network monitoring and measurements : techniques …csiat/network...monitoring.pdf · monitoring...
TRANSCRIPT
![Page 1: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/1.jpg)
1Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Network Monitoring and Measurements : Techniques and Experience
Supratik BhattacharyyaSue Moon
![Page 2: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/2.jpg)
2Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction – Internet architecture– The Sprint IP Backbone– Monitoring : requirements and challenges
• Current techniques– taxonomy, tools and techniques
• The IPMON project• The future of monitoring
![Page 3: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/3.jpg)
3Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction – Internet architecture– The Sprint IP Backbone– Monitoring : requirements and challenges
• Current techniques– taxonomy, tools and techniques
• The IPMON project• The future of monitoring
![Page 4: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/4.jpg)
4Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
The Internet Design Philosophy
• Packet switching• Continued communication around failures• Support for diverse services and protocols• Distributed management of resources• No access control• Simplicity at the core, complexity at the edge
![Page 5: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/5.jpg)
5Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
The Internet Hourglass (Deering@IETF)
IP
TCP, UDP, ...
SMTP, HTTP, RTP, ...
email, WWW, phone, ...
ethernet, PPP, ...
CSMA, Sonet, ...
Copper, fiber, radio, ...
![Page 6: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/6.jpg)
6Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
What is the Internet today?
UUnet
Sprint (AS)
BBN
Dial-up ISP
Tier 2 ISP
BT
Peering point
![Page 7: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/7.jpg)
7Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Today’s Tier-1 Backbones
• Technologies– IP over SONET (POS)– IP over ATM– IP over MPLS
• Topology - points-of-presence (POPs)connected by long-haul fiber– numerous small POPs (e.g., UUNet)– relatively few large POP (e.g., Sprint)
![Page 8: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/8.jpg)
8Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction – Internet architecture– The Sprint IP Backbone– Monitoring : requirements and challenges
• Current techniques– taxonomy, tools and techniques
• The IPMON project• The future of monitoring
![Page 9: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/9.jpg)
9Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Sprint IP Backbone
![Page 10: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/10.jpg)
10Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
A Backbone POP
Peer
Core Router
Other POPs
![Page 11: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/11.jpg)
11Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Common Engineering Practices
• “Over-subscription” at edge• Protection
– large scale outages happen regularly– “over-provisioned” core– MPLS/TE does not help
• Service Level Agreements :– delay (e.g., 55 msec round-trip in USA)– loss (e.g., 0.3%)– port availability (e.g., 99.99%)
![Page 12: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/12.jpg)
12Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Over-subscription and Over-Provisioning
1:3
1:3
customers
accessrouter
corerouters
Rest ofBackbone
Over-subscription Over-provisioning
![Page 13: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/13.jpg)
13Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Intradomain Routing : IS-IS
• Link weights– inter-POP links >> intra-POP links
• Updating weights:– set by hand– modified infrequently, usually for large-scale
failures
• One-way latency across backbone governsweight selection (hence routes)
![Page 14: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/14.jpg)
14Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IS-IS Load Balancing and Protection
R1
R3
R4
R6
R2 R5
• Multiple parallel links between POP pairs• Per-prefix splitting over equal cost paths
POP POP
21
1
1
115
34
34
34
1
1
1
![Page 15: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/15.jpg)
15Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Interdomain Routing : E-BGP & I-BGP
R1
AS1
R4R5
B
AS3
E-BGP
R2R3
AAS2 announce B
I-BGP
IS-IS
![Page 16: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/16.jpg)
16Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Multi-homing and Hot Potato Routing
SprintUUnet
Client
Server
Border Routers
Edge Routers
Request
Response
Peers need to be “consistent” intheir route announcements
![Page 17: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/17.jpg)
17Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Transit vs. Non-transit AS
AS1
ISP1 ISP2
r1
r2 r2
r3
r2
r1 r3
• Transit AS– carries traffic between two other ASes– propagates routes learnt from other ASes
![Page 18: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/18.jpg)
18Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Sprint practices
