivity (border router and peering nodes) and to improve border router connectivity.

ISP operator could have different border router devices. Based on the analysis of the traffic at the border router devices, its modelling (Usage of Intermon border router monitoring and modelling component) and visual data mining, the ISP operator should be able to support its capacity planning at the border router device. Furthermore, using the structure discovery tool and inter-domain performance monitoring, the ISP operator could support inter-domain connectivity and peering optimisation.

Inter-domain traffic engineering focussed on capacity planning and optimisation of inter-domain connectivity with INTERMON toolkit consists of the following steps:

1. Obtaining of border router traces and deriving of traffic matris with Intermon tool2. Based on the border router traffic matrix, derive destination AS for which the inter-

domain performance (inter-domain QoS/ SLA) should be checked. Validate to this AS based on the inter-domain performance the inter-domain QoS/SLA and usage of inter-domain performance monitioring nd measurement based

3. Obtaining border router traffic models for capacity planning and their visual data mining

a. Measurement based modelling of traffic dynamic b. Modelling of traffic per source AS / destination AS pairc. Modelling of traffic considering traffic classes per source ASd. Modelling of traffic for inter-domain admission controle. Inter-domain connection optimisation based on traffic analysis

Special focus of Intermon toolkit usage are- Traffic modelling for capacity planning at ISP border router- Peering interconnectivity study - Balanced and asymetric traffic.

Based on Distinguishing of Traffic Flows at border router (source domain, destination domain, incoming transit domain, outgoing transit domain, topology parameters such as AS distance, per-end user traffic, per application type, HTTP, FTP,TCP, UDP, flow duration) it is possible to obtain traffic models used for support capacity planning (network dimension, load balancing) .

Following border router traffic models could be obtained with Intermon based on measurements to support ISP operator by its planning and inter-domain connectivity optimisation work:

- Dynamic of the Total input /output border router Traffic (The total incoming traffic is measured and dynamic is modelled in a given time scale)

- Activity of the Total input/output Traffic - (An input traffic source is active during a given time interval whenever there is at least one byte of traffic that originates from it during this time interval). Could help to support traffic aggregation and capacity planning. Activity of the input interdomain traffic sources at a ISP border router is better explained by

1. the number of source AS sending traffic over some time interval as well as their variability with respect to different timescales

2. the number of sink AS receiving traffic over some time interval as well as their variability with respect to different timescales

- Topological analysis of traffic - AS distance to source and sink. The active traffic is distinguished by the AS distance to the source AS and sink AS. Such analysis could be base for peering, cost or connectivity optimisation consideration

- Dynamic, activity and topological analysis for input traffic flow classes derived from applications or services (VoIP,..). Traffic classes can be defined per application type (if type can be identified by layer 3/4 information). HTTP, FTP, …TCP, UDP Input traffic. Goal is to characterise the traffic coming from source AS as belonging to some application, VoIP, HTTP, TCP.

- Incoming transit traffic - activity , dynamic and input traffic classes. Incomming Transit Traffic is distinguihed from sink and its activity, dynamic and input traffic classes are considered

- Traffic dynamic for aggregated traffic. Dynamic for aggregated traffic based on same next transit AS for multiple sink AS is obtained. Used for MPLS/DiffServ resource reservation at border router. Traffic dynamic for aggregated traffic could be further obtained considering parameters such as same next transit AS defined by AS distance parameters, traffic flow class for QoS based inter-domain resource reservation.

- Inferring traffic flows - Asymetry of traffic . Dynamic of traffic sources from AS A to AS B is compared with the dynamic of traffic sources from AS B to AS A. Traffic Ratio is determined for some time interval (Traffic AS A to AS B / Traffic AS B to AS A) and asymmetry is obtained. In the case of paid peering model, peering is free until traffic asymmetry reaches a certain ratio (4:1 is common requirement).

- Bidirectional traffic flow classes between AS. The comparison is done in order to obtain significant traffic demand models between two AS and to provide information for capacity planning and inter-domain resource optimisation.Traffic patterns from AS A to AS B is compared with the traffic pattern from AS B to AS A.

5 ConclusionsThe integrated inter-domain QoS monitoring, modelling and simulation concept of Intermon toolkit and some scenarios for inter-domain QoS and traffic using the toolkit are discussed in this paper. The novel concepts of inter-domain data mining compared with existing QoS monitoring and traffic engineering tools are shown.

The Intermon toolkit is based on the effort of different European countries, telecom providers, research institutes and application developers.

