Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 1 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 1 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Internet Measurement (and some inference & modeling) Shivkumar (“Shiv”) Kalyanaraman Rensselaer Polytechnic Institute shivkuma@ecse.rpi.edu http://www.ecse.rpi.edu/Homepages/shivkuma/ GOOGLE: “Shiv RPI”

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 2 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Topics q Measurement philosophy: why, what, when, where, how? q Some measurement projects & results q Techniques: passive & active q Packet tracing q SNMP q Probing q Inference and Modeling q Tomography & Traffic Matrix Estimation for network engineering q Traffic modeling q Rocketfuel: inferring topologies from outside ISP networks

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 3 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Why Measurement? q We built it, we depend on it, so we must try to understand it … as it works in reality... q Measurement gives us the data and basis for this understanding. q Modeling, Inference etc to get new understanding & learning from data q Complex interactions between protocols not well modeled during their design. q Need support for troubleshooting and network management q Wide area behavior unpredictable q Change is normal

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 4 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Characteristics of the Internet q The Internet is q Decentralized (loose confederation of peers) q Self-configuring (no global registry of topology) q Stateless (limited information in the routers) q Connectionless (no fixed connection between hosts) q These attributes contribute q To the success of Internet q To the rapid growth of the Internet q … and the difficulty of controlling the Internet! ISP senderreceiver

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 5 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Internet Measurement Challenges q Size of the Internet q O(100M) hosts, O(1M) routers, O(10K) networks q Complexity of the Internet q Components, protocols, applications, users q Constant change is the norm q Web, e-commerce, peer-to-peer, wireless, next? q The Internet was not developed with measurement as a fundamental feature q Nearly every network operator would like to keep most data on their network private q Floyd and Paxson, “Difficulties in Simulating the Internet”, IEEE/ACM Transactions on Networking, 2000.

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 6 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Themes q Measurement has been the basis for critical improvements q Without measurement, what do you know? q Measurement capability in the Internet is limited q The systems not designed to support measurement q Measurement tools and infrastructures are few and limited q Size, diversity, complexity and change q Measurement data presents many challenges q Networking researchers need better connections with experts in other domains

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 7 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Operator Philosophy: Tension With IP q Accountability of network resources q But, routers don’t maintain state about transfers q But, measurement isn’t part of the infrastructure q Reliability/predictability of services q But, IP doesn’t provide performance guarantees q But, equipment is not especially reliable (no “five-9s”) q Fine-grain control over the network q But, routers don’t do fine-grain resource allocation q But, network automatically re-routes after failures q End-to-end control over communication q But, end hosts and applications adapt to congestion q But, traffic may traverse multiple domains of control

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 8 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Network Operations: Measure, Model, and Control Topology/ Configuration Offered traffic Changes to the network Operational network Network-wide “what-if” model measure control

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 9 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) “Operations” Research: Detect, Diagnose, and Fix q Detect: note the symptoms of a problem q Periodic polling of link load statistics q Active probes measuring performance q Customer complaining (via the phone network?) q Diagnose: identify the illness q Change in user behavior? q Router/link failure or policy change? q Denial of service attack? q Fix: select and dispense the medicine q Routing protocol reconfiguration q Installation of packet filters Network measurement plays a key role in each step!

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 10 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 11 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Traffic Measurement: Control vs. Discovery q Discovery: characterizing the network q End-to-end characteristics of delay, throughput, and loss q Verification of models of TCP congestion control q Workload models capturing the behavior of Web users q Understanding self-similarity/multi-fractal traffic q Control: managing the network q Generating reports for customers and internal groups q Diagnosing performance and reliability problems q Tuning the configuration of the network to the traffic q Planning outlay of equipment (routers, proxies, links)

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 43 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Measurement Techniques

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 44 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Time Scales for Network Operations q Minutes to hours q Denial-of-service attacks q Router and link failures q Serious congestion q Hours to weeks q Time-of-day or day-of-week engineering q Outlay of new routers and links q Addition/deletion of customers or peers q Weeks to years q Planning of new capacity and topology changes q Evaluation of network designs and routing protocols

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 45 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Traffic Measurement: SNMP Data q Simple Network Management Protocol (SNMP) q Router CPU utilization, link utilization, link loss, … q Collected from every router/link every few minutes q Applications q Detecting overloaded links and sudden traffic shifts q Inferring the domain-wide traffic matrix q Advantage q Open standard, available for every router and link q Disadvantage q Coarse granularity, both spatially and temporally

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 47 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Traffic Measurement: Packet-Level Traces q Packet monitoring q IP, TCP/UDP, and application-level headers q Collected by tapping individual links in the network q Applications q Fine-grain timing of the packets on the link q Fine-grain view of packet header fields q Advantages q Most detailed view possible at the IP level q Disadvantages q Expensive to have in more than a few locations q Challenging to collect on very high-speed links q Extremely high volume of measurement data

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 49 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Extracting Data from IP Packets IP TCP IP TCP IP TCP Application message (e.g., HTTP response)  Many layers of information –IP: source/dest IP addresses, protocol (TCP/UDP), … –TCP/UDP: src/dest port numbers, seq/ack, flags, … –Application: URL, user keystrokes, BGP updates,…