• Multi-homing with large peers and customers• Hot Potato Routing• Non-transit for peers• Transit for customers
![Page 19: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/19.jpg)
19Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Sprint Service-Level Agreements
• Peers : no money exchanged– at a network exchange points (NAP)– point-to-point links(OC-3/12/48)
• Customers :– flat fee by link bandwidth
•Performance Guarantees :– 55 msec latency across USA– 0.3% loss– 99.9% availability
![Page 20: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/20.jpg)
20Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction – Internet architecture– The Sprint IP Backbone– Monitoring : requirements and challenges
• Current techniques– taxonomy, tools and techniques
• The IPMON project• The future of monitoring
![Page 21: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/21.jpg)
21Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Monitoring Implications of Network Design
• Network elements do not collect data• Protocols do not provide feedback• Network adapts to failures/congestion• No centralized collectors• Distributed administration:
– operator has no control beyond own network
![Page 22: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/22.jpg)
22Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Monitoring Requirements
• Planning and design• Traffic engineering• Troubleshooting and fault diagnosis• Customer feedback• Research
![Page 23: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/23.jpg)
23Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Planning and design
• Capacity Planning– where to put additional capacity, when?
• Controlled evolution– new link/router/customer– new applications/protocols
• New technologies– MPLS, QOS, etc.
• Router Design– buffer dimensioning, AQM, etc.
![Page 24: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/24.jpg)
24Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Traffic Engineering
• Selecting primary and backup routes• Accommodating changes
– topology, customer usage pattern, newapplications
• Routing protocols– configuring BGP policies, ...
![Page 25: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/25.jpg)
25Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Troubleshooting and Fault Diagnosis
• Some examples :– a link is suddenly overloaded– a route suddenly disappears from BGP table– DOS attack on a customer– router shows high CPU utilization– is a peer using me for transit?
![Page 26: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/26.jpg)
26Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Operations and Management
• Need– up-to-date traffic and routing info– tools to correlate them
• But…– do no harm– simplicity above all !– minimal changes to network– cannot change router configuration
![Page 27: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/27.jpg)
27Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Customer Requirements
• Adherence to SLA– difficult to verify/prove
• Protection for attacks– block, trace back to attackers
• Traffic Engineering :– how are packets being routed?– what are the delay/loss statistics on these routes?– protocol/application/AS number breakup– multi-homed customers
![Page 28: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/28.jpg)
28Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Research
• Monitoring is key to evolution of the Internet :– understanding its global complexity– designing new algorithms/protocols– paradigm shifts (e.g., peer-to-peer)– changes in design philosophy
Challenge :collecting and analyzing massive volumes ofdata!
![Page 29: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/29.jpg)
29Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Limitations
• Technical– poor support in routers– must not interfere with network operations– need storage and analysis infrastructure
• Non-technical– Proprietary– Legal– Privacy– Cost
![Page 30: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/30.jpg)
30Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction :– current Internet architecture– benefits and challenges of monitoring
• Current Techniques:– taxonomy, tools and techniques
• The IPMon Project• The future of monitoring
![Page 31: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/31.jpg)
31Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Taxonomy: Information Types
Data Plane– Packet-level
• port #, src and dst addr, type, length– Flow-level
• duration, total # of packets and bytes, application– Network element-specific:
• link utilization, dropped packet count– Network-level
• Can be derived from packet/flow-level• ingress vs. egress traffic
![Page 32: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/32.jpg)
32Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Taxonomy: Information Types
Control Plane– Routing information
• static - snapshots of routing tables• dynamic - update messages, policies
– Topology• Databased in facility management system• Physical/L2/L3 layer
– Configuration• relatively static, but not widely available.
