1. Resolve today’s IT management dilemma Enable generalist operators to localize user perceptible connectivity problems Raise alerts prioritized by the amount of impact to users Produce near real-time and historical problem analysis reports Offer problem resolution strategies Compliment existing detailed networked diagnosis technologies Further Microsoft’s DSI vision of model based management Produce accurate models of dependencies across wireless & wired networks, servers, end systems & applications Produce SML descriptions for “legacy” networked applications & services Uncovering IT Problems that Affect Users http://pmon MSR Networking Research Group 1 2 Our Mission Uncover problems in networked applications that affect end users Architecture Leverage the clients and servers (edges of the network) Measure end-to-end performance of entire IT infrastructure Integrate networks, services & application management into a single solution for desktop and mobile clients Provide increased visibility into IT Infrastructure, automatically Determine dependencies across components Measure performance of wireless clients Monitor sophisticated applications & services Mitigate failures by Detecting and localizing problems and their cause Responding to wireless resource & security challenges Reporting problems, ranked by their impacts on users Approach Managing Mobile Devices Diagnosing Application Faults Mapping Dependencies and Localizing Faults Opportunity: To automate the management of the exploding number of networked devices, applications & services Pain : Staggering operational costs, recurring glitches, mis- configurations, silent failures with egregious financial outcomes Dilemma : Enterprise IT depts. must choose between huge costs or crippling restrictions to innovation and scale Exchange DHCP Active Directory User Devices Network Management Tools Inference Engine Cluster A Server Management Tools SMS Service Desk NDF Our System A A A AA A = Monitoring Agent Scoping Out the Problem Want enterprise level solutions to problems perceptible to users Today: Get box-level diagnosis that misses critical dependencies Want quick & comprehensive diagnosis of failures in dynamic wireless environments Today: Get local views from clueless access points Want rapid diagnosis of application performance anomalies Today: Get sophisticated event/policy data of uneven relevance Models Enterprise-Wide Topologies, Dependencies, Location Analysis Fault Detection, Isolation & Diagnosis Impact-Analysis Resource Analysis (“What-if” Analysis) Kernel mode packet monitoring (e.g., netmon), driver extensions (e.g., to capture wireless, air interface data) User mode application monitoring (e.g., Internet Explorer) Monitoring Agent Compatible with System Center See the forest, not the trees Automatically learn dependencies among components by observing the behavior of distributed applications & services from multiple vantage points From these dependencies, generate models of interactions between clients, network devices, and applications/services Combine models with historical behavior and compare this to observed performance to identify the causes of problems that affect users Rank problems by the amount and number of users impacted Make every desktop computer a wireless network watchdog Use in- and out-of application instrumentation to diagnose Sophisticated applications have complicated behaviors Use available application APIs to monitor end user experience Use separate monitoring to obtain additional network info Data herding Correlate data across similar clients Contrast data across diverse clients Aggregate data by dependency graph tuples Feed observations to PMON Failure inference Attribute blame by dependency graph components Historical analysis Detect, localize and respond to performance problems RF Holes and areas of inadequate coverage  Sensing node becomes an AP Network slowdown due to rate anomaly  Sensing node becomes repeater Network congestion  Reconfigure AP power settings Expired credentials on client  Sensing node becomes a conduit to allow certificate renewal Detect, localize and respond to security threats Rogue AP  Launch disassociation attack against AP Rogue Ad-hoc network  Launch DoS attack against bridge Client associated with rogue AP  Forcibly disconnect client Denial of Service attack (jamming,  Inform netops of location of attacker Disassociation, NAV etc.) Other services Site planning (AP placement, frequency selection) Historical usage data for capacity planning