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 50 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) flow 1flow 2flow 3 flow 4 Aggregating Packets into Flows q Set of packets that “belong together” q Source/destination IP addresses and port numbers q Same protocol, ToS bits, … q Same input/output interfaces at a router (if known) q Packets that are “close” together in time q Maximum inter-packet spacing (e.g., 15 sec, 30 sec) q Example: flows 2 and 4 are different flows due to time

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 71 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Summary: Traffic Measurement: Flow-Level Traces q Flow monitoring (e.g., Cisco Netflow) q Measurements at the level of sets of related packets q Single list of shared attributes (addresses, port #s, …) q Number of bytes and packets, start and finish times q Applications q Computing application mix and detecting DoS attacks q Measuring the traffic matrix for the network q Advantages q Medium-grain traffic view, supported on some routers q Disadvantages q Not uniformly supported across router products q Large data volume, and may slow down some routers q Memory overhead (size of flow cache) grows with link speed

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 72 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Summary: Reducing Packet/Flow Measurement Overhead q Filtering: select a subset of the traffic q E.g., destination prefix for a customer q E.g., port number for an application (e.g., 80 for Web) q Aggregation: grouping related traffic q E.g., packets/flows with same next-hop AS q E.g., packets/flows destined to a particular service q Sampling: subselecting the traffic q Random, deterministic, or hash-based sampling q 1-out-of-n or stratified based on packet/flow size q Combining filtering, aggregation, and sampling

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 73 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Summary: Comparison of Techniques Sampling Filtering Aggregation Generality Local Processing Local memory Compression Precisionexact approximate constrained a-priori constrained a-priori general filter criterion for every object table update for every object only sampling decision none one bin per value of interest none depends on data depends on data controlled

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 79 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Inference and Modeling…

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 80 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) DATA-DRIVEN…

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 82 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Eg: The Network Design Problem 200 65 258 134 30 42 Düsseldorf Frankfurt Berlin Hamburg München Communication Demands Düsseldorf Frankfurt Berlin Hamburg München Potential topology & Capacities

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 85 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Traffic Modeling …

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 96 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Mandelbrot’s Construction q Renewal reward processes and their aggregates q Aggregate is made up of many constituents q Each constituent is of the on/off type q On/off periods have a “duration” q Constituents make contributions (“rewards”) when “on” q Constituents make no contributions when “off” q What can be said about the aggregate? q In terms of assumed type of “randomness” for durations and rewards q In terms of implied type of “burstiness”

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 97 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Mandelbrot’s Types of “Randomness” q Distribution functions/random variables q “Mild” → finite variance (Gaussian) q “Wild” → infinite variance q Correlation function of stochastic process q None => “IID” (independent, identically distributed) q “Mild” → short-range dependence (SRD, Markovian) q “Wild” → long-range dependence (LRD)

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 98 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Mandelbrot’s Types of “Burstiness” Bursty BURSTY smooth bursty Distribution function Mild Wild Correlation structure Tail-driven burstiness (“Noah effect”) Dependence-driven burstiness (“Joseph effect”)

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 99 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Type of Burstiness: “Smooth” Correlation Function r(n) lag n on linear scale r(n) on log scale CCDF Function 1-F(x) x on linear scale 1-F(x) on log scale Log-linear scales

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 100 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Type of Burstiness: “bursty” Correlation Function r(n) lag n on log scale r(n) on log scale CCDF Function 1-F(x) x on linear scale 1-F(x) on log scale Log-linear scale Log-log scale

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 101 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Type of Burstiness: “Bursty” Correlation Function r(n) lag n on linear scale r(n) on log scale CCDF Function 1-F(x) x on log scale 1-F(x) on log scale Log-log scale Log-linear scale ?

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 102 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Type of Burstiness: “BURSTY” CCDF Function 1-F(x) x on log scale 1-F(x) on log scale Correlation Function r(n) lag n on log scale r(n) on log scale ? ? Log-log scales

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 103 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Mandelbrot’s Types of “Burstiness” Bursty BURSTY smooth bursty Distribution function Mild Wild Correlation structure Tail-driven burstiness (“Noah effect”) Dependence-driven burstiness (“Joseph effect”)

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 104 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Inference For Network Engineering: Traffic Matrix Estimation… (Truncated: Detailed slides in 2005 class)

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 105 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton) Summary q Internet measurement is a fast growing and complex field q We saw brief glimpses of the area: a full course required to do justice q Active vs passive probing q Data management and mining q Modeling and inference q A new book also available! Crovella and Krishnamurthy.

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 1 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)

Similar presentations

Presentation on theme: "Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 1 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)"— Presentation transcript:

Similar presentations

About project

Feedback

Log in

Auth with social network:

Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 1 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)

Similar presentations

Presentation on theme: "Shivkumar Kalyanaraman Rensselaer Polytechnic Institute 1 Slides adapted from Paul Barford (UWisconsin), Matt Roughan (U Adelaide), Jennifer Rexford (Princeton)"— Presentation transcript:

Similar presentations

About project

Feedback