![Page 33: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/33.jpg)
33Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Taxonomy: Observation Points
• Edge vs. core:– Access is often limited– Link-level statistics not accessible from edge– Important to combine observations from
different points
![Page 34: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/34.jpg)
34Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Metrics Derived from Measurements
Loss– Drops per interface– end-to-end loss– per-AS loss rate
Delay & Jitter– One-way vs. RTT– Single vs. multi-hop– Avg vs. max
![Page 35: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/35.jpg)
35Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Metrics Derived from Measurements
Utilization levels– Derived from byte counts
Routing reachability– Duration and frequency of unreachability– # of ASs and prefixes affected
Failure– Frequency– Duration
![Page 36: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/36.jpg)
36Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Issues
Amount of data– Storage– Processing and transfer overhead
Level of aggregation– Temporal aggregation
• Sub-second, minutes, daily, and weekly
– Research vs. operation• Packet-level vs. flow/link/network-level
![Page 37: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/37.jpg)
37Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Network Matrices
• Network-wide representations of variousmetrics– traffic volume (Traffic Matrices)– delay, loss, utilization, …
• Many statistics– average, peak, variance, etc.
• Many aggregation levels– POP-to-POP, router-to-router, AS-to-AS, ...
![Page 38: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/38.jpg)
38Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Example : AT&T Latency Matrix
263714355018
6906
4264
4719
2040 21
3634
3254
22
61
ATL
CAM
NY
LA
DEN
DAL
CHI
CAM
LA
DEN
DAL
CHI
NY
Latency in milliseconds
Current Average : 35 msec
![Page 39: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/39.jpg)
39Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Which Network Matrices to Build?
• What do applications need?– network design, TE, customer reports,
operations, ...– may only need some components
• What is scalable?– e.g. router-to-router is far bigger than POP-to-
POP
![Page 40: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/40.jpg)
40Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Active Measurement
Probes are injected into the network– Can overload the network
• careful calibration needed• Poisson-generated traffic often used
– Measure from the edges• Does not need access to inside of network• Can only infer network-internal performance
![Page 41: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/41.jpg)
41Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Active Measurement Tool: Ping
ICMP-based tool for host reachability• Algorithm
– Sends an ICMP echo request with:• Identifier for unique ping process• Sequence number per echo request
– Receiving host returns an ICMP echo reply– Prints out RTT, TTL, and seq. #.
• Issues– different processing path from other packets
![Page 42: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/42.jpg)
42Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Active Measurement Tool: Traceroute
Used to find out the forward path to a host• Algorithm
– Send an IP datagram with TTL=1– First router sends back ICMP time exceeded– Then send a datagram with TTL=2– Continue till destination is reached/TTL expired
• Issues– not suited for performance measurements
![Page 43: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/43.jpg)
43Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Packet-Pair Based Bandwidth Estimation
RTT
Source Router Bottleneck Sink
bottleneckrate
rateestimate
Time
![Page 44: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/44.jpg)
44Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
PathcharHop n-1 Hop n
FE FE
c :link capacityS : probe sizep : prop. delaye : noise
Vary L, fit line to min[RTT(n) - RTT(n-1)]
Slope of line gives 1/c
2p = RTT(n) - RTT(n-1) - [2L/c + e]
Based on TTL expiration (like traceroute)
![Page 45: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/45.jpg)
45Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Active Measurement Projects
National Internet Measurement Infrastructure(NIMI)– Provides infrastructure for active measurements– BSD-based hosts, scalable, dynamic
NLANR AMPRIPE NCC
![Page 46: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/46.jpg)
46Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Commercialized Monitoring Services
Matrix– Ping-based monitoring of customers
KeyNote– Subscription-based service of application-
specific monitoring
Shortcomings:– Techniques often depend on starting points, not
on the network
![Page 47: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/47.jpg)
47Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Passive Measurement
No traffic injected for measurement purpose– Not invasive
• Only data collection increases traffic
– Access limited• Measurement about total traffic• Privacy/Security - serious concern
![Page 48: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/48.jpg)
48Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tcpdump
Puts a network interface to promiscuous mode– captures only frames matching filters– shows
• network interface info, time, src and dst, etc.• or entire payload
Issues– security: sees all frames on the Ethernet– host performance penalty– timestamps not always dependable
![Page 49: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/49.jpg)
49Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Passive Measurement Examples
Packet monitors– Tcpdump for Unix-based hotst– Dedicated measurement systems
• OC3MON, IPMON
Router/switch traffic statistics– Network internal behavior– SNMP MIBs– flow-level information
![Page 50: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/50.jpg)
50Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
SNMP
Managing entity
Manageddevice
Manageddevice
data
data data
Simple Network Management Protocol
Agent Agent
![Page 51: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/51.jpg)
51Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Packet-level measurements
• Pros :– very fine granularity
• Challenges :– link speeds are increasing!– Large volumes of data– system design issues:
• disk/PCI bus speeds• installation cost
![Page 52: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/52.jpg)
52Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Flow-level measurements
• Many granularities– five-tuple, BGP prefixes, IP header fields, etc.
