1. Rutger Coolen, TNC 2005 Collaborative network monitoring for NREN’s Use cases for LOBSTER

2. TNC 2005Rutger Coolen 2 Agenda LOBSTER Viewpoints and Actors Use cases - Approach 2 example use cases for LOBSTER Your input Current Status

3. TNC 2005Rutger Coolen 3 Viewpoints on LOBSTER Project viewpoint LOBSTER is a “Specific Support Action” project under EU FP6 Infrastructure viewpoint The LOBSTER project realises a pilot infrastructure for advanced network monitoring Community viewpoint The owners and users of the LOBSTER infrastructure co-operate in a community

4. TNC 2005Rutger Coolen 4 Overview of the actors LOBSTER community LOBSTER primarily aims at NREN’s and secondarily at ISP’s Other potential users Customers of NREN’s and ISP’s, including researchers Government / policy-makers

5. TNC 2005Rutger Coolen 5 LOBSTER Viewpoints and Actors Use cases - Approach 2 example use cases for LOBSTER Your input & Current Status

6. TNC 2005Rutger Coolen 6 Use Cases What use-cases are: Applications of the LOBSTER infrastructure What use-cases are used for: To demonstrate the benefits of LOBSTER To derive requirements for the LOBSTER infrastructure What use-cases are not: The (business) case for joining LOBSTER

7. TNC 2005Rutger Coolen 7 Use Cases Inclusion of LOBSTER characteristics Multiple domains Advanced monitoring High Speed Privacy Co-operation between NREN’s Interdomain problems Beyond state-of-the-art monitoring capabilities Distributed sensors Confidentiality reqs Privacy legislation Anonymisation Advanced Hardware Useful for advanced NREN & GN2 networks Benefits for users

8. TNC 2005Rutger Coolen 8 Use Cases Approach Basic Use-Case Template: Structuring Use-Cases with Goals, Alistair Cockburn http://alistair.cockburn.us USE CASE # Goal in Context Scope & Level Preconditions Success End Condition Failed End Condition Primary, Secondary Actors Trigger DESCRIPTIONStepAction 1 2 EXTENSIONSStepBranching Action 1a : SUB-VARIATIONSBranching Action 1

9. TNC 2005Rutger Coolen 9 LOBSTER Viewpoints and Actors Use cases - Approach 2 example use cases for LOBSTER Your input & Current Status

10. TNC 2005Rutger Coolen 10 CSIRT analysis Use Case 1a - Collaborative Worm Detection 1. On detection of a worm a signature is distributed MP NREN x NREN 2 NREN 1 MP Measurement Point, or Monitoring Sensor

11. TNC 2005Rutger Coolen 11 Use Case 1a - Collaborative Worm Detection 2. LOBSTER measurement points collect worm sources Measurement Point Worm list SourceCustomer 10.0.0.1Univ.1 10.0.2.4R&D.2 10.1.1.2 Univ.2… copy of traffic

12. TNC 2005Rutger Coolen 12 Use Case 1a - Collaborative Worm Detection 3a. Incident Response Team takes actions Block sources, or route to special web-site 10.0.0.1 10.0.2.4 … Access Router for Customers Worm Source IP’s Customer X Measurement Point E-mail to customers (1) (2)

13. TNC 2005Rutger Coolen 13 Use Case 1b - Worm Impact Statistics 3b. Anonymous data is combined in an overall picture NREN 2 NREN 1 MP Anonymous worm counts NREN 1 Anonymous worm counts NREN 2

14. TNC 2005Rutger Coolen 14 Use Case 2a – Advanced Services Monitoring 1. Inter- and intradomain call set-up and data-streams NREN x NREN 2 NREN 1 Interdomain Voice-over-IP Intradomain Voice-over-IP Interdomain Video Conferencing

15. TNC 2005Rutger Coolen 15 Use Case 2a – Advanced Services Monitoring 2. A user monitor’s the key parameters NREN 2 NREN 1 MP Intradomain MP Ingress/ egress (Partial) raw data from other NREN

16. TNC 2005Rutger Coolen 16 Use Case 2a – Advanced Services Monitoring 3. Summary of advanced services parameters NREN 2 NREN 1 MP NREN1NRENx NREN1 - 1024 calls/day 1.12 Tb data/day Avg. MOS = 4.12 NRENx… - Advanced Services Summary Advanced Services Summary

17. TNC 2005Rutger Coolen 17 Use Cases Overview of primary actors per case CaseNRENISPCustomersPolicy- makers Security Collaborative Worm Detection (case 1a) Statistical Worm Impact Statistics Statistics (case 1b) Performance measurement Advanced Services Monitoring Quality Measurement (case 2b) Network Planning Advanced Services Monitoring Traffic overview (case 2a)

18. TNC 2005Rutger Coolen 18 More use cases… Security incident response Spyware detection Denial-of-Service attack: control traffic detection Backdoor detection Performance measurement Delay sensitive grid computing On-line (educational) games Network traffic characterisation Peer-to-peer applications Services with dynamic ports

19. TNC 2005Rutger Coolen 19 LOBSTER Viewpoints and Actors Use cases - Approach 2 example use cases for LOBSTER Your input & Current Status

20. TNC 2005Rutger Coolen 20 Your Input: questions or remarks Reaction on use cases Requirements for the infrastructure or community

21. TNC 2005Rutger Coolen 21 Current status Implementation of pilot infrastructure by the LOBSTER consortium Initial community with Forthnet, Uninett, and Cesnet in 2005 Establishing relation with Geant2/ JRA-1 You are invited to join our efforts and become a pilot user!

22. TNC 2005Rutger Coolen 22 Thank you