Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 1 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)

Shivkumar KalyanaramanRensselaer Polytechnic Institute

1Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)

Internet Measurement(and some inference & modeling)

Shivkumar (“Shiv”) Kalyanaraman

Rensselaer Polytechnic Institute

[email protected]://www.ecse.rpi.edu/Homepages/shivkuma/

GOOGLE: “Shiv RPI”



Topics Measurement philosophy: why, what, when, where, how? Some measurement projects & results Techniques: passive & active

Packet tracing SNMP Probing

Inference and Modeling Tomography & Traffic Matrix Estimation for network

engineering Traffic modeling Rocketfuel: inferring topologies from outside ISP

networks



Why Measurement? We built it, we depend on it, so we must try to understand

it … as it works in reality... Measurement gives us the data and basis for this

understanding.Modeling, Inference etc to get new understanding &

learning from data Complex interactions between protocols not well

modeled during their design. Need support for troubleshooting and network

management Wide area behavior unpredictable Change is normal



Characteristics of the Internet The Internet is

Decentralized (loose confederation of peers) Self-configuring (no global registry of topology) Stateless (limited information in the routers) Connectionless (no fixed connection between hosts)

These attributes contribute To the success of Internet To the rapid growth of the Internet … and the difficulty of controlling the Internet!

ISPsender receiver



Internet Measurement Challenges Size of the Internet

O(100M) hosts, O(1M) routers, O(10K) networks Complexity of the Internet

Components, protocols, applications, users Constant change is the norm

Web, e-commerce, peer-to-peer, wireless, next? The Internet was not developed with measurement as a

fundamental feature Nearly every network operator would like to keep most

data on their network private Floyd and Paxson, “Difficulties in Simulating the Internet”,

IEEE/ACM Transactions on Networking, 2000.



Themes

Measurement has been the basis for critical improvements Without measurement, what do you know?

Measurement capability in the Internet is limited The systems not designed to support measurement

Measurement tools and infrastructures are few and limited Size, diversity, complexity and change

Measurement data presents many challenges Networking researchers need better connections with

experts in other domains



Operator Philosophy: Tension With IP

Accountability of network resources But, routers don’t maintain state about transfers But, measurement isn’t part of the infrastructure

Reliability/predictability of services But, IP doesn’t provide performance guarantees But, equipment is not especially reliable (no “five-9s”)

Fine-grain control over the network But, routers don’t do fine-grain resource allocation But, network automatically re-routes after failures

End-to-end control over communication But, end hosts and applications adapt to congestion But, traffic may traverse multiple domains of control



Network Operations: Measure, Model, and Control

Topology/Configuratio

n

Offeredtraffic

Changes tothe network

Operational network

Network-wide“what-if”

model

measure

control



“Operations” Research: Detect, Diagnose, and Fix

Detect: note the symptoms of a problem Periodic polling of link load statistics Active probes measuring performance Customer complaining (via the phone network?)

Diagnose: identify the illness Change in user behavior? Router/link failure or policy change? Denial of service attack?

Fix: select and dispense the medicine Routing protocol reconfiguration Installation of packet filters

Network measurement plays a key role in each step!





Traffic Measurement: Control vs. Discovery

Discovery: characterizing the network End-to-end characteristics of delay, throughput, and

loss Verification of models of TCP congestion control Workload models capturing the behavior of Web users Understanding self-similarity/multi-fractal traffic

Control: managing the network Generating reports for customers and internal groups Diagnosing performance and reliability problems Tuning the configuration of the network to the traffic Planning outlay of equipment (routers, proxies, links)

































































Measurement Techniques



Time Scales for Network Operations Minutes to hours

Denial-of-service attacks Router and link failures Serious congestion

Hours to weeks Time-of-day or day-of-week engineering Outlay of new routers and links Addition/deletion of customers or peers

Weeks to years Planning of new capacity and topology changes Evaluation of network designs and routing protocols



Traffic Measurement: SNMP Data Simple Network Management Protocol (SNMP)

Router CPU utilization, link utilization, link loss, … Collected from every router/link every few minutes

Applications Detecting overloaded links and sudden traffic shifts Inferring the domain-wide traffic matrix

Advantage Open standard, available for every router and link

Disadvantage Coarse granularity, both spatially and temporally





Traffic Measurement: Packet-Level Traces

Packet monitoring IP, TCP/UDP, and application-level headers Collected by tapping individual links in the network

Applications Fine-grain timing of the packets on the link Fine-grain view of packet header fields

Advantages Most detailed view possible at the IP level

Disadvantages Expensive to have in more than a few locations Challenging to collect on very high-speed links Extremely high volume of measurement data





Extracting Data from IP Packets

IPTCP

IPTCP

IPTCP

Application message (e.g., HTTP response)