• Pros– aggregated information
• Challenges– packet-to-flow mapping– terminating expired flows– CPU/memory requirements on routers
![Page 53: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/53.jpg)
53Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Flow-level Monitoring : Cisco Netflow
NetFlow: mechanism to gather flow statistics–caches flow statistics per router interface andsends records by UDP
–Route-based aggregation possible• By AS, protocol port, src prefix, dst prefix, prefix
–Data flows from NetFlow-enabled device toFlowCollector
• No MIB or SNMP• More aggregation possible at FlowCollector
![Page 54: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/54.jpg)
54Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Netflow Pros and Cons
Pros–provide statistics on every flow–detailed prefix-to-prefix traffic matrix
Cons–High memory requirement for short flows–feasible at access routers, not backbone routers– route changes flushes flow cache, may causeCPU overload
–Flow statistics in UDP: losses during peak usage
![Page 55: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/55.jpg)
55Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Commercial Passive Measurement Tools
HP’s OpenView– Integrated network management tool based on
SNMP statistics– Combined with configuration, visualization,
reporting mechanismsAgilent NetMatrix:
– Passive monitoring gear for LAN and up toOC-12 ATM
Niksun’s NetVCR solutions– Packet monitor based management system
![Page 56: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/56.jpg)
56Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Research Project: CAIDA
Cooperative Association for Internet DataAnalysis (http://www.caida.org)– Measurement tools:
• OCxMON, cflowd, CoralReef, NeTraMet: passive• Skitter: global coverage by traceroute
– Visualization tools:• Walrus, Otter, Plankton: graph visualization• Gtrace: traceroute visualization• MapNet: major ISP maps
![Page 57: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/57.jpg)
57Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Some Other Research Projects
• AT&T Labs Network Measurement Tools– active/passive, flow-level data, routing updates
• Surveyor:– one-way loss and delay as defined by IPPM
NLANR’s PMA and AMP– Passive and active measurement sites– Packet traces from passive measurement made
public
![Page 58: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/58.jpg)
58Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Routing Research Projects
Routeviews– 50+ peering at route-views.oregon-ix.net– MRT format RIBs and BGP updates, “show ip
bgp” dumps, route dampening data– only E-BGP
RIPE (Réseaux IP Européens)– routing updates from 9 mostly European IXs– “Looking Glass” services for BGP– Routing information service (RIS)
![Page 59: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/59.jpg)
59Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IETF/IRTF Activity
• IETF Working Groups– IPPM– IPFIX– BMWG– PSAMP
• IRTF– IMRG
![Page 60: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/60.jpg)
60Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction • Current techniques• The IPMON project
– infrastructure and data– selected results
• The future of monitoring
![Page 61: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/61.jpg)
61Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction • Current techniques• The IPMON project
– infrastructure and data– selected results
• The future of monitoring
![Page 62: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/62.jpg)
62Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IPMON Goals
• Identify open problems for an operationalnetwork, influence its evolution
• Feedback to network design and engineering• Tools for operations and management
![Page 63: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/63.jpg)
63Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Data
• Packet traces• SNMP statistics• IS-IS/BGP Listeners• Active Measurement Probes
![Page 64: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/64.jpg)
64Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Collecting packet traces
• Insert optical splitter on links in multiplePOPs (OC-3/12/48)
• Collect and timestamp TCP/IP headers (44bytes) - 2us clock accuracy
• Collect routing information (IS-IS, BGP)• Transfer data to lab for off-line analysis
(SAN based analysis platform)
![Page 65: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/65.jpg)
65Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Monitoring System Architecture
BackboneRouter
Backbone links
