Upload
peregrine-greer
View
214
Download
3
Embed Size (px)
Citation preview
Internet Measurements
2
Web of interconnected networks• Grows with no central authority
• Autonomous Systems optimize local communication efficiency
• The building blocks are engineered and studied in depth
• Global entity has not been characterized
Most real world complex-networks have non-trivial properties.
Global properties can not be inferred from local ones• Engineered with large technical diversity
• Range from local campuses to transcontinental backbone providers
Internet
Need for Internet measurements arises due to commercial, social, and technical issues
• Realistic simulation environment for developed products,
• Improve network management
• Robustness with respect to failures/attacks
• Comprehend spreading of worms/viruses
• Know social trends in Internet use
• Scientific discovery
• Scale-free (power-law), Small-world, Rich-club, Dissasortativity,…
Internet Measurements
3
Internet Topology Measurement
4CAIDA 2006
Internet Topology Measurement
5CAIDA 2006
Internet Topology Measurement
6
Internet Topology Measurement
7CAIDA 2006
IPv4 address space (2010)
8
browse
Direct probing
Indirect probing
A DB C
Internet Topology MeasurementsProbing
IPB TTL=64
IPB
IPD TTL=64
IPD
Vantage Point
A DB C
Vantage Point
IPB
IPD TTL=2IPD TTL=1
IPC
9
Probe packets are carefully constructed to elicit intended response from a probe destination
traceroute probes all nodes on a path towards a given destination• TTL-scoped probes obtain ICMP error messages from routers on the path
• ICMP messages includes the IP address of intermediate routers as its source
Merging end-to-end path traces yields the network map
movie
S DA B C
Destination
Internet Topology MeasurementTopology Collection (traceroute)
TTL=1
IPA
TTL=2
IPB
TTL=3
IPC
TTL=4
IPD
Vantage Point
10
Internet Topology Measurement:Background
11
S
L
U
H
C
N
W
A
s.2
l.1
s.3
u.1
l.3
u.3
h.1
k.3
h.2
h.3
a.3
u.2k.1 c.4
a.1 a.2
w.3c.3
w.1c.2
n.1 n.3
w.2
l.2
K
c.1
k.2
dh.4
Trace to Seattle
h.4
l.3
s.2
Trace to NY
h.4
a.3
w.3
n.3
Internet2 backbone
Internet Topology Measurement:Background
12
S
L
U
C
N
A
s.2
l.1
s.3
u.1
l.3
h.1
k.3
h.2
a.3
u.2k.1 c.4
a.1 a.2
w.3c.3
w.1c.2
n.1 n.3
w.2
l.2
K
c.1
k.2
h.3
dh.4
s.1e f
n.2
H
W
u.3
13
Sampling to discover networks • Infer characteristics of the topology
Different studies considered • Effect of sample size [Barford 01]
• Sampling bias [Lakhina 03]
• Path accuracy [Augustin 06]
• Sampling approach [Gunes 07]
• Utilized protocol [Gunes 08]
• ICMP echo request
• TCP syn
• UDP port unreachable
Topology SamplingIssues
Unresponsive Router Resolution Problem
Unresponsive routers do not respond to traceroute probes and appear as a in path traces• Same router may appear as a in multiple traces.
• Unknown nodes belonging to the same router should be resolved.
Unresponsiveness Types1. Ignore all ICMP packets
2. ICMP rate-limiting
3. Ignore ICMP when congested
4. Filter ICMP at border
5. Private IP address
14
Unresponsive Router Resolution Problem
Internet2 backboneS
L
U
K
C
H
A
W
N
e
d
Traces• d - - L - S - e• d - - A - W - - f• e - S - L - - d• e - S - U - - C - - f• f - - C - - - d• f - - C - - U - S - e
15
f
Unresponsive Router Resolution Problem
U K C N
L H A W
S
d
e
f
Sampled network
d
e
fS U
L
C
AW
Resulting network
16
Traces• d - - L - S - e• d - - A - W - - f• e - S - L - - d• e - S - U - - C - - f• f - - C - - - d• f - - C - - U - S - e
17
Graph Based InductionCommon Structures
Parallel nodes
Ax C y2
y1
y3
Ax C y2
y1
y3
Star
DA wx
C y
E z
DA wx
C y
E z
Complete Bipartite
A
C
x
y
D w
F v
E z
A
C
x
y
D w
F v
E z
Clique
A
C
x
y
D w
E z
A
C
x
y
D w
E z
Each interface of a router
has an IP address. A router may respond with
different IP addresses to
different queries.
