1. DIMES Measurements

2. 2 Topics Description of the measurement module’s structure –How it’s activated –What the output looks like Measurement algorithm –Hop alternatives –Protocols –Glitches and observations Writing measurements for DIMES

3. 3 Structure of the measurement module Uniform API (Measurements) –Uniform activation –Uniform result export – should be adapted to new types of measurements Native implementation of actual measurement, due to Java limitations

4. 4 Measurements Measurements DLL execute Traceroute OperationPing Operation executeMTR(HostIP, MeasurementType, Protocol,PingNum,InitialPort)

5. 5 DimesExperiment AllIPs_5841 NORMAL 2005-05-16 13:01:21.995 2005-05-16 15:01:21 TRACEROUTE UDP nolly-pc 132.66.50.231 207.228.245.59 807078631 4 true … Result File

6. 6 1 2076037149 132.66.48.1 cisco.eng.tau.ac.il 0 … 16 807078792 207.228.244.150 0 161 164 163 Hop Details

7. 7 MTR - Traceroute and Ping Same algorithm for both measurements –4 traces in 1 measurement (was 10) –2 possible protocols – ICMP, UDP –Increasing UDP ports –Delay between packet sending

8. 8 Measurements Algorithm While (numPing < maxNumPing) If (time to send next packet) If (current TTL > max TTL) or (current TTL > min responsive TTL) return send packet (current TTL, current port num) if (traceroute) ++ current TTL wait for packet for short period and process if finished a trace ++ numPing reset TTL ++ port num

9. 9 Hop Alternatives Separate traces in a single measurement Different IPs emerge for the same hop Possible reasons: –Different routes route flapping Load balancing –Same route, different hop IP Router interfaces

10. 10 Result File Revisited Hop Alternatives 12 71596326 4.68.121.38 ge-1-2-52.car2.Washington1.Level3.net 0 159 164 162 12 71596390 4.68.121.102 ge-1-2- 54.car2.Washington1.Level3.net 0 159 null

11. 11 UDP/ICMP Interface-router resolving – alternatives InfoProtocolDestinationSourceTimeNo. Source port: 37404 Destination: port 33435UDP212.150.234.157132.66.50.23101 Destination unreachableICMP132.66.50.231212.150.234.1570.0879732 Source port: 37404 Destination: port 33435UDP206.49.94.22132.66.50.2312.0507643 Destination unreachableICMP132.66.50.231212.29.206.1982.0554434 Source port: 37404 Destination: port 33435UDP206.49.94.8132.66.50.2314.0635215 Destination unreachableICMP132.66.50.231212.29.206.1984.074576 Echo (ping) requestICMP212.150.234.157132.66.50.23121.6984357 Echo (ping) replyICMP132.66.50.231212.150.234.15721.7946788 Echo (ping) requestICMP206.49.94.22132.66.50.23123.7409029 Echo (ping) replyICMP132.66.50.231206.49.94.2223.74571110 Echo (ping) requestICMP206.49.94.8132.66.50.23125.75768311 Echo (ping) replyICMP132.66.50.231206.49.94.825.76081612

12. Differences in packet handling policies – noisy results Block (ignore) Accumulating/batch block (reply to 5 packets in every 10) Delay block (reply to a packet, then wait a fixed delay in which you block) Several echo replies to a single request

13. 13 Batch Block Example No.TimeSourceDestinationProtocolInfo 10132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33435 20.000137132.66.48.22132.66.50.231ICMPDestination unreachable 30.106941132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33436 40.107051132.66.48.22132.66.50.231ICMPDestination unreachable 50.214376132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33437 60.214491132.66.48.22132.66.50.231ICMPDestination unreachable 70.328665132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33438 80.328795132.66.48.22132.66.50.231ICMPDestination unreachable 90.436092132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33439 100.436209132.66.48.22132.66.50.231ICMPDestination unreachable 110.544482132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33440 120.544608132.66.48.22132.66.50.231ICMPDestination unreachable 130.651906132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33441 140.766187132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33442 150.874582132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33443 160.981986132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33444 171.082594132.66.50.231132.66.48.22UDPSource port: 36912 Destination port: 33445 181.08271132.66.48.22132.66.50.231ICMPDestination unreachable

14. 14 Delay Block Example No.TimeSourceDestinationProtocolInfo 10132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33435 20.289947212.150.234.157132.66.50.231ICMPDestination unreachable 30.493298132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33436 40.993328132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33437 51.090265212.150.234.157132.66.50.231ICMPDestination unreachable 61.496268132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33438 71.691473212.150.234.157132.66.50.231ICMPDestination unreachable 81.691734132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33439 92.19165132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33440 102.378263212.150.234.157132.66.50.231ICMPDestination unreachable 112.690695132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33441 123.059041212.150.234.157132.66.50.231ICMPDestination unreachable 133.199505132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33442 143.699542132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33443 153.823024212.150.234.157132.66.50.231ICMPDestination unreachable 164.197622132.66.50.231212.150.234.157UDPSource port: 39776 Destination port: 33444 174.439084212.150.234.157132.66.50.231ICMPDestination unreachable

15. 15 Multiple Echo Replies Example No.TimeSourceDestinationProtocolInfo 10132.66.50.231167.184.128.8ICMPEcho (ping) request 20.42504167.184.128.8132.66.50.231ICMPEcho (ping) reply 30.425381167.184.128.8132.66.50.231ICMPEcho (ping) reply

16. 16 Glitches Blocking policies mess with ping results –Batch and delay blocking Delay between ping packets is increased –Delay between Traceroute packets: 50 mSec –Delay between Ping packets: 500 mSec Number of traces is reduced: 10 4 Blocking policies mess with our credibility… –Google stops responding to UDP –DIMES agent is accused of port scanning Fixed port number for each trace Maximum of hosts allowed in a trace is decreased

17. 17 More Hitches We got some strange results …

18. 18 Histogram AutoCorrelation

19. 19 Why you should read borrowed code thoroughly int gettimeofday(struct timeval* tv, struct timezone *tz) { if(!tv) return -1; struct _timeb timebuffer; _ftime(&timebuffer); tv->tv_sec = timebuffer.time; tv->tv_usec = timebuffer.millitm * 1000 + 500; return 0; }

20. 20 Porting UNIX code should be done carefully In windows environment _ftime() function gives worse then 10ms accuracy !!! To get higher accuracy we have used: QueryPerformanceFrequency((LARGE_INTEGER*)&freq); QueryPerformanceCounter((LARGE_INTEGER*)&perfVal); time = ((perfVal*1000000) / freq);

21. 21 Anything else seems odd? Strange new way of getting microSec accuracy output from milliSec accuracy input… tv->tv_sec = timebuffer.time; tv->tv_usec = timebuffer.millitm * 1000 + 500;

22. 22 compare

23. Writing measurements for DIMES

24. 24 DIMES Agent Measurement Hierarchy Add new measurement type: TRACEROUTE and PING are hardcoded

25. 25 DIMES Agent Measurement Hierarchy Add methods to execute the new operation Add new Measurement Operation New DLL – add measurement

26. 26 So how do you add a measurement? Agent Side Add the measurement implementation and compile the new measurement DLL –Compile it to be accessible from Java (JNI). Add calling method in Measurements. Add new Measurement Operation. Add new Measurement Type. Change Syntax Tree to support the new Measurement Type.

27. 27 If operation syntax is different – adapt the Parser. If the result fields are different, adapt Measurements to write these results correctly. So how do you add a measurement? Agent Side

28. 28 So how do you add a measurement? Server Side Add support to new operation type in the DB: –Add new raw results table Add support in the maintenance task –How to import the new results into the DB