PingER: Navigating the web site and mining the data Les Cottrell SLAC Workshop at the University of Malaya (UM), Kuala Lumpur, June 24-25, 2013

Agenda Navigating the PingER web site Accessing and viewing analyzed data Downloading and mining with Excel etc. Managing the system

PingER home site Set bookmark at wanmon.slac.stanford.edu/cgi-wrap/pingtable.phttp://www- wanmon.slac.stanford.edu/cgi-wrap/pingtable.p Prefer Chrome or Firefox, mostly works with MSIE Public face of PingER

Home site menu bar: Introduction Provides: –Upper level information –An IEEE publication –Technical details –Etc.

Home page: Visualizations Click on African Internet Weather Congestion wave Monitoring sites/ participants Hosts per country by region

Access to PingER site map Provides site map & Geographical deployment maps PingER site map

8 Home page Icons access Pingtable: workhorse of PingER analysisPingtable: workhorse of PingER analysis Summary table of country to country connections Google map of PingER hosts Google Explorer Motion Metrics Bubble chart

9 Pingtable This is the workhorse UNIMAS Workshop, Sarawak, Dec 2012 Help Table Form

10 Pingtable: Help UNIMAS Workshop, Sarawak, Dec 2012 Technical assistance on metrics meanings etc, Help on table content etc., Coloring by thresholds What to click on

11 Host labeling Host labeled... (most important 1 st ). –Assist in sorting etc. UNIMAS Workshop, Sarawak, Dec 2012

12 Pingtable: Scroll right for host names etc. Get Internet host name, TLD and region for each host pair UNIMAS Workshop, Sarawak, Dec 2012

13 Pingtable: Form selection eGY Africa 2012 Workshop, Nairobi Oct 2012

14 Pingtable: Metric selection Pull down to select from Avg RTT, jitter (ipdv), loss, throughput, MOS etc. UNIMAS Workshop, Sarawak, Dec 2012

15 Pingtable: Select tick (time window) UNIMAS Workshop, Sarawak, Dec 2012 Pull down to select: hourly, daily, monthly, yearly etc.

16 Pingtable: Select From (Monitor(s)) UNIMAS Workshop, Sarawak, Dec 2012 Pull down to select monitoring node(s): single monitoring host or all monitors in a country or region etc.

17 Pingtable: Select To (monitored host or site) UNIMAS Workshop, Sarawak, Dec 2012 Pull down to select To node(s): single monitored host/site or all hosts/sites in a country or region etc.

18 Aggregate all hosts in a site UNIMAS Workshop, Sarawak, Dec 2012 Pull down to select whether to aggregate all hosts in a site into one measurement

19 Select packet size UNIMAS Workshop, Sarawak, Dec 2012

20 Pingtable: Select host type UNIMAS Workshop, Sarawak, Dec 2012 Pull down to select type of hosts to display: All, Monitoring, Beacons, Remote

21 Pingtable: other choices Change dataset: no longer any other choices Data points: removes pairs with little data Filter: Removes known anomalous data UNIMAS Workshop, Sarawak, Dec 2012

22 Pingtable: Load selected data UNIMAS Workshop, Sarawak, Dec 2012 Click on Load into table and wait while data loads and display is rendered

23 Pingtable: Active links UNIMAS Workshop, Sarawak, Dec 2012

24 Pingtable: Sorting Click on column heading: –Sorts by host name, host type (? Monitor|Beacon|remote), metric value, TLD, Region UNIMAS Workshop, Sarawak, Dec 2012

25 Pingtable ? Click ? for more info –Details on hosts, –Latest raw data, Format (see iepm.slac.stanford.edu/pinger/tools/retrievedata.html#raw dataformat) iepm.slac.stanford.edu/pinger/tools/retrievedata.html#raw dataformat –Summarized data UNIMAS Workshop, Sarawak, Dec 2012

26 Pingtable (?): More information on pair Select ‘From’ as EDU.SLAC.STANFORD.N3 & Load into Table Click on ? Provides info from database on hosts, e.g.: –Lat/lon, location, web site, comments etc. UNIMAS Workshop, Sarawak, Dec 2012

27 Pingtable: Rawdata Useful for seeing exactly when a host disappears or is reachable again by PingER, e.g. in case of events such as loss of Internet connectivity due to earthquakes, cable cuts, uprisings UNIMAS Workshop, Sarawak, Dec 2012

28 Pingtable(?): Summarized data Provides summary statistics (min, avg, median max) for all chosen remote hosts seen from monitor, for 100 &1000 Byte pings Plus the slope of Bytes vs. RTT UNIMAS Workshop, Sarawak, Dec 2012 Latest summarized data from (pinger.slac.stanford.edu): click hereclick here

