DIMES Measurements

2 Topics Description of the measurement module’s structure –How it’s activated –What the output looks like Measurement algorithm –Hop alternatives –Protocols –Glitches and observations Writing measurements for DIMES

3 Structure of the measurement module Uniform API (Measurements) –Uniform activation –Uniform result export – should be adapted to new types of measurements Native implementation of actual measurement, due to Java limitations

4 Measurements Measurements DLL execute Traceroute OperationPing Operation executeMTR(HostIP, MeasurementType, Protocol,PingNum,InitialPort)

5 DimesExperiment AllIPs_5841 NORMAL :01: :01:21 TRACEROUTE UDP nolly-pc true … Result File

cisco.eng.tau.ac.il 0 … Hop Details

7 MTR - Traceroute and Ping Same algorithm for both measurements –4 traces in 1 measurement (was 10) –2 possible protocols – ICMP, UDP –Increasing UDP ports –Delay between packet sending

8 Measurements Algorithm While (numPing < maxNumPing) If (time to send next packet) If (current TTL > max TTL) or (current TTL > min responsive TTL) return send packet (current TTL, current port num) if (traceroute) ++ current TTL wait for packet for short period and process if finished a trace ++ numPing reset TTL ++ port num

9 Hop Alternatives Separate traces in a single measurement Different IPs emerge for the same hop Possible reasons: –Different routes route flapping Load balancing –Same route, different hop IP Router interfaces

10 Result File Revisited Hop Alternatives ge car2.Washington1.Level3.net ge car2.Washington1.Level3.net null

11 UDP/ICMP Interface-router resolving – alternatives InfoProtocolDestinationSourceTimeNo. Source port: Destination: port 33435UDP Destination unreachableICMP Source port: Destination: port 33435UDP Destination unreachableICMP Source port: Destination: port 33435UDP Destination unreachableICMP Echo (ping) requestICMP Echo (ping) replyICMP Echo (ping) requestICMP Echo (ping) replyICMP Echo (ping) requestICMP Echo (ping) replyICMP

Differences in packet handling policies – noisy results Block (ignore) Accumulating/batch block (reply to 5 packets in every 10) Delay block (reply to a packet, then wait a fixed delay in which you block) Several echo replies to a single request

13 Batch Block Example No.TimeSourceDestinationProtocolInfo UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: UDPSource port: Destination port: UDPSource port: Destination port: UDPSource port: Destination port: UDPSource port: Destination port: ICMPDestination unreachable

14 Delay Block Example No.TimeSourceDestinationProtocolInfo UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: UDPSource port: Destination port: ICMPDestination unreachable UDPSource port: Destination port: ICMPDestination unreachable

15 Multiple Echo Replies Example No.TimeSourceDestinationProtocolInfo ICMPEcho (ping) request ICMPEcho (ping) reply ICMPEcho (ping) reply

16 Glitches Blocking policies mess with ping results –Batch and delay blocking Delay between ping packets is increased –Delay between Traceroute packets: 50 mSec –Delay between Ping packets: 500 mSec Number of traces is reduced: 10 4 Blocking policies mess with our credibility… –Google stops responding to UDP –DIMES agent is accused of port scanning Fixed port number for each trace Maximum of hosts allowed in a trace is decreased

17 More Hitches We got some strange results …

18 Histogram AutoCorrelation

19 Why you should read borrowed code thoroughly int gettimeofday(struct timeval* tv, struct timezone *tz) { if(!tv) return -1; struct _timeb timebuffer; _ftime(&timebuffer); tv->tv_sec = timebuffer.time; tv->tv_usec = timebuffer.millitm * ; return 0; }

20 Porting UNIX code should be done carefully In windows environment _ftime() function gives worse then 10ms accuracy !!! To get higher accuracy we have used: QueryPerformanceFrequency((LARGE_INTEGER*)&freq); QueryPerformanceCounter((LARGE_INTEGER*)&perfVal); time = ((perfVal* ) / freq);

21 Anything else seems odd? Strange new way of getting microSec accuracy output from milliSec accuracy input… tv->tv_sec = timebuffer.time; tv->tv_usec = timebuffer.millitm * ;

22 compare

Writing measurements for DIMES

24 DIMES Agent Measurement Hierarchy Add new measurement type: TRACEROUTE and PING are hardcoded

25 DIMES Agent Measurement Hierarchy Add methods to execute the new operation Add new Measurement Operation New DLL – add measurement

26 So how do you add a measurement? Agent Side Add the measurement implementation and compile the new measurement DLL –Compile it to be accessible from Java (JNI). Add calling method in Measurements. Add new Measurement Operation. Add new Measurement Type. Change Syntax Tree to support the new Measurement Type.

27 If operation syntax is different – adapt the Parser. If the result fields are different, adapt Measurements to write these results correctly. So how do you add a measurement? Agent Side

28 So how do you add a measurement? Server Side Add support to new operation type in the DB: –Add new raw results table Add support in the maintenance task –How to import the new results into the DB