Internet Topology Mapping Hakan Kardes University of Nevada, Reno Modified version of Dr. Gunes’s Presentation on Internet Topology Discovery

Internet Topology Discovery Outline Introduction Router Level Internet Topology Maps Topology Collection Topology Sampling Resolving Anonymous Routers Resolving Alias IP Addresses Resolving Genuine Subnets Conclusion Internet Topology Discovery

Internet Measurements Understand topological and functional characteristics of the Internet Essential to design, implement, protect, and operate underlying network technologies, protocols, services, and applications Need for Internet measurements arises due to commercial, social, and technical issues Realistic simulation environment for developed products, Improve network management Robustness with respect to failures/attacks Comprehend spreading of worms/viruses Know social trends in Internet use Scientific discovery Scale-free (power-law), Small-world, Rich-club, Dissasortativity,… Topology collection is hard as ISPs do not share their internal topology info by default Complex networks are being analyzed for their growth mechanism and topological characteristics. Scale-free (Power-law) Small-world (6 degree of separation) Dissasortative mixing (degree-degree correlation) Rich-club phenomenon (tightly interconnected core) Internet Topology Discovery

Internet Topology Measurement Types of Internet topology maps Autonomous System (AS) level maps Router level maps A router level Internet map consists of Nodes: End-hosts and routers Links: Point-to-point or multi-access links Router level Internet topology discovery A process of identifying nodes and links among them Types of Internet topology maps Autonomous System (AS) level maps Router level maps A router level Internet map consists of Nodes: End-hosts and routers Links: Point-to-point or multi-access links Lumenta Jan 06 CAIDA Jan 08 CAIDA Jan 00 Internet Topology Discovery

Router-Level Internet Topology Maps Background Internet topology measurement studies Involves topology collection / construction / analysis Current state of the research activities Distributed topology data collection studies/platforms iPlane, Skitter, Dimes, DipZoom, … 20M path traces with over 20M nodes (daily) Main Issues Sampling Anonymous routers Alias IP addresses Subnet Inference Dimes: Tel Aviv university Dipzoom: Case Western Internet Topology Discovery

Topology Collection (traceroute) Probe packets are carefully constructed to elicit intended response from a probe destination traceroute probes all nodes on a path towards a given destination TTL-scoped probes obtain ICMP error messages from routers on the path ICMP messages includes the IP address of intermediate routers as its source Merging end-to-end path traces yields the network map IPA IPB IPC IPD Vantage Point Destination TTL=2 TTL=1 TTL=3 TTL=4 A B C D S Details Internet Topology Discovery 6

Internet Topology Discovery Topology Collection Internet2 backbone f e S N C W U K L A H Traces d - H - L - S - e d - H - A - W - N - f e - S - L - H - d e - S - U - K - C - N - f f - N - C - K- H - d f - N - C - K - U - S - e d Internet Topology Discovery

Internet Topology Discovery Topology Sampling Sampling to discover networks Infer characteristics of the topology Different studies considered Effect of sample size [Barford 01] Sampling bias [Lakhina 03] Path accuracy [Augustin 06] Sampling approach [Gunes 07] Utilized protocol [Gunes 08] ICMP echo request TCP syn UDP port unreachable ~ 10% of routers are anonymous Protocol Responsiveness ICMP 81.9 % TCP 67.3 % UDP 59.9 % Approaches Internet Topology Discovery

Anonymous Router Resolution Problem Anonymous routers do not respond to traceroute probes and appear as  in traceroute output Same router may appear as  in multiple traces. S L H y x y y S 1 2 H x y: S – L – H – x y: S –  – H – x Current daily raw topology data sets include ~ 20 million path traces with ~ 20 million occurrences of s along with ~ 500K public IP addresses The raw topology data is far from representing the underlying sampled network topology S L H x: H – L – S – y x: H –  – S – y x Internet Topology Discovery

Anonymous Router Resolution Problem K C N f L H A W e Traces d -  - L - S - e d -  - A - W -  - f e - S - L -  - d e - S - U -  - C -  - f f -  - C -  -  - d f -  - C -  - U - S - e d Sampled network d e f S U L C A W Resulting network Internet Topology Discovery

Anonymous Router Resolution Previous Approaches Basic heuristics IP: Combine anonymous nodes between same known nodes [Bilir 05] Limited resolution NM: Combine all anonymous neighbors of a known node [Xin 06] High false positives More theoretic approaches Graph minimization approach [Yao 03] Combine s as long as they do not violate two accuracy conditions: (1) Trace preservation condition and (2) distance preservation condition High complexity O(n5) – n is number of s ISOMAP based dimensionality reduction approach [Xin 06] Build an nxn distance matrix then use ISOMAP to reduce it to a nx5 matrix Distance: (1) hop count or (2) link delay High complexity O(n3) – n is number of nodes x y z S U L C A W After resolution x y z S U L C A After resolution W H x y z S U L C A W Resulting network U K C N L H A W S x y z Sampled network Internet Topology Discovery

