Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 1 Networking: more than the sum of its pieces Anja Feldmann Fakultät für Informatik Technische Universität München

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 2 The Internet? For Joe Doe: r Social phenomena: changing/redefining m Human to human communication m Human to computer interactions m Business/military/society conduct For Internet researchers: r Technical phenomena: to be m Observed, characterized, understood, improved Possibilities and capabilities Limitations and dangers Scale

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 3 The Internet: Advantages r Highly engineered structure m Well specified and documented (RFCs) r Unique measurement capabilities m In theory unlimited access to data :-) r Exploiting available data m Use invariants not details m Use network wide data sets m Consider emerging phenomena m Take advantage of structural models

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 4 The Internet: Challenges r Is experiencing explosive growth r An immense moving target r Heterogeneity any which way you look r Complex user behavior and traffic dynamics r Highly interacting systems m Temporal: between hosts and network m Spatial: among different connections m Vertical: across different networking layers

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 5 Challenge 1: performance debugging r Locating reasons for performance problem m Top down analysis: Searching for a cause? The protocol itself Missperforming link Bad application design Access network or client problem Missconfiguration DDoS attack Protocol interactions Scaling limits: “success disaster”

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 6 Challenge 2: service performance r How to derive service performance from component performance m Bottom up view: searching for the relationship? High utilization bad Web performance Link failure bad/no connectivity DDoS attack bad response time m Result: Never, sometimes, eventually, occasionally, maybe ? ? ?

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 7 Tools r Instrumentation and analysis m Integrate measurements into the design process m Collect data at a variety of different locations/levels m Find invariants and correlate various datasets r Simulation m Build a mirror world for “what if” studies m Verify explanations r Test-Labs m Incorporate variability m Provide an friendly/unfriendly environment

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 8 Example: Internet Routing Border Gateway Protocol (BGP) r Task: m Routing between Autonomous Systems (AS) m Propagation of reacheability information m Path vector protocol (to prevent routing loops) r Challenges: m Support for routing policies (economic realities) m Stability vs. fast updates m Scale (Internet wide) m Limited resource (e.g. router CPUs and memory)

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 9 AS 1 AS 4 AS 2 AS 5 XP AS 3 AS 6 BGP update propagation

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 10 AS 1 AS 4 AS 2 AS 5 XP AS 3 AS 6 AS 2 issues an update BGP update propagation

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 11 AS 1 AS 4 AS 2 AS 5 XP AS 3 AS 6 AS 6 may announce to reach AS 2 via AS 3 assume damping A B BGP update propagation

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 12 AS 6 may prefer to reach AS 2 via AS 1 AS 1 AS 4 AS 2 AS 5 XP AS 3 AS 6 BGP update propagation

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 13 Instrumentation and analysis r BGP Data m German ISP m RIPE m Route-View r Other data source m Packet Data m Flow Data m Reverse proxy logs m...

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 14 Routing burst duration

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 15 Simulation r Tools: SSFnet and ns-2 r Capabilities m Routing: BGP/OSPF/MPLS m Workload: Web traffic m Network topologies: AS and ISP topologies r Simulation execution m Validation of simulation model OSPF validation From measurements to simulation m Sensibility studies Interactions OSPF/BGP? Does RED help? Switching vs. Routing? MPLS vs. OSPF traffic engineering?

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 16 Test-Lab r Internet in a Lab: Why? m Current lab tests: Component tests Functionality of single feature Maybe limited feature interaction m Current real test: Deployment in the Internet! r Internet Test-Lab: Ingredients m Realistic workloads m Temporal and address variability m Routing

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 17 Exploring in an Internet Test-Lab r BGP m Test interactions IGP vs. BGP m Test BGP‘s scalability via future workloads r Routing protocols m Interactions of routing protocols: intra/inter/mobile m New routing protocols r Security m Intrusion detection m Firewalls r Measurement and analysis m Test instrumentation m Explore data correlation methods m Find relationship between services and components m Try performance debugging and management

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 18 Outlook and challenges r Fortunate confluence of several research tracks m Network-wide measurements m Large-scale simulators m Test environments m Multiscale analysis/visualization analysis r Enables side-by-side comparisons m Measurements from “real world”/“mirror world”/“test world” m For discovery, validation, and replication r Scientific Challenges m Avoid drowning in measured data m Provide foundations for performance evaluation of large- scale networks m Performance debugging

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 19 Networking: more than the sum of its pieces

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 20 BGP workload ingredients r Cause of routing instability m Instability creator r Effect of routing instability m Instability bursts r Baseline for prefix structure/hierarchy m Prefix forest r AS topology and peering policies m AS path properties r Correlations within instability m Attribute changes

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 21 Some projects r Traffic flows: Mice vs. Elephants m Origin and impact r Traffic characterization m Chat traffic, multimedia, DNS,... r Estimating Inter-domain traffic flows m Impact of routing updates on actual traffic flows r Network Intrusion Detection m Distributed IDS using Netflow data r Routing convergence m Understanding the delays in BGP convergence r What if studies (e.g. using network simulator) m MPLS vs. OSPF traffic engineering m RED a performance booster or buster

Feldmann Ne X tworking’03 June 23-25,2003, Chania, Crete, Greece The First COST-IST(EU)-NSF(USA) Workshop on EXCHANGES & TRENDS IN N ETWORKING 22 Example data sets r RIPE’s RRC00: Jan 14, :00 – Jan 20, :10