Peering points
AccessRouter
AccessRouter
AccessRouter
customer customer customer
Analysis platform(located @ Sprint ATL)
![Page 66: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/66.jpg)
66Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Monitoring System Architecture
OC-3/12/48link
opticalsplitter
GPSclock
SONET
DAG Card
main memory buffer
diskarray
IPMON system
Linux PC with multiple PCI buses
90%
10%
![Page 67: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/67.jpg)
67Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Current Status
• Three POPs :– one west coast, two east coast– 50+ IPMON systems– OC-3 to OC-48 capabilities
![Page 68: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/68.jpg)
68Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Practical Constraints
• Difficult to monitor operational network :– complex and expensive procedure– network evolves too fast
• Technology constraints :– line speeds are increasing...– PCI bus, disk speeds need to keep up!– need sophisticated storage systems
![Page 69: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/69.jpg)
69Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Python Routeing Toolkit (PyRT)
Listener software to collect IS-IS/BGP updates :– IS-IS listener :
• collects updates on link failures, weight changes, etc.
– BGP listener :• implements minimal subset of BGP state machine
– Publicly available– Data format compatible with other projects
(Routeviews, etc.)
![Page 70: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/70.jpg)
70Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IPMON Data Management System
• Motivation– management of 10+ terabytes– keep track of “metadata”– information sharing
• Entities to manage– packet traces, routing updates
• location, date of collection, link speed, etc.– analysis results
![Page 71: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/71.jpg)
71Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction • Current techniques• The IPMON project
– infrastructure and data– selected results
• The future of monitoring
![Page 72: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/72.jpg)
72Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IPMON : Selected Results
• Part I: Traffic mix and patterns• Part II: Packet delay and reordering• Part III: SNMP analysis• Part IV: Routing analysis
![Page 73: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/73.jpg)
73Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IPMON: Selected Results
• Part I: Traffic mix and patterns– volume– application breakup– packet sizes– detecting DOS attacks
• Packet delay and ordering• SNMP analysis• Routing analysis
![Page 74: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/74.jpg)
74Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Volume on an OC-12 Link
![Page 75: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/75.jpg)
75Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Application Breakup on OC-12 Links
Tier-2 access CDN access
www
peer-to-peer
www
streaming
![Page 76: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/76.jpg)
76Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Packet size distribution on OC-48 Link
40 - 23%1500 - 14% 576 - 10%
Trace : 1 hour, 676 million packets
![Page 77: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/77.jpg)
77Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Detecting DOS Attacks
TCP SYN bursts
![Page 78: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/78.jpg)
78Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Lessons Learnt - Part I
• Links differ in characteristics• Web traffic dominates, but p2p is making
inroads• Monitoring reveals changes in traffic mix
and characteristics
![Page 79: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/79.jpg)
79Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IPMON: Selected Results
• Traffic mix and patterns• Packet delay and reordering• SNMP analysis• Routing analysis
![Page 80: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/80.jpg)
80Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Delay through a router - OC-12
[Papagiannaki et al 02]
![Page 81: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/81.jpg)
81Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Delay across the USA
![Page 82: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/82.jpg)
82Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
4 6 5 4 3 2 1
measurement point
Out of sequence
Out of Sequence packets
• Challenge– how much of packet reordering?– where do they occur?– what are the causes?
