Introduction

1. Introduction - Evolving IP Network Environment WAN: SONET/SDH (OC3, OC12, OC48, OC192), ATM, WDM/DWDM LAN: 10/100 Mbps to 1 Gbps to 10 Gbps Ethernet Broadband Internet Access: Cable Modem, xDSL, ISDN, FTTx Wireless Access: WLAN (IEEE 802.11), Wireless Internet, 3G, Wibro/WiMax, 4G Wired/Wireless Convergence: Softswitch, Media Gateway, NGCN ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers -----------------------------------------------------------------------------------------------------------------------

1. Introduction – Growth of Internet Users The number of Internet users is growing ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers ----------------------------------------------------------------------------------------------------------------------- Source : www.internetworldstats.com

1. Introduction – Growth of Internet Users ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers ----------------------------------------------------------------------------------------------------------------------- Source : www.internetworldstats.com

1. Introduction – Growth of Internet Traffic Internet traffic has increased dramatically ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers ----------------------------------------------------------------------------------------------------------------------- Cisco forecasts 44 Exabytes per month of IP traffic in 2012 (Exabyte = 1 million terabytes = 260 bytes) Source: Cisco

1. Introduction – Reliance on Internet The Internet generated revenue has been increasing rapidly! ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers ----------------------------------------------------------------------------------------------------------------------- Source : Business Insider Internet plays important role in world economy

1. Introduction – Internet Applications Stand-alone applications can now utilize networking Cooperative editing: Abiword, ACE, MS SharePoint Workspace Browser-based software: Google Docs, Google Wave Game console: Microsoft XBOX, Sony Playstation, Nintendo Wii New network applications Online games, shopping, banking, stock trading, network storage, P2P applications VOD, EOD (Education on Demand), VOIP, IPTV Online game VoIP VOD

1. Introduction – Structure of Applications Client-Server Traditional structure server client Peer-to-Peer (P2P) New concept between file sharing and transferring Generates high volume of traffic discovery, content, transfer query peer peer peer Structures of applications are changing!

1. Introduction – Types of Traffic Static sessions vs. Dynamic sessions connect connect Negotiate & allocate use static protocol, port use dynamic protocol, port disconnect disconnect control data Bursty data transfer vs. Streaming data transfer packet network packet network Types of traffic are various and increasing!

Introduction – Internet Protocol Distribution Flows Packets Bytes TCP 32,515 14.4% 1,797,176 86.3% 1,339,396,630 96.8% UDP 54,561 24.2% 141,769 6.8% 27,812,586 2.0% ICMP 138,253 61.3% 141,247 6.7% 15,720,410 1.1% Others 125 0.0% 474 32,160 2003.09.16 – 19:36 POSTECH Internet Junction Traffic Transport Protocol Distribution The amount of UDP flows is increasing by P2P applications The amount of ICMP flows is increasing by Internet worms

Introduction – Internet Protocol Distribution Flows Packets Bytes TCP 42,533 5.8% 1,677,721 38.7% 1,288,490,188 39.9% UDP 678,800 93.4% 2,621,440 60.5% 1,932,735,283 59.9% ICMP 4,452 0.6% 31,256 0.7% 2,516,582 0.1% Others 445 0.0% 3,099 570,726 2011.03.28 – 18:15 POSTECH Internet Junction Traffic Transport Protocol Distribution The amount of UDP flows is increasing by P2P, gaming & multimedia streaming applications

Introduction – Port number usage in TCP/UDP Port Number Distribution in bytes ? ? TCP Server Listening Port Number Distribution UDP Port Number Distribution Proportion of Internet Applications ? 2003.09.16 – 19:36 POSTECH Internet Junction Traffic Which applications generate this large amount of traffic?

Introduction – Port number usage in TCP/UDP Port Number Distribution in bytes ? ? TCP Server Listening Port Number Distribution UDP Port Number Distribution Proportion of Internet Applications ? 2011.03.28 – 18:15 POSTECH Internet Junction Traffic Which applications generate this large amount of traffic?

1. Introduction – Motivation Needs of Service Providers Understand the behavior of their networks Provide fast, high-quality, reliable service to satisfy customers and thus reduce churn rate Plan for network deployment and expansion SLA monitoring, Network security Increase Revenue! Usage-based billing for network users (like telephone calls) Marketing using CRM data Needs of Customers Want to get their money’s worth Fast, reliable, high-quality, secure, virus-free Internet access To Satisfy Service Providers’ Needs to Satisfy Their Customers! ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers -----------------------------------------------------------------------------------------------------------------------

1. Introduction – Application Areas Network Problem Determination and Analysis Traffic Report Generation Intrusion & Hacking Attack (e.g., DoS, DDoS) Detection Service Level Monitoring (SLM) Network Planning Usage-based Billing Customer Relationship Management (CRM) Marketing ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers -----------------------------------------------------------------------------------------------------------------------

1. Introduction – Issues in Traffic Monitoring Choices Single-point vs. Multi-point monitoring Number of probing or test packet generation point In-service vs. Out-of-service monitoring Whether monitoring should be executed during service or not Continuous vs. On-demand monitoring Monitoring executes continuously or by on-demand. Packet vs. Flow-based monitoring Collect packets or flows from network devices. One-way vs. Bi-directional monitoring Monitor forward path only / forward and return path Trade-offs Network bandwidth Processing overhead Accuracy Cost One-point monitoring Measure traffic at the ingress/egress links of a network Router is ideal Multi-point monitoring Observe traffic at more than one point in the network. Correlate the measurements of flow: Difficult Ex) Packet travel time with synchronized clock, traffic matrix

1. Introduction – Problems Capturing Packets High-speed networks (Mbps  Gbps  Tbps) High-volume traffic Streaming media (Windows Media, Real Media, Quicktime) P2P traffic Network Security Attacks Flow Generation & Storage What packet information to save to perform various analysis? How to minimize storage requirements? Analysis How to analyze and generate data needed quickly? What kinds of info needs to be generated?  Depends on applications ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers -----------------------------------------------------------------------------------------------------------------------

1. Introduction – R&D Goals Develop methods to Capture all packets Generate flows Store flows efficiently Analyze data efficiently Generate various reports or information that are suitable for various application areas Develop a flexible, scalable traffic monitoring and analysis system for high-speed, high-volume, rich media IP networks ------------------------------------------------------------------------------------------------------------------------------------------------------------- [http://http://www.caida.org/outreach/metricswg/faq.xml] CAIDA  Outreach  Network Measurement FAQ 2.1. Why should I measure my network's behaviour? If you don't measure it, you have no objective record or benchmark of how it behaves. This could make it difficult to judge whether changes in the network have improved its performance, or degraded it. If you are buying Internet connectivity from an ISP you need to understand the kind of service being offered, and you need to measure the actual performance so as to verify that you're getting what you pay for. [KRNET Tutorial] http://dpnm.postech.ac.kr/webboard/ Internet Traffic Monitoring & Analysis User’s Needs * Monitor the performance experienced by one’s application - Why is the web page download so slow? - Why is my multicast video stream jerky? * Check if level of service meets one’s need - Do I have enough b/w? * Check if one experiences intrusions and attacks - Is someone attacking me? Service provider’s needs * Monitor the current level of activity * Enforce SLAs(service level agreements) * Detect faults and failures * Engineer the network for better performance * Plan for future capacity * Feedback to customers -----------------------------------------------------------------------------------------------------------------------