1. 1 Network Tomography Using Passive End-to-End Measurements Lili Qiu Joint work with Venkata N. Padmanabhan and Helen J. Wang

2. 2 Motivation Sprint AT&T Web Server UUNET MCI Qwest Earthlink AOL Diagnosis engine Why so slow? Ethernet

3. 3 Network Diagnosis Diagnosis engine Netmon/tcpdump traces Network topology Trouble spots location Diagnosis results: Qwest access link: 63.232.180.230->63.232.33.134 Peering between MCI and AOL: 209.126.62.46->172.139.89.74

4. 4 Network Diagnosis (Cont.) Goal: Determine internal network characteristics using passive end-to-end measurements Primary focus: identifying lossy links Applications Trouble shooting Server selection Server placement Overlay network path construction

5. 5 Previous Work Active probing to infer link loss rate multicast probes striped unicast probes Pros & cons accurate since individual loss events identified expensive because of extra probe traffic S AB S AB

6. 6 Problem Formulation l1l1 l8l8 l7l7 l6l6 l2l2 l4l4 l5l5 l3l3 server clients p1p1 p2p2 p3p3 p4p4 p5p5 (1-l 1 )*(1-l 2 )*(1-l 4 ) = (1-p 1 ) (1-l 1 )*(1-l 2 )*(1-l 5 ) = (1-p 2 ) … (1-l 1 )*(1-l 3 )*(1-l 8 ) = (1-p 5 ) Under-constrained system of Equations

7. 7 #1: Random Sampling Randomly sample the solution space Repeat this several times Draw conclusions based on overall statistics How to do random sampling? determine loss rate bound for each link using best downstream client iterate over all links: pick loss rate at random within bounds update bounds for other links Pros: fast Cons: high false positive rate, little tolerance for estimation error l1l1 l8l8 l7l7 l6l6 l2l2 l4l4 l5l5 l3l3 server clients p1p1 p2p2 p3p3 p4p4 p5p5

8. 8 #2: Linear Optimization Goals Parsimonious explanation Robust to measurement errors Procedures 1) Convert the constraints into linear constraints using log transform L i = log(1/(1-l i )), P j = log(1/(1-p j )) (1-l 1 )*(1-l 2 )*(1-l 4 ) = (1-p 1 )  L 1 +L 2 +L 4 = P 1 2) Add slack variables to account for errors L 1 +L 2 +L 4 = P 1  L 1 +L 2 +L 4 + S 1 = P 1 3) minimize w  L i +  |S j | subject to L 1 +L 2 +L 4 + S 1 = P 1 L 1 +L 2 +L 5 + S 2 = P 2 … L 1 +L 3 +L 8 + S 5 = P 5 l1l1 l8l8 l7l7 l6l6 l2l2 l4l4 l5l5 l3l3 server clients p1p1 p2p2 p3p3 p4p4 p5p5

9. 9 # 3: Gibbs Sampling D observed packet transmission and loss at the clients  ensemble of loss rates of links in the network Goal determine the posterior distribution P(  |D) Approach Use Markov Chain Monte Carlo with Gibbs sampling to obtain samples from P(  |D) Draw conclusions based on the samples

10. 10 # 3: Gibbs Sampling (Cont.) Applying Gibbs sampling to network tomography 1) Initialize link loss rates arbitrarily 2) For j = 1 : warmup for each link i compute P(l i |D, {l i ’}) where l i is loss rate of link i, and {l i ’} =  k  I l k 3) For j = 1 : realSamples for each link i compute P(l i |D, {l i ’}) Use all the samples obtained at step 3 to approximate P(  |D) Pros: accurate Cons: more expensive to compute

11. 11 Performance Evaluation Simulation experiments Trace-driven validation

12. 12 Simulation Experiments Advantage: no uncertainty about link loss rate! Methodology Topologies used: randomly-generated: 20 - 3000 nodes, max degree = 5-50 real topology obtained by tracing paths to microsoft.com clients randomly-generated packet loss events at each link A fraction f of the links are good, and the rest are “bad” LM1: good links: 0 – 1%, bad links: 5 – 10% LM2: good links: 0 – 1%, bad links: 1 – 100% Link loss processes: Bernoulli and Gilbert Goodness metrics: Coverage: # correctly inferred lossy links False positive: # incorrectly inferred lossy links

13. 13 Random Topologies TechniquesCoverageFalse PositiveComputation RandomHigh Low LPModestLowMedium Gibbs samplingHighLowHigh

14. 14 Trace-driven Validation Validation approach Divide client traces into two: tomography and validation Tomography data set  loss inference Validation set  check if clients downstream of the inferred lossy links experience high loss Experimental setup Real topologies and loss traces collected from traceroute and tcpdump at microsoft.com during Dec. 20, 2000 and Jan. 11, 2002 Results False positive rate is between 5 – 30% Likely candidates for lossy links: links crossing an inter-AS boundary links having a large delay (e.g. transcontinental links) links that terminate at clients

15. 15 Summary Passive network tomography is feasible Tradeoff between computational cost and accuracy Gibbs sampling is accurate but expensive to run Random sampling is quickest but with high false positive Random sampling may still be useful in practice when the number of lossy links is small Applications Network diagnosis Re-direct clients to avoid trouble spots Place replicas or mirror sites to avoid trouble spots TechFest demo 3 patent applications in progress Acknowledgements: MSR: Chris Meek, David Wilson, Christian Borgs, Jennifer Chayes, David Heckerman, ITG/GNS: Rob Emanuel, Scott Hogan

16. 16 Random topologies (Cont.) Confidence estimate for gibbs sampling works well and can be used to rank order the inferred lossy links.

17. 17 Overview Goal: Determine internal network characteristics using passive, end-to-end measurements find trouble spots in the network (e.g., AT&T- Sprint peering point) Applications Network diagnosis Server selection Server placement Sprint AT&T Web Server UUNET MCI Qwest AOL Earthlink Why so slow? Diagnosis engine

18. 18 Topological Metrics Topological metrics are poor predictors of packet loss rate All links are not equal  need to identify the lossy links