• Our approach : analyze TCP flows in themid-point of its path
![Page 83: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/83.jpg)
83Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
OOS Classification [Agarwal et al. 02]
Out-of-sequence
Unknown
Reordering
Network Duplicate
Unneeded Retransmission
Retransmissions
CDN Tier-1 ISP Tier-2 ISP
2
19
7772
7
0.01
1
3
54
5
211
0.04
11
0.07
88
1.53
All numbers in p.c.
![Page 84: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/84.jpg)
84Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Lessons Learnt - Part IIb
• Delays– speed of light– no jitter
• Out-of-Sequence– about 5% of packets– mostly due to loss– little duplication due to loops, etc.
![Page 85: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/85.jpg)
85Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IPMON: Selected Results
• Traffic mix and patterns• Packet delay and ordering• SNMP analysis• Routing analysis
![Page 86: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/86.jpg)
86Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Maximum Link Load on Sprint Backbone
![Page 87: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/87.jpg)
87Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
On/Off Periods of Link Overload
![Page 88: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/88.jpg)
88Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Effect of Failures
![Page 89: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/89.jpg)
89Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Lessons Learnt - Part III
• At all times, there are some overloaded links :– difficult to distribute traffic evenly– Link failures happen often– difficult to plan for link failures
• Average utilization conveys incomplete picture• Essential to dampen peaks before increasing
average utilization
![Page 90: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/90.jpg)
90Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IPMON: Selected Results
• Traffic mix and patterns• Packet delay and ordering• SNMP analysis• Routing analysis
![Page 91: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/91.jpg)
91Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Information Sources
• BGP table snapshots• ISIS/BGP listener logs• Router logs• Controlled bi-directional active probes• SNMP data
![Page 92: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/92.jpg)
92Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Duration of Link Failures at IS-IS Level
Many short failures, usually one at a timeSome long outages, usually several links
10 min, 80%
1 min, 50%
![Page 93: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/93.jpg)
93Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
BGP Activity: Temporal Trends
Exceptions
Background noise:• 50-250 BGP udpates/min• O(1000) prefixes~ 1% routing table
Peaks at late night/early morning
20-40% of routing table
![Page 94: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/94.jpg)
94Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Active BGP Prefixes
No. of entries in BGP table ~120K !
![Page 95: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/95.jpg)
95Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Elephant and Mice Prefixes
Most elephant prefixesare /16 to /26
![Page 96: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/96.jpg)
96Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Other BGP findings
• About 5-6% of BGP updates affect prefixescarrying 80% of traffic– little effect on packet loss/reordering– but what about shifts in traffic patterns?
• Elephant flows are not stable– hard to use for load balancing
![Page 97: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/97.jpg)
97Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Lessons Learnt - Part IV
• Need to understand and control effect of“failures”
• Routing is poorly understood– interaction of BGP/IS-IS– how to set BGP policies– how to configure IS-IS (timers, etc.)
• Beneficial to correlate different data sets
![Page 98: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/98.jpg)
98Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Outline
• Introduction • Current techniques• The IPMON project
– infrastructure and data– selected results
• The future of monitoring
![Page 99: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/99.jpg)
99Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
The Future of Monitoring: Topics
• Obtaining traffic matrices– inference techniques– direct measurements
• Router support for path tracing– IP traceback– Trajectory sampling
• Sampling– approaches and challenges
![Page 100: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/100.jpg)
100Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
The Future of Monitoring : Topics
• Obtaining traffic matrices– inference techniques– direct measurements
• Router support for path tracing– IP traceback– Trajectory sampling
• Sampling– approaches and challenges
![Page 101: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/101.jpg)
101Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
POP-to-POP Topology
An under-specifiedproblem :n links, O(n2) O-D pairs
Need statistical techniquesto make “smart” guessAssume routing is known
Estimating TMs from SNMP Link Counts
ATL
ORL
NYC
PEN
RLY
CHI
KCSJ
SEA
STK
3
3
3
3
3
3
![Page 102: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/102.jpg)
102Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
POP-to-POP Topology