29 Graphs of usage (via ?) Time series plot of RTT & Loss last 7 days including today so far from MY.UNIMAS.N4(pinger.unimas.my) to MY.UMT.EDU.N1( click here, add csv file. click hereadd csv file. UNIMAS Workshop, Sarawak, Dec % loss =unreachable

30 Graphs of RTT Valuable if do not have Smokeping graphs, e.g. for non SLAC monitors One day I will fix the tick marks. Also add csv file and cut and paste into Excel for more elegant plots UNIMAS Workshop, Sarawak, Dec 2012

31 Pingtable: (?) Dynamic on demand traceoute Uses traceroute server available at most PingER monitors Click on UNIMAS Workshop, Sarawak, Dec 2012 Current traceroute using traceroute.pl?target=

32 Traceroutes Measured once per day UNIMAS Workshop, Sarawak, Dec 2012

33 Traceroutes: Form Can select 3 days to view concurrently to look for important changes Also can select the remote host Currently only available for SLAC monitoring host UNIMAS Workshop, Sarawak, Dec 2012

34 Traceroute: format UNIMAS Workshop, Sarawak, Dec 2012 Traceroute for First selected date www-wanmon.slac.stanford.edu_to_www.uda.ad_2012_11_30 1 rtr-servcore1-serv01-webserv.slac.stanford.edu ( ) ms 2 rtr-core2-p2p-servcore1.slac.stanford.edu ( ) ms 3 rtr-border1-p2p-core2.slac.stanford.edu ( ) ms 4 slac-mr2-p2p-rtr-border1.slac.stanford.edu ( ) ms 5 sunnsdn2-ip-slacmr2.es.net ( ) ms 6 sunncr1-sunnsdn2.es.net ( ) ms 7 eqxsjrt1-te-sunncr1.es.net ( ) ms 8 * 9 xe par72.ip4.tinet.net ( ) ms 10 interoute-gw.ip4.tinet.net ( ) ms 11 ae1-0.mad-001-score-1-re1.interoute.net ( ) ms 12 ae0-0.mad-001-score-2-re0.interoute.net ( ) ms 13 ae1-0.bcn-002-score-1-re1.interoute.net ( ) ms 14 ( ) ms 15 * 16 *

35 More Traceroutes Background information on traceroute servers – mon/traceroute-srv.htmlhttp:// mon/traceroute-srv.html List of servers by country: – UNIMAS Workshop, Sarawak, Dec 2012

36 PingER traceroute servers API Most PingER installations have traceroute servers. Perl API and web accessible xml file for database can be found by accessing file iepm.slac.stanford.edu/pinger/pingerworld/node s.cf, see comment at start iepm.slac.stanford.edu/pinger/pingerworld/node s.cf –This can be used to find out about PingER hosts & in particular PingER traceroute servers

37 Pingtable: Smokeping Click on the SLAC monitoring host in a line –Not available for other monitors UNIMAS Workshop, Sarawak, Dec 2012

38 Pingtable: Smokeping graph Background is colored for loss (see legend) – Black not reachable – Red 50%-90% loss – Magenta 20%-40% loss – Orange 5%-10% loss – Light yellow 0%-5% loss – Cyan 0% loss UNIMAS Workshop, Sarawak, Dec 2012

39 Pingtable: Smokeping UNIMAS Workshop, Sarawak, Dec 2012 Blue line average RTT, Smoke=jitter X axis in GMT Y axis in seconds (m = msec) Start and end times given in legend Summary statistics given in legend

40 Pingtable: Smokeping graph Form Allows time window selection (also icons) Size of graph, manual scaling Colors for losses UNIMAS Workshop, Sarawak, Dec 2012

41 Pingtable:Summary table At the bottom provides: –Summary stats (min, median, 95%, # pairs, etc.) for each time interval for chosen metric –Can click on columns heading to download statistic UNIMAS Workshop, Sarawak, Dec 2012

42 Pingtable.pl extract summary Summary table at end (e.g. access via wget) - Buried in the output from pingtable.pl is a comment line containing the summary data, forma (… = more of same)t: – –Each line of data is separated by a comma (,) –within a line each token is separated by a +. –The lines in turn are those from the 'Summary for Sites' table at the bottom of pingtable.pl output. –The first line gives the date, the second the min, the 3rd the 25%, the 4th the average, the 5th (i.e. \$lines[4]) line the median etc. –If there is no data for a token then there is an adjacent ++. UNIMAS Workshop, Sarawak, Dec 2012

43 Download Pingtable data First choose some simple, interesting data: Select From = Malaysia Select To = Malaysia Metric = Average RTT Tick-type = last 60 days UNIMAS Workshop, Sarawak, Dec 2012

