정하경 MMLAB Fundamentals of Internet Measurement: a Tutorial Nevil Brownlee, Chris Lossley, “Fundamentals of Internet Measurement: a Tutorial,” CMG journal of Computer Resource Management, Issue 102, Spring Presenter: Jung, Hakyung

MMLAB 2/15 Outline  Motivation  Measurement topics  H/W versus S/W approaches  Active versus Passive measurements  Examples  Main observations in the past research  Conclusion

MMLAB 3/15 Motivation  Network troubleshooting  Protocol debugging  Test out “new, improved” version of network applications and protocols  Workload characterization  design of better protocols and network for supporting the application  Performance evaluation and improvement  Identifying performance bottleneck New versions of the protocols can provide better performance

MMLAB 4/15 Measurement Topics  Hardware approaches  Special-purpose tools designed to collect and analyze network data Often expensive Better functionality and performance  Software approaches  Modify the kernel for the packet-capture capability e.g. tcpdump  Access logs recorded by Web servers or proxies

MMLAB 5/15 Software approach example: MIPv6 traffic measurement HA IPv6 Network AP IPFIX Flow Collector MIPv6 Access Router with IPFIX IPFIX flow data IPv6 Router MN CN FA

MMLAB 6/15 Measurement Topics  Passive measurements  Observe normal network traffic without creating additional traffic e.g. counting # of packets traveling through routers  Do not perturb the network  Rely on traffic flowing across the link being measured  Active measurements  Send test traffic needed to make the measurement e.g. ping, traceroute utilities  Generate extra traffic onto a network, thereby affecting measurement results

MMLAB 7/15 Passive techniques: workload analysis (1/3)  A matrix of traffic from source to destination ASes  2 minute sample from FIX- west in April 1998  can be used to optimize topology or to determine the traffic balance among ISPs  since AS is the unit of routing relationship

MMLAB 8/15 Passive techniques: workload analysis (2/3)  A matrix of traffic from source to destination countries  2 minute sample from FIX- west in April 1998  gives a perspective on international commerce

MMLAB 9/15 Passive techniques: workload analysis (3/3)  Cumulative distribution of packet sizes, and of bytes by the size of packets carrying them  peaks at sizes of 44, 552, 576, and 1500 bytes

MMLAB 10/15 Active technique: Internet mapping project  skitter, a tool for dynamically discovering and depicting global Internet topology  uses the same procedures with traceroute utility  gathers connectivity information, RTT, path data

MMLAB 11/15 Active technique: RTTs measurement  The distribution of RTTs for 1600 probe packets  nearly symmetric & relatively large distribution  The plot of delay values measured along the path  congestion between hop 11 and hop 12

MMLAB 12/15 Observations in the past research (1/3)  Packet traffic is non-uniformly distributed  10% of the hosts account for 90% of the traffic  Client-Server paradigm  Network traffic exhibits “ locality ” properties  Packets are not independent; rather part of a higher-layer logical flow of information  Temporal locality (time-based correlation)  Spatial locality (geography-based correlation)

MMLAB 13/15 Observations in the past research (2/3)  The packet arrival process is not Poisson  Poisson arrival process Events occur independently at random times Inter-arrival times between events are exponentially distributed and independent Memoryless property  Inter-arrival times between packets are not exponentially distributed, nor are they independent  Packet arrival process is bursty  The session arrival process is Poisson  Users seen to operate independently at random

MMLAB 14/15 Observations in the past research (3/3)  Traffic flows are bi-directional, but often asymmetric  Download-intensive nature of the Web  Internet traffic continues to change  Traffic volume, traffic mix, protocols, applications, users  Data set collected from an operational network represents bye one snapshot at one point in time in the evolution of the Internet

MMLAB 15/15 Conclusion  Role of network traffic measurement  Design, testing, evaluation of Internet protocols & applications  Internet traffic measurement Methodology  Summary of the main observations from the past network measurement research  Internet traffic continues to change

MMLAB 16/15 Reference  N. Brownlee, C. Lossley, “Fundamentals of Internet Measurement: a Tutorial,” CMG journal of Computer Resource Management, Issue 102, Spring 2001  KC Claffy, “Internet measurement and data analysis: passive and active measurement,” NAE workshop, 1999  C. Williamson, “Internet Traffic Measurement, “ IEEE Internet Computing, Vol. 5, No. 6, 2001 