1. RESOLVING IP ALIASES USING DISTRIBUTED SYSTEMS

2. Internet Topology Mapping Challenges Related Works Intended Works
PRESENTATION CONTENT
Introduction
Internet Topology Mapping
Challenges
Related Works
Intended Works
Conclusion

4. WHY MAPPING THE INTERNET?
INTRODUCTION
WHY MAPPING THE INTERNET?
Studying the Internet
Detecting problems
Studying virus spread

5. HOW IS INTERNET MEASURED
Traceroute
Time To Live (TTL)
IPA
IPB
IPC
IPD
Vantage Point
Destination
TTL=4
TTL=3
TTL=1
TTL=2 A B C D S

6. TRACEROUTES
Archipelago (Ark)
RIPE
MLAB
IPlane

7. CHALLENGES

8. CHALLENGES
Load Balancing
Unresponsive Routers
IP Aliases
NAT Boxes

9. Per destination Per packet Random Paris traceroute Y D A B C
LOAD BALANCING
Per destination
Per packet
Random
Paris traceroute
Y: “time exceeded”
Dest = D
TTL = 2 Y D A
B: “time exceeded”
Dest = D
TTL = 1 B C

10. UNRESPONSIVE ROUTERS

11. Routers have multiple interfaces Each interface has its own IP address
IP ALIASES
Routers have multiple interfaces
Each interface has its own IP address

12. Multiple routers can use one IP address IPv4 running out
NAT BOXES
Multiple routers can use one IP address
IPv4 running out
Internal Policies

13. RELATED WORKS

14. RELATED WORKS
Iffinder & Mercator
Ally
RadarGun
Midar
APAR
Kapar

15. IFFINDER AND MERCATOR Fingerprint method
Sending UDP packets to unused port number of routers
Receive ICMP PORT UNREACHABLE message from routers
Messages contain IP address of the source (router)
Does the probing address match the address in the message?

16. ALLY Another fingerprint method
Uses IP IDs (16-bit number stored in the IP ID field in IP header) of routers
Sends messages to two or more alias candidates
Inspects the response messages
Problems (false negatives)
Sometimes routers don’t send messages back
Some routers increment IP ID’s very fast
Some routers don't increment IP ID’s
Some routers use different IP IDs for different interfaces
O(n^2)

17. RADARGUN 30 probes in time limits for each IP, O(n)
Saves timestamps and IP ID values of response and inspects them
Ignore if
receive response from less than 25% of the 30 probes
all IP IDs of particular router is either zero or the same value
time series is nonlinear (counter advancing too quickly or generates random values)
If two addresses share an IP ID counter, then their time series should have nearby IP ID values when overlapping in time

18. MIDAR Same ignoring conditions with RadarGun
MONOTONIC ID-BASED ALIAS RESOLUTION
MIDAR
Same ignoring conditions with RadarGun
Threshold higher than RadarGun
Monotonic Bounds Test
MBT checks that two time series A and B meet the monotonicity requirement by individually checking that each sample of B meets the monotonicity requirement with respect to the samples of A, and vice versa

19. APAR Analytical alias resolution
ANALYTICAL AND PROBE-BASED ALIAS RESOLVER
APAR
Analytical alias resolution
Analyzing IP addresses in traces to identify candidate subnets
Resolving IP aliases depending on the subnets inferred

20. Nodes in the same subnet should appear one hop away from each other
APAR CONTINUED
Rules
Accuracy
Nodes in the same subnet should appear one hop away from each other
Completeness
Ignore candidate subnets with less than half of IPs found
Processing Order
Processing priority is given to subnets with more path traces
No loops
Common Neighbors
Distance (candidate aliases should be at same distance from vantage points)

21. Trace ( h1:h4 ) - a b q m g
Trace ( h2:h1 ) - c d o a
Trace ( h3:h1 ) - e f k o a

22. KAPAR Optimized version of APAR
Avoided storing the complete set of paths in memory
Identifies /24 or bigger subnets in the same traces that cannot exist
Gives unique ID to each trace, stores list of all IPs in the traces
Works with sets of aliases obtained from other sources (results of fingerprints)
Uses stricter subnet formation (does probes for IPs not found in AS)
Uses stricter common neighbor condition

23. INTENTION

24. PRELIMINARIES AS (Autonomous Systems)
Within the Internet, an autonomous system (AS) is a collection of connected Internet Protocol (IP) routing prefixes under the control of one or more network operators on behalf of a single administrative entity or domain that presents a common, clearly defined routing policy to the Internet
(Border Gateway Protocol) BGP Announcements

25. INTENTION Parse IPs in traces files
Detect which ASes they belong according to BGP announcement
Collect and separate all traces that belong to the same ASes
Create files for each ASes that store traces belonging to that particular AS (more than 50,000 files)
Distribute all AS files among cluster nodes
Process each AS file independently
Use best IP Alias Resolution technique that fits our case

26. TECHNOLOGIES INTENDED TO BE USED
HIGHLY AVAILABLE, SCALABLE DISTRIBUTED SYSTEMS
TECHNOLOGIES INTENDED TO BE USED

27. WHAT WE TALKED ABOUT
CONCLUSION

28. MAPPING INTERNET Why mapping is important What challenges are there
What has been done
What we intend to do