44 Pingtable: Downloading data & further analysis Click here UNIMAS Workshop, Sarawak, Dec 2012 This report is also provided in downloadable tab- separated-value (.tsv) format for use with Excel.downloadable tab- separated-value (.tsv) Firefox: box pops up, choose save. It should be in Downloads. Can try Start and Search for it MSIE: box pops up, choose ‘save as’ and save on the desktop Chrome: Appears at bottom left of browser window. Drag it to desktop

45 Open downloaded file with Excel Right click the pingtable.pl icon (probably on desktop). Choose “Open with” => “Choose Microsoft Excel”. Open the file UNIMAS Workshop, Sarawak, Dec 2012 Dots = no data

46 Preamble to Excel analysis Insert the URL where in a newline at the start Delete columns A & C Select all (e.g. click on top left hand corner of table) Click on Replace in Home menu Replace all cells with only a period with a null Fix the date: take the Left most add in Excel format, the take the cell in next column to the right set =left one -1 and replicate right UNIMAS Workshop, Sarawak, Dec 2012

47 Draw chart Select relevant data (e.g. a2:bf13) Click on Scatter chart under Insert Tab Now it’s a matter of improving the format to better understand the data UNIMAS Workshop, Sarawak, Dec 2012

48 Icons access Table of country to country connections Maps of metric performance by Country Maps of number of PingER hosts by countryMaps of number of PingER hosts by country Google map of PingER hosts Motion Metrics Bubble chart UNIMAS Workshop, Sarawak, Dec 2012

49 PingER Summary Table URL= Patience takes a long time UNIMAS Workshop, Sarawak, Dec 2012 Help Choose area aggregation Metric Month

50 Drilling down Colors represent quality Click on headings & values to drill down to pingtable UNIMAS Workshop, Sarawak, Dec 2012

51 Pinger Host per country URL: www-iepm.slac.stanford.edu/pinger/geomaps/pinger- node-count-geomap.html www-iepm.slac.stanford.edu/pinger/geomaps/pinger- node-count-geomap.html Scroll down for other regions Mouseover country for node count UNIMAS Workshop, Sarawak, Dec 2012 Can choose monitors or all nodes

52 Map –See monitors, beacons, remotes –Select metric, src, dst, draw colored lines connecting, colors = metric value –Graphs of metric and pinger hosts per country Does not work in MSIE UNIMAS Workshop, Sarawak, Dec 2012

53 Map URL: mon/viper/pinger-coverage-gmap.htmlwww.slac.stanford.edu/wan- mon/viper/pinger-coverage-gmap.html UNIMAS Workshop, Sarawak, Dec 2012 Help More information

54 Map help UNIMAS Workshop, Sarawak, Dec 2012

55 Map More information Mainly for developers UNIMAS Workshop, Sarawak, Dec 2012

56 Map: choose Monitors UNIMAS Workshop, Sarawak, Dec 2012 Selected only Monitors

57 Map: Beacons Beacons are remote hosts monitored by all monitors UNIMAS Workshop, Sarawak, Dec 2012 Selected only Monitors

58 Map: Remote hosts UNIMAS Workshop, Sarawak, Dec 2012 Selected only remotes

59 Map: Controls UNIMAS Workshop, Sarawak, Dec 2012

60 Map: Locate Pakistan UNIMAS Workshop, Sarawak, Dec 2012

61 Map: Locate Kota Samarahan UNIMAS Workshop, Sarawak, Dec 2012 UMIMAS

62 Map: Locate UNIMAS UNIMAS Workshop, Sarawak, Dec 2012 UNIMAS

63 Map: plot monitored links UNIMAS Workshop, Sarawak, Dec 2012

64 Map plot time series last 365 days UNIMAS Workshop, Sarawak, Dec 2012 Mouseover points to get coordinates Click on graph

65 Demo and VideoVideo Interactive demonstrations of the data mining capabilities of public data sources provided by organizations such as the UN and ITU coupled with monitoring data from PingER Summer Joint Techs Stanford, July 2012

66 Video of motion metric bubble charts URL: –www-iepm.slac.stanford.edu/pinger/motion chart/www-iepm.slac.stanford.edu/pinger/motion chart/ 5.5 minutes UNIMAS Workshop, Sarawak, Dec 2012

67 Managing Site map –Introductions Meta database –Oracle database => Perl require script and pinger.xml files Data gathering status Measurements: –Run from cronjob each 30 mins Spotting anomalies, hosts with same IP addr, hosts with missing information (country, lat/lon Finding hosts Finding location eGY Africa 2012 Workshop, Nairobi Oct 2012

