MGRID: Network Testing and Performance Charles J. Antonelli Center for Information Technology Integration University of Michigan

MGRID NTAP Project NTAP : Network Testing and Performance Purpose : provide a secure and extensible network testing and performance tool invocation service at U-M Service based on Globus Runs on dedicated nodes attached to routers in a VLAN environment

MGRID Architecture mod ssl mod kx509 mod kct CHEF Apache Tomcat KCT GateKeeper Resource Grid Resource KCA kx509 kinit User Workstation KDC Kerberos V5 SSL – Client Certificate required GSI Kerberos SASL MGRID Portal Authorization Resource Mng SASL 8 mod jk mod php LDAP Authorization LDAP libpkcs11 Browser

MGRID NTAP Project Initial work implemented a bandwidth reservation tool: – Securely modifies network switch configurations to provide differentiated services – Based on GARA “General-purpose Architecture for Reservation and Allocation” Layered on Globus Implements role-based authorization Includes scheduler for future reservations

MGRID NTAP Project Added modular, fine-grained authorization – Added signed group membership(s) to reservation data – Now provides two authorization methods: Keynote policy engine / AFS PTS group service PERMIS policy engine / LDAP group service Generalized from bandwidth reservations to the ability to run securely arbitrary programs at a Grid service endpoint – Designed to easily add functionality – Network testing tools being used now Iperf, traceroute, ping, owamp, etc

MGRID NTAP Architecture Web Portal Router 1 Host A Router 2Router 3 Host B PMP 1PMP 2PMP 3 GSI Attribute Callout AFS PTSPERMISFlat File

MGRID NTAP Project Multihomed PMP support – One routing table per VLAN – Routing policy selects routing table based on source address of outgoing packet – Emulates a default route per virtual interface Path discovery – Use traceroute to obtain routing information – Use network topology databases to map network segments to PMP pairs

MGRID NTAP Project PERMIS authorization – User, Target, Action – Attribute, policy certificates – Policy engine Production hardening – Error handling/recovery – Cleanup/restart – Log file management – Deployment packaging

MGRID NTAP Project Performance measurement – Deployment to ITCom lab Output Database – Permanent, secure storage of results – Searches and aggregations – Throughput/latency matrix Host Endpoint Testing – The “last mile” segment – Secure download of signed binaries

MGRID NTAP Project Demonstration R1 Host A PMP 1 R2 Host B PMP / /

MGRID NTAP Project Performance test, step 1 – locate the first PMP, the performance machine “nearest” to the tester

MGRID NTAP Project Performance test, step 2 – discover network path (i.e. routers)

MGRID NTAP Project Performance test, steps 3, 4, …, n – run pairwise tests between “adjacent” PMPs ideally, this will capture hop-by-hop network data sometimes there are network “holes” – lastly, timestamp and store the output for post- processing (generate graphs, check for empirical anomalies, etc)

Any Questions?