1. 1 RECONSTRUCTION OF APPLICATION LAYER MESSAGE SEQUENCES BY NETWORK MONITORING Jaspal SubhlokAmitoj Singh University of Houston Houston, TX Fermi National Accelerator Laboratory Batavia, IL

2. 2 Introduction Reconstruct Application layer message sequences by analyzing Transport layer traffic. messages sent messages recvd TCP segments exchanged N1 N3 N2

3. 3 Purpose (why bother ?) Application message exchange pattern is a fundamental program property –e.g., determines application performance in different conditions Network traffic due to an application can be monitored non-intrusively, but.. discovering application message sequence is hard – need access to source code or a profiling library Hence this method to construct application messages from TCP monitoring

4. 4 Particular Motivation Data Sim 1 Vis Sim 2 Stream Model Pre ? Application Network size and pattern of message exchanges is a key component of an application profile used to select good network nodes to execute on

5. 5 Key Principle An application message is typically fragmented into a consecutive sequence of TCP segments where all except the last segment is of size MSS (Maximum Segment Size). Application message TCP segment 1 unit = MSS Application Layer TCP layer Last TCP segment

6. 6 Message Reconstruction Procedure Phases 1.Separate TCP streams. 2.Sanitize a TCP stream. 3.Reconstruct application layer messages. 4.Error minimization by “best-of-three” technique.

7. 7 Separating TCP streams A communication link transports multiple TCP streams A TCP stream spans a unique series of sequence numbers 1 : 1448 1449 : 2896 2897 : 4344 431376 : 432823 4345 : 5792 5793 : 7240 432824 : 433610 7241 : 8688 8689 : 10136 431376 : 432823 432824 : 433610 1 : 1448 1449 : 2896 2897 : 4344 4345 : 5792 5793 : 7240 7241 : 8688 8689 : 10136 MSS = 1448 bytes Separate red and black streams of TCP Segments (not fool proof but adequate)

8. 8 Sanitizing TCP streams Insert TCP segments not recorded (assume it is rare) Filter out retransmissions 1 : 1448 1449 : 2896 2897 : 4344 4345 : 5792 7241 : 8688 8689 : 10136 10137 : 11584 11585 : 13032 4345 : 5792 5793 : 7240 7241 : 8683 Missing TCP segment Duplicate TCP segment is removed. 1448 bytes 997 bytes 1448 bytes Missing TCP segment is inserted

9. 9 Reconstruct application messages A TCP segment of size smaller than MSS (=1448) indicates the end of an application message. 1 : 1448 1449 : 2896 2897 : 4344 4345 : 5792 5793 : 7240 7241 : 8688 8689 : 10136 10137 : 11584 11585 : 12574 12575 : 14022 14023 : 15022 12,574 bytes 2,248 bytes End of Message Start of Message Application messages TCP segments + + + + + + + + + 997 bytes 800 bytes 1448 bytes

10. 10 Best-of-three Reconstruction heuristic is not perfect 1.A TCP segment smaller than MSS may be sent before the entire application message is finished. 2.Two short application messages may be packed into the same TCP segment. Application message TCP segment 1. 2.

11. 11 Best-of-three Basic idea:reconstruction heuristic is unlikely to fail in exactly the same way in multiple identical runs Solution: make 3 runs and select the majority view at every stage Run 1 Run 2 Run 3Correct Message Sequence A B C D A B C+D A+B C D A B C D

12. 12 Experimental setup NAS parallel benchmark suite programs run on a cluster of 4 workstations tcpdump utility used to capture TCP segments The reconstructed application layer message sequence compared with the true sequence obtained with profiling

13. 13 Results APPROX MATCH: Includes reconstructed messages off by upto 100 bytes AND/OR combined with one other application message. Perfect for large messages (IS), Approx for small (LU)

14. 14 Conclusions Majority of messages reconstructed accurately, almost all detected approximately Accuracy low for large number of small messages Procedure based entirely on network measurements, hence can be applied to any code Accuracy sufficient for resource selection in Network/Grid environments.

15. 15 Dominant communication pattern of the NAS benchmarks

16. 16 Experimental Setup tcpdump – capturing outgoing TCP packets. 100 Mbps Ethernet switch 500 MHz dual processor Pentium Linux workstations.