Formal Problem Statement
Xj: Traffic demand for POP pair j
n: number of POPsr: number of linksc: Number of POP pairs
– c = n * (n - 1)A: r by c 1-0 routing matrixYi: Link count on link i
ArxcXc = Yr
ATL
ORL
NYC
PEN
RLY
CHI
KCSJ
SEA
STK
83
3
3
10
2
3
5
5
4
15
13
4
4
![Page 103: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/103.jpg)
103Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Proposed Statistical Techniques
• Linear Programming [Goldschmit 00]• Network Tomography [Vardi JASA 96]• Bayesian Estimation [Tebaldi & West 98]• Maximum Likelihood Estimation [Cao et al
98]
![Page 104: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/104.jpg)
104Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
• SNMP data is not enough– large errors
• Bayesian : 20%-60%• EM : 11% - 40%• LP is larger
– statistical assumptions not valid– marginal gain from partial information
• All methods sensitive to prior• No good model for O-D traffic flows
Comparison [Medina et al. 2002]
![Page 105: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/105.jpg)
105Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Estimating POP Fan-out [Medina et al 02]
• Why does POP i choose POP j– user behavior– network design and configuration
• Use choice models– criterion: maximize utility
Uij = Vi
j + eij
deterministic random
Vij = m1* Wi
j(1) +m2* Wij(2) + … + gj
![Page 106: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/106.jpg)
106Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
• Demand between i and j : Xij = Oi * αij
Oi = total traffic sourced by POP iαij = fan-out factor
• Model for fanout
• Initial Model: estimate m1 m2 and gj using– Wj(1): outgoing bytes at POP i
– Wi(2): incoming bytes at POP j
Estimating POP Fan-out (contd.)
exp (Vij)
exp (Vik)
![Page 107: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/107.jpg)
107Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Measured fanouts
nyc pen sj0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0.4
0.45
POP name
Fan
outs
to e
gres
s P
OP
sObserved Fanouts
![Page 108: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/108.jpg)
108Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Initial Validation: Fitting Observed Data
• Parameters estimated using MLE with– SNMP link counts– fanout for three POPs
nyc tac che sea kc orl sj fw stk pen atl ana rly chi0
0.05
0.1
0.15
0.2
0.25
0.3
0.35
0.4
0.45
POP number
Fra
ctio
n of
traf
fic fr
om N
YC
NYC:SRC: UINTERLOUT - DST: UINTERLIN
observedpredictedValidates
exponential formfor fan-out
![Page 109: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/109.jpg)
109Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Direct Measurement at Ingress
Measuring at egress : hard to disambiguateingress
![Page 110: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/110.jpg)
110Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Challenges of Direct Measurements
• Scalability– monitor every ingress interface– how much data, what granularity– router overhead
• Possible directions– build components of TM for specific purposes
• customer request, problem peers, etc.
– can we monitor periodically?
![Page 111: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/111.jpg)
111Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
The Future of Monitoring : Topics
• Obtaining traffic matrices– inference techniques– direct measurements
• Router support for path tracing– IP traceback– Trajectory sampling
• Sampling– approaches and challenges
![Page 112: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/112.jpg)
112Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IP Traceback : Basic Idea
• probability of receiving mark from d hops = p(1-p)d-1
• reconstruct path based on counting marks from each router
a
b
c
Victim
a
a b
cba
router marks itsaddress in apacket withprobability p
Goal : Trace sink tree from victim to source of attack,even with address spoofing
![Page 113: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/113.jpg)
113Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
IP Traceback : Edge Sampling
• Need additional (short) field to mark distance• Further compression possible...
a
b
c
Victim
a XOR b
b XOR c
c
•Issues•slow process : p = 0.51, d= 15, need 42K packets•not robust to multiple attackers
![Page 114: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/114.jpg)
114Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Trajectory Sampling [Duffield et al 00]
• Key Idea :– Track the “trajectory” of a packet by consistent
sampling everywhere
• No statistics or inference techniques• Uses :
– how is a customer’s packet routed?– is routing working as expected?– diagnosing source address spoofing
![Page 115: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/115.jpg)
115Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Trajectory Sampling
MeasurementSystem
label src dest length
g(x1) a.b.c.d w.x.y.z 500Ingressnode
Egress node
Sample same pkt everywhere or nowhereg(x) is deterministic
![Page 116: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/116.jpg)
116Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
The Future of Monitoring : Topics
• Obtaining traffic matrices– inference techniques– direct measurements
• Router support for path tracing– IP traceback– Trajectory sampling
• Sampling/Filtering– approaches and challenges
![Page 117: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/117.jpg)
117Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Why Sampling/Filtering?
