1 RECONSTRUCTION OF APPLICATION LAYER MESSAGE SEQUENCES BY NETWORK MONITORING Jaspal SubhlokAmitoj Singh University of Houston Houston, TX Fermi National Accelerator Laboratory Batavia, IL

2 Introduction Reconstruct Application layer message sequences by analyzing Transport layer traffic. messages sent messages recvd TCP segments exchanged N1 N3 N2

3 Purpose (why bother ?) Application message exchange pattern is a fundamental program property –e.g., determines application performance in different conditions Network traffic due to an application can be monitored non-intrusively, but.. discovering application message sequence is hard – need access to source code or a profiling library Hence this method to construct application messages from TCP monitoring

4 Particular Motivation Data Sim 1 Vis Sim 2 Stream Model Pre ? Application Network size and pattern of message exchanges is a key component of an application profile used to select good network nodes to execute on

5 Key Principle An application message is typically fragmented into a consecutive sequence of TCP segments where all except the last segment is of size MSS (Maximum Segment Size). Application message TCP segment 1 unit = MSS Application Layer TCP layer Last TCP segment

6 Message Reconstruction Procedure Phases 1.Separate TCP streams. 2.Sanitize a TCP stream. 3.Reconstruct application layer messages. 4.Error minimization by “best-of-three” technique.

7 Separating TCP streams A communication link transports multiple TCP streams A TCP stream spans a unique series of sequence numbers 1 : : : : : : : : : : : : : : : : : : MSS = 1448 bytes Separate red and black streams of TCP Segments (not fool proof but adequate)

8 Sanitizing TCP streams Insert TCP segments not recorded (assume it is rare) Filter out retransmissions 1 : : : : : : : : : : : 8683 Missing TCP segment Duplicate TCP segment is removed bytes 997 bytes 1448 bytes Missing TCP segment is inserted

9 Reconstruct application messages A TCP segment of size smaller than MSS (=1448) indicates the end of an application message. 1 : : : : : : : : : : : ,574 bytes 2,248 bytes End of Message Start of Message Application messages TCP segments bytes 800 bytes 1448 bytes

10 Best-of-three Reconstruction heuristic is not perfect 1.A TCP segment smaller than MSS may be sent before the entire application message is finished. 2.Two short application messages may be packed into the same TCP segment. Application message TCP segment 1. 2.

11 Best-of-three Basic idea:reconstruction heuristic is unlikely to fail in exactly the same way in multiple identical runs Solution: make 3 runs and select the majority view at every stage Run 1 Run 2 Run 3Correct Message Sequence A B C D A B C+D A+B C D A B C D

12 Experimental setup NAS parallel benchmark suite programs run on a cluster of 4 workstations tcpdump utility used to capture TCP segments The reconstructed application layer message sequence compared with the true sequence obtained with profiling

13 Results APPROX MATCH: Includes reconstructed messages off by upto 100 bytes AND/OR combined with one other application message. Perfect for large messages (IS), Approx for small (LU)

14 Conclusions Majority of messages reconstructed accurately, almost all detected approximately Accuracy low for large number of small messages Procedure based entirely on network measurements, hence can be applied to any code Accuracy sufficient for resource selection in Network/Grid environments.

15 Dominant communication pattern of the NAS benchmarks

16 Experimental Setup tcpdump – capturing outgoing TCP packets. 100 Mbps Ethernet switch 500 MHz dual processor Pentium Linux workstations.