Many layers of information– IP: source/dest IP addresses, protocol (TCP/UDP), …

– TCP/UDP: src/dest port numbers, seq/ack, flags, …

– Application: URL, user keystrokes, BGP updates,…



flow 1 flow 2 flow 3 flow 4

Aggregating Packets into Flows

Set of packets that “belong together” Source/destination IP addresses and port numbers Same protocol, ToS bits, … Same input/output interfaces at a router (if known)

Packets that are “close” together in time Maximum inter-packet spacing (e.g., 15 sec, 30 sec) Example: flows 2 and 4 are different flows due to time











































Summary: Traffic Measurement: Flow-Level Traces

Flow monitoring (e.g., Cisco Netflow) Measurements at the level of sets of related packets Single list of shared attributes (addresses, port #s, …) Number of bytes and packets, start and finish times

Applications Computing application mix and detecting DoS attacks Measuring the traffic matrix for the network

Advantages Medium-grain traffic view, supported on some routers

Disadvantages Not uniformly supported across router products Large data volume, and may slow down some routers Memory overhead (size of flow cache) grows with link speed



Summary: Reducing Packet/Flow Measurement Overhead

Filtering: select a subset of the traffic E.g., destination prefix for a customer E.g., port number for an application (e.g., 80 for Web)

Aggregation: grouping related traffic E.g., packets/flows with same next-hop AS E.g., packets/flows destined to a particular service

Sampling: subselecting the traffic Random, deterministic, or hash-based sampling 1-out-of-n or stratified based on packet/flow size

Combining filtering, aggregation, and sampling



Summary: Comparison of Techniques

SamplingSamplingFilteringFiltering AggregationAggregation

Generality

LocalProcessing

Local memory

Compression

Precision exact exact approximate

constraineda-priori

constraineda-priori

general

filter criterionfor every object

table updatefor every object

only samplingdecision

none one bin pervalue of interest

none

dependson data

dependson data controlled













Inference and Modeling…



DATA-DRIVEN…





Eg: The Network Design Problem

200

65

258

134

30

42Düsseldorf

Frankfurt

Berlin

Hamburg

München

Communication Demands

Düsseldorf

Frankfurt

Berlin

Hamburg

München

Potential topology &

Capacities







Traffic Modeling …























Mandelbrot’s Construction

Renewal reward processes and their aggregates Aggregate is made up of many constituents Each constituent is of the on/off type On/off periods have a “duration” Constituents make contributions (“rewards”) when “on” Constituents make no contributions when “off”

What can be said about the aggregate? In terms of assumed type of “randomness” for

durations and rewards In terms of implied type of “burstiness”



Mandelbrot’s Types of “Randomness” Distribution functions/random variables

“Mild” → finite variance (Gaussian) “Wild” → infinite variance

Correlation function of stochastic process None => “IID” (independent, identically distributed) “Mild” → short-range dependence (SRD, Markovian) “Wild” → long-range dependence (LRD)



Mandelbrot’s Types of “Burstiness”

Bursty BURSTY

smooth bursty

Dis

trib

utio

n fu

nctio

n

M

ild

Wild

Mild Wild

Correlation structure

• Tail-driven burstiness (“Noah effect”)• Dependence-driven burstiness (“Joseph effect”)



Type of Burstiness: “Smooth”

White Noise

Correlation Function r(n)

lag n on linear scale

r(n

) o

n l

og

sca

le

CCDF Function 1-F(x)

x on linear scale

1-F

(x)

on

lo

g s

cal

e

Log-linear scales



Type of Burstiness: “bursty”

Colored Noise


lag n on log scale

r(n

) o

n l

og

sca

le


x on linear scale

1-F

(x)

on

lo

g s

cal

eLog-linear scale

Log-log scale



Type of Burstiness: “Bursty”

Stable Noise


lag n on linear scale

r(n

) o

n l

og

sca

le


x on log scale

1-F

(x)

on

lo

g s

cal

eLog-log scale

Log-linear scale

?



Colored Stable Noise

Type of Burstiness: “BURSTY”


x on log scale

1-F

(x)

on

lo

g s

cal

e


lag n on log scale

r(n

) o

n l

og

sca

le

?

?

Log-log scales



Mandelbrot’s Types of “Burstiness”

Bursty BURSTY

smooth bursty

Dis

trib

utio

n fu

nctio

n

M

ild

Wild

Mild Wild

Correlation structure

• Tail-driven burstiness (“Noah effect”)• Dependence-driven burstiness (“Joseph effect”)



Inference For Network Engineering: Traffic Matrix Estimation…

(Truncated: Detailed slides in 2005 class)



Summary

Internet measurement is a fast growing and complex field

We saw brief glimpses of the area: a full course required to do justiceActive vs passive probingData management and miningModeling and inference

A new book also available! Crovella and Krishnamurthy.

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 1 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)

Documents

q modeling

hosts q

q techniques

q measurement data

q measurement capability

internet q components

success of internet

limited q size