Alias Resolution is the process of grouping the interface IP addresses of each router into a single node.
Inaccuracies in alias resolution may result in a network map that• includes artificial links/nodes
• misses existing links
Alias Resolution:
.5.33
.18
.13.7
Denver
18
19
S
L
U
C
N
W
A
s.2
l.1
s.3
u.1
l.3
u.3
h.1
k.3
h.2
a.3
u.2k.1 c.4
a.1 a.2
w.3c.3
w.1c.2
n.1n.3
w.2
l.2
K
c.1
k.2
h.3
d
h.4
s.1e f
n.2
HTraces• d - h.4 - l.3 - s.2 - e• d - h.4 - a.3 - w.3 - n.3 - f• e - s.1 - l.1 - h.1 - d• e - s.1 - u.1 - k.1 - c.1 - n.1 - f• f - n.2 - c.2 - k.2 - h.2 - d• f - n.2 - c.2 - k.2 - u.2 - s.3 - e
IP Alias ResolutionProblem
20
IP Alias ResolutionProblem
U K C N
L H A W
S
d
e
fSampled network
Sample map without alias resolution
s.3
s.1
s.2
l.3
l.1
u.1
u.2
k.1 c.1 n.1
n.2k.2 c.2
w.3
a.3
h.2
h.4
h.1
e
d
f
n.3
Traces• d - h.4 - l.3 - s.2 - e• d - h.4 - a.3 - w.3 - n.3 - f• e - s.1 - l.1 - h.1 - d• e - s.1 - u.1 - k.1 - c.1 - n.1 - f• f - n.2 - c.2 - k.2 - h.2 - d• f - n.2 - c.2 - k.2 - u.2 - s.3 - e
21
Genuine Subnet ResolutionProblem
Alias resolution
• IP addresses that belong to the same router
Subnet resolution
• IP addresses that are connected over the same medium
IP2 IP3
IP4IP1
IP6 IP5
IP2 IP3
IP1
IP2 IP3
IP1
Autonomous System Level Mapping
22
Historical
Internet Topology Discovery 23
Internet Topology Discovery 24
Internet Topology Discovery 25
Autonomous System Level Mapping
26
27
Internet Topology Discovery 28
2010
Traffic Measurements
Traffic Measurements Monitoring and measuring network traffic
• to produce better models of network behavior
• to diagnose failures and detect anomalies
• to defend against unwanted traffic
Live weather map• Internernet2
PlanetLab
30
Traffic flow monitoring
31
Cisco US traffic estimate
32
Cisco Monthly Traffic Volume
33
DNS Workload for the Chilean TLD the number of queries and clients seen by one of
the .CL nameservers in Chile • its hourly variation along two days of traces on July 3rd 2007
animation
34
Code-Red Worm On July 19, 2001, more than 359,000 computers connected to the
Internet were infected with the Code-Red (CRv2) worm in less than 14 hours
Spread
35
Sapphire Worm was the fastest computer worm in history
• doubled in size every 8.5 seconds
• infected more than 90 percent of vulnerable hosts within 10 minutes.
36
Witty Worm reached its peak activity after approximately 45 minutes
• at which point the majority of vulnerable hosts had been infected
World USA
37
Nyxem Email Virus Estimate of total number of infected computers is
between 470K and 945K
At least 45K of the infected computers were also compromised by other forms of spyware or botware
Spread
38
Scam Hosting Study dynamics of scam hosting infrastructure
39
Measurement Studies Cheleby
• map Internet backbone
iPlane• construct an atlas of the Internet, measuring link attributes
Glasnost• tests whether BitTorrent is being blocked or throttled
BW-meter• Measurement tools for the capacity and load of Internet paths
NPAD Diagnostics Servers• Automatic diagnostic server for troubleshooting end-systems and
last-mile network problems
Hubble• find persistent Internet black holes as they occur
40
Internet Measurements The Internet is man-made, so why do we need to
measure it?
• Because we still don’t really understand it• Sometimes things go wrong
• Malicious users
• Measurement for network operations• Detecting and diagnosing problems
• What-if analysis of future changes
• Measurement for scientific discovery• Creating accurate models that represent reality
• Identifying new features and phenomena
41