68 Problems Hosts change IP address –Maybe v frequent, e.g. a cluster or slowly as host with same name is replaced with a new host with new IP address. Hosts not where you think they are No packet loss how to calculate Throughput ~ 1460(bytes)*8(bits)/(RTT*sqrt(loss)) Throughput approx. only good for TCP Reno –OS’ such as Windows, Linux now allow other congestion control algorithms eGY Africa 2012 Workshop, Nairobi Oct 2012

69 Joining We need several monitoring hosts in Malaysia and S.E. Asia Remove any UNIMAS caused anomalies Detailed study of Malay E2E Internet performance Trilateration research platform From PingER home page pull down joining and get startedPingER home page UNIMAS Workshop, Sarawak, Dec 2012

70 Joining – Remote Hosts Only monitored No need to do anything Host has to respond to pings & be reliable –Lightly or consistently loaded Finding hosts –Contacts –Developed HostSearcher eGY Africa 2012 Workshop, Nairobi Oct 2012

71 HostSearcher.pl Gets list of <1000 hosts in TLD from Google –Options to only select www or.edu etc. Checks if pingable Uses GeoIPTools ( to get locationGeoIPToolswww.geoiptools.com Manually go to web site –Look for street address, city etc., (contacts) If well known site try latitude & longitude finder – Choose based on how representative it is –Proximity to other hosts etc. UNIMAS Workshop, Sarawak, Dec 2012

72 Monitoring Hosts 80 working monitors worldwide Invitation letter for monitoring sites –www-iepm.slac.stanford.edu/pinger/letters/invite-monitor.doc –Describes PingER & its goals –Gives information on public access to results –Provides requirements of monitoring host –Tells how to get started (download and install) UNIMAS Workshop, Sarawak, Dec 2012

73 Monitoring Host requirements Responds to pings, known location, contact In DNS Linux and usual utilities (dig, mail, make Perl +XML::Simple Web server (e.g. Apache) Lightly loaded UNIMAS Workshop, Sarawak, Dec 2012

74 First install Reverse Traceroute server UNIMAS Workshop, Sarawak, Dec 2012 Self contained Perl CGI for web server –Supports IPv4 & IPv6 Instructions: – mon/Pinger2/install2.htmlwww.slac.stanford.edu/comp/net/wan- mon/Pinger2/install2.html –Appears at: E.g. Responds to requests for traceroutes from traceroute server to a target host Also a ping and tracepath server Installed at most PingER monitor sites –www-wanmon.slac.stanford.edu/cgi- wrap/reflector.cgi?PE=set&function=landmarkswww-wanmon.slac.stanford.edu/cgi- wrap/reflector.cgi?PE=set&function=landmarks

75 Also is a ping server icfamon.dl.ac.uk/cgi- bin/traceroute.pl?target= =pingicfamon.dl.ac.uk/cgi- bin/traceroute.pl?target= =ping Used by TULIP trilateration research projectTULIP –Locate a target by pinging from multiple landmarks –Use the RTT to estimate distance –Use trilateration to locate target –See mon/tulip/ mon/tulip/ UNIMAS Workshop, Sarawak, Dec 2012

76 Install PingER2 measurement engine UNIMAS Workshop, Sarawak, Dec 2012 Install: Joint Techs: I2 & ESnet, Stanford Internet 10 ping request packets each 30 mins Remote Host (typically web server) > ping host Ping response packets Measure Round Trip Time & Loss Uses ubiquitous ping Monitor Host Caches data Once a Day Repositori es NUST

77 Status of Monitoring hosts See iepm.slac.stanford.edu/monitoring/checkdata/ iepm.slac.stanford.edu/monitoring/checkdata/ Data successfully gathered Data partially gathered Host not pingable today No data gathered

78 Trilateration for User Location of an IP Host (TULIP) Want to verify where a IP node is located –Tools such as GeoIPTools work reasonably well for end host (names and IP addresses) –Usually ( usually works for well known sites( –For tracing routes however unless the name of a router gives it away they are usually identified (e.g. by GeoIPtools) as being at the corporate HQ of the router owner (e.g. Qwest, Level3, the NREN etc.) UNIMAS Workshop, Sarawak, Dec 2012

79 TULIP Based on using ping to measure RTT from a landmark (e.g. a PingER monitor) to target Today most of the RTT is based on how far the signal has to go over the backbone Distance = d(km)=RTT(ms)*100km/ms –Speed of light in vacuum = c=300km/sec –In fibre or copper cable=(2/3)c= 200km/sec –For round trip =(1/2)*(2/3)c= 100km/sec UNIMAS Workshop, Sarawak, Dec 2012

80 Can use these distance measured from multiple nearby landmarks to use trilateration to estimate the location of the target. Challenges: –The fibre path is not direct Globally or locally –There are no nearby landmarks UNIMAS Workshop, Sarawak, Dec 2012