Traffic Monitoring on CJK-Network

1. Traffic Monitoring on CJK-Network 17th CJK NGN-WG 2009.11.16-17 TTC Nobuyuki NAKAMURA and Kei KATO nakamura758@oki.com, katou235@oki.com

2. outline • Research overview • experiments • between China and Japan • Peer to peer connections • analysis • Utilization of FFT and Data Mining • Further Study & Schedule • Quality Evaluation using Stream mining method • Observation of quality degradation to detect degraded points in the network. • Appendix. • CEATEC demo • CEATEC Japan 2009 10/6-10, at Makuhari-Messe, Japan

3. Research overview • Given the situation of interconnectivity among various NGN networks,MPM will become a very important node for traffic observation.We have been investigating the possibility of analyzing network quality by observing traffic at MPM. We will perform monitoring at MPM with the following traffic paths using our monitoring method( Stream Mining ), which is suitable for real-time analysis. Detection of the network anomalythrough traffic analysis at MPMwith the following steps. #1 Create Network anomaly by intentionally generating instability to wireless link #2 Collect packets capturing data at MPM (Japan) These packets might contain not only our experiment traffic but also various traffic in CJK test-bed. #3 Extract the packets that relates to network anomaly through our analysis. #4 Detect network anomaly point i.e. instability of wireless link in Japan <Previous result shown at 16h CJK Meeting> <Current Status>

4. experiments • Main Objectives • To analyze QoS/QoE characteristics by capturing RTP/RTCP traffic • To Detect the network quality degradation and the points that such degradation occurred. • We mean network degradation by • Degradation that occurs with high probability to the flow, which traverses specific network nodes and links • Not accidental one • Excludes jitter that occurs depending on the characteristics of network itself e.g. Wired or wireless etc. • Experiments overview • Created wired and wireless network over CJK testbed, • Case1: Wired-Wired • Case2: Wireless-Wired • Case3: Wireless-Wireless（local test） • Test environment consists of Video Meeting software and network Simulator • Software: • Com@WILL:Video Meeting • Voice(G.711) • Bidirectional communications • The CLOUD: Network Simulator． • packet loss： 3～20% • jitter：10～!00ms

5. analysis • Objectives of Evaluation • To determine set of parameters that is useful for detecting quality degradation. • Phase1: By applying FFT to quality parameters e.g. packet loss, jitter etc., we investigate whether remarkable characteristics can be obtained. • Phase2: Investigate set of parameters that is suitable for detecting degradation. Router Failure Link Failure • Reference： • NAKAMURA and IKADA, “Network Quality Degradation Detection Method by using Network Specification”, IEEE 2009 First International Conference on Emerging Network Intelligence pp.97-102.

6. analysis (cont’d) : • FFT • Prepared 3 patterns of traffic data with or without degradation. • By applying FFT to these patterns, frequency portion can be obtained. • However, it is difficult to determine set of parameters by just looking at frequency. Learning method is needed. ． • Data Mining • The map shows result of machine learning by SOM by applying above network characteristics(FFT data) • We are now investigating if there’s any status change by mapping characteristics on this map. Wireless-Wired (normal) Wireless-Wired (bad) Mean jitter (After FFT)

7. Further Study & Schedule Absolute value of єN • We apply Stream Mining as real-time analysis method • Approximate Frequency Counts Algorithm • One of the Stream mining method • Allows extraction of frequently captured characteristics from the stream data • Can be applied as quality analysis method by utilizing parameters such as RTCP. • Reference： • IKADA and HAMAGUCHI, “Approximate Frequency Counts Algorithm for Network Monitoring and Analysis: Improvement of “Lossy Counting””, IEEE 2009 First International Conference on Emerging Network Intelligence pp.9-14.

8. Further Study & Schedule (cont’d) experiments for implementation CJK 18th NGN CEATEC Demo manufacturing for experiments evaluation on CJK NW Thank you for your attention. This work is partly supported by the National institute of Information and Communications Technology (NICT).

9. Appendix. • CEATEC demo( CEATEC Japan 2009 Oct. 6-10) • Resulted in appealing our CJK activity to IT-related users/vendors/network providers. • We showed Video Scene and Voice from China site thorough CJK Network. • Thanks to CATRand KDDI lab

10. Collaboration with China and Korea side Japan Korea Remote Desktop Remote Desktop China Remote Desktop This collaboration will provide remote environment for China and Korea side to utilize CJK testbed!! • Objectives • To generate suitable network for this evaluation by increasing traffic • To utilize as much traffic path as possible so as to perform degradation and degraded point detection のtraffic path • We would like to prepare test environment to perform evaluation remotely • Need to install 2 PCs（WindowsXP） • Web camera for each PCWeb • We would like to attach PC to MPM in ETRI to provide Remote Desktop done To be done Example: Intentionaly generate DDoS-like traffic from Korea to JapanMPM to analyze traffic variation.