1. Open privacy-aware network measurement, analysis, and visualization service
Jennifer Schopf
International Networks, Indiana University
Sean Peisert, Brian Tierney
ESnet, LBNL, and UC Davis
Jason Leigh
Laboratory for Advanced Visualization & Applications,
University of HawaiʻI Mānoa
Supported by the National Science Foundation

2. IRNC Monitoring: NetSage
Open, privacy-aware, network measurement, analysis, and visualization service
Designed to address the needs of today’s international networks
Focus on work with production networks, not on novel research
Tasked by NSF to coordinate monitoring work across the IRNC projects

4. IRNC Backbones and Exchange Points
TransPAC4 (Schopf, IU)
AmLIght ExP (Ibarra, FIU)
Pacific Islands Research and Education Networks (PIREN) (Lassner, U Hawaii)
America Connects to Europe (ACE) (Schopf, IU)
Network for European, American, and African Research (NEAAR) (Schopf, IU)
Exchange Points
AtlanticWave (Ibarra, FIU)
StarLight (Mambretti, NU)
Pacific Wave(Fox, CENIC)

5. NetSage End users Project oversight (NSF, etc)
Congressional mandate that NSF projects show societal relevance
IRNC NOC and other operators
Project planning by backbone and exchange point operators
Application engagement staff of IRNC projects

6. Additional Project Goals
General expandable infrastructure – wider deployment
Canonical TestPoint for basic info gathering
PerfSONAR, SNMP, Flow, retransmits, etc
Open source tools and archive
Standard measurement and analysis frameworks

7. Use Cases Year 1 and 2
What is the max, min, average bandwidth used between links?
Which exchange points or networks are congested?
When and how often do they remain congested?

8. Data Sources Passive Measurements Active Measurements SNMP
De-identified Flow data
De-identified flow-like data from Tstat
Active Measurements
PerfSONAR

9. What is perfSONAR? perfSONAR is a tool to:
Find network problems (“soft failures”)
Help fix these problems
All in multi-domain environments
Over 2000 public hosts on many different networks
These problems are all harder when multiple networks are involved
Focus on Research and Education (R&E) Networking, 1Gbps links or higher
perfSONAR provides a standard way to publish active and passive monitoring data
This data is interesting to network researchers as well as network operators

10. New in perfSONAR 4.0 pScheduler New Graphs MaDDash 2.0
Replaces scheduling layer with new component that adds many new features and improves on a number of old ones
New Graphs
Cleaner display of multiple types of data
MaDDash 2.0
Added alerting features
CentOS 7 and Debian 8 support

11. Tstat is a tcp statistics gathering tool that examines packet header data and compiles statistics about tcp flows in flight such as source/destination and size similar to netflow, but is nonsampled and gives a little more visibility into things such as retransmission rate and window size so that we can get a better view into the performance of the tcp flows rather than just what we can infer from flowdata

12. Flow analysis tools Example
A little more on tstat – we can extract certain data from the flowdata such as is in this graph. It shows a single TCP flow starting about march 14th and running until about march 21st, so about a week. The flow runs at about 8 mbps average. So the transfer size was about 500GB, but it took a week. Looking at the flow data, we can’t see any more information about the performance of the flow, but with tstat we hope to discover the additional statistics I mentioned

13. NetSage: Network measurement, analysis, and visualization
The default view from the portal is the previous 24 hours, but that can be easily changed to other timeframes, such as previous month or an arbitrary time period in the past

14. NetSage Portal (2)

16. NetSage Portal (3)

17. Heatmaps showing periodic patterns in bandwidth use across the IRNC networks from 8/1/16-9/1/16
Aggregated weekly bandwidth use use

18. Year 3 Focus What are the top sites that use the IRNC links?
What are the top science projects that use the IRNC links?
How can we best identify a list of top talkers for each link?

19. Data
Collection
New
Visualizations
Analysis

20. Top Talkers Could be by flow number or size Could be between
Countries
Organizations
Projects
We will never show between 2 IPs
NetSage archive doesn’t have that data!
Useful information when planning network build outs

21. TransPAC Example
I have show this graph a lot, and it is generated manually, so netsage is trying to find ways of automating it and displaying it in different formats

22. Global Science Registry
Map IP and AS numbers to
Organization
Science project
Science domain
Initial idea: Gloriad’s Science Registry
Joint work with AARnet

23. Global Science Registry (cont)
Needed to answer basic usage questions
What percentage used by what science domain?
How much of this link used by a specific organization?
Needs to be easy for science projects to update

24. De-identified Flow Data
At the source – raw flow data
Verify only header
Tag data using science registry
Remove low order bits from IP address
Forward to NetSage every hour
Never more than 24 hours of raw data at the source
UN de-identified data never makes it to the archive

25. DTN measurement
Supplemental to add instrumentation to data transfer nodes
Running TSTAT on a DTN to get a better view than perfSONAR on actual
Similar to what was mentioned in the first talk

26. Summary Data (Kibana Sample)
We use an ELK stack as a short term data system for our flow data.  From this, we generate aggregates stored in the TSDS system (and since it is coming out of the netsage archive it has already been deidentified and tagged by the science registry).  Additionally we use it with out internal kibana system to develop experimental visuals and internal dashboards.
- the green ovals are filters applied, in this case they are narrowing in on all perfsonar TCP performance tests between hawaii and IU going through seattle.
- as the filters or time selectors are adjusted all widgets on page reflect the change in their calculations.
- the ns-metrics widget is showing the set of metrics that summarize all matching activity
- the ns-sensor widget shows the corresponding per sensor details

27. Sankey Graph (NetSage prototype)
Data in both directions
April 1 to April 18 for netflow data collected from AmLight and TransPAC100G

28. Country to Country Pairs (Kibana Sample)
The same sort of data using a Kibana style heat map

29. Top Talker by Country (Kibana Sample)

30. Top Talker by Country (Kibana Sample)
The same data in more of a heat map format, country over time (each block is a week)

31. NetSage Prototype Top Talker (org)
And this is what a top talker might look like in the netsage portal

32. Acknowledgements NetSage is funded by US NSF award #1540933
NetSage Website:
INIU Website:
Interested in NetSage? Contact:
Dr. Jennifer Schopf –
Andrew Lee –