Anonymous Router Resolution Graph Based Induction x C y2 y1 y3  A x C y2 y1 y3  Details Parallel nodes A C x y D w F v E z  A C x y D w E z  D A w x C y E z  Clique Complete Bipartite Star Parallel *-substrings is equivalent to Initial Pruning Star is equivalent to neighbor matching A C x y D w F v E z  A C x y D w E z  D A w x C y E z  Details Details Details Internet Topology Discovery

IP Alias Resolution Problem A set of collected traces w, …,b1, a1, c1, …, x z, …,d1, a2, e1, …, y x, …,c2, a3, b2, …, w y, …,e2, a4, d2, …, z 1 3 4 2 w b c x a z d e y a sub-graph Sample map from the collected path traces A router may appear with different IP addresses in different path traces Need to resolve IP addresses belonging to the same router b1 c1 d1 e1 a1 a2 w x z y a3 a4 b2 c2 d2 e2 with no alias resolution Internet Topology Discovery

IP Alias Resolution Problem K C N Sampled network f L H A W e d Sample map without alias resolution s.3 s.1 s.2 l.3 l.1 u.1 u.2 k.1 c.1 n.1 n.2 k.2 c.2 w.3 a.3 h.2 h.4 h.1 e d f n.3 Traces d - h.4 - l.3 - s.2 - e d - h.4 - a.3 - w.3 - n.3 - f e - s.1 - l.1 - h.1 - d e - s.1 - u.1 - k.1 - c.1 - n.1 - f f - n.2 - c.2 - k.2 - h.2 - d f - n.2 - c.2 - k.2 - u.2 - s.3 - e Internet Topology Discovery 14

IP Alias Resolution Problem c1 b2 b1 c2 partial alias resolution (only router a is resolved) x w e1 d2 d1 e2 y z a c d b e sub-graph w z y x 1 3 4 2 partial alias resolution (only router a is not resolved) a2 c d b e w z y x a3 a4 a1 Internet Topology Discovery

IP Alias Resolution Several Approaches Source IP Address Based Method [Pansiot 98] Relies on a particular implementation of ICMP error generation. IP Identification Based Method (ally) [Spring 03] Relies on a particular implementation of IP identifier field, Many routers ignore direct probes. DNS Based Method [Spring 04] Relies on similarities in the host name structures sl-bb21-lon-14-0.sprintlink.net sl-bb21-lon-8-0.sprintlink.net Works when a systematic naming is used. Record Route Based Method [Sherwood 06] Depends on router support to IP route record processing A B B Dest = A A B A, ID=100 Dest = A Dest = B B, ID=103 B, ID=99 Dest = B Internet Topology Discovery

Genuine Subnet Resolution Problem Identify IP addresses that are connected over the same medium Improve the quality of resulting topology map IP2 IP3 IP1 Improve the quality of the resulting topology map Increase the scope of the map by detecting connectivity that was not observed in path traces C D A B C D A B C D A B C D A B (underlying topology) (observed topology) (inferred topology) Internet Topology Discovery

Internet Topology Discovery Conclusion The Internet is man-made, so why do we need to measure it? Because we still don’t really understand it Sometimes things go wrong Measurement for network operations Detecting and diagnosing problems What-if analysis of future changes Measurement for scientific discovery Creating accurate models that represent reality Identifying new features and phenomena Researchers have been sampling and analyzing Internet topology Building network graph from raw-data was not handled carefully Many researchers pointed out issues due to sampling and developed algorithms to handle each of them Resolving anonymous routers, IP aliases, and genuine subnets Huge computational and probing overhead due to very large data size Internet Topology Discovery

Internet Topology Discovery References M.H. Gunes, S. Bilir, K. Sarac and T. Korkmaz, “A Measurement Study on Overhead Distribution of Value-Added Internet Services”, Computer Networks 2007. M.H. Gunes and K. Sarac, “Resolving IP aliases in Building Traceroute-Based Internet Maps”, IEEE Transactions on Networking (to appear). M.H. Gunes, M. Baysan and K. Sarac, “Resolving Anonymous Routers in Building Traceroute-Based Internet Maps”, IEEE Transactions on Networking (in preperation). M.H. Gunes and K. Sarac, “Analytical IP Alias Resolution”, IEEE ICC 2006. M.H. Gunes, N.S. Nielsen and K. Sarac “Impact of IP alias resolution on Traceroute-Based Sample Network Topologies”, PAM 2007. M.H. Gunes and K. Sarac, “Importance of IP alias resolution in Sampling Internet Topologies”, IEEE GI 2007, M.H. Gunes and K. Sarac, “Inferring Subnets in Router-level Topology Collection Studies”, ACM SIGCOMM IMC 2007. M.H. Gunes and K. Sarac, “Resolving Anonymous Routers in Internet Topology Measurement Studies”, IEEE INFOCOM 2008. Internet Topology Discovery

Internet Topology Discovery Questions ? Internet Topology Discovery