Problems with large volumes of data– feasibility of collection at high-speeds
• memory/bus/processor requirements
– storage limitations– complexity of analysis
![Page 118: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/118.jpg)
118Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
State-of-Art
• Cisco– sampled netflow
• capture 1 in N• aggregate by five-tuple
• Juniper– filter on any combination of header fields– sample 1 in N
• recommends 1 in 1000 or less
![Page 119: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/119.jpg)
119Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Comparison of Approaches [Claffy et al 93]
• Traffic Characteristics– packet size distribution– inter-arrival times
• Key Results– Packet-triggered techniques better than time-triggered– difference within each class is small
systematic
simple random
stratified random
![Page 120: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/120.jpg)
120Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Flow-Level Sampling [Duffield et al 01]
• Motivation– charge for measured usage
• fixed charge below threshold• usage-based charged above threshold
– sample a subset of flows with commonproperty, e.g., source/destination address
• Key Idea :– flow size distribution is heavy-tailed– need lower estimation error for larger flows
![Page 121: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/121.jpg)
121Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Flow-level Sampling [Duffield et al 01]
• Approach– Each flow i has size and color– Goal is to estimate total usage
– Sample flow i with probability min {1, / Z}
• Important results– yields unbiased estimate– variance decreases as increases– much smaller errors than 1 in N sampling
∑=
=cci
ii
xcX:
)(ix ic
ix
ix
![Page 122: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/122.jpg)
122Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Towards a Two-Tier Monitoring System
Goal : make monitoring an integral part ofbackbone engineering and operations
• Tier 1– network-wide continuous monitoring– coarse-grained, long time-scales
• Tier 2– on-demand monitoring at specific points– fine-grained, short time-scales
![Page 123: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/123.jpg)
123Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Challenges
Collecting fine-grained packet data is hard!
• Sampling techniques– should be requirement-driven– need complete traces for evaluation
• (Re)Design hardware to support monitoring– custom-built equipment– router architecture...
![Page 124: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/124.jpg)
124Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Monitoring on Routers
• Pros– no additional
infrastructure– up-to-date routing
tables
• Cons– space and storage
constraints– switched backplane
Interface
CrossbarSwitch
RouteProcessor
Modern Router Architecture
Interface
Interface
Interface
![Page 125: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/125.jpg)
125Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Monitoring on Routers: Open Issues
• Feasibility– how much memory?– what operations can
be performed?– What part of the
packet to capture?– What to export, how
often?
Interface Card
CrossbarSwitch
RouteProcessor
Periodicexport
To collectionstation
CPU
memory
Incoming packetFIB
![Page 126: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/126.jpg)
126Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
Tutorial Summary
• Monitoring IP networks– difficult… but essential
• Some tools/techniques exist– but a lot more remains to be done
• Need integrated infrastructure– router support– wider data collection and sharing– storage/analysis capabilities– sampling and scalable export
![Page 127: Network Monitoring and Measurements : Techniques …csiat/Network...Monitoring.pdf · Monitoring Implications of Network Design • Network elements do not collect data • Protocols](https://reader030.vdocument.in/reader030/viewer/2022021705/5b6b1a847f8b9a2b668cf6fa/html5/thumbnails/127.jpg)
127Advanced Technology LaboratoriesAdvanced Technology LaboratoriesCopyright
How To Contact Us
• Email– [email protected]– [email protected]
• Visit us on-line– www.sprintlabs.com– under development: ipmon.sprintlabs.com