The final paper should describe in more precised shape scenarios and Intermon architecture

6 References

[IntD2] A. Nassri, Intermon , “Analysis and requirements report” , INTERMON-IST-2001-3412, Juni 2002

[BS 93] R.J. Brachman, P.G. Selfridge, et all, Integrated support for data archeology, International journal of Intelligent and cooperative Information Systems, 2, 1993

[BH 01] L. Burns, J.L.Hellerstein, et. all, Asystematic approach to discovering correlation rules for event management, In Proceedings of International Symposium on Integrated Network Management, 2001

[GR 94] J.Goldstein, S.F. Roth, et. all, A framework for knowledge based interactive data exploration, Journal of visual languages and computing, 5, 1994

[MH 01] S.Ma, J.L:Hellerstein, Mining partially periodic event patterns, In ICDE, 2001

[BPM 00] A.Beygelzimer, C. Perng, S. Ma, Ordering by continuous optimisation, AAAI Symposium on Smart Graphics, 2000

[Skitter1] The Skitter project. http://www.caida.org/Tools/Skitter.

[Skitter2] Daniel McRobb, kc claffy, Skitter. CAIDA, 1998. http://www.caida.org/tools/measurement/skitter/.

[Skitter3] CAIDA skitter monitor locations. http://www.caida.org/tools/measurement/skitter/monitors.xml.

[OCxmon/CoralReef ] http://www.caida.org/tools/measurement/coralreef/) [cflowd] http://www.caida.org/tools/measurement/cflowd/).[Hetz02] Hetzer, Dirk (2002) QoS and Resource Optimization in the Internet (QORE

System), Ph.D. Thesis submitted to Potsdam University[CADENUS] The CADENUS Project (1999) Creation and Deployment of End-User Services

in Premium IP Networks, http://www.cadenus.org/ (March 10, 2002)[TEQUILA] Traffic Engineering for Quality of Service in the Internet, at Large Scalehttp://www.ist-tequila.org (April 8, 2002).

[AQDMA] F Strohmeier, H. Dörken, B. Hechenleitner. AQUILA Distributed QoS Measurement. In Proc. of COMOCON8 Conference, Crete, Greece, pages 177-185, June 2001.

[AQUILA] AQUILA project page http://www.ist-aquila.org

[CAIDA] Co-operative Association for Internet Data Analysis (CAIDA). http://www.caida.org

[Int-IST] Advanced architecture for INTER-domain quality of service MONitoring, modelling and visualisation, Intermon IST project page intermon http://www.ist-intermon.org

[FGLRR 00] A. Feldmann, A. Greenberg, C. Lund, N. Reingold, and J. Rexford, "NetScope: Traffic Engineering for IP Networks," IEEE Network Magazine, special issue on Internet Traffic Engineering, March 2000.http://www.research.att.com/~jrex/papers/ieeenet00.ps

[FR 00] Feldmann and J. Rexford, "IP network configuration for traffic engineering," AT&T Research Technical Report 000526-02, May 2000.http://www.research.att.com/~jrex/papers/netdb.tm.ps

[RFC 2702] D. Awduche et al, Requirements for Traffic Engineering Over MPLS, RFC 2702, Sept. 1999

[Argus] Project Argus, http://www.cs.cornell.edu/cnrg/topology_aware/discovery/argus.html

[ITU E.600] ITU-T Recommendation E.600, Terms and Definitions of Traffic Engineering, March 1993

[IPMA] B. Cheswick. Internet mapping project. http://www.cs.belllabs.com/who/ches/map/.

[MC 01] M. Murray, KC Claffy, Measuring the Immeasurable: Global Internet Measurement Infrastructure, Proceedings PAM 2001, p. 159-167, Amsterdam, April 2001

[FDL 01] C, Fraleigh, C. Diot, B. Lyles, S.Moon, F. Owezarski, D. Papagiannaki, F. Tobagi, , Proceedings PAM 2001, p. 12-22, Amsterdam, April 2001

[NLANR] T. Hansen, J. Otero, T. McGregor, H.-W. Braun. Active Measurement Data Analysis Techniques http://moat.nlanr.net/Papers/AMP_case_studies/

[QoS2] Internet 2 Qbone http://www.internet2.edu/qos

[RIPE] http://www.ripe.net/ripencc/mem-services/ttm

[Surveyor] Surveyor: An Infrastructure for Internet Performance Measurements http://bsdi4.advanced.org/~kalidindi/papers/INET/inet99.html